# Graylog MCP Conversational AI for Modern Security Operations Source: https://www.egnworks.com/blog/graylog-mcp-conversational-ai-for-modern-security-operations Author: Jacob Strix Published: 2026-06-19 Updated: 2026-06-19 Category: AI SecOps Tags: Graylog, Model Context Protocol, SIEM, Prompt Injection > A practical guide to Graylog 7.1 MCP. Connect Claude to your SIEM enable the endpoint use the tools and handle the prompt injection risk. --- ## Overview Graylog 7.1 shipped in the Spring 2026 release on 5 May 2026 and it brought one feature that changes how a SOC talks to its data. Graylog now exposes a Model Context Protocol endpoint so a language model like Claude can query your SIEM in plain English. Instead of building a search and remembering the query language you ask a question and the model calls the right tool against your live Graylog instance. This guide walks through what the feature is and how it works and how to turn it on safely. It also covers the parts that the marketing pages skip which are the write capable tools and the prompt injection risk that comes with feeding hostile log data to a model. The feature is powerful but it is still experimental so it deserves a careful setup. ## Quick Facts **Product:** Graylog 7.1 (Security and Enterprise) **Released:** 5 May 2026 **Feature status:** **Experimental** **Endpoint:** `/api/mcp` **Transport:** Streamable HTTP **Authentication:** `Authorization: Basic` with a base64 API token **Supported clients:** Claude and LM Studio **Permission model:** Inherits the Graylog user role **New network ports:** None **Recommended:** A dedicated read only user ## What is Graylog MCP Model Context Protocol is an open standard that lets a language model call external tools through a structured interface. Graylog implements it as an embedded server that lives inside the deployment you already run. When you enable it Graylog publishes a set of tools that map onto its own REST API. A connected model can then list inputs or search messages or open an investigation by calling those tools rather than by hitting raw endpoints. The important design choice is that the model never gets special access. Every tool call runs as the Graylog user whose token you connected with so the model can only see and do what that user could already see and do. The conversation is a new front door onto the same house with the same locks. ## Why It Matters for the SOC Most SIEM work is repetitive. An analyst checks input health and pulls the newest security events and asks which assets carry a given vulnerability dozens of times a day. Each of those is a few clicks or a saved search. A conversational layer collapses them into a single sentence and returns the answer without any dashboard navigation. The stated payoffs are faster triage and less alert fatigue and quicker investigations. There is also a training benefit. A junior analyst who does not yet know the Graylog query language can still ask useful questions on day one. The model translates intent into the correct tool call so the learning curve flattens. For a lean team that cannot staff every shift with a senior this matters a lot. ## How It Works The flow is simple. Your client opens a streamable HTTP connection to the endpoint at `/api/mcp` on the same port as the Graylog web interface. It authenticates with a base64 encoded API token in a Basic authorization header. Graylog checks the token resolves it to a user and then serves only the tools and data that the user is permitted to touch. No extra port is opened and no separate service runs because the server is embedded in Graylog itself. ## Setup Step by Step ### Step 1. Enable the MCP Endpoint Open System then Configurations then MCP and switch Enable MCP to On and save. Graylog now serves the endpoint at `/api/mcp` on the existing web port so you are not exposing anything new at the network level. ### Step 2. Create a Read Only User and Token Create a dedicated Graylog user with a read only role and do not reuse an admin account. Then open System then Users and Teams then Tokens and generate an API token for that user. The MCP server enforces exactly what this user can see so a tight role here is your primary control. After you have the token encode it for the Basic scheme. ``` echo -n ":token" | base64 ``` The word token stays literal. Replace only the api_token part with the value you generated. The output is the credential you hand to the client. ### Step 3. Connect Your Client For Claude Code one command registers the server. Swap the host and port for your own Graylog address and use the base64 value from the previous step. ``` claude mcp add --transport http graylog http://127.0.0.1:9000/api/mcp \ --header "Authorization: Basic BASE64_TOKEN_HERE" ``` For LM Studio add the server to the client configuration instead. ```json { "mcpServers": { "graylog-mcp-server": { "url": "http://localhost:9000/api/mcp", "headers": { "Authorization": "Basic BASE64_TOKEN_HERE" } } } } ``` Once the client connects it can list the tools and call them right away. A quick way to confirm the link works is to ask which inputs are active and watch the model return a real answer from your instance. ## The