Link Search Menu Expand Document

Additional Data ingress

Table of contents

Fluency has the means to integrate with a variety of vendor and devices. At this point, you will have a steady stream of data feeding into your Fluency instance.

Please refer to the Integration section of this document to see a full list of devices and services that Fluency can integrate with

Some examples:

Source What is Collected Reason
Security Device Logs The complete alert information from the security device. Provides key events for alerting and supporting information for analysis.
Network Logs Network flow information. Network activity provides insight into what communication could be involved in an issue but did not trigger an alert.
Application Flows Protocol exchange information above the network level. Provides the best understanding of what the communications intent is.
DNS Complete DNS exchange to include errors and recursive lookups. Today’s networks often multi-home services. Host name is needed to understand when end point responded.
Files Complete http file transfers. Allows for network antivirus review in case endpoint does not have AV or is out of date.
Active Directory Window events Provides additional data such as user and asset. PCI requires a number of AD events to be compliance.
Office365 Logs The complete Office365 record. Not all the fields of an Office365 log can be accessed via its web interface. Storing in Fluency allows grouping, searching and analyzing the data faster than what is possible in the Office365 interface.
DHCP Logs Asset requesting data. Allows for the tracking of an asset and user, even when IP addresses are changed due to DHCP.
SMTP Logs Header information and sending communication. Provides a means to track how a particular email entered the system.
Asset Logs Information from devices such as Infoblox, BlueCat and Forescout. Allows for the tracking of asset and comparison of use by device.
SSL Certificates SSL certificate used in communication. Provides insight into the application and use even when communication is encrypted.
SIEM Data Events and alerts. Provides the capability of included data already collected without changing infrastructure.

Fluency is designed to collect and correlate logs from system, datalink and application levels (data