{ "version": "https://jsonfeed.org/version/1", "title": "Fluency Ingext User Manual Blog", "home_page_url": "https://manual.ingext.io/splash", "description": "Fluency Ingext User Manual Blog", "items": [ { "id": "https://manual.ingext.io/splash/2026-10-23-password-spray", "content_html": "

Attackers are spraying passwords from old breaches at Microsoft 365 accounts through the Azure command-line client (Azure CLI), whose password-only sign-in never shows an MFA prompt. Huntress reported one campaign that made more than 81 million sign-in attempts in two weeks of June 2026 and compromised 78 accounts at 64 organizations.

\n

Any organization whose MFA policy leaves gaps (some users, some apps, trusted locations, report-only mode) is exposed. MSSPs should check every tenant they manage. On October 23, 2026, Fluency released to every instance a detection for the takeover that follows a blocked attempt. No action is needed to turn it on.

\n

The playbook​

\n\n

Why MFA did not stop it​

\n

Among the organizations Huntress saw compromised that had MFA, it did not apply because it was:

\n\n

Eight of the 23 businesses Huntress analyzed had no MFA policy at all. And each record looks normal on its own: the block is the policy working, and the success is a routine sign-in.

\n

Fluency's new detection​

\n
DetectionFires whenNeeds
EntraID_SignIn_After_BlockA user signs in successfully within two hours after Conditional Access blocked a high-risk sign-in that presented their correct password, and the success comes from an address none of the blocked attempts came from.Entra ID sign-in logs (Azure Event Hubs or Microsoft Graph), and Entra ID P2 for Microsoft's sign-in risk rating
\n

It raises a high-severity alert on the user. The release also sharpens EntraID_Valid_Password_Blocked, which alerts whenever Conditional Access blocks a sign-in that had the correct password: it no longer reports blocked attempts with a wrong password. Neither rule can catch an attacker whose very first attempt succeeds with nothing blocked before it. MFA is the control for that.

\n

What we recommend​

\n

For every organization​

\n
    \n
  1. Require MFA for all users, all cloud apps and all client app types, with no group, app, location or report-only exceptions. Accounts outside an \"admins\" group are the ones being taken over.
    2. \n
  2. Restrict Azure CLI and Azure PowerShell to the people who need them. Require assignment on the Microsoft Azure CLI enterprise app and assign it to an IT group, or block Azure management for everyone else.
    3. \n
  3. Turn off password-only (ROPC) sign-in where nothing depends on it. Conditional Access has no separate setting for it: requiring MFA for all client app types makes ROPC sign-ins fail.
    4. \n
  4. Don't rely on location alone. IP geolocation is often wrong, and an attacker can come from an address in your own country.
    5. \n
  5. Treat a blocked sign-in with the correct password as a stolen password. Reset it and require MFA for that user, even though the attempt was stopped.
    6. \n
  6. Disable dormant accounts. An account nobody signs in to has no owner to notice a takeover.
    7. \n
\n

For MSSP partners​

\n\n

If you find a match, raise a support ticket and Fluency will help with the investigation. The rule's full match conditions, what it does not cover, and triage steps are in the Password-Spray Account Takeover Detection release notes.

\n

References​

\n\n
Splash Summary

Attackers are spraying passwords from old breaches at Microsoft 365 accounts through the Azure command-line client (Azure CLI), whose password-only sign-in never shows an MFA prompt. Huntress reported one campaign that made more than 81 million sign-in attempts in two weeks of June 2026 and compromised 78 accounts at 64 organizations.

Any organization whose MFA policy leaves gaps is exposed. On October 23, 2026, Fluency released to every instance a detection for the takeover that follows a blocked attempt. No action is needed to turn it on.

", "url": "https://manual.ingext.io/splash/2026-10-23-password-spray", "title": "Advisory: Azure CLI Password-Spray Account Takeover", "summary": "Attackers are spraying passwords from old breaches at Microsoft 365 accounts through the Azure command-line client (Azure CLI), whose password-only sign-in never shows an MFA prompt. Huntress reported one campaign that made more than 81 million sign-in attempts in two weeks of June 2026 and compromised 78 accounts at 64 organizations.", "date_modified": "2026-10-23T21:55:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "advisory", "microsoft", "detections" ] }, { "id": "https://manual.ingext.io/splash/2026-10-23-connectwise-app-compromise", "content_html": "

An attacker stole the credentials of ConnectWise's multi-tenant Cloud Backup (formerly SkyKick) and Cloud Management apps. It then signed in to customers' Microsoft 365 tenants as those apps, with no user and no MFA. Microsoft attributed the attack on October 21, 2026 to Storm-0940, a China state-aligned actor that automated it with an AI penetration-testing framework. Microsoft counts attempts against more than 2,250 tenants. In several cases, the actor went from first targeting to privileged access in under three hours.

