Five more data sources can be queried with KQL as typed tables: Zscaler, Cisco Meraki, F5 BIG-IP LTM, Palo Alto Networks Cortex alerts and incidents, and Qualys, each released with sample queries. Windows audit events, whose schema shipped in v2.6.16, gain sample queries too.
The Microsoft 365 applications can be set up with an app registration you create yourself, instead of through admin consent. Workday, Abnormal Security, Azure Event Hubs and Qualys move to the new platform, and resource polling for Office 365 and SentinelOne runs as a separate job.
The first versioned release of Ingext Skills adds two skills that turn natural-language questions into validated, ready-to-run queries, with no query language required: ingext-kql for events in the data lake, and ingext-promql for platform health. Ten skills ship in this release, and all of them are open source.
KQL gets simpler column names and four new table schemas: Office 365, Windows audit events, Google Workspace and AWS CloudTrail.
A minor release for AI clients and reports: MCP tools work for read-only roles, a new kql_search MCP tool queries the data lake, and reports can run for up to an hour.
The FPLv2 engine now follows JavaScript strict-mode grammar. Boolean expressions short-circuit, and assigning to a variable that was never declared fails validation. Processors in the Fluency repository are already updated; processors written or edited on your own instance may need a one-line fix. The release also splits egress statistics between EventWatch and the data lake.
The next-generation Fluency SaaS platform is in full production, with deployments in the United States and Africa. This release adds a real-time search service, syslog import, and usage and runtime metrics, and raises data-lake throughput to more than 2 TB per day for each index.
Ingext Community Edition v1.1.0, the free, self-hosted edition that runs in your own Kubernetes cluster, can now be configured entirely from the command line. It adds the ingext CLI, a data-lake management page that holds multiple data lakes, and application templates for six sources.
FPL now runs JavaScript (ES6). Parsers and reports written in JavaScript, including code generated by AI tools, run without modification, and existing FPL code runs unchanged. The release also adds notification endpoints and restricted API tokens in tenant mode, AlienVault OTX feed lookups, and a LavaLake data-lake sink (beta). It rolled out to all instances the weekend of May 17–18, 2025.
This release introduces Fluency Applications. A data source is now installed from an application template that sets up every component it needs, and each installed application gets its own processing pipeline and metrics. The release rolled out to all instances the weekend of January 18–19, 2025. Existing integrations and pipelines are unchanged.