Ingext Community Edition v1.1.0, the free, self-hosted edition that runs in your own Kubernetes cluster, can now be configured entirely from the command line. It adds the ingext CLI, a data-lake management page that holds multiple data lakes, and application templates for six sources.
FPL now runs JavaScript (ES6). Parsers and reports written in JavaScript, including code generated by AI tools, run without modification, and existing FPL code runs unchanged. The release also adds notification endpoints and restricted API tokens in tenant mode, AlienVault OTX feed lookups, and a LavaLake data-lake sink (beta). It rolled out to all instances the weekend of May 17–18, 2025.
This release introduces Fluency Applications. A data source is now installed from an application template that sets up every component it needs, and each installed application gets its own processing pipeline and metrics. The release rolled out to all instances the weekend of January 18–19, 2025. Existing integrations and pipelines are unchanged.
A minor release that adds egress metrics to the EventWatch and LavaDB sinks, lets scheduled jobs run exports and send them by email, and introduces a platform job API, which now runs FPLv1 investigations. It also stops a behavior event with a future timestamp from halting behavior summaries.
A minor release that gives FPL full control over REST API calls — method, path, headers, parameters and form encoding — with secrets kept as variables on the integration. It also fixes the Webhook data source and adds a security token to it. The release rolled out to all instances the week of November 18, 2024.
This release adds Prometheus as an integration, a data source and a data sink, and FPL functions to push metrics. With them, every Fluency site can collect metrics and push them in real time to its service provider's manager site.
FPL gains a generic REST API call, Grok parsing and an entity-info row lookup, and FPL reports move into the platform as a new fpl_report processor type with cron jobs. HEC and webhook sinks can skip TLS verification for endpoints with self-signed certificates. The release rolled out to all instances the week of August 12, 2024.
This release introduces the Asset Manager, which builds one asset table from the data sources a site already polls. It also adds Sophos, Tenable, Qualys and Microsoft Defender ATP platform plugins, configurable headers on the webhook sink, and several FPL fixes. It rolled out to all instances on July 13, 2024.
Multi-tenant sites gain a provider role, so an MSSP's own staff can work across their tenants — collectors, syslog ports, platform configuration and behavior data — without site-admin rights.
AWS integrations can now authenticate with an assumed role, managed on a new AssumeRole page, and come with CloudFormation templates and IAM policies. Multi-tenant sites gain an Invitations page, and the Fluency Collector can write its HEC and RabbitMQ data to S3.