Integrations
Fluency connects to a data source by installing an application — a packaged pipeline carrying a data source, the processors that parse it, and the sinks it writes to. Installing one is filling in a form rather than building a pipeline: pick the product's template from the catalog, supply the credentials or index name it asks for, and press Install.
This section is the vendor-side companion to that catalog. Each page covers what has to happen in the product being connected — the API token to mint, the syslog destination to point at, the permissions to grant — and then which template to install and what to put in it.
Connecting a Source
-
Go to Platform → Applications and select Install Application From Template.
-
Find the product's tile. The catalog is grouped into the eight categories below, and a Search box spans the top.
-
Click the tile. A Setup New <template> Application panel opens on the right.
-
Set Name and Display Name. Both are pre-filled with
default/Default; change them when you are installing a second instance of the same template, because the name is what distinguishes the two on the applications list. -
Fill in the Parameters. Required fields carry a red asterisk. A template that writes to the data lake keeps its datalake (pre-filled
managed) and datalake index name in a collapsed Advanced Configurations row below the parameters; the defaults are usually right, but two applications writing to the same index name in the same lake will collide, and the second one aborts. -
Press Install. The application appears under Installed Applications with a Running badge and a pipeline diagram.
Each guide in this section reproduces its own template's setup form; Install Application From Template has all 65 of them in one place.
Reading an installed application
Collapsed, a card is a single row: an arrow at the left edge that toggles the card, the application's icon and name in the form application type: instance name, a status badge — Running in green, Aborted in red — and a blue eye button at the right edge. A red exclamation mark (!) after the badge marks a component that is unhealthy even though the application as a whole is still running; it matches a red-outlined node in the pipeline diagram.
Expanding the card draws the pipeline left to right, one labelled box per object with its name on the first line and its type on the second, and a throughput sparkline above most of them. Outlines and connectors are green where data is flowing, grey where the path is idle, and red where a node is in error. The round chevron button in the page header expands or collapses every card at once.
The blue eye button opens a details panel over the right side of the page, titled Viewing <type> Application. It always opens with a Details section (Application, Name, Display Name, Status, and — when aborted — an Error Message in red) and ends with a red Uninstall button. Between them it shows whichever apply: Parameters (the install values, secrets masked), Outputs (values the install produced, such as a collector token), and Actions (one line per pipeline object created). Every field is read-only — to change a parameter, uninstall and install again.
The Template Catalog
The platform ships 65 application templates in eight categories. The categories below are the catalog's own; where this section has a guide for a template, it is linked.
AWS Services
| Template | Guide |
|---|---|
| Amazon GuardDuty | GuardDuty |
| AWS CloudTrail | CloudTrail |
| CloudWatch LogGroup | Amazon CloudWatch |
| AWS EKS Logs | EKS Logs |
Cloud-based Business Softwares
| Template | Guide |
|---|---|
| Abnormal Security | Abnormal Security |
| Bitwarden | Bitwarden |
| BlackKite Findings | Black Kite |
| Cloudflare API | Cloudflare |
| GitHub via Org Webhook | GitHub Audit |
| Okta Events | Okta |
| Salesforce Event Monitoring | Salesforce Event Monitoring |
| Varonis | Varonis SaaS API |
| Workday Events | Workday |
Cloud Infrastructure (IaaS)
| Template | Guide |
|---|---|
| Azure Event Hubs | Azure Event Hubs |
| box.com | box.com |
Email Audit and Protection
| Template | Guide |
|---|---|
| Mimecast CG Events | Mimecast Cloud Gateway |
| Mimecast Events (Legacy) | Mimecast (Legacy API 1.0) |
| Proofpoint Essentials | Proofpoint Essentials |
| Proofpoint TAP | Proofpoint TAP |
Endpoint Management
| Template | Guide |
|---|---|
