Supported Products Matrix
Every product this manual documents, and how its data gets into Fluency.
Ingress Methods
Each method is a transport described in full under Data Collection.
| Method | What it means | Transport |
|---|---|---|
| API | Fluency polls the vendor's API on a schedule using credentials you supply. | API Polling |
| HEC | The vendor pushes to Fluency's Splunk-compatible HTTP Event Collector. | HEC |
| Webhook | The install produces a URL; the vendor is configured to post to it, signing each delivery with a shared secret. | Webhooks |
| Syslog | The device sends syslog to a listener, either the cloud endpoint or a local collector. | Syslog |
| Cloud storage | The vendor writes objects to a bucket; Fluency consumes them via an SQS notification queue. | Cloud Storage |
| Event stream | A managed streaming service Fluency reads from. | Event Streams |
| LDAP via collector | A local collector queries the directory and sends the results to the platform. | LDAP |
| Connector | No application template — set up as an integration on Platform → Integrations, with the data source added by hand. | — |
Products With an Application Template
These install from Platform → Applications → Install Application From Template. The Install Application From Template reference lists the exact parameters each one asks for.
AWS Services
| Product | Template | Ingress | Guide |
|---|---|---|---|
| Amazon GuardDuty | Amazon GuardDuty | API | GuardDuty |
| AWS CloudTrail | AWS CloudTrail | Cloud storage | CloudTrail |
| Amazon CloudWatch | CloudWatch LogGroup | Cloud storage | Amazon CloudWatch |
| Amazon EKS | AWS EKS Logs | Cloud storage | EKS Logs |
Cloud-based Business Softwares
| Product | Template | Ingress | Guide |
|---|---|---|---|
| Abnormal Security | Abnormal Security | API | — |
| Bitwarden | Bitwarden | API | Bitwarden |
| Black Kite (third-party risk findings) | BlackKite Findings | API | Black Kite |
| Cloudflare (audit log, GraphQL analytics) | Cloudflare API | API | Cloudflare |
| GitHub (organization audit) | GitHub via Org Webhook | Webhook | GitHub Audit |
| Okta | Okta Events | API | Okta |
| Salesforce | Salesforce Event Monitoring | API | Salesforce Event Monitoring |
| Varonis (SaaS — DatAlert alerts, activity events) | Varonis | API | Varonis SaaS API |
| Workday (user activity log) | Workday Events | API | Workday |
Cloud Infrastructure (IaaS)
| Product | Template | Ingress | Guide |
|---|---|---|---|
| Azure Event Hubs | Azure Event Hubs | Event stream | Azure Event Hubs |
| box.com | box.com | API | box.com |
Email Audit and Protection
| Product | Template | Ingress | Guide |
|---|---|---|---|
| Mimecast Cloud Gateway (API 2.0) | Mimecast CG Events | API | Mimecast Cloud Gateway |
| Mimecast (API 1.0) | Mimecast Events (Legacy) | API | Mimecast (Legacy API 1.0) |
| Proofpoint Targeted Attack Protection | Proofpoint TAP | API | Proofpoint TAP |
| Proofpoint Essentials | Proofpoint Essentials | API | Proofpoint Essentials |
Endpoint Management
| Product | Template | Ingress | Guide |
|---|---|---|---|
| Bitdefender GravityZone (events) | Bitdefender EventPush | HEC | Bitdefender GravityZone |
| Bitdefender GravityZone (telemetry) | Bitdefender SecurityTelemetry HEC | HEC | Bitdefender GravityZone |
| Coro Cybersecurity | Coro via HEC | HEC | — |
| CrowdStrike Falcon (alerts, streaming events, host roster) | CrowdStrike Falcon | API | CrowdStrike Falcon |
| CrowdStrike Falcon host roster (legacy add-on) | FalconResource | API | CrowdStrike Falcon |
| (any HEC-capable source) | HEC Input Passthrough | HEC | HTTP Event Collector |
| Active Directory / LDAP | LDAP Connector | LDAP via collector | LDAP integration |
| ManageEngine | Manage Engine | Syslog | ManageEngine |
| Microsoft Defender XDR | Microsoft Defender | API | Microsoft Defender |
| Microsoft Defender XDR (fixed destination) | Microsoft Defender Legacy | API | Microsoft Defender |
| Palo Alto Cortex XDR | PaloAlto Cortex XDR | API | PaloAlto Cortex XDR |
| Qualys | Qualys | API | — |
| SentinelOne | SentinelOne API Integration | API | SentinelOne API |
| Sophos Central | Sophos EDR | API | Sophos EDR |
| Symantec Endpoint Protection Manager (on-prem) | Symantec EPM Syslog | Syslog | Symantec Endpoint Protection Manager |
| Trend Micro Vision One | TrendMicro VisionOne | API | TrendMicro VisionOne |
| Windows Server | Windows Server w/ NXLog | Syslog | Windows Server |
| Zscaler | Zsaler NSS | HEC | Zscaler NSS |
Office Software (SaaS) and IAM
| Product | Template | Ingress | Guide |
|---|---|---|---|
| Entra ID / Azure AD (admin consent, legacy) | Azure Directory Audit | API | Azure AD audit (Legacy) |
| Cisco Duo | Cisco Duo Admin API | API | Cisco Duo |
| Google Workspace (service account) | Google Workspace | API | Google Workspace (Service Account) |
| Google Workspace (OAuth) | Google Workspace (OAuth) | API | Google Workspace (OAuth) |
| Office 365 (admin consent) | Office365 | API | Office 365 Activity API |
| Office 365 + Entra audit (client secret) | Office365-Audit | API | Office 365 Audit |
| Office 365 resources (admin consent) | Office365 Resource Watch | API | Office 365 Resource Watch |
On-Premise IT
All syslog. The template supplies the parser.
