60–80%
SIEM ingest reduction
data no rule, hunt, or report reads leaves the SIEM
Fleak joins the Databricks startup accelerator. See the announcement
Detect the threats that matter. Pay only for the data they need.
Fleak researches each new threat against your own telemetry, writes and tests the detection for your SIEM, and ties every source and field to the rules that read it. Broken rules get fixed, noisy ones get tuned, and unused data leaves the SIEM, all in the stack you already run.
- Threat research
- Detection as code
- MITRE ATT&CK
- Rule health
- Alert tuning
- Detection-driven data
6mo → 1wk
Time to onboard a source
when a new detection needs telemetry you don't collect
< 3 min
Mean heal time
when a schema change would leave a rule blind
More data, more rules, more alerts,
and less certainty you're covered.
Detection engineers write rules by hand, SIEM bills grow with data nobody queries, and nobody knows which rules stopped working until an incident shows it.
Coverage trails the threat
A new technique is public the day it's reported. Researching it, finding the telemetry, and writing a tested rule takes weeks of a scarce engineer's time.
Rules break quietly
A field gets renamed, a source stops sending, or a parser changes. The rule still shows as enabled, but it can no longer fire.
Data kept just in case
Without a map from each source and field to the rules that read it, nobody can say what's safe to drop, so the SIEM keeps everything.
One loop from threat to detection,
and from detection to data.
Fleak connects threat research, detection engineering, and the data pipeline, so every rule has the data it needs and every byte in the SIEM has a rule that reads it.
Threat research, automated
Fleak tracks new threat reports and advisories, extracts the techniques and tradecraft, and works out what telemetry and logic a detection needs.
Your intel, your red team
Add red team findings, threat intel feeds, and your own threat models. Each one becomes a prioritized queue of detections to build.
Gaps found in your environment
Each threat is checked against the sources, fields, and rules you actually have, so the gaps are real ones, not a generic checklist.
Detections written for your SIEM
Fleak writes each rule in your SIEM's language, such as SPL, KQL, or YARA-L, or in Sigma, and tests it against your own data before anyone reviews it.
Shipped as code
New and changed rules arrive as pull requests in GitHub, GitLab, or Bitbucket, with test results attached, and deploy through your existing process.
Rules checked on live data
Fleak confirms each rule's sources are arriving and its fields are populated, and fixes the rule or the pipeline when a change breaks it.
Noisy rules tuned
Rules that fire too often or never lead anywhere are tuned with analyst feedback, without dropping the behavior they're meant to catch.
Every field tied to a detection
Each source and field is mapped to the rules, hunts, and reports that use it. Keep it in the SIEM, send it to cold storage, or stop collecting it.
Coverage you can report
ATT&CK coverage, rule health, and data spend in one view, so you can show what's covered, what changed, and what it costs.
Every rule needs data. Every byte should serve a rule.
Fleak keeps the two in sync, so coverage goes up while SIEM spend comes down.
From the stack you run to a working loop,
in four steps.
01 / Connect your stack
Give Fleak read access to your SIEM, pipeline, detection repo, and intel feeds. Nothing is ripped out or replaced.
02 / Map coverage and data
Fleak maps every rule to ATT&CK and to the sources and fields it reads, and flags data no rule uses.
03 / Close the gaps
New threats become tested detections as pull requests. Broken and noisy rules come back fixed.
04 / Trim and maintain
Unused data moves to cold storage or stops being collected, source by source, while health checks run continuously.
The Brain engineers.
The Muscle enforces.
The Brain researches each threat, writes the detection, and decides what data it needs. The Muscle enforces those data decisions in the pipeline, deterministically, on every event, and raises an alert when a rule's data stops arriving.
Works with
- Splunk
- Microsoft Sentinel
- Google SecOps
- CrowdStrike
- Elastic
- GitHub
- Jira
- Tines
A report on a new phishing kit lands.
What does Fleak do with it?
Coverage gap
ResearchTwo of the kit's five techniques aren't covered. One needs a proxy field you already collect. The other needs a source you don't.
New detection
Pull requestA rule for the first technique, tested on your proxy logs, opens as a pull request with sample matches attached.
Data change
PipelineThe missing source is onboarded through Fleak, and only the fields the new rule reads go to the SIEM.
Every threat ends as a tested rule, a data change, or a documented gap. Nothing waits in a backlog.
"A detection is only as good as the data under it. Engineer both together, and coverage stops decaying."
Detection engineering · Fleak Platform
FAQ
Frequently asked questions
Does Fleak replace my SIEM or SOAR?
No. Fleak writes, tests, and tunes rules for the SIEM you run today, shapes the data that feeds it, and hands alerts to your SOAR or AI SOC. If you change SIEMs, your detections and data decisions carry across.
Which rule languages does Fleak write?
Your SIEM's own language, such as SPL for Splunk, KQL for Microsoft Sentinel, and YARA-L for Google SecOps, plus Sigma for tools that run it.
Do new detections deploy automatically?
Only if you want them to. By default, every new or changed rule arrives as a pull request with test results, so your team reviews and merges it the way it does today.
How does Fleak decide which data is unused?
It maps each source and field to the rules, hunts, dashboards, and reports that read it. Data nothing reads is flagged, and you decide whether it stays, moves to cold storage, or stops being collected.
Can we bring our own threat intel?
Yes. Red team findings, threat intel feeds, and your own threat models join Fleak's threat research in one queue, ranked by how exposed your environment is.
Bring one threat report.
30-minute working session. We'll map it to your telemetry, show the gaps, and draft the first detection with you.
Explore Related
Catch the known-bad before it's indexed
Sigma rules and ATT&CK coverage on normalized events.
See Detail →Less volume, same coverage
Filter, trim, deduplicate, sample, and aggregate in flight.
See Detail →Know a pipeline broke before the dashboard does
Throughput, errors, field health, and alerts.
See Detail →