Wazuh
Open-source XDR and SIEM platform
Security platform combining an endpoint agent, a manager and an indexer for log analysis, intrusion detection, file integrity monitoring and compliance.
- Stars
- 17k
- Forks
- 2.6k
- Last commit
- today
Graylog
Centralised log management
Log management server that collects, parses, stores and searches logs, with streams, pipelines, dashboards and alerts.
Source-availableSSPL-1.0
Alternative toSplunk Enterprise Security
What Graylog does
Graylog ingests logs over inputs such as Syslog, GELF and Beats, processes them with extractors and pipeline rules, and stores them in OpenSearch or Graylog's own data node for search and dashboards. Streams route messages and alerts trigger on conditions.
Graylog Open, the free edition, is published under the SSPL, so ThreatWire labels it source-available. Graylog Security and Graylog Enterprise are commercial products built on top.
Key features
- Many log inputs (Syslog, GELF, Beats and more)
- Pipeline rules and extractors
- Streams, dashboards and alerts
- Search over OpenSearch or the Graylog data node
- REST API
Licence
SSPL-1.0 · Server Side Public License v1 · Source-available
The server repository LICENSE file is the SSPL v1, which is not OSI-approved. Graylog Open is free to use; enterprise and security features are commercial.
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: NOASSERTION. Source-available means the code is public but the licence is not approved by the Open Source Initiative.
Security of Graylog itself
17 published advisories for Graylog in GitHub repository advisories; the 12 most recent are listed. Keep the tool updated: security tools often run with broad access.
GHSA-w9wq-g358-3x8ghigh2026-10-05
Privilege escalation via user creation and user permission/role updates
GHSA-vpqc-v737-94g9medium2026-09-15
Palo Alto Networks input parser can be exploited to consume excessive CPU and delay message processing
GHSA-xwgc-q8x5-538whigh2026-09-14
IPFIX input parser can be exploited to consume excessive CPU and block message processing
GHSA-m9c2-85gv-8xr5CVE-2026-69190medium2026-07-07
Manager-to-Owner privilege escalation on saved searches and dashboards
GHSA-q79r-r9xg-r863CVE-2026-55425medium2026-07-03
System Catalog titles endpoint can be used to retrieve values of protected database fields
GHSA-j769-9gv9-65grCVE-2026-55867medium2026-06-24
Graylog token revocation endpoint allows authenticated users to delete other users’ access tokens
GHSA-gqr6-r77p-c2pjCVE-2026-55841high2026-06-24
Fortigate syslog message parser can be exploited to modify or delete fields from the original message
GHSA-3m86-c9x3-vwm9CVE-2025-53106high2025-06-30
Privilege escalation through API tokens
GHSA-76vf-mpmx-777jCVE-2025-46827high2025-05-07
Session Takeover via Insufficient HTML Sanitization
GHSA-q9q2-3ppx-mwqfhigh2025-05-07
Stored Cross-Site Scripting via Files Plugin and API Browser
GHSA-q7g5-jq6p-6wvxCVE-2025-30373medium2025-04-07
Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong value
GHSA-vggm-3478-vm5mCVE-2024-52506high2024-11-18
Concurrent PDF report rendering can leak other users' reports
Sources: GitHub repository advisories · checked 2026-10-20.
Categories and tags
SIEM, XDR and log management#log-management#siem#java#log-analysis#log-collector#log-viewer#logging#logging-server
Related tools
Security Onion
Platform for threat hunting and security monitoring
Linux distribution and platform for network security monitoring, log management and threat hunting that bundles Suricata, Zeek and Elastic components.
- Stars
- 4.9k
- Forks
- 681
- Last commit
- 1 month ago