Fluency Security Data-Source Health & Status

Which feeds are running, which have stopped, and exactly what the SOC cannot see while they are down — across seventeen tenants on one connector.

Connector 00000000-0000-0000-0000-000000000000 · 17 tenants · Generated 2026-05-30 · 24h window · Read-only

§1

Health summary

Nine of seventeen Apex MSSP tenants are in an error verdict — over half the book. Two failure patterns dominate: SentinelOne agents that will not load (customer-04 ×2, customer-01), and S3-backed feeds (CiscoUmbrella, JudySecurity) returning errors. A second cluster — customer-13, customer-07, customer-10, customer-08 — has integration_misconfigured findings: sources claim integrations that Fluency does not see a matching resource for. No tenant is unreachable; the platform side is healthy.

§2

Per-tenant verdict

Inactive sources are quiet — not a finding. Inactive is not the same as broken; without time-comparison data the platform cannot distinguish "always quiet" from "stopped working." Resource fetchers (BlackKite, Office365, SentinelOne) are verified via freshness probe, not throughput.

§3

Ingestion & data flow

Total 24h ingest across the connector: 361.8 GB. Top tenants by volume:

Tenant	Top source
customer-06	SyslogEndpoint (46.5 GB)
customer-11	FluencyCollector (43.2 GB)
customer-08	LocalSyslog (27.8 GB)
customer-10	FluencyCollector (11.9 GB)
customer-01	LocalSyslog (10.8 GB)
customer-02	SyslogEndpoint (9.1 GB)
customer-14	LocalSyslog (7.7 GB)
customer-13	LocalSyslog (6.2 GB)

§4

Errored / silent sources

Ten source-level errors across the book. Each below is a configured source that is failing or producing no events.

• customer-04 · SentinelOne:SentinelOne Source error

  failed to load sentinelone agent (×9) · bytes_passed=0 · errorStates corroborated

  Lineage: live_fluency_pull · histogram_24h · errorStates_corroborated

• customer-04 · SentinelOne:Customer 04 — Cloud Telecom Source error

  failed to load sentinelone agent (×9) · bytes_passed=0 · errorStates corroborated

  Lineage: live_fluency_pull · histogram_24h · errorStates_corroborated

• customer-01 · SentinelOne:Customer 01 — Retail Holdings Source error

  failed to load sentinelone agent (×9) · bytes_passed=0 · errorStates corroborated

  Lineage: live_fluency_pull · histogram_24h · errorStates_corroborated

• customer-16 · DefenderATP-default Source error

  poll error (×9) · bytes_passed=0 · errorStates corroborated

  Lineage: live_fluency_pull · histogram_24h · errorStates_corroborated

• customer-13 · CiscoUmbrella_DNSLogs Source error

  S3 data source Error (×9) · bytes_passed=0 · errorStates corroborated

  Lineage: live_fluency_pull · histogram_24h · errorStates_corroborated

• customer-13 · CiscoUmbrella_ProxyLogs Source error

  S3 data source Error (×9) · bytes_passed=0 · errorStates corroborated

  Lineage: live_fluency_pull · histogram_24h · errorStates_corroborated

• customer-08 · JudySecurity Source error

  S3 data source Error (×9) · bytes_passed=0 · errorStates corroborated

  Lineage: live_fluency_pull · histogram_24h · errorStates_corroborated

• customer-02 · BehaviorSummary Transform errors

  3,234 bytes errored in 24h · bytes_errored=3,234 · bytes_dropped=90,506 · bytes_aborted=3,234

  Lineage: live_fluency_pull · histogram_24h

• customer-07 · BehaviorSummary Transform errors

  15,073 bytes errored in 24h · bytes_errored=15,073 · bytes_dropped=302,705 · bytes_aborted=15,073

  Lineage: live_fluency_pull · histogram_24h

• customer-11 · FluencyCollector Source-side errors

  14,804 events in 24h; collector still passing 43.2 GB · bytes_passed=43.2 GB · source_errors=14,804

  Lineage: live_fluency_pull · histogram_24h

Integration misconfigurations

Sixteen integration_misconfigured findings across four tenants. Each is a source claiming an integration (for example Office365) where Fluency's get_system_config reports no matching resource — typically the integration was renamed, removed, or never finished the discovery handshake.

Tenant	Integrations with no matching resource
customer-13	AzureAudit, BlackKite, Falcon, Office365, Office365ResourceWatch
customer-08	AzureAudit, BlackKite, Office365, Office365ResourceWatch, SentinelOne
customer-07	AzureAudit, AzureEventHubs, Office365, Office365ResourceWatch
customer-10	BlackKite, Falcon

Suppressed

Informational · no action needed

Seven errorStates_noise alerts suppressed across the connector — all are Office365 "failed to get access token" events occurring on sources that are passing data normally (OAuth token-refresh hiccups, not outages). Suppressed per verdict precedence rule 3.