\n

Any tenant that consented to one of these apps should be checked for changes the attacker made. MSPs use the apps widely, so MSSPs should check every tenant they manage. Every other tenant runs the same kind of risk through the vendor apps it trusts. On October 23, 2026, Fluency released four detections to every instance for an app that hands out directory roles or keys other apps. No action is needed to turn them on.

\n

The playbook​

\n\n

ConnectWise disabled the apps on October 17.

\n

Why it is hard to catch​

\n\n

Fluency's new detections​

\n
DetectionFires whenAlerts
EntraID_App_Self_Role_AssignedAn app assigns any directory role to its own service principal.Critical, every time
EntraID_App_Privileged_Role_AssignedAn app assigns a privileged directory role (Global, Exchange, Privileged Role or Application Administrator and the like) to a user or group, or any role to another service principal.High confidence, first time per app in 30 days
EntraID_App_Role_AssignedAn app assigns a non-privileged directory role to a user or group.Medium, first time per app in 30 days
EntraID_App_Credential_By_AppAn app adds a secret or certificate to another app or service principal.Medium, first time per app in 30 days
\n

All four read the Entra ID audit logs, collected by Entra ID Audit via Event Hubs or Microsoft Graph. Access brokers and CI pipelines do some of these things as their job, so the first-time rules raise one alert per app, not one a week. They start alerting about a week after reaching a tenant. Self-assignment is never routine and alerts from the start. For activity before October 23, hunt as described below.

\n

What we recommend​

\n

For every organization​

\n
    \n
  1. \n

    Find the ConnectWise apps by application ID, not by name. In older tenants the Cloud Management apps can appear as \"SkyKick Cloud Manager\". Huntress lists these IDs:

    \n
    ApplicationApplication ID
    ConnectWise Cloud Backup506e08f9-6e9a-4da4-942b-a099a03644ae
    ConnectWise Cloud Management2399d300-6fca-4e6a-a686-399fefe75b83
    ConnectWise Cloud Management - MS Teams24205314-2b89-4e07-a2a4-579e898a5640
    ConnectWise Cloud Management - Exchange Onlineb78f6a77-d4e5-46fb-87e5-d1648bd02519
    ConnectWise Cloud Management - MS Graph0de14c77-b9b0-4137-9360-34878a929827
    ConnectWise Cloud Management - Partner Center412dcf96-176d-4b3a-a1b0-4981ad66971e
    ConnectWise Cloud Management - SharePoint Onlineb2b55f5b-7758-4719-8d8f-88ae172e6bdb
    \n
    2. \n
  2. \n

    Disable the apps, don't delete them, until ConnectWise confirms they are safe. Deleting an app removes its consent and the evidence of what it held.

    \n
    3. \n
  3. \n

    Look for credentials you did not add. Check the secrets and certificates on every enterprise application and app registration added since October 13, especially on management and security tools. Remove any you did not create.

    \n
    4. \n
  4. \n

    Check which directory roles vendor apps hold. Remove Global Administrator, Exchange Administrator or Privileged Authentication Administrator from any app that does not need it.

    \n
    5. \n
  5. \n

    Collect service principal sign-ins. Select the ServicePrincipalSignInLogs category in the Entra ID diagnostic setting that feeds Entra ID Audit via Event Hubs. Without it, an app signing in with a stolen credential leaves no record. The Microsoft Graph template collects interactive sign-ins only.

    \n
    6. \n
  6. \n

    Give multi-tenant apps the least privilege they need, and review the consents you have granted to vendors.

    \n
    7. \n
\n

For MSSP partners​

\n\n

If you find a match, raise a support ticket and Fluency will help with the investigation. Each rule's full match conditions, what it does not cover yet, and triage steps are in the Entra ID App Identity Detections release notes.

\n

References​

\n\n
Splash Summary

An attacker stole the credentials of ConnectWise's multi-tenant Cloud Backup (formerly SkyKick) and Cloud Management apps. It then signed in to customers' Microsoft 365 tenants as those apps, with no user and no MFA. Microsoft attributed the attack on October 21, 2026 to Storm-0940, a China state-aligned actor, and counts attempts against more than 2,250 tenants.

Any tenant that consented to one of these apps should be checked for changes the attacker made, and MSSPs should check every tenant they manage. On October 23, 2026, Fluency released four detections to every instance for an app that hands out directory roles or keys other apps. No action is needed to turn them on.

", "url": "https://manual.ingext.io/splash/2026-10-23-connectwise-app-compromise", "title": "Advisory: ConnectWise App Compromise (Storm-0940)", "summary": "An attacker stole the credentials of ConnectWise's multi-tenant Cloud Backup (formerly SkyKick) and Cloud Management apps. It then signed in to customers' Microsoft 365 tenants as those apps, with no user and no MFA. Microsoft attributed the attack on October 21, 2026 to Storm-0940, a China state-aligned actor that automated it with an AI penetration-testing framework. Microsoft counts attempts against more than 2,250 tenants. In several cases, the actor went from first targeting to privileged access in under three hours.", "date_modified": "2026-10-23T18:45:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "advisory", "microsoft", "detections" ] }, { "id": "https://manual.ingext.io/splash/2026-10-23-announcements", "content_html": "

Attackers posing as IT support are contacting employees on Microsoft Teams from throwaway Microsoft 365 tenants. They call within seconds of opening a chat and talk the employee into a remote-support session, a fake IT page or an installer. This is the campaign Microsoft Threat Intelligence described on September 2, 2026, which turns one remote session into enterprise-wide access.

