Skip to main content

October 2026 Platform Update

Sysadmin
Sysadmin
Fluency Sysadmin

The v2 interface is available on every instance, and every escalated case now carries an AI investigation report. Detections gain parser rules, and Entra ID audit and sign-in logs, including non-interactive sign-ins, can be collected through Azure Event Hubs.

Changes​

v2 interface​

  • The v2 interface is available to all tenants. Add /v2 after your instance's address — for example https://<companyname>.app.ingext.io/v2. The current interface stays at the same address.

AI investigation reports​

Parser rules​

Fluency now supports parser rules alongside EventWatch rules. A parser rule looks like an EventWatch rule without the event selector: instead of selecting events from the whole stream, it receives the events a parser hands to it on a named channel.

  • A parser passes an event to every parser rule on a channel with Platform_Channel, for example Platform_Channel("Office365Exchange", {obj}).
  • The fpl_rule processor on that channel does the matching and captures the attributes, and a match goes straight to the correlation service, bypassing EventWatch.
  • Rules can be added to a channel without changing the parser that transforms the events.

See Detections.

Entra ID audit through Azure Event Hubs​

  • A new opt-in application, Azure Directory Audit (Event Hub), collects Entra ID audit and sign-in logs through an Azure Event Hub. It includes the non-interactive and service principal sign-ins that the Graph-based feed does not collect.
  • Expect several times the volume of the current feed. Microsoft charges for the Event Hubs namespace.

See Entra ID Audit via Event Hubs.