Context lives in other systems
Department and manager in Active Directory, owner in the CMDB, criticality in a spreadsheet, reputation in a threat feed. None of it is in the log.
Fleak joins the Databricks startup accelerator. See the announcement
Context in the event, not in the analyst's head.
Fleak adds identity, asset, threat intel, vulnerability, and GeoIP context to every event in flight. Analysts and agents start with the answers to the first three questions, and the SOAR stops making the same lookups on every alert.
- Identity
- Asset & CMDB
- Threat intel
- GeoIP
- Vulnerabilities
- Lookup tables
Every alert starts with
the same three lookups.
Who is this user? What is this host? Is this IP known-bad? Analysts answer them by hand on every alert, and AI agents spend tokens answering them too.
Query-time joins are slow
Joining at search time runs on every query, against data you have already paid to ingest at SIEM prices.
SOAR repeats the work
Playbooks call the same directory, CMDB, and reputation APIs for every alert, and hit their rate limits on the busy days.
Context attached
before the SIEM sees the event.
Enrichment runs as a node in the pipeline. In-memory lookups add no network call per event, and the enriched event is what every destination receives.
Identity context
Pull department, manager, account type, and privileged-group membership from Active Directory, LDAP, or your identity provider.
Asset and CMDB context
Attach owner, business unit, and criticality from your CMDB or asset inventory, including ServiceNow, to every host and IP.
Threat intel and vulnerabilities
Match IPs, domains, and hashes against your threat intel feeds, and flag assets with known exploited vulnerabilities from CISA KEV and your scanners.
GeoIP and network zones
Add country, city, and ASN to external addresses, and classify internal ones against your own subnets and zones.
Any lookup, any source
Join on CSV tables, Postgres, BigQuery, or any HTTP API, with lookups refreshed on the schedule you set.
Explicit miss handling
Decide what happens when nothing matches: pass the event through, set the field to null, or fail the event for review.
Asset discovery
Fleak discovers the assets behind your telemetry and keeps a live inventory with owner, business unit, hardware, network, and CVE context.
A knowledge graph of your environment
Relationships between users, hosts, services, and owners turn an IP address into a device, an owner, and a blast radius.
Indicators indexed in flight
IPs, domains, URLs, and hashes are extracted as events pass, with first-seen, last-seen, and frequency, so an IOC hunt returns in seconds.
Do the lookups once, upstream.
The SIEM, the lake, the SOAR, and every agent downstream receive the same context.
Enriched in flight.
Investigated with context.
Fleak looks up context for every event as it passes through the pipeline and attaches the result next to the original fields. Detections, hunts, playbooks, and AI agents downstream read one record with everything they need.
Context sources
- Active Directory
- ServiceNow CMDB
- Threat intel feeds
- CISA KEV
- GeoIP
- HTTP APIs
A failed login for svc-backup from 10.20.4.17.
What does the analyst see?
Raw
3 lookupsA username and an IP address. The analyst opens the directory, the CMDB, and the network map before triage can start.
Enriched
In the eventA service account owned by the backup team, on a critical host in the production data zone. Triage starts with context.
Trust model
Your dataContext comes from your own directory, CMDB, feeds, and APIs. Nothing is inferred by a model.
Enrich once, upstream. The SIEM, the lake, and every AI agent downstream receive the same context, and nobody repeats the lookup.
"The first ten minutes of every investigation are lookups. Do them once, in the pipeline, for every event."
Enrichment · Fleak Platform
Bring an alert your team triages by hand.
30-minute working session. We'll enrich it live from a lookup table you bring.
Explore Related
Mask sensitive data in flight
Detectors, custom patterns, hashing, and quarantine.
See Detail →Test, version, and roll back
Pipelines built and shipped like software.
See Detail →Route every log by what it's for
SIEM, lake, and archive, each in its own schema.
See Detail →