\n

Any organization that allows Teams chats from outside tenants is exposed, and Teams allows them by default. MSSPs should check every tenant they manage. On October 23, 2026, Fluency released two detections for the campaign to every instance. No action is needed to turn them on.

\n

The playbook​

\n\n

Storm-1811, a Black Basta ransomware actor, has used the same lure since 2024.

\n

Why it is hard to catch​

\n\n

Fluency's new detections​

\n
DetectionFires whenNeeds
O365_Teams_OnMicrosoft_Tenant_ChatA user of an outside *.onmicrosoft.com tenant opens a Teams chat with one of your users, whatever name they use. Guests of your own tenant, partners on their own domains and personal Teams accounts are not matched.The Microsoft 365 audit log, including Teams (Office365 Audit API or Office 365 Audit)
O365_Endpoint_Download_From_Azure_CloudAppA browser downloads an installer, executable, script or archive from a *.cloudapp.azure.com host.Windows devices onboarded to Microsoft Purview, which record browser downloads in the same audit log
\n

Both raise a high-confidence alert. What the installer does after it runs is left to your endpoint protection (EDR). Fluency scores and triages EDR alerts from Microsoft Defender XDR, CrowdStrike Falcon and SentinelOne alongside these.

\n

What we recommend​

\n

For every organization​

\n
    \n
  1. Switch Teams external access to an allowlist. In the Teams admin center, under Users → External access, choose Allow only specific external domains and list the partners you work with. The attackers' tenants are created for the campaign, so an allowlist blocks them by default. Also turn off People in my organization can communicate with unmanaged Teams accounts, so the attackers cannot move to personal accounts. Turning external access off entirely also works, but it breaks legitimate partner chats.
    2. \n
  2. Tell staff how real IT reaches them. Internal IT never makes first contact from an outside Teams account, and never asks for an unscheduled screen share or installer. A sudden flood of spam is a common setup for a fake help desk call.
    3. \n
  3. Turn on the data the detections need. Send the Microsoft 365 audit log, with Teams, to Fluency. Onboard Windows devices to Microsoft Purview so browser downloads are recorded.
    4. \n
  4. Treat Defender's Teams-impersonation and mail-bombing alerts as urgent. A clean sign-in history does not clear them.
    5. \n
  5. Remove or block Quick Assist if IT support does not use it.
    6. \n
\n

For MSSP partners​

\n\n

If you find a match, raise a support ticket and Fluency will help with the investigation. Each rule's full match conditions, what it does not cover, and a prioritized triage checklist are in the Teams Helpdesk Impersonation Detections release notes.

\n

References​

\n\n
Splash Summary

Attackers posing as IT support are contacting employees on Microsoft Teams from throwaway Microsoft 365 tenants. They call within seconds of opening a chat and talk the employee into a remote-support session, a fake IT page or an installer. This is the campaign Microsoft Threat Intelligence described on September 2, 2026, which turns one remote session into enterprise-wide access.

Any organization that allows Teams chats from outside tenants is exposed, and Teams allows them by default. On October 23, 2026, Fluency released two detections for the campaign to every instance. No action is needed to turn them on.

", "url": "https://manual.ingext.io/splash/2026-10-23-announcements", "title": "Advisory: Teams IT-Helpdesk Impersonation Campaign", "summary": "Attackers posing as IT support are contacting employees on Microsoft Teams from throwaway Microsoft 365 tenants. They call within seconds of opening a chat and talk the employee into a remote-support session, a fake IT page or an installer. This is the campaign Microsoft Threat Intelligence described on September 2, 2026, which turns one remote session into enterprise-wide access.", "date_modified": "2026-10-23T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "advisory", "microsoft", "detections" ] }, { "id": "https://manual.ingext.io/splash/2026-10-20-announcements", "content_html": "

Fluency has released new behavior rules for Microsoft Entra ID and Microsoft 365 that detect three campaigns reported by Microsoft Threat Intelligence: adversary-in-the-middle session theft, device-code phishing, and takeover of whole tenants through a registered app.

\n

The rules rolled out October 18–20, 2026 and reach every instance automatically. No configuration is needed.

\n

What is covered​

\n\n

The release also adds detections for federation and federated-credential changes, elevated access, privileged role assignments, high-risk sign-ins, MFA fatigue and MFA fraud reports, per-user brute force, and correct passwords blocked by Conditional Access.

