Item: Graylog
Rating: 9
Author: Jeremy Cejka

Use Cases and Deployment Scope

We currently use Graylog as a log aggregator and some light weight SEIM. However, we haven't had the cycles to use the other features of it. Presently solves our centralized log collection problem.

Pros and Cons

Log Aggregation pipeline
Dashboards

Pricing for Enterprise is a bit unrealistic.
Archiving should be a standard feature in the community edition.

Return on Investment

Full return on investment for the free version.
Paid features aren't fully justifiable at the enterprise cost.

Alternatives Considered

IBM QRadar, Splunk Enterprise Security, AlienVault OSSIM and AlienVault USM

In terms of log aggregation, the free product fully stacks up with the competitors listed. Full control over the data ingests for flexible configuration. Graylog even better on that front than AlienVault USM because you cannot configure the variable mapping. We haven't used the threat exchange stuff or correlation. But with regex searches, we have created function dashboards that show threat theater pictures of our network based on logs from our firewall.

Support Rating

From a product perspective, it's an 8.

I am still unhappy with the pricing model for the enterprise. Graylog competes against the likes of IBM and Splunk, but your still the new kid on the block. To price Graylog enterprise at 50k for 20GB ingest an unrealistic data. It would require multiple facets of Graylog to be stood up and only forward pruned logs to the paid version.

Key Insights

Do you think Graylog delivers good value for the price?

Are you happy with Graylog's feature set?

Yes

Did Graylog live up to sales and marketing promises?

Did implementation of Graylog go as expected?

Yes

Would you buy Graylog again?

Other Software Used

Palo Alto Networks Next-Generation Firewalls - PA Series, Palo Alto Networks GlobalProtect Mobile Security Manager, Palo Alto Networks URL Filtering PAN-DB

Likelihood to Recommend

Graylog is suited for all environments. Its easy setup and use is great for small businesses. Its flexibility for configuration of ingested logs is excellent for medium to large scale, and its ingest capability is great for super-sized. One size fits all for Graylog. It's a great competitor to QRadar and Splunk, and even AlienVault USM/OSSIM

Graylog can compete against the big boys.

Overall Satisfaction with Graylog