Glossary
The platform uses a large amount of invented vocabulary — packer, receiver, behavior, facet configuration, EntityInfo table — and much of it is used without definition in the pages that depend on it. This glossary gives one authoritative one-line definition per term and points at the page that covers it in depth. It is the place to send a reader who has hit a word for the first time.
Naming notes
Two naming inconsistencies confuse readers before any individual term does. Both are real and current; neither is a leftover from a rename.
Fluency vs. Ingext
Fluency and Ingext are two live brands from the same company, not an old name and a new one.
- Ingext (ingext.io, launched 2024) is the streaming data-pipeline and lakehouse product — collection, transformation, routing, and storage.
- Fluency (fluencysecurity.com) is the AI-native SIEM — detection, behavior analytics, investigation, and response.
Both names appear in product surfaces and in this manual, and the live web interface still shows a Fluency logo. Neither is a correction of the other.
FPL: "Programming" or "Processing"?
FPL is expanded two different ways in official material:
- Fluency Programming Language — used in the product interface and at fpl.fluencysecurity.com.
- Fluency Processing Language — used in the Ingext documentation.
This manual follows the interface and expands FPL as Fluency Programming Language, noting the Processing variant where a reader is likely to encounter it.
A
Action (FPL Action)
An FPL object that performs an outbound operation — sending an email, posting to Slack, calling an external API — when a rule, notification endpoint, or report invokes it. Managed on Platform → Processors under the Actions tab. See Processors and Actions.
Application
An installed unit of platform functionality — a packaged pipeline and its configuration — listed on Platform → Applications under Installed Applications. Installing one stands up a data source, the processors that parse it, and the sinks it writes to as a unit, which is why connecting a source is a form to fill in rather than a pipeline to build.
Application Template
The reusable definition an application is installed from. Templates are browsed and installed from the Install Application From Template view, which groups them into eight categories, and listed by internal ID in the Application Templates view, where a template of your own can also be defined in YAML. The platform shipped 60 of them at the 2026-08 catalog capture; see Integrations for which product each one connects.
Asset
A tracked host, device, or system record maintained by the platform and searchable on Platform → Assets → Assets Search. Also the subject of metric alerts. See Assets and Ingress Management.
B
Behavior
A correlated finding produced by the EventWatch engine from one or more events — the platform's unit of detection output, as opposed to a raw event. See Investigate and Detections.
Behavior Filter
An exception to a behavior rule — a named, toggleable condition that stops matching behaviors from being raised. Filters are managed from the Behavior Filters view of the Behavior Rules page, subtitled Exceptions for Behavior Rules, where each filter carries an Enabled toggle and the list of behaviors it applies to. Use one to suppress a known-good pattern without editing or disabling the rule that detects it. See Behavior Rules and Detections.
Behavior Rule
The definition that tells EventWatch what pattern to detect and what behavior to emit. Also called a behavior model in older pages and in parts of the interface; see the terminology-drift note above. See Creating a Behavior Rule, Managing Rules, and Behavior Rules.
Behavior Summary
The aggregated view of behaviors grouped by entity and key, used to see which subjects are accumulating risk. See Behavior Summary and SIEM → Behavior Summary.
Behavior Timeline
The chronological view of individual behavior records, used to reconstruct what happened in order. See Behavior Timeline and SIEM → Behavior Timeline.
C
Case
A grouping of related behaviors, events, and analyst notes tracked through an investigation workflow to a disposition. No page in this manual documents case management. See Ticket for the queue item the interface actually exposes.
Cloud Collector
Collection performed by the platform's own cloud-side receivers rather than by software you run — the per-tenant syslog endpoint and the hosted API pollers. Contrast with Collector. See Syslog Import and Syslog Ports.
Collector
The Fluency Collector: software deployed inside your network to gather data that cannot reach the cloud directly and forward it to the platform. See Fluency Collector and Why Use a Collector.
D
Data Lake
The platform's long-term event store and the section of the interface that queries it — indexes, schemas, search, investigations, and the KQL builder. See Data Lake and Data Storage.
Data Sink
The pipeline component that writes records out of a pipeline — to the data lake, to EventWatch, or to an external destination. See Data Sinks.
Data Source
The pipeline component that reads records into a pipeline from a receiver, a queue, or an external API. See Data Sources.
E
EntityInfo Table
A lookup table of entity values — event-ID dictionaries, watchlists, translations — that the SIEM references to enrich or interpret events. See EntityInfo Tables.
Entity / Key / Key Type
The subject a behavior is tracked against. The key is the identifying value (a username, an IP address, a hostname), the key type declares what kind of value it is, and entity is the resolved subject the key refers to. See Behavior Summary.
Event
One normalized record in the data lake — the smallest unit of collected data, after parsing and normalization. See Event Data Model and Events Search.
EventWatch
The real-time correlation and alerting engine that evaluates incoming events against behavior rules and emits behaviors, risk, and notifications. The name also survives as a menu label in older pages. See Detections.
F
Facet
The attribute / value / count breakdown shown beside search results, used to focus or exclude results with a three-state checkbox per value. See Facets.
Facet Configuration
A named, saved set of facet groups applied to a particular index — the interface ships a general Default plus a per-source configuration for each integrated data source. See Data Lake → Search and Facets.
