Skip to main content
Link
Search
Menu
Expand
Document
(external link)
Welcome
Getting Started
Fluency Web Portal
Login
User Information / Preference
Changing your password
Navigation
Getting Data into Fluency
Proof of Concept
Onboarding
Access Setup
Notification Setup
Additional Data ingress
FAQ
Administration
Users and Roles
Managing Users
Roles
Audit
Collectors
Managing collectors
API Tokens
Managing API Access
Access Control
Resource API Structure
Data Sources
Featured Integrations
Amazon AWS
AWS CloudTrail
AWS CloudWatch
AWS CloudFormation
Fluency Configuration
SentinelOne EDR
Peplink SD-WAN
PagerDuty
Data Ingress
Syslog Import
Supported Event Sources
Linux Syslog
Windows Active Directory
Windows Sysmon
Cloud Import (Plugins)
Azure Event Hubs
Crowdstrike Falcon
Google Workspace
Mimecast
Office365 Audit API
SentinelOne Cloud Funnel
PagerDuty
Okta
Zoom Video
Cylance
Microsoft ATP
Bitdefender GravityZone
Template Page
LDAP (Requires collector)
Network Traffic Ingress
Processing Language (FPL) Guide
Concepts
stream
env
let
Data Selection - Events
search - time
search - sContent
search - sContains
search - sStartswith
search - sEndswith
search - sRange
search - sEntityInfo
search - sRegexp
search - sWildcard
search - sIsnull
where
Data Selection - Resources
resource - ADUser
resource - falconAgent
resource - sentinelOneAgent
resource - FEHxDevice
resource - awsIAMUser
resource - awsS3Bucket
resource - awsEc2Instance
resource - awsEbsVolume
resource - nessusPlugin
Data Extraction
f
let
Data Processing
aggregate
timechart
time-related functions
coalesce
condition
entitylookup
except
geoip
join
parseInt
sort
split
table
top
len
regexp
tolower and toupper
urlparse
export
use
listcount
Arguments
Guide
Examples
Basic Information
Total Bytes Used
New Users
Time Series
Top N
Geographic Distribution
Appendix
Appendix-Resource
Appendix-System Log
Behavior Analytics
Event Watch
Creating a Behavior Model
Policy Watch
Creating a Model
Behavior Models (Rules)
Reports
Data Review / Workflow
Investigating a Behavior Alert
Global Summary
Behavior Summary
Behavior Timeline
Search
Defining the Query
Lucene Queries
Facets
Flow Search
Event Search
Alerts / Notifications / Actions
Event Export
Actions
Slack Integration
PagerDuty Integration
Data Processing
Normalization
Parsers
Page Functionality
Overview
Risk Dashboard
Notifications
Risk Score
Summary
Charts
Sankey
Protocol Tree
Histogram
Status
TopN
Tracking
SetUp Review
User Tables
Saved Searches
Behavior Filters
Policy Filters
Event Processors
Entity Info Lists
Reputation Feed
Resource Sync
Global
Time Range
Flow Search
Event Search
Report Edit
Report
Analytics
Event Watch
Creating an Aggregation Bucket
Creating a Behavior Model
Creating a Policy Model
Behavior Timeline
Behavior Summary
Policy Summary
Actions
Recent vs. Summary
Recent
Alerts
Address
Host Name
Summary
Alerts
Address
Host Name
Configuration
Collectors
Event Streams
Cloud Import
Event Export
Devices
Configuration
Cloud Service
Virus Total
API
AWS
Report
Slack
Syslog Export
Resource
User Admin
API Policies
Audit
Data Policies
Roles
User Activity
Users
API Tokens
Database
Data Schema
DB Segment
DB Shard
DB Status
DB Task
Search Task
DB Notification
Appendix
API Guide
Event Search
Behavior Summary Search
Requirement Standards
Mapping of FISMA Audit to Fluency
Mapping of PCI DSS to Fluency
Duo 2FA
Alerts / Notifications / Actions
Actions
Actions
Table of contents
Table of contents
Slack Integration
PagerDuty Integration