TLS for the Graylog web interface, API and inputs
Encrypting every Graylog connection: HTTPS for the web interface and API, TLS on Beats, Syslog and GELF inputs, certificate file permissions and Data Node TLS to OpenSearch.
Graylog security
Specific security controls for self-hosted Graylog beyond baseline hardening: encryption in transit, roles and sharing, audit trails and protecting the backends.
Graylog roles, sharing and teams for least-privilege access
Controlling who can search which logs: roles for actions, sharing for streams and dashboards, teams in Enterprise, restricting input creation and reviewing access for compliance.
Graylog audit log for user and configuration changes
Recording who changed what in Graylog: Enterprise audit logging, signed entries, retention in MongoDB, exports through the API and backing entries up before they expire.
Securing MongoDB and OpenSearch behind Graylog
Locking down the Graylog backends: MongoDB authentication, network restrictions so only Graylog reaches MongoDB and OpenSearch, Data Node managed certificates and protecting support bundles that contain secrets.
