Skip to main content

Navigation

The Fluency web interface comes in two versions on the same site. The v2 interface, served under /v2/, is navigated from a navigation rail down the left edge of the screen, with tenant configuration gathered on one Configuration page and site administration in a separate Admin console. The classic v1 interface, at the site's root, is navigated from a navigation bar across the top of the screen, whose menus each group the pages of one functional area. Both sign in with the same account and work on the same data.

For a page-by-page reference of the interface (what each page shows, and what every button, menu, and dialog does), see the Page Functionality section. To find where a v1 page lives in the v2 interface, see Finding a Page from the v1 Interface.

Every page except the Admin console shares the same navigation rail down the left edge of the screen. The rail opens collapsed, as a column of icons; hover over an icon to see its name. Expand menu, near the bottom of the rail, widens it to show each name beside its icon, and Collapse menu narrows it again.

v2 interface with the navigation rail expanded, listing Home through Configuration at the top and Admin console, Documentation, What’s new, Collapse menu, the signed-in account, and Sign out at the bottom

From top to bottom, the rail contains:

  • Fluency logo: returns to the Home dashboard.
  • Home: the landing dashboard: open cases, usage, data lake storage, and application health.
  • Overview Summary, Metric Alerts, Cases Search, and Notable Events: reviewing detections and cases. See Detection and Triage.
  • Datalake Search and KQL Search: searching stored events. See Search and the Data Lake.
  • Resources and Assets: the users, devices, and other entities integrations have collected, and the assets registered or discovered from data ingress.
  • Applications and Platform: the data pipeline. See The Data Pipeline.
  • Reports: the system dashboard reports and the FPL report processors. See Reports.
  • Configuration: a hub of cards, one per tenant configuration page. See Configuration and Administration.

Near the bottom of the rail are Admin console (site administration), Documentation (opens this manual), What’s new (announcements, release notes, and attack coverage from Fluency), Expand menu / Collapse menu, the account avatar with your initials, which opens your own Profile, and Sign out.

Above the page, the top bar carries Fluency Portal, which also returns to Home. A page reached from another page shows a Back to … link above its title (Back to Configuration, Back to Applications, and so on) that returns to the page it belongs to.

Detection and Triage​

The pages used to review detections sit at the top of the rail:

  • Overview Summary: a dashboard of the account's behavior summaries: open and AI-closed counts, response time, a severity breakdown that doubles as a filter, and the filtered list of summaries. This is the primary entry point for reviewing Behavior Alerts.
  • Metric Alerts: alerts raised by platform metrics, such as an import source that stopped sending.
  • Cases Search: faceted search across case summaries. Clicking a case opens its detail panel; Open case there opens the Behavior Summary page, for one entity on one day.
  • Notable Events: faceted search across notable behavior events.

Detection logic is managed from the Configuration page: Behavior Rules (the rules, and the Behavior Filters that act as their exceptions) and Entity Tables (the entity information lookup tables used to enrich events).

Search and the Data Lake​

Two rail items search stored events:

  • Datalake Search: faceted search across all collected events in a data lake index, with a histogram, facet filters, a result table, and a detail panel for each event.
  • KQL Search: a KQL workbench for data lake indexes. Its Search History button opens the account-wide record of KQL searches, each reopening its stored results.

Where and how event data is stored is managed from the Configuration page: Data Lakes (data lakes and their indexes), Schemas (the schemas that describe stored data), and Search Facets (the saved facet profiles Datalake Search uses). The history of investigation searches run against the data lake is in the Admin console, under Investigation History.

The Data Pipeline​

Two rail items operate the data pipeline:

  • Applications: install and monitor the applications that bring data into the pipeline. The page lists the installed applications with their status and traffic; clicking one opens its details (state, pipeline, parameters, and the actions its installation performed), and Install Application opens the Application Catalog of 72 templates you connect a new source from.
  • Platform: a live diagram of the pipeline's sources, routers, and sinks. New components can be added and configured from here.

The rest of the pipeline's configuration is on the Configuration page: Collectors, Integrations (connections to external services), Processors (the FPL processors that parse and transform events, with FPL Receivers, Packers, Actions, and Rules), Resource Sync, Syslog Ports, Notifications, Application Templates, and AWS Roles. Charts of data ingress and search volume are on Reports, as the Event Ingress Report and the Usage Report.

Reports​

The Reports page has two tabs:

  • Dashboard: the site's system dashboard reports: the Event Ingress Report, the Ticket Analysis Report, and the Usage Report, each opening as an interactive dashboard over a time range you choose.
  • FPL reports: create and manage the FPL report processors, and open, run, and save them in an editor.

Reports are scheduled from the Configuration page, on Report Scheduler. The run history of the report processors is in the Admin console, under Report Tasks, and the daily report archives under Archived Reports.

Configuration and Administration​

Configuration, the last item in the upper part of the rail, opens a hub of fourteen cards, one per configuration page. The page holds no settings of its own: click a card to open its page, and that page's Back to Configuration link to return.

Configuration page with fourteen cards in two columns, each with an icon, a title, and a one-line description

The cards are Application Templates, AWS Roles, Behavior Rules, Collectors, Data Lakes, Entity Tables, Integrations, Notifications, Processors, Report Scheduler, Resource Sync, Search Facets, Schemas, and Syslog Ports. Configuration describes each one.

Admin console, the shield icon near the bottom of the rail, opens the site-administration area. It replaces the rail with a side navigation of its own and opens on the Users page: the accounts that can sign in, their roles, and how they authenticate, with an Add User button.

Admin console open on the Users page, with the side navigation on the left grouped into Administration, RBAC, Management, and Portal, and the signed-in user and Sign out at its foot

The side navigation groups its pages:

  • Administration: Users and API Tokens.
  • RBAC: Roles, API Policies, and Data Policies.
  • Management: Audit Logs (the log of user activity in the portal), Lake Tasks, Report Tasks, Archived Reports, and Investigation History.
  • Portal: Back to portal, which returns to the Home page.

For the full walkthrough of each page, see Admin console.

Your Profile​

The account avatar with your initials, near the bottom of the rail (and at the foot of the Admin console's side navigation), opens your own Profile page (URL path /v2/profile). Your account details are shown read-only (an administrator changes them on Admin console → Users) beside a Change Password card, your Theme preference (Light, Dark, or System), and the Keep rail expanded switch. The portal's version number is printed beneath the preference cards.

Profile page with the read-only Account Information card and the Change Password card on the left, and the Preference and Portal Layout cards on the right

Last updated on