\n

In all: 19 new alerting rules, 12 context rules that add events to the timeline without raising alerts, and 5 older rules retired or removed.

\n

What to expect​

\n\n

The full rule list, triage guidance for each alert, and the retired rules are in the Entra ID Detection Update release notes.

\n
Splash Summary

Fluency has released new behavior rules for Microsoft Entra ID and Microsoft 365 that detect three campaigns reported by Microsoft Threat Intelligence: adversary-in-the-middle session theft, device-code phishing, and takeover of whole tenants through a registered app.

The rules rolled out October 18–20, 2026 and reach every instance automatically. No configuration is needed.

", "url": "https://manual.ingext.io/splash/2026-10-20-announcements", "title": "Detections: AiTM, Device-Code Phishing and App Takeover", "summary": "Fluency has released new behavior rules for Microsoft Entra ID and Microsoft 365 that detect three campaigns reported by Microsoft Threat Intelligence: adversary-in-the-middle session theft, device-code phishing, and takeover of whole tenants through a registered app.", "date_modified": "2026-10-20T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "detections" ] }, { "id": "https://manual.ingext.io/splash/2026-10-13-announcements", "content_html": "

The v2 interface is available on every Fluency instance. To open it, add /v2 after your instance's address. Every escalated case now comes with an AI investigation report attached.

\n

Opening the v2 interface​

\n

Add /v2 to the address you already use, for example https://<companyname>.app.ingext.io/v2. Sign in as usual. The current interface stays at its address, so you can switch between the two.

\n

AI investigation reports​

\n

When AI triage escalates a case instead of closing it, the case now carries an AI investigation report, built from the raw events stored for the case. See Investigation Workflows.

\n

The rest of this month's changes are in the October 2026 Platform Update release notes.

\n
Splash Summary

The v2 interface is available on every Fluency instance. To open it, add /v2 after your instance's address. Every escalated case now comes with an AI investigation report attached.

", "url": "https://manual.ingext.io/splash/2026-10-13-announcements", "title": "The v2 Interface Is Here", "summary": "The v2 interface is available on every Fluency instance. To open it, add /v2 after your instance's address. Every escalated case now comes with an AI investigation report attached.", "date_modified": "2026-10-13T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "interface", "ai" ] }, { "id": "https://manual.ingext.io/splash/2026-09-16-announcements", "content_html": "

The Fluency platform now has a public status page. saasmgr.ingext.io/status shows the current operational status of the platform, so you can check it directly before opening a support request.

\n

When to check it​

\n\n

If the status page shows no problem and only one source has gone quiet, the delay may be on the vendor's side: Microsoft, for example, occasionally holds back its Office 365 audit feed for hours. See No Data Arriving.

\n
Splash Summary

The Fluency platform now has a public status page. saasmgr.ingext.io/status shows the current operational status of the platform, so you can check it directly before opening a support request.

", "url": "https://manual.ingext.io/splash/2026-09-16-announcements", "title": "Platform Status Page", "summary": "The Fluency platform now has a public status page. saasmgr.ingext.io/status shows the current operational status of the platform, so you can check it directly before opening a support request.", "date_modified": "2026-09-16T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "platform" ] }, { "id": "https://manual.ingext.io/splash/2026-08-21-announcements", "content_html": "

Free trials now run on the new Fluency platform, and they are fully self-service. Sign up at trial.ingext.io/signup, confirm your email, and your trial instance launches on its own, ready for your first data sources.

\n

How it works​

\n
    \n
  1. Fill out the form at trial.ingext.io/signup. The older address, trial.fluencyplatform.com, leads to the same signup.
    2. \n
  2. Open the verification link in the email you receive.
    3. \n
  3. Your instance launches automatically. Connect a source and follow the Quickstart.
    4. \n
\n

Trial terms​

\n\n
Splash Summary

Free trials now run on the new Fluency platform, and they are fully self-service. Sign up at trial.ingext.io/signup, confirm your email, and your trial instance launches on its own, ready for your first data sources.

", "url": "https://manual.ingext.io/splash/2026-08-21-announcements", "title": "Self-Service Trials on the New Platform", "summary": "Free trials now run on the new Fluency platform, and they are fully self-service. Sign up at trial.ingext.io/signup, confirm your email, and your trial instance launches on its own, ready for your first data sources.", "date_modified": "2026-08-21T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "trial" ] }, { "id": "https://manual.ingext.io/splash/2026-06-28-announcements", "content_html": "

Fluency instances are moving to the new Fluency SaaS platform. Each instance is migrated application by application, most data sources move over without any change on your side, and your current instance stays available while you try the new one.

\n

Why move​

\n

The new platform is the base for everything released this year: real-time search, the data lake with KQL, the new applications, MCP and AI clients, and processing that scales with your data volume. See the release notes from v1.6.6 on.

