Your data, shaped for AI.
Automatically.

Any source. Any schema.
Delivered to any destination in real time.

If it emits data,
Fleak connects to it.

500+ native connectors across security, cloud, IT, industrial OT, and logistics systems. For anything not listed, Fleak generates a parser from sample data in minutes.

Sources 415

Cloud platforms 33

AW

AWS CloudTrail

Source • Cloud API activity

AZ

Azure Monitor

Source • Cloud & infra events

GL

Google Cloud Logging

Source • GCP audit & platform

AC

Amazon CloudFront

Source • CDN access logs

AC

Amazon CloudWatch

Source • Logs & metrics

AE

Amazon EC2 security groups

Source • Network rules

AG

Amazon GuardDuty

Source • Threat detections

AR

Amazon Route 53

Source • DNS query logs

AS

Amazon Security Lake

Source • OCSF security data lake

AV

Amazon VPC Flow Logs

Source • Network flow records

AW

Amazon Web Services

Source • Account & resource APIs

AC

AWS Certificate Manager

Source • Certificate inventory

AC

AWS Config

Source • Resource inventory & changes

AK

AWS KMS

Source • Key usage & changes

AL

AWS Lambda

Source • Function logs

AN

AWS Network Firewall

Source • Firewall flow & alert logs

AO

AWS Organizations

Source • Accounts & policies

AS

AWS Secrets Manager

Source • Secret access events

AW

AWS WAF

Source • Web ACL logs

AA

Azure Activity Logs

Source • Subscription activity

AA

Azure App Service

Source • App & HTTP logs

AF

Azure Front Door

Source • CDN & WAF logs

AN

Azure NSG Flow Logs

Source • Network flow records

AR

Azure Resource Graph

Source • Resource changes

AS

Azure Storage

Source • Storage access logs

AV

Azure Virtual Machines

Source • VM inventory

AV

Azure VNet Flow Logs

Source • Network flow records

EL

Elastic Load Balancing

Source • ALB, NLB & CLB logs

GC

Google Cloud

Source • Project & resource APIs

GC

Google Cloud Asset Inventory

Source • Resource inventory

GC

Google Compute Engine

Source • VM logs

MA

Microsoft Azure

Source • Subscription & resource APIs

OC

Oracle Cloud

Source • Cloud Guard, firewall & sign-ins

Identity & access 39

OK

Okta

Source • Identity events

1P

1Password

Source • Sign-ins & item usage

AD

ADIMS

Source • Audit logs

AR

Admin By Request

Source • Elevation requests

AC

Amazon Cognito

Source • User pool events

AU

Auth0

Source • Tenant log events

AU

AuthMind

Source • Identity threat issues

AI

AWS IAM

Source • Roles, policies & access

BE

BeyondTrust

Source • Privileged access events

BI

Bitwarden

Source • Vault events

BI

Bravura Identity

Source • Identity governance

CD

Cisco Duo

Source • Authentication & admin logs

CI

Cisco ISE

Source • Network access control

CY

CyberArk

Source • Privileged access audit

DE

Delinea

Source • Privileged access audit

HV

HashiCorp Vault

Source • Secrets audit logs

JU

JumpCloud

Source • Directory events

KE

Keyfactor

Source • Certificate lifecycle

LA

LastPass

Source • Vault events

LO

Logic4

Source • AD audit

MA

ManageEngine ADAudit Plus

Source • AD change auditing

MP

ManageEngine Password Manager Pro

Source • Privileged password audit

MA

Microsoft AD FS

Source • Federation sign-ins

MD

Microsoft Defender for Identity

Source • Identity threat alerts

ME

Microsoft Entra ID

Source • Sign-in & audit logs

NA

Netwrix Auditor

Source • Change auditing

OS

Obsidian Security

Source • SaaS identity threats

ON

OneLogin

Source • SSO events

OP

Opal

Source • Access requests

PE

Persona

Source • Identity verification audit

PI

PingOne

Source • SSO & MFA events

RS

RSA SecurID

Source • Authentication logs

SA

SailPoint

Source • Identity governance events

SC

SAP Customer Data Cloud

Source • Customer identity audit

SA

Saviynt

Source • Identity governance

SE

SecureAuth

Source • Authentication events

SH

Shibboleth

Source • Federated sign-ins

SO

SoftwareIDM

Source • Identity reporting

TE

Teleport

Source • Infrastructure access audit

Endpoint & XDR 36

CS

CrowdStrike Falcon

