Graylog capabilities that shape detection and data flow design, with the edition each needs, since several depend on an Enterprise or Security license on top of SSPL-licensed Graylog Open.
Controlling where each log type goes in Graylog: stream rules at intake, pipelines attached to streams, interaction with Illuminate content pack rules, and choosing destinations so noisy data does not fill expensive search storage.
Detecting incidents that span several log sources with the Enterprise correlation engine: per-field correlation, cross-source sequences such as a login after an IDS alert from the same IP, negative event monitoring, and how this differs from Graylog Open event definitions.
Enriching log messages with lookup tables: data adapters such as CSV files and GeoIP, caches that protect external APIs, using lookups in pipeline rules, and keeping enrichment data current.
Writing Graylog searches that return the right messages: Lucene-based syntax, field and existence queries, inclusive and exclusive ranges, fuzzy matching, escaping and why leading wildcards are off by default.
Building reusable Graylog searches and dashboards with parameters: generic, dropdown and lookup table types, defaults, saved searches that prompt for values and the Enterprise license they need.
What Illuminate content packs add to Graylog: prebuilt parsing pipelines and lookup tables, normalization to the Graylog Information Model, the few packs available on Graylog Open and licensing for the rest.
Which Graylog Enterprise capabilities change day-to-day operations: archiving, correlation, parameters, reporting, enterprise inputs, Illuminate, outputs, the Forwarder and audit logs, and what Graylog Open covers on its own.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.