Your data, shaped for AI.
Automatically.

Any source. Any schema.
Delivered to any destination in real time.

If it emits data,
Fleak connects to it.

500+ native connectors across security, cloud, IT, industrial OT, and logistics systems. For anything not listed, Fleak generates a parser from sample data in minutes.

Sources 415

Cloud platforms 33

AWS CloudTrail

Source • Cloud API activity

Azure Monitor

Source • Cloud & infra events

Google Cloud Logging

Source • GCP audit & platform

Amazon CloudFront

Source • CDN access logs

Amazon CloudWatch

Source • Logs & metrics

Amazon EC2 security groups

Source • Network rules

Amazon GuardDuty

Source • Threat detections

Amazon Route 53

Source • DNS query logs

Amazon Security Lake

Source • OCSF security data lake

Amazon VPC Flow Logs

Source • Network flow records

Amazon Web Services

Source • Account & resource APIs

AWS Certificate Manager

Source • Certificate inventory

AWS Config

Source • Resource inventory & changes

AWS KMS

Source • Key usage & changes

AWS Lambda

Source • Function logs

AWS Network Firewall

Source • Firewall flow & alert logs

AWS Organizations

Source • Accounts & policies

AWS Secrets Manager

Source • Secret access events

AWS WAF

Source • Web ACL logs

Azure Activity Logs

Source • Subscription activity

Azure App Service

Source • App & HTTP logs

Azure Front Door

Source • CDN & WAF logs

Azure NSG Flow Logs

Source • Network flow records

Azure Resource Graph

Source • Resource changes

Azure Storage

Source • Storage access logs

Azure Virtual Machines

Source • VM inventory

Azure VNet Flow Logs

Source • Network flow records

Elastic Load Balancing

Source • ALB, NLB & CLB logs

Google Cloud

Source • Project & resource APIs

Google Cloud Asset Inventory

Source • Resource inventory

Google Compute Engine

Source • VM logs

Microsoft Azure

Source • Subscription & resource APIs

Oracle Cloud

Source • Cloud Guard, firewall & sign-ins

Identity & access 39

Okta

Source • Identity events

1Password

Source • Sign-ins & item usage

AD

ADIMS

Source • Audit logs

Admin By Request

Source • Elevation requests

Amazon Cognito

Source • User pool events

Auth0

Source • Tenant log events

AuthMind

Source • Identity threat issues

AWS IAM

Source • Roles, policies & access

BeyondTrust

Source • Privileged access events

Bitwarden

Source • Vault events

Bravura Identity

Source • Identity governance

Cisco Duo

Source • Authentication & admin logs

Cisco ISE

Source • Network access control

CyberArk

Source • Privileged access audit

Delinea

Source • Privileged access audit

HashiCorp Vault

Source • Secrets audit logs

JumpCloud

Source • Directory events

Keyfactor

Source • Certificate lifecycle

LastPass

Source • Vault events

LO

Logic4

Source • AD audit

ManageEngine ADAudit Plus

Source • AD change auditing

ManageEngine Password Manager Pro

Source • Privileged password audit

Microsoft AD FS

Source • Federation sign-ins

Microsoft Defender for Identity

Source • Identity threat alerts

Microsoft Entra ID

Source • Sign-in & audit logs

Netwrix Auditor

Source • Change auditing

Obsidian Security

Source • SaaS identity threats

OneLogin

Source • SSO events

Opal

Source • Access requests

Persona

Source • Identity verification audit

PingOne

Source • SSO & MFA events

RSA SecurID

Source • Authentication logs

SailPoint

Source • Identity governance events

SAP Customer Data Cloud

Source • Customer identity audit

Saviynt

Source • Identity governance

SecureAuth

Source • Authentication events

Shibboleth

Source • Federated sign-ins

SoftwareIDM

Source • Identity reporting

Teleport

Source • Infrastructure access audit

Endpoint & XDR 36

CrowdStrike Falcon

Source • Endpoint telemetry

Action1

Source • Patch audit trail

Apple Business

Source • Device management audit

Automox

Source • Patch & device events

Cisco Secure Endpoint

Source • Endpoint detections

Cortex XDR

Source • Endpoint & XDR incidents

CrowdStrike Falcon Data Replicator

Source • Raw endpoint events

Cybereason

Source • EDR detections

Fleet

Source • osquery fleet activity

Halcyon

Source • Ransomware alerts

HCL BigFix

Source • Endpoint management

Huntress

Source • MDR incidents

Idira

Source • Audit events

Island

Source • Enterprise browser events

Jamf

Source • Device inventory & events

Koi

Source • Extension security audit

Kolide

Source • Device trust audit