| Product | Template | Guide |
|---|---|---|
| Check Point firewall | Check Point Firewall Syslog | Check Point firewall |
| Cisco ASA | Cisco ASA Syslog | Cisco ASA |
| Cisco Meraki | Cisco Meraki Syslog | Cisco Meraki |
| Fortinet FortiGate | FortiGate NGFW Syslog V2 | Fortinet FortiGate |
| Red Hat Enterprise Linux | Linux (RHEL) Syslog | Linux (RHEL) syslog |
| Palo Alto NGFW | PaloAlto Firewall Syslog | Palo Alto NGFW |
| Peplink routers | Peplink Router/Firewall Syslog | Peplink routers |
| SonicWall NGFW | SonicWall NGFW Syslog | SonicWall NGFW |
| Sophos firewall | Sophos Firewall Syslog | Sophos firewall |
| Sophos UTM | Sophos UTM Syslog | Sophos UTM |
| Ubiquiti UniFi Network | Ubiquiti UniFi Syslog (CEF) | Ubiquiti UniFi Network |
| VMware ESXi | VMWare ESXi Syslog | VMware ESXi |
System Components
Not third-party sources — the platform's own parts.
| Template | Purpose | Documented at |
|---|---|---|
| BehaviorSummary Notification Export | Mails behaviour summaries out | Notifications |
| Fluency Syslog Endpoint | The cloud syslog listener | Syslog Import |
| Fluency AI Assistant | The assistant's API integration | — |
| Fluency Collector | Registers an on-premises collector | Fluency Collector |
| Normalized Metaflow | Writes the platform's normalized metaflow to a lake index | — |
| Import collector | Imports an existing collector by name | Managing collectors |
| Ingext Collector import via S3 | Replays collector data from a bucket | Cloud Storage → Replaying an Archive |
| Fluency legacy archive import via S3 | Replays a legacy archive from a bucket | Cloud Storage → Replaying an Archive |
| Ingext Syslog import via S3 | Replays syslog from a bucket | Cloud Storage → Replaying an Archive |
Products Without an Application Template
These are connected some other way. Do not go looking for a tile in the catalog.
| Product | Ingress | Guide |
|---|---|---|
| 1Password | Connector (REST + API pull) | — |
| Acronis Cyber Protect Cloud | Connector (API client) | — |
| Avanan | HEC | Avanan |
| AWS Kinesis | Connector | — |
| AWS Kinesis Data Firehose | Cloud storage, via S3 | Amazon Data Firehose |
| AWS Security Lake | — | Security Lake |
| AWS VPC flow logs | Cloud storage or CloudWatch | — |
| AWS Route 53 resolver logs | Cloud storage or CloudWatch | — |
| Cato Networks | Connector (REST + API pull) | — |
| Cisco Umbrella | Cloud storage (Cisco-managed bucket) | Cisco Umbrella |
| Cylance | Connector | Cylance |
| Darktrace | Connector (REST + API pull) | — |
| Seraphic Browser Security | Connector (API polling) | Seraphic |
| SentinelOne Cloud Funnel | Cloud storage | SentinelOne API |
| Varonis DatAdvantage (on-premise) | Syslog, parser built by hand — the SaaS API has a template, see above | Varonis |
| Zoom | Connector (OAuth app + webhook) | Zoom |
Outbound integrations — Fluency sending to a service rather than collecting from it — are covered under Notification & Ticketing and are not listed here.
Parser Cookbooks
Most templates ship a working parser, so a cookbook is only needed for customisation or for a source with no template. The parser cookbooks currently cover: Bitdefender, Cisco Meraki, FortiGate firewall, Linux server, Palo Alto firewall, Peplink device, SentinelOne, SentinelOne Cloud Funnel, SonicWall, SonicWall VPN, Sophos UTM, Windows NXLog, Zimperium, plus a passthrough recipe and a time adjustment recipe.
Related
- Integrations — the catalog, grouped as the product groups it.
- Install Application From Template — every template's parameters.
- Data Collection — the transports behind the ingress methods.