\n

How the move works​

\n\n

What changes for you​

\n\n

Next steps​

\n

Your Fluency representative will contact you to schedule your instance's move. Questions about timing can go to them or to Fluency support.

\n
Splash Summary

Fluency instances are moving to the new Fluency SaaS platform. Each instance is migrated application by application, most data sources move over without any change on your side, and your current instance stays available while you try the new one.

", "url": "https://manual.ingext.io/splash/2026-06-28-announcements", "title": "Moving to the New Fluency Platform", "summary": "Fluency instances are moving to the new Fluency SaaS platform. Each instance is migrated application by application, most data sources move over without any change on your side, and your current instance stays available while you try the new one.", "date_modified": "2026-06-28T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "platform" ] }, { "id": "https://manual.ingext.io/splash/2026-06-09-announcements", "content_html": "

Fluency is introducing the Fluency Logic Layer™, an architecture built for AI-assisted operations. It turns security expertise (investigation procedures, behavioral analytics, reporting methods and operational workflows) into governed capabilities that AI assistants such as Claude, Codex and ChatGPT, as well as analysts, MSSPs and automation, can call directly.

\n

The Logic Layer is available now as part of the Fluency platform.

\n

Why headless​

\n

A SIEM has always exposed its data through dashboards, searches and reports, and relied on trained analysts to turn that data into answers. AI assistants change how people work with software: more and more, security staff ask an assistant a question instead of navigating an interface. But an assistant needs more than access to data. It needs the expertise and procedures that govern how the work should be done.

\n

The Logic Layer separates that expertise from the user interface and builds it into the platform. Instead of knowing where data lives and which queries to run, you ask for an outcome:

\n\n

Governed, not open-ended​

\n

The AI decides which capability to call. The Logic Layer governs how data is accessed, how the analysis is performed, and how the result is delivered, so answers stay consistent, auditable and within each user's permissions.

\n

Built on your expertise as well as ours​

\n

The Logic Layer carries Fluency's own security-operations methods, and MSSPs and enterprises can add theirs: service methodologies, investigation procedures, reporting standards and customer-specific practices become reusable capabilities available to their analysts, customers and AI clients.

\n

Getting connected​

\n\n
Splash Summary

Fluency is introducing the Fluency Logic Layer™, an architecture built for AI-assisted operations. It turns security expertise (investigation procedures, behavioral analytics, reporting methods and operational workflows) into governed capabilities that AI assistants such as Claude, Codex and ChatGPT, as well as analysts, MSSPs and automation, can call directly.

The Logic Layer is available now as part of the Fluency platform.

", "url": "https://manual.ingext.io/splash/2026-06-09-announcements", "title": "The Fluency Logic Layer: A Headless SIEM", "summary": "Fluency is introducing the Fluency Logic Layer™, an architecture built for AI-assisted operations. It turns security expertise (investigation procedures, behavioral analytics, reporting methods and operational workflows) into governed capabilities that AI assistants such as Claude, Codex and ChatGPT, as well as analysts, MSSPs and automation, can call directly.", "date_modified": "2026-06-09T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "ai" ] }, { "id": "https://manual.ingext.io/splash/2026-05-16-announcements", "content_html": "

The FPLv2 engine now follows JavaScript strict-mode rules. An assignment to a variable that was never declared, such as a = 1, now fails validation. Processors from the Fluency repository are already updated. Processors written or edited on your own instance should be checked.

\n

What to check​

\n

Open each processor you created or edited yourself on the Processors page and choose Validate. If validation fails on an undeclared variable, declare it where it is first assigned:

\n
let a = 1
\n

What else changed​

\n

Boolean expressions now short-circuit: if a && a.b { ... } returns false when a is null or undefined, where the old engine raised an error. Guards like this, common in JavaScript, now work as written.

\n

Details are in the FPL Engine Update: Strict Mode release notes.

\n
Splash Summary

The FPLv2 engine now follows JavaScript strict-mode rules. An assignment to a variable that was never declared, such as a = 1, now fails validation. Processors from the Fluency repository are already updated. Processors written or edited on your own instance should be checked.

", "url": "https://manual.ingext.io/splash/2026-05-16-announcements", "title": "FPL Strict Mode: Check Your Custom Processors", "summary": "The FPLv2 engine now follows JavaScript strict-mode rules. An assignment to a variable that was never declared, such as a = 1, now fails validation. Processors from the Fluency repository are already updated. Processors written or edited on your own instance should be checked.", "date_modified": "2026-05-16T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "fpl" ] }, { "id": "https://manual.ingext.io/splash/2026-02-02-announcements", "content_html": "

Ingext Community Edition, free on AWS Marketplace since 2024, now also installs into your own Kubernetes cluster on AWS, Microsoft Azure or Google Cloud, from Helm charts. It collects, labels, enriches, transforms and routes telemetry before it reaches a SIEM, and stores it in a searchable data lake in your own cloud account.

\n

What's new​

\n\n

The AWS Marketplace edition remains available; see Ingext Community Edition on AWS Marketplace.

\n

What it does​

\n\n

Sources and sinks​

\n

Out of the box, Community Edition reads AWS CloudTrail, AWS CloudWatch log groups, Amazon EKS logs, Azure Event Hubs, Office 365 and Google Workspace audit events, and HEC input, with sources and sinks on Amazon Kinesis, Amazon S3, Azure Blob Storage and Google Cloud Storage.

\n

Small to start​

\n\n

Getting started​

\n
    \n
  1. Clone the ingext-helm-charts repository.
    2. \n
  2. From the repository's root folder, start the cloud shell with ./ingext-shell.sh.
    3. \n
  3. In the shell, change to the lakehouse folder for your cloud, then run the preflight check and the installer.
    4. \n
  4. Follow the repository's configuration guide to connect your first sources.
    5. \n
\n

The latest changes are in the Ingext Community Edition v1.1.0 release notes.

\n
Splash Summary

Ingext Community Edition, free on AWS Marketplace since 2024, now also installs into your own Kubernetes cluster on AWS, Microsoft Azure or Google Cloud, from Helm charts. It collects, labels, enriches, transforms and routes telemetry before it reaches a SIEM, and stores it in a searchable data lake in your own cloud account.

", "url": "https://manual.ingext.io/splash/2026-02-02-announcements", "title": "Ingext Community Edition Now Runs on Kubernetes, in Any Cloud", "summary": "Ingext Community Edition, free on AWS Marketplace since 2024, now also installs into your own Kubernetes cluster on AWS, Microsoft Azure or Google Cloud, from Helm charts. It collects, labels, enriches, transforms and routes telemetry before it reaches a SIEM, and stores it in a searchable data lake in your own cloud account.", "date_modified": "2026-02-02T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "ingext" ] }, { "id": "https://manual.ingext.io/splash/2025-11-14-announcements", "content_html": "

On November 13, 2025, Microsoft briefly changed the user ID in the Office 365 audit feed to all lowercase. For users whose usernames contain capital letters, Fluency saw the lowercase name as a new user, so O365_AzureAD_UserLoggedIn and other rules that key on the field raised false positives.

\n

No action is needed. Alerts raised during that window for this reason can be closed as false positives.

\n

What happened​

\n

The Office 365 Management Activity API, which feeds the Office 365 audit integration, carries the user's UPN in UserId, stored in Fluency as @fields.UserId. For a period on November 13, Microsoft sent that field in lowercase. Fluency builds each user's behavior baseline on this value, so Jane.Doe@example.com and jane.doe@example.com were treated as two different users, and the lowercase one was flagged as first seen.

\n

How to recognise it​

\n\n

Update: January 15, 2026​

\n

Microsoft made the same change again on January 15, 2026, and normalized UserId to lowercase. Besides first-seen user alerts, the change set off impossible-travel alerts in some tenants. The guidance is the same: alerts that match the pattern above can be closed as false positives.

\n
Splash Summary

On November 13, 2025, Microsoft briefly changed the user ID in the Office 365 audit feed to all lowercase. For users whose usernames contain capital letters, Fluency saw the lowercase name as a new user, so O365_AzureAD_UserLoggedIn and other rules that key on the field raised false positives.

No action is needed. Alerts raised during that window for this reason can be closed as false positives.

", "url": "https://manual.ingext.io/splash/2025-11-14-announcements", "title": "Advisory: Microsoft 365 User ID Case Change", "summary": "On November 13, 2025, Microsoft briefly changed the user ID in the Office 365 audit feed to all lowercase. For users whose usernames contain capital letters, Fluency saw the lowercase name as a new user, so O365AzureADUserLoggedIn and other rules that key on the field raised false positives.", "date_modified": "2025-11-14T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "advisory", "microsoft" ] }, { "id": "https://manual.ingext.io/splash/2025-07-10-announcements", "content_html": "

AI Assist reviews each behavior alert before an analyst has to. It gathers the evidence around the alert, decides whether it needs action, explains its reasoning, and closes the alerts that do not, so analysts spend their time on the ones that do.

\n

After a beta with early customers, AI Assist is rolling out to all instances in stages.

\n

How it works​

\n\n

What you need​

\n

AI Assist works on the data your instance already collects. Instances with the Office 365 Resource Watch application installed give it user records (roles, account creation dates) that make its decisions on Microsoft 365 alerts more precise.

\n

See Investigation Workflows.

\n
Splash Summary

AI Assist reviews each behavior alert before an analyst has to. It gathers the evidence around the alert, decides whether it needs action, explains its reasoning, and closes the alerts that do not, so analysts spend their time on the ones that do.

After a beta with early customers, AI Assist is rolling out to all instances in stages.

