What's New in Graylog 7.2?

Graylog 7.2 delivers major enhancements in AI-assisted operations, threat detection, event definition management, and platform health. This release introduces the Graylog Agentic Framework along with purpose-built agent workflows, detection chains that correlate individual events into multi-stage attack campaigns, and a Health Module that reports the status of your deployment in a single view. It also folds Sigma rules into event definitions and extends data lake storage with additional object storage backends.

AI and Agentic Workflows

  • Graylog Agentic Framework: Introduces the framework that runs Graylog agents, including large language model configuration, per-agent permissions, auditing, and resource guardrails.

  • Event Definition Tuning Advisor: Adds an agent workflow that reviews noisy event definitions and suggests tuning changes to reduce alert volume.

  • Asset Risk Review: Adds an agent workflow that reviews your highest-risk assets and opens investigations for confirmed threats.

Threat Detection

  • Detection Chains: Correlates individual security events into multi-stage attack campaigns, so a sequence of seemingly unrelated alerts is recognized as a single attack and raises the risk score accordingly.

  • Watchlists: Provides six built-in watchlists for IP, user, file hash, port, domain, and geolocation values that flag matches in your log messages and can be referenced in searches, dashboards, event definitions, and pipeline rules.

  • Anomaly Events: Expands the built-in anomaly detectors with configurable thresholds and direct integration with the alerts and events workflow.

  • Random Cut Forest Anomaly Detection: Documents the Graylog Illuminate anomaly detectors that use Random Cut Forest machine learning, including requirements, tunable settings, and the additional event fields they produce.

  • Sigma Rule Events: Folds Sigma rules into event definitions, so a single entity controls detection logic and scheduling. Existing rules migrate automatically, and repository management moves to Alerts > Sigma Repos.

Platform Health and Administration

  • Health Module: Adds a built-in health check system that monitors your deployment and presents results in a hierarchical health tree, with status rolled up across cluster subsystems.

  • Health Checks Reference: Provides the full catalog of automated checks by component, along with the condition that triggers each Warning and Critical status.

  • Welcome Page: Introduces a landing experience that guides new deployments toward ingesting their first data.

Data Management and Storage