Graylog Agents
Graylog Agents are out-of-the-box, pre-built automations that perform specific analyst and administrative tasks on your Graylog data. Each agent runs on the Graylog Agentic Framework, which provides its large language (LLM) connection, permissions, and auditing.
This article introduces the available Graylog Agents, explains how they differ from custom workflows built on the MCP server, and shows where to configure them.
Available Graylog Agents
The following Graylog Agents are available:
-
Asset Risk Review: Evaluates high-risk assets and opens or reprioritizes investigations when it identifies confirmed threats.
-
Event Definition Tuning Advisor: Analyzes events you have marked as false positives and recommends tuning changes to reduce alert noise.
Graylog Agents vs. the MCP Server
Graylog Agents are built for out of the box agent-assisted automation. Each agent performs its task using its predefined logic and calls Graylog tools directly, without going through the MCP server. If you want to create custom agents or workflows tailored to your environment instead, use the Graylog Model Context Protocol (MCP) server, which exposes Graylog data and actions as tools that any MCP-compatible client can build against.
Where to Configure Agents
You manage Graylog Agents from Enterprise > AI Agent Workflows. The Workflows tab lists each available workflow with its description, status, provider, model, and schedule. Click a workflow's status to enable or disable it. Click a workflow's title to open its page, where you can run the workflow, change its settings, and review its runtime permissions, token usage, and prompt. The Runs tab shows the results of each run, and the Usage tab shows LLM token usage. Framework-level settings, such as your LLM provider and model, apply to every workflow and are set on the Model Provider page under System > AI Management. If no provider is configured, the Workflows tab shows a Model provider configuration is missing message and workflows do not run. Click Configure Provider in the message to open the Model Provider page. See Graylog Agentic Framework for the permissions, auditing, and guardrails that apply to every agent.
Use Case
A lean security team whose analysts start each shift with hundreds of accumulated alerts can enable the Asset Risk Review agent to work through high-risk assets overnight. Instead of opening each alert, running pivot searches, and rebuilding context asset by asset, analysts begin with a smaller set of investigations that already include the agent's initial assessment, supporting evidence, and recommended priority. They can spend their shift confirming and working incidents instead of on mechanical triage.
Further Reading
Explore the following additional resources and recommended readings to expand your knowledge on related topics:
