The v2 interface is available on every instance, and every escalated case now carries an AI investigation report. Detections gain parser rules, and Entra ID audit and sign-in logs, including non-interactive sign-ins, can be collected through Azure Event Hubs.
A milestone release. EventWatch now runs under the job manager, which extends exactly-once processing through rule evaluation and lets the processing pipeline scale past 1 TB per day. The release also adds KQL search history, a send_email MCP tool, and SentinelOne, CrowdStrike Falcon, LDAP, Duo and Abnormal Security applications.
The Microsoft 365 applications can be set up with an app registration you create yourself, instead of through admin consent. Workday, Abnormal Security, Azure Event Hubs and Qualys move to the new platform, and resource polling for Office 365 and SentinelOne runs as a separate job.
KQL gets simpler column names and four new table schemas: Office 365, Windows audit events, Google Workspace and AWS CloudTrail.
A minor release for AI clients and reports: MCP tools work for read-only roles, a new kql_search MCP tool queries the data lake, and reports can run for up to an hour.
The next-generation Fluency SaaS platform is in full production, with deployments in the United States and Africa. This release adds a real-time search service, syslog import, and usage and runtime metrics, and raises data-lake throughput to more than 2 TB per day for each index.