", "url": "https://manual.ingext.io/splash/2025-07-10-announcements", "title": "AI Assist: AI Triage on Every Alert", "summary": "AI Assist reviews each behavior alert before an analyst has to. It gathers the evidence around the alert, decides whether it needs action, explains its reasoning, and closes the alerts that do not, so analysts spend their time on the ones that do.", "date_modified": "2025-07-10T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "ai" ] }, { "id": "https://manual.ingext.io/splash/2025-06-03-announcements", "content_html": "

A redesigned Fluency interface is rolling out, site by site. Each site moves to a new address in its own region, and your existing login carries over. Partners can show their own logo and background.

\n

What to expect​

\n\n

Timing​

\n

Sites move in stages over the coming months. The current interface keeps working until your site has moved. If you would like your site moved sooner, contact your Fluency representative.

\n

See Navigation for a tour of the interface.

\n
Splash Summary

A redesigned Fluency interface is rolling out, site by site. Each site moves to a new address in its own region, and your existing login carries over. Partners can show their own logo and background.

", "url": "https://manual.ingext.io/splash/2025-06-03-announcements", "title": "A New Fluency Interface", "summary": "A redesigned Fluency interface is rolling out, site by site. Each site moves to a new address in its own region, and your existing login carries over. Partners can show their own logo and background.", "date_modified": "2025-06-03T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "interface" ] }, { "id": "https://manual.ingext.io/splash/2025-05-15-announcements", "content_html": "

The Fluency Programming Language (FPL) now accepts JavaScript (ES6). Parsers and reports written in JavaScript, including the code AI assistants generate, run in Fluency without being translated by hand.

\n

The update rolls out to all instances the weekend of May 17–18, 2025. Existing FPL code runs unchanged.

\n

Why it matters​

\n

Writing a parser used to mean learning FPL's own syntax. AI assistants already write good JavaScript: given a sample log line and the fields you want, they produce a working parser in minutes. With ES6 support, that code can be pasted into a processor, validated and deployed as it is.

\n

What is supported​

\n\n

A few features are not available yet, such as the regular-expression global flag (/g). The full list, with the limitations, is in the FPL JavaScript (ES6) Support release notes. See also the FPL reference.

\n
Splash Summary

The Fluency Programming Language (FPL) now accepts JavaScript (ES6). Parsers and reports written in JavaScript, including the code AI assistants generate, run in Fluency without being translated by hand.

The update rolls out to all instances the weekend of May 17–18, 2025. Existing FPL code runs unchanged.

", "url": "https://manual.ingext.io/splash/2025-05-15-announcements", "title": "FPL Now Runs JavaScript", "summary": "The Fluency Programming Language (FPL) now accepts JavaScript (ES6). Parsers and reports written in JavaScript, including the code AI assistants generate, run in Fluency without being translated by hand.", "date_modified": "2025-05-15T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "fpl" ] }, { "id": "https://manual.ingext.io/splash/2025-04-02-announcements", "content_html": "

Fluency is launching Replay, a scenario-based training and testing platform. Replay plays real, sanitized security telemetry into a Fluency instance, so analysts, and AI, can work a realistic incident from first alert to response in a controlled, repeatable environment.

\n

How it works​

\n\n

What it is for​

\n\n

See Replay to get started.

\n
Splash Summary

Fluency is launching Replay, a scenario-based training and testing platform. Replay plays real, sanitized security telemetry into a Fluency instance, so analysts, and AI, can work a realistic incident from first alert to response in a controlled, repeatable environment.

", "url": "https://manual.ingext.io/splash/2025-04-02-announcements", "title": "Introducing Replay", "summary": "Fluency is launching Replay, a scenario-based training and testing platform. Replay plays real, sanitized security telemetry into a Fluency instance, so analysts, and AI, can work a realistic incident from first alert to response in a controlled, repeatable environment.", "date_modified": "2025-04-02T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "replay" ] }, { "id": "https://manual.ingext.io/splash/2025-03-18-announcements", "content_html": "

Anyone can now start a Fluency trial on their own. Sign up at trial.fluencyplatform.com/trial to get your own Fluency instance, connect your data sources, and see your first behavior alerts.

\n

How it works​

\n
    \n
  1. Sign up at trial.fluencyplatform.com/trial.
    2. \n
  2. Complete your profile, and your trial instance is created.
    3. \n
  3. Connect your first data sources.
    4. \n
\n

The Quickstart walks through the first steps.

\n

For MSSP partners​

\n

Partners can offer trials to their own customers through a signup page of their own. Contact your Fluency representative to set one up.

\n
Splash Summary

Anyone can now start a Fluency trial on their own. Sign up at trial.fluencyplatform.com/trial to get your own Fluency instance, connect your data sources, and see your first behavior alerts.

", "url": "https://manual.ingext.io/splash/2025-03-18-announcements", "title": "Start a Free Fluency Trial", "summary": "Anyone can now start a Fluency trial on their own. Sign up at trial.fluencyplatform.com/trial to get your own Fluency instance, connect your data sources, and see your first behavior alerts.", "date_modified": "2025-03-18T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "trial" ] }, { "id": "https://manual.ingext.io/splash/2025-01-15-announcements", "content_html": "

Fluency is introducing Applications: a new way to add data sources. Instead of assembling an integration, a router, pipes and processors by hand, you pick an application template and Fluency installs every component the source needs.

