Fluency’s Focus on Fundamentals
Addressing Compliance and Scalability
Fluency is redefining log management by focusing on fundamentals. Fluency Cloud is written specifically to take advantage of what makes cloud technology different, such as dynamically allocating processing power and storage when needed. We wrote an award-winning database designed to handle streaming data, the very characteristic of audit data. We also treat correlation differently. Data is not just correlated but fused into a fully-indexed immutable shardless database. This avoids costly joins and provides time-dependent insight into the user and device related to an event at that moment. Fluency removes many of the difficulties that plague SIEMs and their lack of innovation in how they parse, store, and retrieve data.
The Fluency approach is to make simple the process of collection and analysis of data. Fluency administers the system, to include the writing of parsers and the maintenance of the databases. We do not limit the number of users a customer can have to access the data. The focus of Fluency is to perform the task of log management in an efficient and scalable manner. We charge simply based on the amount of data and the length of retention.
How Fluency® Works
There are two basic components to central log management: the flow engine and the data store. The flow engine’s job is processing incoming data. The data store is the repository of all the data and provides historical access.
- Audit Processing: Information is collected from the Cloud, network, host and 3rd party providers (services). Data is parsed and placed in Fluency’s patented correlation window. When data for that event is correlated, it creates a fused record. All real-time decisions are made at this point. Here, Fluency EventWatch performs statistical and machine learning on “buckets” (see Notification).
- Audit Record Stream: Fluency streams this information into the data store. This is the natural state of audit data. Fluency’s database is designed to handle streaming data.
- Datastore: Records are stored in an immutable, shard-less database. The database is schemaless and fully indexed. This proprietary index-format remains intact even in cold storage. During the storage process, summary data is created to improve analytic searches. This datastore is what machine historical analysis and people use to interact with the audit.
- Notification: Notifications come from the flow engine (via EventWatch or the correlation engine) and from the historical machine analysis. In the Flow Engine, statistical analysis creates buckets that are real-time detailed models. These buckets can be used to create histograms or notifications based on a predefined rule.
For further insight into Fluency’s Central Log Manamgent look at our Technology page.
News & Blog
Fluency® is a modern approach to security event management
Data Retention Compliance & More
Fluency addresses audit retention and data analysis for compliance with standards such as PCI, FISMA, NYDFS, and HITRUST. SIEM and analytic platforms fall significantly short of the 90 days searchable, and full year audit retention requirements for compliance. This shortcoming is a critical gap. While audit retention is not as sexy or exciting as machine learning and artificial intelligence, it is a basic requirement. When done right, it is extremely powerful. With the average time for detecting a breach is 206 days, the truth is that the ability to search the past to find which user and what device is a critical element to security operations.
Fluency proprietary database has the industry’s highest events per second and fastest search times. It is a factor of 50 times faster than the leading open source big data solution. The system stores not just 90 days, but a full 365 days as its basic service. A leading dashboard vendor stressed the need to store security-relevant data. The truth is that all data is security relevant. Fluency’s pricing is aimed at making collecting and storing all audit data a reality. It’s more than just compliance, it’s an operational need.