Fluency Console 0.2.5

Fluency Console 0.2.5 adds eleven dashboards across Microsoft 365 and Entra ID, AWS, Google Workspace, Acronis, CrowdStrike, SentinelOne, Microsoft Defender, FortiGate and Windows Server, plus a Compliance Evidence Report organized around NIST SP 800-53 control groups. Case review is faster. Application setup gains a dry run, an NXLog wizard and Bitdefender GravityZone setup. Administrators can reset local users' passwords. The release includes every change since version 0.1.7.

Fluency Console is the v2 interface: add /v2 after your instance's address, for example https://<companyname>.app.ingext.io/v2.

New reports and dashboards

The new reports are in the report library on Reports.

Report	What it shows
Microsoft 365 and Entra Activity Report	Audit activity, sign-ins, directory changes and failed sign-ins, with daily trends and breakdowns.
AWS CloudTrail Activity Report	Daily activity trends, breakdowns by operation, and highlights for investigation.
FortiGate Security Activity Report	Security activity, breakdowns by security control, and daily summaries.
Windows Server Activity Report	Audit activity, failed logons, account lockouts, log clearing, and which hosts report.
Microsoft 365 Resource Inventory	Users and MFA, devices, Conditional Access, app registrations and their client secrets, application permissions, enterprise apps, groups, and named user lists.
SentinelOne Resource Report	Endpoint health, agent versions, applications and threats.
CrowdStrike Falcon Resource Report	Host check-in health, sensor versions, protection gaps, policies and detections.
Microsoft Defender Resource Report	Onboarding, device and antivirus health, vulnerabilities and exploitable CVEs, configuration, recommendations, alerts and incidents.
Google Workspace Resource Report	The directory inventory and audit activity, including administrative and suspicious events.
AWS GuardDuty Resource Report	Findings by severity and attention priority, affected resources, AWS accounts and regions, repeated findings and daily updates, with a separate list of current findings.
Acronis Protection Report	Agents, EDR cases, updates, backup outcomes, events and alerts.
Compliance Evidence Report	Observed evidence organized around NIST SP 800-53 control groups. It supports an evidence review; it does not certify or attest compliance.

What each account sees:

• Archive-backed dashboards open once the scheduled report behind them has archived days for the selected account. Until then, the card reads Available once the scheduled report <name> is archived for this account. A report's daily archive is turned on in Report Scheduler.
• Sources. A dashboard shows the products the account has connected and collects data from.
• Inventory reports show the state at collection time. A backfill does not rebuild past inventory, and days missing from the archive appear as gaps.

Reporting and archives

• Report style. Reports use a mostly monochrome style with restrained color accents, in light and dark themes, and download as HTML.
• Report library. Reports carry vendor tags and product icons, search reaches more of each report, and archive-backed dashboards show whether they are available for the account.
• Date ranges. An archive-backed dashboard opens on the previous UTC day. A backfill can cover up to 92 days.
• Archive history. Archived Reports shows each archive's searchable history, its daily coverage, the stored results and the run logs.
• Backfill. Backfill checks its dates, can rerun days that already completed (Rerun completed days), shows its progress, and can be refreshed.
• Archive settings. A report's daily archive is managed separately from its schedule.
• Deleting results. An archived result or a local FPL report can be deleted, after a confirmation; Delete Processor in the report editor removes a report.
• Running reports. A report is validated before it runs. Result tables and charts are clearer, and so are trace and error output.
• Older results. Past results stay readable after the report processor that produced them is removed.