LogMeIn Rescue

Source • Remote session logs

Malwarebytes

Source • Detections

McAfee ePO

Source • Endpoint events

Microsoft Defender Antivirus

Source • Antivirus events

Microsoft Defender for Endpoint

Source • Alerts & device events

Microsoft Defender XDR

Source • Alerts & incidents

Microsoft Intune

Source • Device compliance

NinjaOne

Source • RMM activity

SentinelOne Singularity

Source • Threats & activities

Sepio

Source • Hardware asset events

Sophos Endpoint

Source • Alerts & events

Symantec Endpoint Security

Source • Incidents & events

Sysmon

Source • Process & network events

Tanium

Source • Endpoint inventory

TeamViewer

Source • Remote session audit

ThreatLocker

Source • Allowlisting actions

Trellix

Source • Endpoint & XDR events

Trend Vision One

Source • XDR detections

VMware Carbon Black

Source • EDR alerts & audit

Network & perimeter 61

Cisco Security Cloud

Source • Duo, SNA, Secure Endpoint

Zscaler

Source • Web and zero-trust access logs

AG

Airlock Gateway

Source • WAF events

Akamai

Source • Edge & security events

Arbor Edge Defense

Source • DDoS & blocked hosts

Arista NDR

Source • NDR detections

Aruba Networks

Source • Switch & wireless logs

BlueCat

Source • DNS & DHCP logs

Broadcom ProxySG

Source • Web proxy logs

Brocade

Source • SAN switch logs

Cato Networks

Source • SASE events

Check Point

Source • Firewall & threat prevention

Cisco ASA

Source • Firewall & VPN logs

Cisco Firepower

Source • NGFW & IPS events

Cisco Meraki

Source • Network config changes

Cisco Model-Driven Telemetry

Source • gNMI & streaming telemetry

Cisco Secure Network Analytics

Source • Flow analytics

Cisco Umbrella

Source • DNS & proxy logs

Cisco Wireless

Source • WLAN controller logs

Citrix NetScaler

Source • ADC, VPN & WAF logs

Cloudflare

Source • HTTP, firewall & DNS logs

Cloudflare Zero Trust

Source • Access requests & logins

Corelight

Source • Zeek-based network logs

Darktrace

Source • NDR alerts

ExtraHop RevealX

Source • NDR detections

F5 BIG-IP

Source • Load balancer & WAF logs

Fastly

Source • CDN logs

Fidelis Security

Source • NDR & CSPM alerts

FireEye NX

Source • Network threat alerts

Forcepoint

Source • Firewall & web proxy

Forescout

Source • Device visibility & NAC

Fortinet FortiGate

Source • Firewall logs

Gigamon

Source • Network metadata

HAProxy

Source • Load balancer logs

Illumio

Source • Segmentation traffic & events

Imperva

Source • WAF & database security

Infoblox

Source • Network & security logs

Ivanti Connect Secure

Source • VPN sessions

Juniper Networks

Source • Firewall & router logs

McAfee Web Gateway

Source • Web proxy logs

Microsoft DNS & DHCP

Source • DNS & DHCP server logs

NetFlow & IPFIX

Source • Flow records

Netskope

Source • SSE events & alerts

OPSWAT

Source • DNS, firewall & proxy

Palo Alto Networks NGFW

Source • Firewall, GlobalProtect & flow

pfSense

Source • Firewall & VPN logs

Radware DefensePro

Source • DDoS events

sFlow

Source • Sampled flow records

SNMP traps

Source • Device traps

SonicWall

Source • Firewall logs

Squid

Source • Web proxy logs

Tailscale

Source • Audit & network flow logs

Vectra AI

Source • NDR detections

VeloCloud SD-WAN

Source • SD-WAN firewall

Versa Networks

Source • SASE & NGFW logs

VMware Avi Load Balancer

Source • Load balancer logs

VMware NSX

Source • Distributed firewall

VMware Unified Access Gateway

Source • Remote access logs

WatchGuard Firebox

Source • Firewall logs

Zeek

Source • Network security logs

Zero Networks

Source • Segmentation audit

Cloud & app security 43

Wiz

Source • Cloud security findings

Aikido

Source • Code & cloud issues

Amazon Inspector

Source • Vulnerability findings

Aqua Security

Source • Container security events

AWS Security Hub

Source • Aggregated findings

Axonius

Source • Asset inventory

Brinqa

Source • Risk audit logs

Cyera

Source • Data security posture

Digital Guardian

Source • DLP events

Endor Labs

Source • Supply chain audit

Forcepoint DLP

Source • DLP incidents

GitHub Advanced Security

Source • Dependabot & advisories

Google Security Command Center

Source • Cloud findings

Ivanti

Source • Endpoint vulnerabilities

Kiteworks

Source • Secure file sharing

Lacework

Source • Cloud security events

Lansweeper

Source • Asset vulnerabilities

McAfee Database Security

Source • Database activity

Microsoft Defender for Cloud