\n

Applications roll out to all instances the weekend of January 18–19, 2025. Existing integrations keep working as they are.

\n

What changes​

\n\n

Available at launch​

\n

Templates for 26 sources, including Office 365, Google Workspace, Okta, Duo, Salesforce, AWS CloudTrail, AWS Security Lake, Azure Event Hubs, SentinelOne, CrowdStrike Falcon, Microsoft Defender ATP, Mimecast, Proofpoint, Fortinet FortiGate and Palo Alto Networks, plus the Fluency Collector and Cloud Syslog.

\n

The full list is in the Fluency Applications release notes, and the page itself is described in Applications.

\n
Splash Summary

Fluency is introducing Applications: a new way to add data sources. Instead of assembling an integration, a router, pipes and processors by hand, you pick an application template and Fluency installs every component the source needs.

Applications roll out to all instances the weekend of January 18–19, 2025. Existing integrations keep working as they are.

", "url": "https://manual.ingext.io/splash/2025-01-15-announcements", "title": "Introducing Fluency Applications", "summary": "Fluency is introducing Applications: a new way to add data sources. Instead of assembling an integration, a router, pipes and processors by hand, you pick an application template and Fluency installs every component the source needs.", "date_modified": "2025-01-15T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "applications" ] }, { "id": "https://manual.ingext.io/splash/2024-10-31-announcements", "content_html": "

If your Google Workspace integration shows administrator events but no user activity (no sign-ins, no Drive or Gmail events), the cause is an access setting in your Google Admin console, not in Fluency. Google sends only administrator events to a third-party app whose access is left at Limited.

\n

Why it happens​

\n

Approving the Fluency app's OAuth request is not, on its own, enough for Google to release user activity. Google Workspace also applies the app-access setting the administrator chooses for the app, and while that setting is Limited, the Reports API returns administrator events only. Google enforces this whether or not anything changed on the Fluency side.

\n

What to do​

\n
    \n
  1. In the Google Admin console, go to Security → Access and data control → API controls → Manage Third-Party App Access.
    2. \n
  2. Find the Fluency app.
    3. \n
  3. Change its access from Limited to Trusted, so it receives the two scopes it requested:\n\n
    4. \n
\n

User activity, including successful and failed sign-ins, then flows on the next poll. See Google Workspace.

\n
Splash Summary

If your Google Workspace integration shows administrator events but no user activity (no sign-ins, no Drive or Gmail events), the cause is an access setting in your Google Admin console, not in Fluency. Google sends only administrator events to a third-party app whose access is left at Limited.

", "url": "https://manual.ingext.io/splash/2024-10-31-announcements", "title": "Advisory: Google Workspace User Activity", "summary": "If your Google Workspace integration shows administrator events but no user activity (no sign-ins, no Drive or Gmail events), the cause is an access setting in your Google Admin console, not in Fluency. Google sends only administrator events to a third-party app whose access is left at Limited.", "date_modified": "2024-10-31T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "advisory", "google" ] }, { "id": "https://manual.ingext.io/splash/2024-09-04-announcements", "content_html": "

Ingext Community Edition is now available free on AWS Marketplace. It runs Ingext in your own AWS account, so you can collect, transform and route your data without it leaving your control. Deployment takes about five minutes.

\n

Deploy in three steps​

\n
    \n
  1. Subscribe to Ingext Community Edition on AWS Marketplace.
    2. \n
  2. Run the CloudFormation stack, which creates the instance and the S3 bucket access Ingext needs.
    3. \n
  3. Sign in to the Ingext interface.
    4. \n
\n

What it includes​

\n\n

Community and Enterprise​

\n
CommunityEnterprise
DeploymentSingle nodeNo limit
Parsing, filtering and transformingYesYes
Aggregation (logs to metrics)YesYes
Persistent queuingYesYes
High availabilityNoYes
AutoscalingNoYes
SupportCommunity24×7
\n
Splash Summary

Ingext Community Edition is now available free on AWS Marketplace. It runs Ingext in your own AWS account, so you can collect, transform and route your data without it leaving your control. Deployment takes about five minutes.

", "url": "https://manual.ingext.io/splash/2024-09-04-announcements", "title": "Ingext Community Edition on AWS Marketplace", "summary": "Ingext Community Edition is now available free on AWS Marketplace. It runs Ingext in your own AWS account, so you can collect, transform and route your data without it leaving your control. Deployment takes about five minutes.", "date_modified": "2024-09-04T00:00:00.000Z", "author": { "name": "Support", "url": "https://github.com/SecurityDo" }, "tags": [ "ingext", "aws" ] } ] }