Fleak joins the Databricks startup accelerator. See the announcement

Catch the known-bad before it's indexed.

Fleak matches Sigma rules against OCSF-normalized events in flight, maps your coverage to MITRE ATT&CK, and routes every match to the SIEM, SOAR, or AI triage in real time. The full stream still lands where it belongs.

Book a demo See how it works
  • Sigma rules
  • MITRE ATT&CK
  • OCSF
  • Correlation
  • AI triage
  • SOAR & ITSM

T1 → T3

Detection fidelity

same engine, OCSF-normalized input (Gruve)

1 rule

Every source of a log type

written once against OCSF, not per vendor

0

Indexing before detection

rules run on events in flight

Detections run last,
after the data is already paid for.

Every rule waits for ingest, indexing, and a scheduled search. Atomic tripwires don't need any of that.

Minutes of latency

Scheduled searches run every five or fifteen minutes. A known-bad indicator sits unnoticed in between.

Rules per source format

A Sigma rule has to be rewritten for every vendor's field names before it runs, and it breaks quietly when a schema drifts.

Cheap storage, unwatched data

Telemetry routed to the lake to save money is telemetry no rule ever sees.

Detection where the data flows,
coverage you can see.

Rules run on normalized events in the pipeline, so one rule covers every source of a log type, and nothing has to be indexed before it can be detected.

Sigma rules in the stream

Import your Sigma rules or start from the catalog, filter by log type and minimum severity, and exclude the ones you don't want.

Written once, against OCSF

Rules match normalized OCSF events, so one rule covers every EDR, identity provider, or firewall that produces that log type.

Correlation across sources

Chain matches across sources and time windows to surface multi-step attacks, not just single events.

ATT&CK coverage and rule health

Map active rules to MITRE ATT&CK, see the techniques you can't detect, and find rules that broke after a schema change or fire too often.

AI triage on every match

The Brain groups related matches into one alert, adds context, and ranks it, so analysts start with the alerts that matter.

Route matches anywhere

Send matches to the SIEM, a SOAR playbook, a ticketing queue, or an AI agent, while the full stream keeps flowing to its normal destinations.

Coverage gaps to sources

See which ATT&CK techniques you can't detect today and exactly which log sources to onboard to close each gap.

In sync with your SIEM

Fleak reads your SIEM's detection rules and schemas and keeps pipelines aligned, so a content update never leaves a rule reading fields that stopped arriving.

IOCs matched as events arrive

Match IPs, domains, and hashes against your threat intel in the stream and raise an early warning before downstream tools index the event.

Detect in flight. Keep the SIEM for history.

Atomic tripwires run in the pipeline. Correlation over months of data runs where that data lives.

Read the docs Book a demo

Normalize first.
Detect in flight.

The Brain normalizes every source to OCSF, so Sigma rules apply across vendors. The Muscle evaluates them deterministically on every event and routes matches in real time, before anything is stored or indexed.

Matches routed to

  • Splunk
  • Microsoft Sentinel
  • SOAR
  • ServiceNow
  • AI SOC agents

A PowerShell download cradle appears in an endpoint log.
How long until someone sees it?

Scheduled search

Minutes

Ingested, indexed, then caught by the next run of a scheduled search, if the field names still match.

In-stream

Real time

Matched in flight against the Sigma rule and routed to the SOC queue as the event arrives.

Coverage

Every EDR

The same rule matches the event from every endpoint vendor, because every source arrives in OCSF.

Atomic tripwires belong in the pipeline. Correlation and hunting still run where the history lives.

"The cheapest place to catch a known-bad event is the first place it passes through."

In-stream detection · Fleak Platform

Bring the rule that keeps breaking.

30-minute working session. We'll run it in-stream against OCSF and show you what it catches.

Read the docs Book a demo

Explore Related

Investigations

Investigate without rehydrating

One search across the lake, the archive, and the SIEM.

See Detail →
Monitoring

Know a pipeline broke before the dashboard does

Throughput, errors, field health, and alerts.

See Detail →
SIEM migration

Run both SIEMs, cut over by source

Every source dual-shipped from one pipeline.

See Detail →