| Bitdefender EventPush | Bitdefender GravityZone |
| Bitdefender SecurityTelemetry HEC | Bitdefender GravityZone |
| Coro via HEC | Coro Cybersecurity |
| PaloAlto Cortex XDR | PaloAlto Cortex XDR |
| Microsoft Defender Legacy | Microsoft Defender |
| CrowdStrike Falcon | CrowdStrike Falcon |
| FalconResource | CrowdStrike Falcon |
| HEC Input Passthrough | HTTP Event Collector |
| LDAP Connector | LDAP integration |
| Manage Engine | ManageEngine |
| Microsoft Defender | Microsoft Defender |
| Qualys | Qualys |
| SentinelOne API Integration | SentinelOne API |
| Sophos EDR | Sophos EDR |
| Symantec EPM Syslog | Symantec Endpoint Protection Manager |
| TrendMicro VisionOne | TrendMicro VisionOne |
| Windows Server w/ NXLog | Windows Server |
| Zsaler NSS | Zscaler NSS |
Office Software (SaaS) and IAM
| Template | Guide |
|---|---|
| Azure Directory Audit | Azure AD audit |
| Cisco Duo Admin API | Cisco Duo |
| Google Workspace | Google Workspace (Service Account) |
| Google Workspace (OAuth) | Google Workspace (OAuth) |
| Office365 | Office 365 Activity API |
| Office365-Audit | Office 365 Audit |
| Office365 Resource Watch | Office 365 Resource Watch |
On-Premise IT
Every template in this category takes syslog from an appliance on your network, and most take no parameters at all — the template supplies the parser, and the transport is configured on the syslog listener rather than in the form.
| Template | Guide |
|---|---|
| Check Point Firewall Syslog | Check Point firewall |
| Cisco ASA Syslog | Cisco ASA |
| Cisco Meraki Syslog | Cisco Meraki |
| FortiGate NGFW Syslog | Fortinet FortiGate |
| Linux (RHEL) Syslog | Linux (RHEL) syslog |
| PaloAlto Firewall Syslog | Palo Alto NGFW |
| Peplink Router/Firewall Syslog | Peplink routers |
| SonicWall NGFW Syslog | SonicWall NGFW |
| Sophos Firewall Syslog | Sophos firewall |
| Sophos UTM Syslog | Sophos UTM |
| Ubiquiti UniFi Syslog | Ubiquiti UniFi Network |
| VMWare ESXi Syslog | VMware ESXi |
System Components
These install the platform's own moving parts rather than a third-party source, and are documented outside this section.
| Template | Documented at |
|---|---|
| BehaviorSummary Notification Export | Notifications |
| Fluency Syslog Endpoint | Syslog Import |
| Fluency AI Assistant | The assistant's API integration |
| Fluency Collector | Fluency Collector |
| Normalized Metaflow | The platform's own normalized metaflow stream |
| Import collector | Managing collectors |
| Ingext Collector import via S3 | Ingress management |
| Fluency legacy archive import via S3 | Ingress management |
| Ingext Syslog import via S3 | Ingress management |
Sources Without an Application Template
Not every supported product has a template. Some are connected as a connector on Platform → Integrations, some push to the HTTP Event Collector, and some send syslog to a listener with a parser built by hand. Those pages say so at the top and name the path that applies; see the Integration Matrix for the whole picture at a glance.
Platform → Integrations (URL path /platform/integrations) is subtitled A list of active integrations and integration types, and has a view selector on the left with two entries: Existing Integrations, the view it opens on, and New Integration, where a connector is created from a catalog of 48 integration types. Active integrations are grouped into category panels — Office Software (SaaS) and IAM, Endpoint Management, On-Premise IT, and so on — one tile per integration, each showing the service icon, the integration's instance name, and its integration type (for example AWS S3 w/ SQS or Office365). A tile outlined in green is active.
Adding the connector is only half the job — the data source that consumes it is then added by hand, along with the router and sink behind it.
In This Section
- AWS — CloudTrail, GuardDuty, CloudWatch, EKS, and the S3/SQS delivery paths behind them.
- Microsoft — Defender, Office 365, Azure AD, Azure Event Hubs, and Windows Server.
- Endpoint Management — EDR and XDR products.
- Cloud Networking — SASE, DNS, and proxy services.
- Email Security — mail gateways and phishing protection.
- Business Software — SaaS business applications and identity providers.
- On-Prem / Syslog — firewalls, routers, and servers.
- Notification & Ticketing — outbound integrations, which send from Fluency rather than to it.
- Integration Matrix — every product and how it gets in.