Fleak is a serverless API builder and AI workflow platform for data teams, whose core purpose is to build secure data pipelines that normalize, filter, and route logs, sending each log to the destination best suited for it—SIEM, data lake, or archive.
Main capabilities:
- Intent-based routing: Fleak evaluates each event type and routes it according to the needs of downstream tools. Events that require real-time correlation go to SIEM; datasets used for hunting go to the data lake at object storage pricing; compliance logs go to archive; noise is discarded.
- AI-orchestrated self-healing pipelines: Describe the pipeline in natural language, and Fleak's copilot can build it. When upstream schemas change, Fleak detects drift, generates a corrected configuration, and redeploys it, with optional human review. Average self-healing time is about three minutes.
- Normalization: Normalize any log source in real time to OCSF, UDM, or a custom schema.
- Filtering and deduplication: Filter and deduplicate before data reaches SIEM or detection tools.
- Governed delivery: Supports managed SaaS, own cloud, on-premises, or air-gapped deployment; fine-grained access control at the data layer, every transformation is logged, and production data never touches AI models. Provides SOC 2 Type II and full audit trails.
How to use:
- Connect any source: EDR, identity, cloud audit, network, SaaS, OT, etc. As long as it produces logs, it can be connected, with no need to hand-write parsers.
- Describe the pipeline: Explain the requirements in natural language, for example, "send failed logins to Sentinel and everything else to the data lake," and the copilot builds the pipeline within minutes.
- Normalize and route: Each log is normalized to OCSF, UDM, or a custom schema, then routed according to destination requirements. When the source changes, Fleak repairs the pipeline on its own.
- Deliver anywhere: Detection data to SIEM, hunting data to the data lake, compliance logs to the vault, real-time streaming, and Fleak does not store any data.
Applicable scenarios:
- SOC security operations: Reduce SIEM ingestion volume and lower SOC spending while maintaining coverage.
- OT/IoT telemetry: Normalize OT and IoT telemetry in real time into a unified schema, and deduplicate and filter sensor noise before it reaches the data lake.
- Compliance and fraud: Normalize transaction data across sources into a canonical schema, deduplicate and enrich events before they reach fraud detection, enforce fine-grained data governance, and retain regulatory audit trails.
The integration catalog covers the security stack (Splunk, Microsoft Sentinel, Palo Alto XSIAM, CrowdStrike Falcon, Google Chronicle, Okta, AWS CloudTrail, Azure Monitor, Google Cloud Logging, Datadog, Kafka) as well as data lake and warehouse destinations (Databricks, Snowflake, Amazon S3, BigQuery, Elasticsearch, ClickHouse), and also includes industrial OT and aviation sources.
Limitations and notes:
- Specific pricing, free trials, and plan details are not yet provided.
- Deployment options include managed SaaS, own cloud, on-premises, or air-gapped, and specific availability is not yet provided.
- Documentation is publicly available, and a 30-minute working session can be booked for a live demo.
