Skip to main content
Link
Menu
Expand
(external link)
Document
Search
Copy
Copied
Welcome
Getting Started
Fluency Web Portal
Login
User Profile
Navigation
Getting Data into Fluency
Proof of Concept
Onboarding
Access Setup
Notification Setup
Additional Data ingress
FAQ
Administration
Users and Roles
Managing Users
Roles
Audit
Collectors
Collector Login
Collector VM install
API Tokens
Managing API Access
Access Control
Resource API Structure
Data Sources
Featured Integrations
Amazon Web Services (AWS)
Monitoring
ResouceWatch
CloudTrail/CloudWatch Logs
(Legacy) AWS CloudTrail
(Legacy) AWS CloudWatch Logs
PagerDuty
API Integration
Webhook
Demo Incident
Peplink SD-WAN
SentinelOne EDR
Integration Matrix
Data Ingress
Syslog Import
Linux Syslog
Windows Active Directory
Windows Sysmon
Cloud Import (Plugins)
Azure Event Hubs
Crowdstrike Falcon
Google Workspace
Mimecast
Office365 Audit API
Microsoft Defender
DUO Security (2FA)
SentinelOne Cloud Funnel
Okta
Zoom Video
Cylance
Splunk HEC
Bitdefender GravityZone
LDAP (Requires collector)
Network Traffic Ingress
Fluency Processing Language
Data Search - Events / Metaflow
Time Selection
Search Query
Query Functions
sContent
sContains
sStartswith
sEndswith
sRange
sEntityInfo
sRegexp
sWildcard
sIsnull
Data Load - Resources
ADUser
falconAgent
sentinelOneAgent
FEHxDevice
awsIAMUser
awsS3Bucket
awsEc2Instance
awsEbsVolume
nessusPlugin
Data Extraction
let
f
where
except
condition
listfind
coalesce
Data Processing
aggregate
timechart
Table Functions
table
export
use
join
append
except
Lookup Functions
entitylookup
geoip
Utility Functions
time-related functions
sort
top
parseInt
toupper
tolower
toString
split
urlparse
regexp
len
listcount
Runtime Arguments
Guide
Examples
Basic Information
Total Bytes Used
New Users
Time Series
Top N
Geographic Distribution
Appendix (FPL)
Appendix-Resource
Appendix-System Log
Behavior Analytics
Event Watch
Creating a Behavior Model
Behavior Models (Rules)
EventWatch Reports
Data Review / Workflow
Investigating a Behavior Alert
Global Summary
Behavior Summary
Behavior Timeline
Search
Defining the Query
Lucene Queries
Facets
Flow Search
Event Search
Alerts / Notifications / Actions
Event Export
Actions
Slack Integration
PagerDuty Integration
Event Processing
Normalization
Parsers
Page Functionality
Overview
Notifications
Summary
Setup Review
User Tables
Facet Searches
Behavior Filters
Event Processors
EntityInfo Lists
Reputation Feeds
Data Lake
Network Flows
Events Search
EventWatch
Reports
EventWatch Rules
Behavior Timeline
Behavior Summary
API Actions
Notification Export
Metaflow
Flows Summary
Alerts
Address
Host Name
Processors
Dashboards
Report Scheduler
Task Editor/Sandbox
Task History
Data Ingress
Cloud Intergrations
Event Parsers
Source Devices
Unknown Source
Summary
Configuration
Collectors
System Notification
Resource Sync
System Settings
Resource
Office365
AWS
Acronis
AzureAD Audit
SentinelOne
User Admin
Users
Roles
API Tokens
API Policies
Data Policies
Audit
User Activity
Database
Schema
Segments
Shards
Status
Search Instances
Mgmt Tasks
Search Tasks
Notifications
Appendix
API Guide
Event Search
Behavior Summary Search
Requirement Standards
Mapping of FISMA Audit to Fluency
Mapping of PCI DSS to Fluency
Duo 2FA
Behavior Analytics
Event Watch
Event Watch
Page last updated: 2022 Oct 13 15:21:43 EDT
Table of contents
Creating a Behavior Model