Skip to main content

Quickstart

This is the shortest complete path from "I have been given a login" to "I have data arriving, I can search it, I have seen a detection, and I will be told when the next one happens." It is written for a new administrator or analyst on their first day, working in a fresh instance. Each step is a separate page with numbered instructions and a verification section, so you can stop after any step and pick up later.

The worked example is Microsoft 365, connected with the Office365-Audit application template. Every step is written against that source, so the screens, index names, and field values on these pages are the ones you will actually see if you follow along with a Microsoft 365 tenant.

Who This Path Is For​

This path assumes you are setting up an instance for the first time, or joining a team and want to understand the system end to end by driving it once yourself. It is not a production rollout plan — it connects one source, not your whole estate.

If you are not the person setting things up​

If you are an analyst joining an instance that is already collecting data, steps 1, 4, and 5 are the ones that matter to you. Steps 2, 3, and 6 are administrator work; read them for context and skip the clicking.

What You Will Have When You Finish​

  • One connected data source, collecting the Microsoft 365 unified audit log, the Entra ID directory audit, and the Entra sign-in log.
  • Ingress confirmed in three independent places — application status, usage charts, and the data lake.
  • One successful search against your own data, with facets that describe what is in it.
  • One behavior summary read end to end, from the risk score down to the original record.
  • One notification endpoint and one rule, so the next detection reaches you without you looking.

What this path deliberately does not set up: coverage of your remaining data sources, tuned detection content, your team's user accounts and roles, reports, or anything on-premises. Those come after, and the last page points at each of them.

Prerequisites​

Have these in hand before you start, so you do not discover a blocker at step 2.

Access to an instance​

Your portal URL and your credentials. Standard deployments use:

https://<companyname>.app.ingext.io

Older deployments use https://<companyname>.cloud.fluencysecurity.com or https://<companyname>.app.fluencyplatform.com, and custom or self-hosted deployments use their own hostname. If you do not have a URL yet, raise a support ticket.

An account that can install applications​

Step 2 installs an application and step 6 configures platform notifications. Both are administrator actions. With read-only access you can still complete steps 1, 4, and 5.

A Microsoft 365 tenant you can register an application in​

Step 2 registers an application in Microsoft Entra ID, which needs an identity that can both create an app registration and grant tenant-wide admin consent — Global Administrator, or Privileged Role Administrator combined with Application Administrator or Cloud Application Administrator. Consent rights are the part people miss: without them the application is created but no data ever flows.

You also need unified audit logging turned on in the tenant. It is on by default for most Microsoft 365 organizations but not for Business Basic, Business Standard, or Business Premium. Office 365 Audit has the one-line PowerShell check and how to turn it on.

If you do not have a Microsoft 365 tenant, pick a different source from the Integration Matrix. The shape of every step below is the same; only the vendor-side half of step 2 changes.

A supported browser​

Chrome or Firefox, current version. See Fluency Web Interface.

Patience for the first data​

Data does not appear the moment you press Install. Two different clocks are running:

  • Entra ID directory audit and sign-ins arrive within roughly an hour of the install.
  • The Office 365 unified audit log is delivered through a subscription-based API, and Microsoft warns that a newly created subscription can take up to 12 hours to produce its first content. An empty Office365 index on the afternoon of the install is expected, not a fault.

Plan on doing steps 1–3 in one sitting and steps 4–6 the next day.

Before You Start: Five Words to Know​

You can follow every step below with just these five. Key Concepts covers the rest.

  • Application — a packaged pipeline, installed from a template by filling in a form: a data source, the processors that parse it, and the sinks it writes to, created as one unit. Office365-Audit is an application template.
  • Integration — a stored connection to an external service, held on Platform → Integrations so several applications can share it. Not every template needs one; the Microsoft templates take their credentials directly on the install form.
  • Data lake index — the named place stored events land. This quickstart's application writes to three: Office365, AzureAudit, and AzureSigninLogs.
  • Behavior — a scored observation raised when a behavior rule matches an event, attached to an entity such as a user. Behaviors accumulate per entity into a behavior summary carrying that entity's risk score.
  • Ticket — the platform's own queue item, raised from a behavior summary. Tickets are what the three counters on the landing dashboard count, and what an analyst works and closes.

The Path​

StepWhat it accomplishesRoughly
1. Access Your InstanceSign in, and learn the four top-level menus so the rest is direction-following.5 min
2. Connect Your First SourceRegister an Entra application, then install the Office365-Audit template with its credentials.20 min
3. Confirm Data Is ArrivingVerify ingress in three independent places before searching for anything.5 min, then wait
4. Run Your First SearchFind your own events in the data lake and read one in full.10 min
5. See Your First DetectionOpen the ticket queue, read a behavior summary, and trace it back to the record.15 min
6. Set Up Your First NotificationGet told when the next one happens.10 min

Steps you can skip​

On an instance that already has data flowing, steps 2 and 3 are optional — but read step 3 anyway, because its three checks are the first thing to reach for whenever a source goes quiet later.

Step 6 is the only step that changes how an instance treats other people: a badly scoped notification rule mails everyone. If you are exploring someone else's production instance, read step 6 rather than doing it.

Steps 1, 4, and 5 are safe to repeat at any time and change nothing.

If You Get Stuck​

Every step page ends with How to Tell It Worked and If It Did Not Work, keyed to the symptom you are actually seeing. Beyond that:

  • Troubleshooting — no data arriving, parsing problems, notification delivery, search performance.
  • FAQ.
  • Create a support ticket — have your instance URL and the application's status badge ready. The application version is printed in the lower-left corner of your Profile page.

Where to Go After the Quickstart​