Investigation Workflows
The platform advertises a set of named investigation workflows — prebuilt sequences that take a triggering signal, gather the evidence a human analyst would have gathered, and produce a conclusion with its supporting timeline. This page documents each workflow in the same three terms: what triggers it, what evidence it collects, and what it produces. Workflows are the operator-facing view of the platform's AI skills.
The workflow names and behaviour below come from Fluency's own product material rather than from a live account. Confirm which of these workflows your deployment actually runs, and what each produces, before relying on the descriptions here.
Impossible Travel
Trigger. Successful authentications for one identity from geographically separated locations within a window too short to physically travel between them.
Evidence gathered. The authentication events and their source addresses, geolocation and ASN resolution for each, the implied velocity, the identity's normal location and device history, VPN and proxy indicators that would explain the anomaly benignly, and what else the identity did in each session.
Expected output. A verdict on whether the travel is genuinely impossible or explained by infrastructure, with the paired login events, the computed distance and time delta, and a session timeline. The standard false-positive sources are corporate VPN egress, mobile carrier NAT and cloud service proxies.
Email Rule Change
Trigger. Creation or modification of a mailbox rule — forwarding, redirection, or a rule that moves or deletes mail — typically from Microsoft 365 or Google Workspace audit telemetry.
Evidence gathered. The rule definition itself and what it does to incoming mail, who created it and from where, whether the actor is the mailbox owner or a delegate or administrator, recent authentication history for that identity, and whether the rule sends mail outside the organization.
Expected output. A classification of the rule as benign administration or as a business-email-compromise indicator, with the rule text, the actor, and a timeline linking the change back to the session that made it. The telemetry comes from the Microsoft and Google Workspace integrations.
New User
Trigger. Creation of a new identity, or the first appearance of an identity that has never been seen in the environment before.
Evidence gathered. The creation event and the creating actor, the groups and roles assigned at creation and shortly after, whether the account was granted privilege immediately, the account's first authentications and first actions, and whether creation followed an approved provisioning path.
Expected output. A determination of whether the account is a legitimate provisioning event or an attacker establishing persistence, with the creation record, the privilege grants, and the account's early activity timeline. Directory synchronization affects what "never seen before" means — see LDAP Integration.
PowerShell Analysis
Trigger. PowerShell execution that looks suspicious — encoded commands, download-and-execute patterns, script-block content matching known tradecraft, or execution from an unusual parent process.
Evidence gathered. The full command line and decoded script block, the process ancestry, the host and the user context it ran under, any network destinations contacted, files written, and whether the same pattern appears on other hosts.
Expected output. A decoded and explained command, a statement of what it actually does, and a verdict on whether it is administrative tooling or malicious. It depends on endpoint telemetry with script-block logging enabled — see Windows Sysmon.
Lateral Movement
Trigger. Authentication or remote-execution patterns consistent with an actor moving between hosts — remote service creation, admin-share access, remote WMI or WinRM, or a burst of authentications from one source to many destinations.
Evidence gathered. The chain of source and destination hosts with timestamps, the credentials used at each hop, the authentication types (interactive, network, delegated), the tooling observed on each host, and whether the path is consistent with normal administration for that account.
Expected output. A reconstructed movement path across hosts with the credential used at each step, an assessment of blast radius, and the affected assets ranked by criticality. It produces the widest evidence set of the five; the resulting cluster appears in Behavior Timeline.
Related
- Detections — the rules that trigger workflows
- Investigate — the manual equivalent of these workflows
- Replay — running scenarios to exercise workflows against known telemetry