Source • Endpoint telemetry

AC

Action1

Source • Patch audit trail

AB

Apple Business

Source • Device management audit

AU

Automox

Source • Patch & device events

CS

Cisco Secure Endpoint

Source • Endpoint detections

CX

Cortex XDR

Source • Endpoint & XDR incidents

CF

CrowdStrike Falcon Data Replicator

Source • Raw endpoint events

CY

Cybereason

Source • EDR detections

FL

Fleet

Source • osquery fleet activity

HA

Halcyon

Source • Ransomware alerts

HB

HCL BigFix

Source • Endpoint management

HU

Huntress

Source • MDR incidents

ID

Idira

Source • Audit events

IS

Island

Source • Enterprise browser events

JA

Jamf

Source • Device inventory & events

KO

Koi

Source • Extension security audit

KO

Kolide

Source • Device trust audit

LR

LogMeIn Rescue

Source • Remote session logs

MA

Malwarebytes

Source • Detections

ME

McAfee ePO

Source • Endpoint events

MD

Microsoft Defender Antivirus

Source • Antivirus events

MD

Microsoft Defender for Endpoint

Source • Alerts & device events

MD

Microsoft Defender XDR

Source • Alerts & incidents

MI

Microsoft Intune

Source • Device compliance

NI

NinjaOne

Source • RMM activity

SS

SentinelOne Singularity

Source • Threats & activities

SE

Sepio

Source • Hardware asset events

SE

Sophos Endpoint

Source • Alerts & events

SE

Symantec Endpoint Security

Source • Incidents & events

SY

Sysmon

Source • Process & network events

TA

Tanium

Source • Endpoint inventory

TE

TeamViewer

Source • Remote session audit

TH

ThreatLocker

Source • Allowlisting actions

TR

Trellix

Source • Endpoint & XDR events

TV

Trend Vision One

Source • XDR detections

VC

VMware Carbon Black

Source • EDR alerts & audit

Network & perimeter 61

CI

Cisco Security Cloud

Source • Duo, SNA, Secure Endpoint

ZS

Zscaler

Source • Web and zero-trust access logs

AG

Airlock Gateway

Source • WAF events

AK

Akamai

Source • Edge & security events

AE

Arbor Edge Defense

Source • DDoS & blocked hosts

AN

Arista NDR

Source • NDR detections

AN

Aruba Networks

Source • Switch & wireless logs

BL

BlueCat

Source • DNS & DHCP logs

BP

Broadcom ProxySG

Source • Web proxy logs

BR

Brocade

Source • SAN switch logs

CN

Cato Networks

Source • SASE events

CP

Check Point

Source • Firewall & threat prevention

CA

Cisco ASA

Source • Firewall & VPN logs

CF

Cisco Firepower

Source • NGFW & IPS events

CM

Cisco Meraki

Source • Network config changes

CM

Cisco Model-Driven Telemetry

Source • gNMI & streaming telemetry

CS

Cisco Secure Network Analytics

Source • Flow analytics

CU

Cisco Umbrella

Source • DNS & proxy logs

CW

Cisco Wireless

Source • WLAN controller logs

CN

Citrix NetScaler

Source • ADC, VPN & WAF logs

CL

Cloudflare

Source • HTTP, firewall & DNS logs

CZ

Cloudflare Zero Trust

Source • Access requests & logins

CO

Corelight

Source • Zeek-based network logs

DA

Darktrace

Source • NDR alerts

ER

ExtraHop RevealX

Source • NDR detections

FB

F5 BIG-IP

Source • Load balancer & WAF logs

FA

Fastly

Source • CDN logs

FS

Fidelis Security

Source • NDR & CSPM alerts

FN

FireEye NX

Source • Network threat alerts

FO

Forcepoint

Source • Firewall & web proxy

FO

Forescout

Source • Device visibility & NAC

FF

Fortinet FortiGate

Source • Firewall logs

GI

Gigamon

Source • Network metadata

HA

HAProxy

Source • Load balancer logs

IL

Illumio

Source • Segmentation traffic & events

IM

Imperva

Source • WAF & database security

IN

Infoblox

Source • Network & security logs

IC

Ivanti Connect Secure

Source • VPN sessions

JN

Juniper Networks

Source • Firewall & router logs

MW

McAfee Web Gateway

Source • Web proxy logs

MD

Microsoft DNS & DHCP

Source • DNS & DHCP server logs

NI

NetFlow & IPFIX

Source • Flow records

NE

Netskope

Source • SSE events & alerts

OP

OPSWAT

Source • DNS, firewall & proxy

PA

Palo Alto Networks NGFW

Source • Firewall, GlobalProtect & flow

PF

pfSense

Source • Firewall & VPN logs

RD

