Receiving Data

Just like collecting data from the outside world, the Fluency SIEM has to be configured to get data from Replay.

The quickest route is an application template. Go to Platform → Applications and choose the Install Application From Template view. If your deployment carries the Fluency Replay HEC template, it sits at the bottom under System Components — click it and install that pipeline, and you are done.

The tile is not on every deployment

System Components carries nine templates on a standard deployment and Fluency Replay HEC is not among them — see Install Application From Template for the current catalog. If you do not see the tile, install an HEC receiver by hand instead; that route is below and does not depend on the template.

Check you are on the right view first. Application Templates and Install Application From Template are two different views of the Applications page: the template catalog with the category cards is the second one, while Application Templates is a flat, paginated table of template IDs with no install action.

The catalog has a Search box across the top and the templates grouped into category cards, with System Components at the bottom:

On a deployment that carries the template, the System Components card shows the Fluency Replay HEC tile among the others:

Installing an HEC receiver by hand

If you need to install the pipeline outside System Components, this can be done by installing an HEC receiver. Have the HEC receiver send its data to a processor that is a simple pass-through. This is an example of a passthrough pipe that addressed the case that there is metaflow data.

function main(doc) {
    // The body of the original message is held in the event field
    if (doc.obj["@type"] == "metaflow") {
    
       let flow = doc.obj
       let timestamp = doc.obj["@timestamp"]
    
       doc.obj = {
          "@collector": "fluency-server",
          "@eventType": "flow",
          "@event_type": "flow",
          "@parser": "fpl-flow",
          "@parserVersion": "20250402",
          "@sender": "52.4.126.188",
          "@source": "52.4.126.188",
          "@timestamp": flow["timestamp"],
          "@type": "event",
        }
        
        doc.obj["@flow"] = flow
        doc.obj["@timestamp"] = timestamp

        return "pass"
    }
    //doc.obj = doc.obj["event"]
    return "pass"
}

A passthrough that is just doing events can be as simple as this:

function main(doc) {
    doc.obj = doc.obj["event"]
    return "pass"
}

Before testing, ensure that the resources for the data type you are sending are turned on. This will insure both detection rules and reporting. This can be found on SIEM->Resource Sync. Thes behavior ensure detection by event watch.

Finally, send this pipe to the EventWatch service.

To test the service, send data from the replay into the SIEM. You can look at the different pipe queues to see that data is being ingressed. While timeline data is immediate, the summary data is waiting for the window to close or exceed the threshold.