Skip to main content

Asset Manager (v8.240713)

Sysadmin
Sysadmin
Fluency Sysadmin

This release introduces the Asset Manager, which builds one asset table from the data sources a site already polls. It also adds Sophos, Tenable, Qualys and Microsoft Defender ATP platform plugins, configurable headers on the webhook sink, and several FPL fixes. It rolled out to all instances on July 13, 2024.

Changes​

Asset Manager​

  • One asset table from many sources. Assets come from the resource APIs the site already polls — Active Directory, Entra ID, EDR agents and vulnerability scanners — plus assets that FPL parsers discover in the event stream and assets added by hand.
  • Providers on every asset. Each asset lists the providers that contributed to it, so you can see which sources know about a host.
  • Merging. When providers disagree on a single-value field, the higher-priority provider wins: manual entries first, then Active Directory, then Entra ID, then EDR. List fields are merged.
  • New APIs: Platform_Asset_Lookup, Platform_Asset_Register and Platform_Asset_Refresh, plus Platform_Cache_Delete and Platform_Cache_Replace for the platform cache.

See Assets.

Platform plugins​

  • Sophos
  • Tenable
  • Qualys
  • Microsoft Defender ATP

Platform​

  • HTTP headers can be configured on the webhook sink.

Fluency Collector​

  • Collector queues on the server side: each collector gets a named event queue.

FPL​

  • sort takes an optional compare function.
  • Empty declarations, such as let a, b.
  • Fixed evaluation of the NOT operator, as in if !a.
  • Fixed a bug in argmax.

Fixes​

  • Fixed updates to the object-path lambda on the S3 sink.
  • An event that leaves a pipe with no sink configured is now marked as dropped.