Radware DefensePro

Source • DDoS events

SF

sFlow

Source • Sampled flow records

ST

SNMP traps

Source • Device traps

SO

SonicWall

Source • Firewall logs

SQ

Squid

Source • Web proxy logs

TA

Tailscale

Source • Audit & network flow logs

VA

Vectra AI

Source • NDR detections

VS

VeloCloud SD-WAN

Source • SD-WAN firewall

VN

Versa Networks

Source • SASE & NGFW logs

VA

VMware Avi Load Balancer

Source • Load balancer logs

VN

VMware NSX

Source • Distributed firewall

VU

VMware Unified Access Gateway

Source • Remote access logs

WF

WatchGuard Firebox

Source • Firewall logs

ZE

Zeek

Source • Network security logs

ZN

Zero Networks

Source • Segmentation audit

Cloud & app security 43

WZ

Wiz

Source • Cloud security findings

AI

Aikido

Source • Code & cloud issues

AI

Amazon Inspector

Source • Vulnerability findings

AS

Aqua Security

Source • Container security events

AS

AWS Security Hub

Source • Aggregated findings

AX

Axonius

Source • Asset inventory

BR

Brinqa

Source • Risk audit logs

CY

Cyera

Source • Data security posture

DG

Digital Guardian

Source • DLP events

EL

Endor Labs

Source • Supply chain audit

FD

Forcepoint DLP

Source • DLP incidents

GA

GitHub Advanced Security

Source • Dependabot & advisories

GS

Google Security Command Center

Source • Cloud findings

IV

Ivanti

Source • Endpoint vulnerabilities

KI

Kiteworks

Source • Secure file sharing

LA

Lacework

Source • Cloud security events

LA

Lansweeper

Source • Asset vulnerabilities

MD

McAfee Database Security

Source • Database activity

MD

Microsoft Defender for Cloud

Source • Cloud alerts & compliance

MD

Microsoft Defender for Cloud Apps

Source • CASB alerts & activity

MD

Microsoft Defender Vulnerability Management

Source • Vulnerability findings

MP

Microsoft Purview DLP

Source • Data loss prevention events

NI

Nightfall

Source • DLP posture events

NS

Noname Security

Source • API security findings

OS

Orca Security

Source • Cloud alerts

PA

Palo Alto Data Security

Source • Data security alerts

PO

Polymer

Source • SaaS DLP activity

PC

Prisma Cloud

Source • Cloud alerts

PR

Prowler

Source • Cloud compliance findings

QU

Qualys

Source • Assets & vulnerability scans

RA

Rapid7

Source • Assets & exploits

RI

RiskSense

Source • Vulnerabilities

RU

runZero

Source • Asset inventory

SE

Semgrep

Source • Code & supply chain findings

SN

Snyk

Source • Code & dependency issues

SO

Socket

Source • Dependency scans

SY

Sysdig

Source • Runtime security events

TE

Tenable

Source • Assets & vulnerabilities

TC

Thales CipherTrust

Source • Encryption & key audit

TS

Threat Stack

Source • Workload threats

UP

Upwind

Source • Cloud findings & detections

VA

Varonis

Source • Data access alerts

VE

Veracode

Source • Application security

Business apps 39

SF

Salesforce

Source • CRM events & audit

SN

ServiceNow

Source • ITSM events

AL

Alta

Source • Alerts, devices & users

BA

BambooHR

Source • Employee directory

CA

CaptivateIQ

Source • App audit & activity logs

CO

Coda

Source • App audit & activity logs

CO

CoLab

Source • Audit records

CO

Confluence

Source • Audit logs

DI

Dialpad

Source • Admin change log

DO

Docusign

Source • Envelope events

EX

Experian

Source • App audit & activity logs

FI

Figma

Source • App audit & activity logs

FI

Finxact

Source • Core banking logs

FL

FloQast

Source • App audit & activity logs

FR

Freshservice

Source • ITSM events

GC

Genesys Cloud

Source • Contact center audit

GR

Greenhouse

Source • App audit & activity logs

JA

Jarvis

Source • Logs

JI

Jira

Source • Audit logs & user directory

LO

Looker

Source • BI audit logs

MF

Method Financial

Source • Financial account data

MU

MuleSoft

Source • App audit & activity logs

NP

Neat Pulse

Source • App audit & activity logs

NE

NetSuite

Source • Audit logs

OF

Oracle Fusion Cloud

Source • FSCM audit

OR

Origami Risk

Source • Risk events

PA

PagerDuty

