Graylog launches AI case system in security platform. Mon, 26th Oct 2026 (Today) Graylog has launched the Verascend Incident System alongside version 7.2 of its security information and event management and log management platform, targeting security teams dealing with rising volumes of cyber alerts. The product introduces a case-based approach to incident triage, instead of requiring analysts to review alerts one by one. It groups related evidence into prioritised cases, with AI agents carrying out an initial review before a human analyst investigates further. The release comes as cybersecurity teams face pressure from a growing number of attacks, alongside staff and budget shortages. Graylog cited findings from the European Union Agency for Cybersecurity, ENISA, that ransomware operators are using AI coding assistants to build tools for affiliates. The FBI has also warned that cyberattacks are likely to increase as criminal groups industrialise ransomware, fraud and cryptocurrency theft. Used by more than 60,000 organisations, the latest version of the platform is intended to help security teams focus on the incidents that present the greatest risk. Each case in Verascend opens with supporting evidence attached. Analysts can also run additional searches from within the case and receive an AI-assisted summary and suggested remediation steps when an investigation closes. "Attackers are using AI to move faster, and most security teams are expected to keep up with a handful of people," said Andy Grolnick, Chief Executive Officer of Graylog. "Hiring more analysts to read more alerts isn't a plan most of those teams can afford. With Verascend and Graylog v7.2, they start the day with verified cases instead of an overwhelming alert queue, and they keep their data where their regulators need it," Grolnick said. Detection workflow Verascend brings several of Graylog's existing detection methods into the same workflow. These include Detection Chains, which raise risk levels when further evidence supports signs of known adversary campaign activity, as well as Sigma rules and custom correlation rules, which now sit alongside other detection methods in a single case-management process. A new Detection Chains page shows the threat actor associated with a campaign, along with targeted technologies and industries. Graylog also said expanded watchlists are aligned with its own detection content, allowing users to tune the system to their environment. Seth Goldhammer, Vice President of Products at Graylog, said the system was designed so AI agents work from a narrower set of information after data has already been normalised and risk-scored. "Most agentic SOC tools point an AI agent at raw log data and ask it to make sense of everything at once. We did it the other way around. Graylog normalises the data and scores the risk first, so by the time our agents get involved, they're reasoning over a small set of facts about a specific asset or user," Goldhammer said. "That's why an analyst opens a case with the evidence already there - and can see every prompt and tool call behind the agent's assessment," he added. System visibility Version 7.2 also adds new views into pipeline performance, data lake storage and system health. These tools are intended to help platform administrators identify resource consumption, address bottlenecks and keep storage costs under control. Graylog has also added support for OVH and Secunet SysEleven S3-compatible storage, giving European organisations an option to keep security data within the region without creating a separate storage architecture. Data location is becoming a more prominent issue as security teams hand more triage work to AI systems. For European users in particular, data residency requirements have become an important factor in technology purchasing and deployment decisions. Graylog said the Verascend Incident System is included in Graylog Security under existing licences. The company operates from offices in Hamburg, Houston, London and Singapore, and says its products are used in 180 countries.

Press releases. Graylog v7.2 launches the Verascend(TM) Incident System, transforming how security teams detect and respond to threats. HOUSTON, Oct. 13, 2026 /PRNewswire/ - Graylog today launched the Verascend(TM) Incident System with Graylog v7.2. Verascend turns correlated, risk-scored events into prioritized cases, so security analysts investigate verified incidents instead of sorting through individual alerts. The launch comes as attackers adopt AI to move faster. Europe's cybersecurity agency, ENISA, found ransomware operators using AI coding assistants to build the platforms they rent to affiliates, and it expects AI to directly enable more stages of an attack through 2026 - a pace that leaves lean security teams on legacy tools drowning in alerts. How Verascend unifies detection Verascend brings together detection capabilities, including Detection Chains and Sigma rules, with risk-scoring algorithms, intelligent event consolidation, and multiple AI agent assistants that take the first pass at triage. Every case opens with corroborating events, logs, and an initial assessment attached, and analysts can run additional searches from inside the case. When the investigation closes, AI-assisted reporting summarizes what happened and recommends remediation steps, showing the prompts, tool calls, and evidence behind each recommendation. Graylog v7.2 adds a new Detection Chains page that shows each adversary campaign's threat actor, targeted technologies, and targeted industries. Sigma rules and custom correlation rules now sit in the same workflow as every other detection method, and expanded watchlists align to Graylog's provided detection content. Pipeline, storage, and system health visibility Graylog v7.2 also introduces new views into pipeline performance, Data Lake storage, and system health, letting administrators see what's consuming resources, fix bottlenecks before they slow detection, and keep costs under control. EU data residency with OVH and Secunet SysEleven Support for OVH and Secunet SysEleven S3-compatible storage lets European organizations keep security data in the region without building a separate storage architecture. Availability and licensing Graylog v7.2 is available from October 13, 2026. The Verascend Incident System is included in Graylog Security under existing licenses. Register for the live walkthrough of the release, "Graylog 7.2: What's New for Security and IT Teams," on October 21, 2026 at 10:00 a.m. ET. Approved Quotes "Most agentic SOC tools point an AI agent at raw log data and ask it to make sense of everything at once," said Seth Goldhammer, VP of Products at Graylog. "We did it the other way around. Graylog normalizes the data and scores the risk first, so our agents reason over a small set of facts about a specific asset or user." "Attackers are using AI to move faster, and most security teams are expected to keep up with a handful of people," said Andy Grolnick, CEO of Graylog. "Hiring more analysts to read more alerts isn't a plan most of those teams can afford. With Verascend and Graylog v7.2, they start the day with verified cases instead of an overwhelming alert queue, and they keep their data where their regulators need it." About Graylog Graylog is the SIEM and log management platform for the AI era. Trusted by 60,000+ organizations, Graylog combines scalable log management, real-time correlation, explainable AI, and data sovereignty to turn overwhelming data into clear insight and confident action. The Verascend(TM) Incident System brings AI-driven detection and investigation to Graylog, putting high-risk assets first and handing analysts AI-triaged cases. SOURCE Graylog