Skip to main content

Introduction

This is the user manual for the Fluency Ingext platform: collecting audit data from across an environment, shaping it in flight, storing it in a searchable data lake, detecting behavior worth acting on, and reporting on all of it.

A note on two names​

You will see both Fluency and Ingext in this manual, and they are not an old name and a new one — they are two products from the same company that are usually deployed together:

  • Ingext is the streaming data pipeline and lakehouse — collecting data once, cleaning it in motion, routing it by value, and storing it in open formats.
  • Fluency is the SIEM that sits on top of it — streaming analytics, behavior rules, risk scoring, cases and AI-assisted triage.

The web interface is branded Fluency, and this manual is published at manual.ingext.io. Where a page needs to name the whole system generically, it says "the platform". The full term list is in the Glossary.

What the platform does​

Collect​

Many ways to get data in — see Data Collection and the Integrations catalog.

  • A dedicated, per-client syslog endpoint with TLS on each cloud instance
  • Audit APIs for a wide range of security and business products
  • Azure Event Hubs
  • HEC (Splunk-compatible HTTP Event Collector) and HTTP webhook sources
  • Direct streaming from AWS S3 buckets

Process​

Data is shaped as it arrives by a pipeline of Sources → Routers → Sinks, with FPL processors doing the parsing, normalization and enrichment. See Platform.

A data lake purpose-built for streaming analytics, searchable without rehydration. See Search.

  • Indexes, schemas and virtual tables over open storage
  • Task-based, parallel searching across long time ranges
  • One year (365 days) hot-searchable by default — see Data Storage
  • KQL for tabular queries — see the KQL reference

Detect and investigate​

The EventWatch streaming analytics engine correlates records in real time and raises the behavior summaries an analyst works from. See Detections and Investigate.

  • Behavior event summaries with UEBA
  • Open-ended risk scoring with alert suppression
  • Notification and ticketing integrations — see Alerts & Actions

Report​

FPL drives scheduled and on-demand reporting and dashboards. See Reports.

How this manual is organized​

Start here

Getting data in and shaping it

Working the data

Running the system

  • Administration — users, roles, API tokens, the audit log, and MSSP resource sync

Looking things up