Skip to main content

Reference

Reference holds the manual's specifications: the things you look up rather than follow. Where the rest of the manual is task-oriented — how to connect a data source, how to build a behavior rule, how to run an investigation — this section describes the query languages, the programmatic interfaces, the data model, and the vocabulary that those tasks depend on. Pages here are meant to be complete and precise about what something is, not narrative about what to do next.

What belongs in Reference​

Material qualifies for this section when it is a specification, an enumeration, or a definition that multiple task guides need to point at. Language syntax, endpoint contracts, field schemas, and terminology all qualify. A walkthrough of a page in the interface does not — those live under Page Functionality — and neither does a configuration procedure, which belongs with the feature it configures.

How Reference relates to the rest of the manual​

Task guides should link into Reference for the exact spelling of a function, the shape of a response body, or the meaning of a term, and Reference pages should link back out to the guide that shows the thing in use. This section is deliberately not a tutorial path; nothing here assumes you have read the page before it.

In this section​

Glossary​

Glossary — an A–Z of the platform's vocabulary, with a one-line definition per term and a pointer to the page that covers it in depth. Also records the two naming inconsistencies readers hit first: Fluency vs. Ingext, and the two expansions of FPL.

FPL — the Fluency Programming Language​

FPL — the language reference. Covers the language's operators, control blocks, conditions, data types, and the function libraries used by processors, receivers, packers, actions, and rules. Note the expansion of the acronym: this manual follows the interface and reads FPL as Fluency Programming Language; see the Glossary naming notes.

KQL​

KQL — the query language used by the Data Lake KQL Query Builder and exposed programmatically for search and validation. Covers the tabular data model, the pipe-operator query structure, the operator and function surface, time filters, query cost, and the differences from other KQL dialects.

API & Automation​

REST API — the HTTP interface behind the web application: the request and response envelopes, worked curl examples, and the per-endpoint references. The MCP Server page covers the tool surface for AI clients.

Event Data Model​

Event Data Model — the normalized field schema for records: the base record, flow values, and the per-domain field groups. It documents the legacy record model, which does not everywhere match the schemas the Data Lake ships today.

What is an Audit Log​

What is an Audit Log — the conceptual definition of audit data: actor, action, target, result, location, timestamp, and the metadata added during collection. The vocabulary the rest of the manual assumes when it says "event".

  • Page Functionality — screen-by-screen walkthroughs of the current interface
  • Search — task guides for searching, including Lucene query syntax
  • Data Lake — where indexes, schemas, and the KQL builder live
  • Appendix — cookbooks and worked examples