Tools You Get Graylog 7.1 exposes a broad tool set grouped by domain. Most are read only but a handful in the security events and investigations groups can change state so read the next section before you grant those. ``` System Information get_system_status get_formatted_system_status get_current_time get_mitre_threat_coverage list_illuminate_content_packs list_resource describe_resource Streams and Index list_streams list_index_sets list_indices list_inputs Search and Aggregation search_messages aggregate_messages list_fields Security Events list_new_security_events describe_security_events list_security_events_by_asset update_security_events describe_event_procedures Investigations list_investigations create_investigation update_investigation get_possible_investigation_values Assets and Vulnerabilities list_assets describe_asset list_vulnerabilities ``` ## Real Triage Prompts The point of this interface is that you ask in plain English and the client picks the right tool. These prompts map cleanly onto the tools above. ``` Which inputs are active right now? How much disk space is my Graylog server using? Show me the new security events from the last hour. Which assets have open critical vulnerabilities? Open an investigation for the failed logins against the finance host. ``` Behind each of those the client calls list_inputs or get_system_status or list_new_security_events or list_vulnerabilities or create_investigation. You get the answer without touching the search bar and without remembering the query syntax. ## Security Model and Caveats Every call runs as the user behind the token so the MCP server can never do more than that user could do in the web interface. This is the whole reason a read only role is the right default. Keep admin accounts away from this feature and scope the token to the smallest role that still answers your questions. Notice that a few tools are not read only. The update_security_events tool and the create_investigation and update_investigation tools all change state. If you want a pure analyst assistant give the token a role that cannot reach those actions. Grant write access only when you actually want the model to manage cases for you. There is a deeper risk that is easy to miss. Logs are attacker controlled data. An adversary who can land a crafted line into any source that Graylog ingests can try to plant text that the model reads as an instruction when it summarizes that log. This is prompt injection and a SIEM is an ideal target for it because collecting hostile input is its entire job. A SIEM that pipes raw log data into a language model is exactly the kind of place where AI tooling turns into an attack surface. The same lesson showed up when an AI workflow builder became an unauthenticated remote code execution path in the [Langflow case](/blog/cve-2026-33017-unauthenticated-rce-in-langflow-and-the-20-hour-exploit). Treat anything the model says about log content as a lead rather than as ground truth and never wire its output straight into an automated action that you would not let a stranger trigger. Finally this is an experimental feature in Graylog 7.1. The tool names and their behavior can shift between versions so pin your workflows to a known version and retest them after every upgrade. ## When to Use It and When Not To Graylog MCP shines for fast triage and for the questions you ask all day long. Checking input health and pulling the latest security events and asking which assets carry a given vulnerability are all quicker through a prompt than through the interface. It also lowers the barrier for junior analysts who do not yet know the query language. It is not a detection engine and it is not a replacement for written detection content. The model does not watch your data and it does not page you. It answers when you ask. Keep your alerting and your Sigma rules and your correlation exactly where they are and treat the conversational layer as a faster way to ask questions on top of them. ## Related Reading [CVE-2026-33017 Unauthenticated RCE in Langflow and the 20 Hour Exploit](/blog/cve-2026-33017-unauthenticated-rce-in-langflow-and-the-20-hour-exploit) [CVE-2026-45777 Unauthenticated RCE in Open XDMoD and the Chart Export Behind It](/blog/cve-2026-45777-unauthenticated-rce-in-open-xdmod-and-the-chart-export-behind-it) [Building an AI Chatbot Interface with Vercel AI SDK and Next.js](/blog/building-an-ai-chatbot-interface-with-vercel-ai-sdk-and-nextjs) [Building AI Features in Modern Web Applications](/blog/building-ai-features-in-modern-web-applications) ## References [Graylog Spring 2026 Release Announcement](https://graylog.org/news/graylog-announces-spring-2026-release-with-automated-investigations-and-behavioral-detection/) [Graylog MCP Integration Documentation](https://go2docs.graylog.org/current/setting_up_graylog/graylog_mcp.htm) [Graylog MCP Tools Reference](https://go2docs.graylog.org/current/setting_up_graylog/model_context_protocol__mcp__tools.htm) [Graylog Configure MCP Guide](https://go2docs.graylog.org/current/setting_up_graylog/configure_mcp.htm) [MCP Explained Conversational AI for Graylog](https://graylog.org/post/mcp-explained-conversational-ai-for-graylog/)