Source • Cloud alerts & compliance

Microsoft Defender for Cloud Apps

Source • CASB alerts & activity

Microsoft Defender Vulnerability Management

Source • Vulnerability findings

Microsoft Purview DLP

Source • Data loss prevention events

Nightfall

Source • DLP posture events

Noname Security

Source • API security findings

Orca Security

Source • Cloud alerts

Palo Alto Data Security

Source • Data security alerts

Polymer

Source • SaaS DLP activity

Prisma Cloud

Source • Cloud alerts

Prowler

Source • Cloud compliance findings

Qualys

Source • Assets & vulnerability scans

Rapid7

Source • Assets & exploits

RiskSense

Source • Vulnerabilities

runZero

Source • Asset inventory

Semgrep

Source • Code & supply chain findings

Snyk

Source • Code & dependency issues

Socket

Source • Dependency scans

Sysdig

Source • Runtime security events

Tenable

Source • Assets & vulnerabilities

Thales CipherTrust

Source • Encryption & key audit

Threat Stack

Source • Workload threats

Upwind

Source • Cloud findings & detections

Varonis

Source • Data access alerts

Veracode

Source • Application security

Hosts, containers & DevOps 42

Aiven

Source • Managed service logs

Akuity

Source • Argo CD audit logs

Amazon EKS

Source • Kubernetes audit logs

Apache HTTP Server

Source • Access & error logs

Azure DevOps

Source • Audit logs

Azure Monitor Agent

Source • Windows & Linux events

Buildkite

Source • CI audit logs

Citrix

Source • Virtual apps & desktops

Cloudsmith

Source • Artifact audit logs

Clumio

Source • Backup audit & alerts

Cohesity

Source • Backup audit logs

Dell EMC

Source • Storage alerts & audit

Device42

Source • CMDB & discovery

Druva

Source • Backup events

Gerrit

Source • Code review events

GitHub

Source • Audit logs

GitHub Actions

Source • Workflow logs

GitLab

Source • Audit & issue events

Google Kubernetes Engine

Source • Kubernetes audit logs

Host metrics

Source • CPU, memory, disk, processes

HP-UX

Source • Unix system logs

HPE iLO

Source • Server management logs

IBM AIX

Source • Unix system logs

Kubernetes

Source • Logs, metrics & events

Linux journald

Source • systemd journal

Log files

Source • Tail files on hosts

macOS Unified Logs

Source • Apple endpoint logs

Microsoft IIS

Source • Web server logs

OwnBackup

Source • Backup audit logs

Postman

Source • API platform audit

PowerShell

Source • Script block logs

Precisely Ironstream

Source • Mainframe & IBM i data

Pure Storage

Source • FlashArray & Pure1 events

Red Hat Enterprise Linux

Source • System logs

Rubrik

Source • Backup & recovery events

Snare

Source • Windows & Unix event agent

Terraform

Source • Run & audit events

Veeam

Source • Backup & recovery events

Vercel

Source • Deploy & audit events

VMware vCenter

Source • Virtualization events

Windows Event Logs

Source • Event Log & WEF

Zerto

Source • Replication events

Destinations 93

Destinations Schemas

Normalize once to a standard schema — every downstream tool that speaks that schema inherits it automatically. Write the mapping once, use it everywhere.

Schema
Full name
What it unlocks
Vertical

OCSF

Open Cybersecurity Schema Framework

Write detection and analytics logic once — every OCSF-native tool inherits it. Supported by Splunk, Databricks, AWS, Microsoft, and 100+ vendors.

Cybersecurity

UDM

Unified Data Model

Google Chronicle's native schema. Normalize any source for Chronicle-native analytics without manual parser work.

Cybersecurity

IEC 61968/61970

Common Information Model

Energy and utilities standard. Connect OT devices and operational systems to AI workloads without custom connectors.

Industrial/OT

OPC-UA

OPC Unified Architecture

Industrial protocol normalization. Bridge legacy OT device data to modern AI and analytics infrastructure.

Industrial/OT

ACARS

Aircraft Comms Addressing & Reporting

Normalize aviation communications and operational telemetry for AI and analytics workloads.

Aviation

Parquet / Delta

Columnar Storage Formats

Output any normalized data in Parquet or Delta Lake format — optimized for Databricks, Spark, and lakehouse architectures.

Any vertical

Don’t see your sources?
Fleak generates the parser.

Paste a sample of your data. Fleak's schema engine identifies the fields, maps them to your destinations schema, and produces a deployable transformation config in ~ 3 minutes.

Book a 30 minute demo