Graylog Security

Log-management-based SIEM with a free open edition and published entry prices

Overview

Graylog is a log management company headquartered in Houston, Texas, with offices in London and Hamburg[19]. Its product family starts with Graylog Open, a free, source-available edition under the SSPL licence with no volume restrictions and community support only[19]. Graylog Enterprise adds commercial log management features, and Graylog Security adds SIEM capabilities on top of Enterprise, including threat detection content, investigations and anomaly detection[19].

Graylog is one of few SIEM vendors to publish entry prices. Graylog Enterprise starts at US$15,000 a year and Graylog Security at US$18,000 a year, both with an entry point of 10 GB per day of processed data or 100 Graylog Compute Units a year[19]. Licensing is based on data processed in the active tier, not on devices, users or stored data, and one compute unit converts to 20 GB of Security processing or 25 GB of Enterprise processing[19]. All paid licences are annual subscriptions.

The open edition makes Graylog a common starting point for smaller teams, which can later upgrade without changing collectors. Its limitations are scale and depth: it lacks the bundled endpoint agents, threat intelligence and large detection libraries of the platform vendors.

Graylog Security features

  • Free Graylog Open edition with no volume limit
  • SIEM features in Graylog Security
  • Licensing on processed active-tier data only
  • Compute units convertible between editions
  • Self-managed or cloud deployment

Graylog Security pricing

Graylog Open: free, community support. Graylog Enterprise: from US$15,000 per year. Graylog Security: from US$18,000 per year. Entry point 10 GB/day or 100 GCUs per year; one GCU equals 20 GB of Security or 25 GB of Enterprise processing. Annual subscriptions only.

Graylog Security strengths and limitations

Strengths

  • Published entry prices
  • Free open edition for evaluation and small deployments
  • Licensing ignores user and device counts
  • Upgrade path from log management to SIEM

Limitations

  • SSPL licence is source-available rather than OSI open source
  • Smaller detection and threat-intelligence content than large vendors
  • Annual billing only for paid plans
  • Fewer native endpoint capabilities

Appears in

Graylog Security alternatives and competitors

Alternatives to Graylog Security: companies ranked in the same lists.

Is this your company?

Update the description, logo, image and link through the submission form. Editors review every change.

Update this listing

Is your company missing from a list?

Send your logo, description and link. Editors review every submission, and approved listings are clearly labelled.

Add your company