§5

Detection blind spots

What the SOC currently cannot see, derived from the §4 errors and known-stopped sources.

SentinelOne endpoint telemetry — customer-04, customer-01

Risk: high

Gap	Agent load failing across three configured sources; zero EDR events in 24h
Cannot detect	Malware execution, ransomware behaviors, EDR-detected lateral movement on endpoints in these tenants
Why it matters	Endpoint detection is the primary control surface for these customers
Remediation	Verify SentinelOne API token validity and console URL; reload agent config in Fluency

Microsoft Defender ATP — customer-16

Risk: high

Gap	Defender poll failing for 24h (×9 retries observed)
Cannot detect	Defender alerts, suspicious process events, sign-in risk from MDE
Why it matters	customer-16 has no SentinelOne fallback configured
Remediation	Re-auth MDE app registration; confirm Graph API permissions are still granted

Cisco Umbrella DNS & Proxy logs — customer-13

Risk: medium-high

Gap	Both S3-backed Umbrella feeds erroring
Cannot detect	DNS tunneling, C2 callbacks via DNS, blocked-category web access patterns
Why it matters	Umbrella is the perimeter visibility for customer-13
Remediation	Verify S3 bucket access keys and Umbrella log-export config

JudySecurity S3 feed — customer-08

Risk: medium

Gap	S3 source erroring for 24h
Cannot detect	Whatever JudySecurity provides (likely mobile / endpoint threat intel) for the customer-08 internal tenant
Why it matters	Depends on JudySecurity's role in the stack; confirm with operator
Remediation	Check S3 credentials and bucket path

BehaviorSummary transform errors — customer-02, customer-07

Risk: low

Gap	Behavior summarization dropping a small fraction of events (3K and 15K bytes errored in 24h)
Cannot detect	The specific events that errored out — likely malformed records, not a broad outage
Why it matters	bytes_errored is small relative to throughput; verify the pattern is not growing
Remediation	Pull errorStates detail via ingress_source_detail to identify the failing record shape

Integration registry drift — customer-13, customer-08, customer-07, customer-10

Risk: medium

Gap	Sources claim integrations that Fluency's resource discovery does not see
Cannot detect	Cross-resource correlation (for example linking an Office365 alert to its user record) may degrade until the registry is reconciled
Why it matters	Data is flowing, but enrichment and entity linking are at risk
Remediation	For each tenant, re-run integration discovery; rename the source's integration tag to match the discovered resource

§6

Integration inventory

no_index on customer-01's SentinelOne and Office365 fetchers means the resource index does not exist yet — typical for sources that have never successfully synced. Worth investigating alongside customer-01's SentinelOne source error.

§7

Recommended actions

• Fix SentinelOne agent load failures — customer-04 (×2), customer-01 P1

  Re-validate API tokens and console URLs in Fluency. Three EDR sources blind for at least 24h. Tied to §4, §5.

• Re-auth Defender ATP for customer-16 P1

  Polling failed for 24h and the tenant has no healthy SentinelOne fallback. Confirm the Azure app registration and Graph permissions. Tied to §4, §5.

• Restore Cisco Umbrella S3 ingestion for customer-13 P1

  Both DNS and Proxy feeds erroring — primary perimeter visibility is down. Verify S3 access keys and Umbrella export config. Tied to §4, §5.

• Restore JudySecurity S3 feed for customer-08 P2

  Confirm S3 credentials and bucket path; treat as an opaque vendor feed until the owner confirms scope. Tied to §4, §5.

• Reconcile integration registry — customer-13, customer-08, customer-07, customer-10 P2

  Run integration discovery for each; correct the source-side integration= tag to match what Fluency now reports. Data is flowing — this is enrichment risk, not blind-spot risk. Tied to §4.

• Investigate customer-01 "no_index" resource fetchers P2

  SentinelOne and Office365 resource indexes do not exist. Pair with the SentinelOne source-error fix; likely the same root cause. Tied to §6.

• Drill into BehaviorSummary transform errors — customer-02, customer-07 P3

  3.2 KB and 15 KB errored respectively. Use ingress_source_detail to pull the failing record shape. Low volume, but worth identifying the pattern before it grows. Tied to §4.

• Investigate customer-11 FluencyCollector source errors P3

  14,804 events. The collector is still passing 43 GB; errors are on a subset. Pull source detail to identify the failing inputs. Tied to §4.