Graylog Agentic Framework

The following section exclusively pertains to a Graylog Enterprise feature. To learn more about obtaining an Enterprise license, please contact the Graylog Sales team.

The Graylog Agentic Framework is the shared foundation that every Graylog Agent runs on. Agents define what tasks to perform. The framework handles how they run, including their connection to your large language model (LLM), permissions, tool calls to Graylog, and auditing of their actions.

This article explains how the framework's LLM connection, agent permissions, auditing, and guardrails work.

Highlights

The following highlights provide a summary of the key takeaways from this article:

Every Graylog Agent uses a single, global LLM provider and model.
Agents run inside Graylog and call Graylog tools directly, not through the MCP server.
Each agent runs under its own built-in service account with least-privilege access, so its actions are attributable and auditable.
Graylog audits every change an agent makes and every configuration change. Graylog also keeps a run history for each agent, and automatically disables an agent that produces repeated errors.
Resource and data safety guardrails limit agent searches and reduce the risk of log injection.

LLM Connection

The framework connects every Graylog Agent to one LLM provider and model. This is a single, global setting. You configure it once on the Model Provider page, under System > AI Management, and every agent uses it. Each workflow's page shows the Model and Provider it uses. No agent can run until a provider is configured, and removing the provider configuration stops every agent workflow until you configure a new one.

Graylog supports the following providers: Amazon Bedrock, Anthropic, Google, Mistral, Ollama, and OpenAI.

Ollama connects to a model hosted on your own network. Use it to keep agent traffic inside your network, for example in an environment without internet access, or to use a model you trained yourself.
Mistral is an EU-based provider, for organizations that want LLM traffic to stay with a European provider.

The models you can select come from the provider and reflect what your account can use, so new models become available without a Graylog upgrade. However, if your provider retires the model you selected, agent workflows fail until you select a model the provider still offers.

To set up the connection, see Configure LLM Provider for Graylog Agents.

Hint: LLM output is not deterministic. Two runs over the same data can produce different results, so review an agent's output before you act on it.

How Agents Access Graylog Data

Graylog Agents run inside Graylog and call Graylog's tools directly. They do not go through the Graylog MCP server, so agent tool calls stay within Graylog; the only data that leaves Graylog is what the agent sends to your LLM provider. Because each agent's tools are predefined, the agent does not need to discover the available tools on every run, which reduces LLM token usage.

Each run is a single agent working from a single prompt. Graylog does not split a run into separate sub-agents, so the agent sees everything it reviews in a run together and can connect related activity, such as two high-risk assets involved in the same incident.

Agent Permissions and Accounts

Each agent operates under its own built-in service account that ships with the product, similar to the approach Graylog uses for Graylog Sidecar. This gives every agent a distinct, auditable identity instead of running it as a shared account or as an administrator. Each account holds only the permissions its workflow needs, so an agent cannot take actions outside its task, such as deleting streams. Where possible, Graylog assigns an agent's account an existing role, scoped to the least access that agent needs. Access needs differ by agent: the Asset Risk Review agent needs comparatively broad read access to evaluate assets and events across your environment, while the Event Definition Tuning Advisor needs narrower access scoped to event definitions.

To view the role and stream access assigned to an agent's account, navigate to Enterprise > AI Agent Workflows, click the workflow's title on the Workflows tab, and expand Runtime Permissions.

Agent output can also appear elsewhere in the Graylog interface, such as a note an agent adds to an investigation or a tuning recommendation on an event definition. The standard Graylog permission model governs who can see that output; you need access to the underlying investigation, event definition, or stream to see what an agent added to it.

Warning: An agent can act only on the streams and data its own account can access. If an agent has broader access than a person viewing its output, such as notes it adds to a shared investigation, that output may reference activity from streams the viewer cannot otherwise see. Review agent permissions carefully before you enable an agent in a multi-team or multi-tenant environment.

Auditing and Execution Controls

Graylog records an audit event for every change an agent makes in Graylog, such as creating or updating an investigation, and for every change to an agent's configuration, such as enabling or disabling the agent or changing its parameters. Agent changes appear in the audit log under the workflow's service account, so you can tell them apart from changes users make. The same account appears in the Ran by column of the Runs tab and as the author of notes the agent adds, such as Asset Risk Review Agent User (built-in) on an investigation note.

Graylog also keeps a run history for each agent, available on the Runs tab of Enterprise > AI Agent Workflows. Graylog checks scheduled workflows every minute and runs each one when its interval is due. The run history records how each run was triggered, the account that ran it, and the outcome of each run and any errors the agent encountered, such as a failure to reach the LLM, a failure to access a tool it depends on, or an error in its own reasoning output. If an agent produces repeated errors, Graylog automatically disables it from further scheduled runs so that it does not keep failing unattended. The Usage tab of Enterprise > AI Agent Workflows shows total token usage by day, week, and month so you can track how much of your LLM's capacity the framework consumes. Each workflow's page also has a Token Usage section for that workflow.

Resource and Data Safety Guardrails

Resource guardrails keep agent processing from competing with normal Graylog operations. For example, Graylog limits the size of an agent's searches and indicates when a search result has been limited, so you understand the basis for the agent's findings.

Agents reason over log content and notes that can come from untrusted or attacker-controlled sources. To reduce the risk of log injection, which is content crafted to manipulate an agent when it appears in a search result, the framework sanitizes content before it reaches the LLM and keeps each agent's responsibilities narrow and separate. As a result, a single manipulated input has limited ability to affect an agent's actions.