Graylog

I use Graylog Enterprise in a SOC context, mainly for monitoring security events, log analysis, and investigations of possible incidents.

During an investigation involving Graylog Enterprise, I run queries to identify suspicious activity, analyze IP addresses and users, and correlate those logs.

I believe that Graylog Enterprise has a positive impact on my organization because, when doing this analysis, whether of an alert or of information that the client requested within their environment, we were able to bring that back to them with a lot of detail.

The access to detailed information from Graylog Enterprise had a big impact because with it we could state whether an alert was a false positive or a true positive; I would do this log correlation, and I could get an answer for the alert.

I think one of the best features that Graylog Enterprise offers is log centralization, which really makes investigation work easier; it provides the possibility of performing searches and also applying filters so you can search for specific events.

Log centralization and applying filters make my day-to-day investigations easier because when I need to investigate suspicious behavior, they help me gain agility during triage.

I think that with log centralization, you get very broad visibility of the customer's environment.

I believe that Graylog Enterprise could be improved. One of the negative points is that it could be more intuitive, especially for someone who is just starting to use it; depending on the amount of logs and the complexity of the query, the analysis may require a bit more technical knowledge.

I think the main improvement needed for Graylog Enterprise is to make some search and visualization features easier.

I used Graylog Enterprise for a period of two years, but I am not currently using it anymore.

Graylog Enterprise is stable; we used it quite proficiently.

I would say that the scalability of Graylog Enterprise is such that the more space you need, you just have to contract it, so you can have a lot of workstations in it.

I liked customer support a lot; whenever we had any difficulty, whether with log ingestion or integrating with a client, they gave us full support.

I would rate customer support a ten on a scale from one to ten because they were always very proactive with us, helping with whatever was required.

Before working with Graylog Enterprise, I worked with CrowdStrike's EDR, Falcon, and I currently work with SentinelOne, which is also an EDR solution.

Graylog Enterprise was deployed in my organization through AWS cloud.

We used AWS, from Amazon, as our cloud provider.

I believe we saw some return on investment even though I don't have access to that information, but based on what customers told us and the work we did using Graylog Enterprise, there was good customer satisfaction.

I worked more on the alert analysis side.

I would rate Graylog Enterprise an eight on a scale from one to ten.

I give that number because of the negative points I mentioned about it needing to be more intuitive, since I think someone who doesn't know it very well could have some difficulty.

Regarding the intelligence features of Graylog Enterprise, as I mentioned, I didn't use them in depth enough to have a solid evaluation, but I believe they can help speed up analyses and identify suspicious patterns.

My recommendation to others reading reviews on PeerSpot is that if you want log centralization and a SIEM, I highly recommend Graylog Enterprise.

Public Cloud

Amazon Web Services (AWS)

I used Graylog Enterprise in the context of a SOC, so I used it for log monitoring and also for security purposes.

During investigations in the SOC context, I ran some queries in Graylog Enterprise to identify suspicious activities, IP addresses, and users, allowing us to track all activity.

Regarding automation in Graylog Enterprise, when we created use cases, whether for VPN access or brute force, if it matched the query, we would receive the alert in the corporate email. Upon receiving it in the corporate email, we had automation that would send it directly to the Teams group for the clients.

The positive impact of Graylog Enterprise on my organization is that it provides visibility into activity, leading to client satisfaction because we were able to track all activity from the root cause to the user's final activity to determine whether it was something malicious or legitimate.

Definitely, with the visibility provided by Graylog Enterprise, you do not have to assume things that might have happened; you really know what happened, which allows you to provide clearer information about the alert and also for the client.

I think one of the positive points Graylog Enterprise offers is this centralization of logs, which greatly facilitates investigation work. Another point is its ability to perform searches, apply filters, and run queries so that you can look for a specific event, user, or IP.

I think Graylog Enterprise brought efficiency gains because when you run a search or do some research, you can save it, so you do not need to enter the query again; you just retrieve what is already saved.

I think the main point regarding Graylog Enterprise features is that it helps a lot in event analysis and identification because it brings in a lot of logs and a lot of information, so you can access all the information about the alert there.

I believe Graylog Enterprise's AI features are very good, allowing you to use AI to run specific searches, which brings a lot of results.

Regarding the AI features of Graylog Enterprise, I did not use them in such depth as to accurately evaluate their reliability, but I believe that AI can help speed up analysis and identify some suspicious patterns, though it is important that the result is always validated by an analyst.

I think one aspect of Graylog Enterprise that could be improved is that it could be more intuitive, especially for someone just starting to use it, as depending on the amount of logs and the complexity of the query, it might require a bit more technical knowledge.

Regarding necessary improvements for Graylog Enterprise, I think integration is a point that could be improved because it is very technical, so it would be good to make some search and visualization features easier.

I used Graylog Enterprise for two years, but currently, I no longer use it.

I believe Graylog Enterprise is stable; it provides a lot of information about alerts, allowing good visibility of the client's environment.

Definitely, Graylog Enterprise handles data and user growth well, as I think the more space you contract, the more you will be able to use it.

I did use customer support for Graylog Enterprise; sometimes it stopped bringing in logs, so we had to call support to see what was happening, and it was always answered very proactively.

I would rate customer support a 10 because we were always very well served.

In my previous job, I used CrowdStrike Falcon, but in my current job, we stopped using Graylog Enterprise and started using SentinelOne.

We had contracted an AWS cloud, so we used their cloud to host Graylog Enterprise.

I believe we achieved a return on investment by using Graylog Enterprise, as for about two years, it was our main SIEM tool to run the SOC environment for clients, enabling us to have full visibility and deliver results regarding information security.

I worked in the SOC environment focusing more on analyzing alerts, but I was able to understand the configurations well, including setting up use cases and automations.

I would rate Graylog Enterprise an eight.

I believe the negative points that I mentioned, about it needing to be more intuitive and requiring a lot of technical knowledge to use the tool effectively, are why I did not give it a 10.

I believe that nowadays for a SOC environment, we have more complete solutions, but if you want a SIEM exclusively for log analysis and full visibility, I highly recommend Graylog Enterprise.

Public Cloud

Amazon Web Services (AWS)

What do you like best about the product?

I use Graylog to monitor application logs and troubleshoot backend issues. I like that it keeps logs in one place, which saves me time and makes it easier to find errors. Searching and filtering logs is easy, and I can quickly find specific errors without digging through multiple log files.

What do you dislike about the product?

I found the initial setup a bit challenging, especially configuring log inputs and sources. The interface sometimes feels overwhelming, and a step-by-step wizard with clearer instructions would help.

What problems is the product solving and how is that benefiting you?

Graylog saves me time by keeping logs in one place and making it easier to find specific errors without digging through multiple log files.