FPL
Fluency Programming Language — the platform's own language for parsing, transforming, correlating, and reporting on data. It is the implementation language of processors, receivers, packers, actions, and rules. Also expanded as Fluency Processing Language in Ingext material; see the naming note above. See FPL.
H
HEC
HTTP Event Collector — the Splunk-compatible HTTP ingest endpoint, letting any client that can post to Splunk's HEC send to this platform instead. See HEC (Splunk-compatible).
I
Index
A named table of records in the data lake, with its own column set and schema; queries name an index as their starting point. See Data Lake → Management and KQL.
Ingress
The inbound side of the platform — the flow of data in, and the volume of it. Used both for the mechanism and for the measured rate. See Integration Matrix, Ingress Management, and Usage.
Integration
A configured connection to an external product, either to pull its audit data in or to push notifications and actions out. See Integrations and Platform → Integrations.
Investigation
A costed, asynchronous search run over the data lake, started from the Search page with Run Investigation and tracked with its state, cost, and duration. See Investigations and Data Lake → Search.
K
Key / Key Type
KQL
The Kusto-style, pipe-oriented query language used by the Data Lake KQL Query Builder and by the platform's programmatic search and validation calls. Distinct from the Lucene syntax used by Data Lake → Search, which is the platform's primary event search and is current, not superseded. See KQL and Lucene Queries.
L
Lakehouse
The Ingext architecture pattern that combines a streaming pipeline with lake storage, so records are queryable as tables without a separate warehouse load. The term appears in Ingext product material; this manual documents the components individually rather than under this name.
N
Notification
The delivery of an alert to a person or system through a configured endpoint (Email, Slack, and others), governed by notification rules. Endpoints are backed by FPL actions. See Notifications and Alerts & Actions.
P
Packer
An FPL object type that batches, formats, or encodes records before they leave the pipeline — the counterpart to a receiver on the outbound side. Managed on Platform → Processors under the Packers tab. See Processors.
Pipe
An ordered chain of processors inside a router. A router holds one or more pipes; each pipe row on the router shows the pipe's name and how many processors it contains, for example (1 procs). A record entering the router is passed through the processors of a pipe in order. Distinct from the | operator, which chains stages within a single FPL or KQL statement. See Router, Pipeline Components and KQL.
Processor
An FPL object that parses and transforms events as they pass through the pipeline — the workhorse of normalization. Managed on Platform → Processors. See Processors and Platform → Processors.
R
Receiver
An FPL object type that accepts inbound data on the platform's edge and hands it to a pipeline. Managed on Platform → Processors under the Receivers tab. See Processors and Receiving Data.
Report Processor
An FPL processor written to produce a report — a scheduled or on-demand query whose output is a table, a dashboard panel, or a delivered document. See Reports → Processors and Reports.
Resource
A record collected from an integration and held in the account for correlation and lookup — the directory objects behind the events, rather than the events themselves. The Resources page lists them per integration, with types such as Applications, Devices, Groups and Users, and each record can be opened or exported. Not to be confused with a Resource Sync Group, which is a bundle of content. See SIEM → Resources.
Resource Sync Group
A named bundle of platform content — one per integration — that Resource Sync keeps up to date in the account. Groups are named after what they carry, such as Fluency_AWS, Fluency_AzureAD and Fluency_CiscoMeraki; enabling a group brings in the parsers, rules and supporting objects for that integration. It groups content, not tenants. See Resource Sync and, for the multi-tenant use of the same mechanism, Resource Sync (MSSP).
Risk Score
The open-ended, accumulating score attached to an entity as behaviors fire against it, used to rank what deserves attention. See Risk Scoring.
Router
The pipeline component that directs records down different paths based on their content or labels. See Data Routers.
S
Schema
The definition of an index's fields, their types, its aliases, and its virtual tables. Managed on Data Lake → Schemas; the demo instance ships roughly twenty. See Schemas.
Severity Level
The ranked importance assigned to a behavior or alert, used for sorting, filtering, and deciding notification routing. The interface uses five bands — Critical, High, Serious, Medium and Low — which are also the values offered by the Severity Filter on the Overview Summary page. See Behavior Timeline.
Syslog Port
A listener port that accepts syslog. On the cloud syslog endpoint the tenant is allocated a small block of ports and one port is used per protocol — Syslog TLS, TLS RFC 6587, Syslog UDP, Syslog TCP — not per data source; the domain and the per-protocol ports are read from Platform → Administration → Syslog Ports. On a collector appliance the defaults are 514 for udp and tcp, 6514 for tls and 7514 for tls (RFC6587), and a listener there can carry a Customer Tag, which is how records are attributed to a site or customer. See Syslog Ports and Platform → Syslog Ports.
T
Ticket
The platform's own queue item — the unit of work an analyst opens, acknowledges and closes. Tickets are counted on the landing dashboard as Total Tickets, Tickets Closed By AI and Open Tickets, and carry a status of New, Acknowledged, Closed or Closed By AI. A ticket may additionally be mirrored into an external system such as PagerDuty or ServiceNow by an FPL action, but the record in that system is the copy, not the ticket itself. See SIEM → Overview Summary, Actions and Notification & Ticketing.
V
Virtual Table
A derived table projected from an index by a schema — defined with a name, a root field, and a label selector — so a subset of a wide index can be queried as its own table. See Data Lake → Management and Schemas.
Related
- Reference — the rest of the specification material
- Page Functionality — where each term appears in the interface
- FPL — the language reference
- KQL — the data lake query language