Fleak joins the Databricks startup accelerator. See the announcement

Every source, one ingestion layer.

Fleak receives whatever your tools push, pulls from the APIs they expose, and discovers the cloud logs you haven't onboarded yet. Paste an API key, pick a source, and data flows in minutes, with no custom collector to maintain.

Book a demo See how it works
  • Syslog
  • HTTP & webhooks
  • OpenTelemetry
  • Splunk HEC
  • Kafka
  • SaaS & cloud APIs

500+

Sources and destinations

across security, cloud, OT, and aviation

6mo → 1wk

Time to first source live

vs. hand-built pipelines

Millions

Events per second

real time, zero storage required

Every new source
is a new collector to maintain.

One forwarder for syslog, a script for the SaaS API, a Lambda for the cloud bucket. Each breaks on its own schedule.

APIs that fight back

Pagination, rate limits, token refresh, and descending timestamps. Every vendor API needs its own defensive code.

Gaps after every outage

When a collector stops, the data for that window is gone unless someone writes a backfill job by hand.

Blind spots nobody listed

Cloud accounts and services get created faster than anyone onboards their logs. Missing sources stay invisible until an incident.

Push it, pull it, or discover it.
Fleak collects it.

Receivers for everything your tools send, managed connectors for everything they expose, and the same pipeline behind both.

A universal receiver

Send syslog over UDP, TCP, or TLS, HTTP and webhooks, OpenTelemetry, Splunk HEC, Prometheus remote-write, Kafka, or NetFlow, sFlow, and IPFIX. No new agents required.

Managed API connectors

Pull from identity, endpoint, cloud, SaaS, and AI tools such as Okta, CrowdStrike, Microsoft 365, Google Workspace, and Wiz. Fleak maintains the connector when the API changes.

Cloud log discovery

Connect a read-only role and Fleak finds CloudTrail, VPC flow, and service logs across your accounts and regions, and flags the ones not yet onboarded.

Backfill and incremental sync

Pull history on the first run, sync incrementally after, and fill the gap automatically after an outage.

Filter at the source

Apply vendor-side filters, such as severity or project, so low-value data never leaves the source API.

Test before you trust it

Every connector tests its credentials and permissions when you create it, and samples live events before you deploy.

Agent or agentless

Run a lightweight agent where you need one, or collect agentlessly from hosts and devices where agents can't go. Existing agents keep running untouched.

Connectors generated from API docs

Point the Brain at a vendor's API documentation and it generates the connector, so a new SaaS source is live in hours instead of a sprint.

No gaps, no loss

Collectors queue, load-balance, and fail over automatically, so a destination outage or a network blip never leaves a hole in the data.

Connect a source in minutes.

Paste the key, pick the source, and watch normalized events arrive. Missing a connector? Ask, and we'll build it.

Read the docs Book a demo

Collected once.
Shaped for every consumer.

Every source, pushed or pulled, enters the same pipeline. The Brain maps it to your schema, and the Muscle normalizes and routes it in real time, so a new source reaches every destination the day it's connected.

Collects from

  • Okta
  • CrowdStrike
  • Microsoft 365
  • AWS CloudTrail
  • Palo Alto Networks
  • Kafka

A team adopts a new SaaS tool on Monday.
When does the SOC see its logs?

Hand-built

Weeks

Write the API client, handle paging and rate limits, schedule it, monitor it, and fix it when the API changes.

With Fleak

Same day

Pick the connector, paste the API key, backfill the last 90 days, and route normalized events to the SIEM.

Upkeep

Managed

Connector updates, API changes, and schema drift are Fleak's problem, not your on-call rotation's.

Every source on one ingestion layer: pushed, pulled, or discovered, and normalized before it reaches any destination.

"If it emits logs, Fleak connects to it. No hand-written collectors, no six-month onboarding."

Data collection · Fleak Platform

Bring the source nobody has onboarded.

30-minute working session. We'll connect it live and show the first normalized events.

Read the docs Book a demo

Explore Related

Edge

Collect and filter at the source

One agent, managed centrally, cutting volume before it moves.

See Detail →
OCSF

Every source in OCSF, long tail included

211 templates, plus AI-generated mappings for the rest.

See Detail →
Enrichment

Context in every event

Identity, asset, threat intel, and geo context in flight.

See Detail →