Source • Incidents & on-call

PL

Plaid

Source • App audit & activity logs

RO

Rootly

Source • Incident audit logs

SM

Smartsheet

Source • Events

ST

STARLIMS

Source • Lab system events

TI

Tines

Source • Automation audit & events

TW

Twilio

Source • Events & SendGrid activity

VO

Voltio

Source • App audit & activity logs

WF

Wells Fargo

Source • Commercial transaction detail

WO

Workato

Source • App audit & activity logs

WO

Workday

Source • Audit logs

WO

Workiva

Source • App audit & activity logs

ZE

Zendesk

Source • Audit logs

Hosts, containers & DevOps 42

AI

Aiven

Source • Managed service logs

AK

Akuity

Source • Argo CD audit logs

AE

Amazon EKS

Source • Kubernetes audit logs

AH

Apache HTTP Server

Source • Access & error logs

AD

Azure DevOps

Source • Audit logs

AM

Azure Monitor Agent

Source • Windows & Linux events

BU

Buildkite

Source • CI audit logs

CI

Citrix

Source • Virtual apps & desktops

CL

Cloudsmith

Source • Artifact audit logs

CL

Clumio

Source • Backup audit & alerts

CO

Cohesity

Source • Backup audit logs

DE

Dell EMC

Source • Storage alerts & audit

DE

Device42

Source • CMDB & discovery

DR

Druva

Source • Backup events

GE

Gerrit

Source • Code review events

GI

GitHub

Source • Audit logs

GA

GitHub Actions

Source • Workflow logs

GI

GitLab

Source • Audit & issue events

GK

Google Kubernetes Engine

Source • Kubernetes audit logs

HM

Host metrics

Source • CPU, memory, disk, processes

HU

HP-UX

Source • Unix system logs

HI

HPE iLO

Source • Server management logs

IA

IBM AIX

Source • Unix system logs

KU

Kubernetes

Source • Logs, metrics & events

LJ

Linux journald

Source • systemd journal

LF

Log files

Source • Tail files on hosts

MU

macOS Unified Logs

Source • Apple endpoint logs

MI

Microsoft IIS

Source • Web server logs

OW

OwnBackup

Source • Backup audit logs

PO

Postman

Source • API platform audit

PO

PowerShell

Source • Script block logs

PI

Precisely Ironstream

Source • Mainframe & IBM i data

PS

Pure Storage

Source • FlashArray & Pure1 events

RH

Red Hat Enterprise Linux

Source • System logs

RU

Rubrik

Source • Backup & recovery events

SN

Snare

Source • Windows & Unix event agent

TE

Terraform

Source • Run & audit events

VE

Veeam

Source • Backup & recovery events

VE

Vercel

Source • Deploy & audit events

VV

VMware vCenter

Source • Virtualization events

WE

Windows Event Logs

Source • Event Log & WEF

ZE

Zerto

Source • Replication events

Destinations 93

Destinations Schemas

Normalize once to a standard schema — every downstream tool that speaks that schema inherits it automatically. Write the mapping once, use it everywhere.

Schema
Full name
What it unlocks
Vertical

OCSF

Open Cybersecurity Schema Framework

Write detection and analytics logic once — every OCSF-native tool inherits it. Supported by Splunk, Databricks, AWS, Microsoft, and 100+ vendors.

Cybersecurity

UDM

Unified Data Model

Google Chronicle's native schema. Normalize any source for Chronicle-native analytics without manual parser work.

Cybersecurity

IEC 61968/61970

Common Information Model

Energy and utilities standard. Connect OT devices and operational systems to AI workloads without custom connectors.

Industrial/OT

OPC-UA

OPC Unified Architecture

Industrial protocol normalization. Bridge legacy OT device data to modern AI and analytics infrastructure.

Industrial/OT

ACARS

Aircraft Comms Addressing & Reporting

Normalize aviation communications and operational telemetry for AI and analytics workloads.

Aviation

Parquet / Delta

Columnar Storage Formats

Output any normalized data in Parquet or Delta Lake format — optimized for Databricks, Spark, and lakehouse architectures.

Any vertical

Don’t see your sources?
Fleak generates the parser.

Paste a sample of your data. Fleak's schema engine identifies the fields, maps them to your destinations schema, and produces a deployable transformation config in ~ 3 minutes.

Book a 30 minute demo