 |
HOUSTON, Oct. 13, 2026 /PRNewswire/ — Graylog today launched the Verascend™ Incident System with Graylog v7.2. Verascend turns correlated, risk-scored events into prioritized cases, so security analysts investigate verified incidents instead of sorting through individual alerts.
The Verascend™ Incident System narrows millions of log messages to a handful of verified incidents. Along the way, risk amplifiers such as compliance violations, adversary campaign intelligence, and vulnerability scan results push the highest-risk assets to the top before an AI agent triages them.
The launch comes as attackers adopt AI to move faster. Europe’s cybersecurity agency, ENISA, found ransomware operators using AI coding assistants to build the platforms they rent to affiliates, and it expects AI to directly enable more stages of an attack through 2026 – a pace that leaves lean security teams on legacy tools drowning in alerts.
How Verascend unifies detection
Verascend brings together detection capabilities, including Detection Chains and Sigma rules, with risk-scoring algorithms, intelligent event consolidation, and multiple AI agent assistants that take the first pass at triage. Every case opens with corroborating events, logs, and an initial assessment attached, and analysts can run additional searches from inside the case. When the investigation closes, AI-assisted reporting summarizes what happened and recommends remediation steps, showing the prompts, tool calls, and evidence behind each recommendation.
Graylog v7.2 adds a new Detection Chains page that shows each adversary campaign’s threat actor, targeted technologies, and targeted industries. Sigma rules and custom correlation rules now sit in the same workflow as every other detection method, and expanded watchlists align to Graylog’s provided detection content.
Pipeline, storage, and system health visibility
Graylog v7.2 also introduces new views into pipeline performance, Data Lake storage, and system health, letting administrators see what’s consuming resources, fix bottlenecks before they slow detection, and keep costs under control.
EU data residency with OVH and Secunet SysEleven
Support for OVH and Secunet SysEleven S3-compatible storage lets European organizations keep security data in the region without building a separate storage architecture.
Availability and licensing
Graylog v7.2 is available from October 13, 2026. The Verascend Incident System is included in Graylog Security under existing licenses. Register for the live walkthrough of the release, “Graylog 7.2: What’s New for Security and IT Teams,” on October 21, 2026 at 10:00 a.m. ET.
Approved Quotes
“Most agentic SOC tools point an AI agent at raw log data and ask it to make sense of everything at once,” said Seth Goldhammer, VP of Products at Graylog. “We did it the other way around. Graylog normalizes the data and scores the risk first, so our agents reason over a small set of facts about a specific asset or user.”
“Attackers are using AI to move faster, and most security teams are expected to keep up with a handful of people,” said Andy Grolnick, CEO of Graylog. “Hiring more analysts to read more alerts isn’t a plan most of those teams can afford. With Verascend and Graylog v7.2, they start the day with verified cases instead of an overwhelming alert queue, and they keep their data where their regulators need it.”
About Graylog
Graylog is the SIEM and log management platform for the AI era. Trusted by 60,000+ organizations, Graylog combines scalable log management, real-time correlation, explainable AI, and data sovereignty to turn overwhelming data into clear insight and confident action. The Verascend™ Incident System brings AI-driven detection and investigation to Graylog, putting high-risk assets first and handing analysts AI-triaged cases.
Learn more at graylog.com or connect with us on Bluesky and LinkedIn.
Graylog Illuminate maps login data from Windows, Office 365, Cisco ASA, and other sources into one information model. The Verascend™ Incident System correlates events like these failed logins by shared users and assets, weighing them in a single risk-scored case instead of sending another alert.