Fleak joins the Databricks startup accelerator. See the announcement

Route every log by what it's for.

Fleak evaluates each event type against what every downstream tool needs, then sends it there: correlation to the SIEM, hunting data to the lake, compliance logs to the archive. One ingestion stream, any number of destinations.

Book a demo See how it works
  • Content-based routing
  • Multi-destination fan-out
  • Per-destination schemas
  • Hot / warm / cold tiers
  • Persistent queues

60–80%

SIEM ingest reduction

signal-worthy event types only

30–50%

SOC spend reduction

every log routed to where its job gets done

Millions

Events per second, real time

zero storage required

Static routes can't tell
a detection from a debug log.

Most routing rules match on source and severity. They have no idea which events a detection, a hunt, or an auditor actually uses.

Everything goes to the SIEM

When the routing layer can't judge value, the default destination is the most expensive one.

Rules rot

Hand-written regex routes break when a vendor changes a field, and nobody notices which events stopped arriving.

One copy, one shape

Each tool wants the event in its own schema. Without per-destination shaping, every consumer writes its own parser.

One stream in,
every destination served.

Fleak decides where each event belongs, shapes it for that destination, and delivers it, with no event lost when a destination slows down.

Intent-aware routing

The Brain classifies event types by downstream value and proposes where each belongs. Your team approves the rules before anything is filtered.

Fan out to every destination

Send the same event to the SIEM, the lake, the archive, and your AI agents from one stream, with no egress charge per destination.

Per-destination shaping

Each destination receives the schema it expects: OCSF for the lake, the native format for each SIEM, a compact shape for your agents.

Tiers by value

Hot path for real-time correlation, warm tables for hunting, cold storage for retention. Routing picks the tier per event type.

Content-based rules

Route on any field, value, or expression, such as severity, event type, user, asset criticality, or network zone.

Delivery you can trust

Persistent queues and backpressure hold events when a destination slows or fails, then deliver them in order once it recovers.

Cut egress with in-region processing

Process and reduce data in the region and cloud where it's produced, so only what's needed crosses regions and clouds.

Versioned, auditable routes

Every routing rule is versioned and audited, and stays portable when you change the SIEM or the lake behind it.

Only approved destinations

Policies bind each class of data to the destinations allowed to receive it, so sensitive data never lands somewhere it shouldn't.

Not every log deserves a SIEM.

Every log deserves to land where its job gets done. Routing by intent, not by log score.

Read the docs Book a demo

The Brain decides where.
The Muscle delivers.

The Brain evaluates each event type against what your downstream tools need and drafts the routing rules. The Muscle executes the approved rules deterministically for every event, at line rate, with no model in the path.

Destinations

  • Splunk
  • Microsoft Sentinel
  • Palo Alto XSIAM
  • Databricks
  • Snowflake
  • Amazon S3

A day of DNS, EDR, and CloudTrail events.
Where does each one go?

SIEM

Hot path

Only event types with a detection behind them: failed admin logons, new process trees, IAM policy changes.

Data lake

Hunt

Full-fidelity DNS and EDR telemetry for threat hunting, at object-storage prices.

Archive

Retain

Routine CloudTrail reads kept for compliance, queryable when an auditor asks.

Signal goes to the SIEM, the full corpus to the lake, and noise nowhere. Add a destination without touching a single source.

"Not every log deserves a SIEM. Every log deserves to land where its job gets done."

Intent-based routing · Fleak Platform

Bring your noisiest log source.

30-minute working session. We'll show you where each event type belongs, and what it stops costing your SIEM.

Read the docs Book a demo

Explore Related

Log reduction

Less volume, same coverage

Filter, trim, deduplicate, sample, and aggregate in flight.

See Detail →
Replay

Store it cheap, replay it when it matters

A full-fidelity archive, replayed through the same pipeline.

See Detail →
Detection

Catch the known-bad before it's indexed

Sigma rules and ATT&CK coverage on normalized events.

See Detail →