Case review and investigations

• Closure titles. The workspace and manager home pages show an investigation's closure title where there is one, and the entity name otherwise.
• Cases Search. A result on Cases Search opens directly in Behavior Summary.
• Search on Overview Summary. Overview Summary, in both the workspace and manager consoles, has a Search field. It filters the summaries already loaded, without requesting them again.
• Decision and severity. A case shows the investigation's decision and severity together, such as Closed - Info. The severity the investigation supplied is kept even when the numeric risk score differs.
• Action-needed order. Cases that need action are sorted by severity, then by risk score. A case without AI analysis keeps its NEW indicator.
• Severity counts and filters. Severity counts, filtering and search are improved. Show all tickets (including score 0) includes cases below the overview's default score threshold of 3,000, down to a score of zero (see Notification Threshold).
• Case summaries and AI analysis. Required actions, closure titles, verdicts, profiles and asset details are easier to find.
• Ticket comments. Tickets take comments. A draft is kept when posting fails, and a comment cannot be submitted twice.
• Ticket JSON and AI reports. A ticket's full JSON can be viewed and copied, and its original AI report downloaded.
• Rule and suppression testing. Rules can be tested and imported again. A suppression can be tested from a ticket or a timeline event, filled in with the event's observed details (see Test Suppressions).

Application and integration setup

• Dry run. Dry run checks an application's configuration and credentials before it is installed. Failed checks must be acknowledged to install anyway; warnings and skipped checks stay visible. A dry run does not install prerequisites, and it is not available when admin consent mode is on.
• Uninstall. Uninstall on the application details page asks for confirmation, then shows its progress and any error.
• NXLog wizard. A Windows Server w/ NXLog application has a Configure NXLog wizard that builds nxlog.conf in the browser: the endpoint and TLS settings, the Windows event logs, Sysmon, and optionally the events already in the logs. The advanced step no longer offers the DHCP and DNS log options or options that had no effect, and the steps are reordered and spaced more clearly. See Windows Active Directory for what to enter.
• Bitdefender GravityZone. Event Push setup, a review of the current Event Push settings, output validation and a test event. See Bitdefender GravityZone.
• Cloud storage integrations. Azure Blob Storage and Google Cloud Storage integrations can be created in Fluency, from Integrations. The existing restrictions on DataLake integrations are unchanged.
• S3 prefix test. An S3 prefix can be tested, listing the objects it finds, and retested after the prefix is edited.
• Feedback. Integration updates, Cloudflare Log Push challenges and application status messages are clearer.

Resources and platform

• Acronis. Agent and tenant views on Resources, which now groups its views by vendor, with the standard filters, columns and details.
• Horizon3. Pentest, weakness and host views. Links saved under the Other vendor group still work.
• Values. UTC timestamps and durations are clearer, fields display as their declared type, and small numbers are no longer shown as dates.
• Resource filters. Filtering is improved, with a Customer filter group on every resource view.
• Pipes. On the Platform diagram, a pipe's processor can be replaced, data sinks attached to and detached from a pipe more freely, and a pipe created on a router that has none. A processor links to the full processor editor, and validation, confirmation and copy feedback are clearer.
• Health checks. A running application no longer raises a health-check alert only because one of its component records is missing.
• Data lakes. Add Virtual Table is available again on Data Lakes, and editing entity fields and search facets is improved.
• Skills. Configuration > Skills is a searchable catalog of the AI assistant's skills, grouped into reports and other skills. Each skill shows what it does and its version, links to its source, and can be downloaded to install in the assistant.

Administration and usability

• Password reset. Administrators can reset a local user's password, entered twice and validated. Users who sign in through OAuth keep using their identity provider.
• Users and access policies. Deleting a user or an access policy asks for confirmation, dialogs handle errors better, and editing keeps the selected roles, policies and permissions.
• Notification recipients. An invalid recipient stays editable, with the format error shown where it needs correcting.
• Text size. The text size on Profile offers Normal, Large and Extra large, is saved with the profile, and applies to platform diagrams too.
• Interface. Saved themes, navigation tooltips, keyboard access, field pickers and dialog layouts are improved.
• JSON-line preview. Each search page remembers its own JSON-line preview setting. The preview is hidden by default.
• One account per tab. A browser tab stays on its selected account when another tab switches accounts, and so do links to cases and notable events.
• Sign-in. After a session expires, signing in again returns to the page you were on, and a failed sign-in recovers more cleanly. Sign-in and navigation keep the /v2 path and the selected account.
• KQL history. Viewing or rerunning a query from KQL Search History uses its original time window, and a query cannot be submitted twice while it runs.
• Component timestamps. A component timestamp that was never set reads Never.