Moving to Platform Integrations
Fluency is moving existing data sources from the legacy Cloud Integrations to Platform integrations, which support multi-tenant mode and the new parsers. The legacy plugins and parsers are being deprecated. Most sources move without any change on your side, but a few things look different afterwards.
What to expect
- A one-time burst of first-seen alerts. On some sites the legacy Office 365 integration had no parser between the import and EventWatch, so sign-ins arrived without location data. Once the source moves, sign-ins are parsed with their ISP and country, and Fluency may raise "first seen" alerts for locations it is seeing for the first time. This happens once, right after the move.
- Event fields change for some sources. Searches, facets, reports and custom rules that use the legacy field names need updating — see below.
Field changes
| Source | Legacy field | Platform field | What to change |
|---|---|---|---|
| Office 365 | @eventType:Office365 | @sender:office365 | The Platform Office 365 processor does not set @eventType. Select Office 365 events with @sender:office365 in searches and reports. |
| CrowdStrike Falcon | @falcon | falcon | Fluency's Falcon rules match both forms. Update any local copy of a Falcon rule, or a custom rule, that references @falcon. |
Rules on multi-tenant sites
The histogram aggregation in EventWatch rules is deprecated and does not work in multi-tenant mode. Rules that use it need a different correlation.
Updates
- September 23, 2024: added the Office 365
@senderchange above. - September 26, 2024: added the CrowdStrike Falcon change above. Fluency's Falcon rules now match both
@falconandfalcon, and reach every instance within the hour.
See CrowdStrike Falcon and Office 365 Activity API.
Splash Summary
Fluency is moving existing data sources from the legacy Cloud Integrations to Platform integrations, which support multi-tenant mode and the new parsers. The legacy plugins and parsers are being deprecated. Most sources move without any change on your side, but a few things look different afterwards.