Fleak joins the Databricks startup accelerator. See the announcement

Every source in OCSF. Not just the ones with a template.

Start from 211 community templates, or let Fleak's Brain read sample logs and generate the OCSF mapping in minutes. Your engineer reviews it. Zephflow runs it on every event, with no AI in the data path.

Book a demo See how it works
  • OCSF
  • UDM
  • ECS
  • ASIM
  • Splunk CIM
  • Custom schemas

211

Community OCSF templates

in the open ocsf.ai library, ready to edit

< 5 min

New source to OCSF

Zscaler and Okta onboarding in the Gruve benchmark

100%

Schema consistency

every source on one OCSF shape (Gruve benchmark)

Every tool logs in its own dialect.
Your detections pay the translation tax.

OCSF fixes the vocabulary. Someone still has to map every source onto it, and keep the mapping right when the source changes.

One user, three identities

Okta logs actor.alternateId. CloudTrail logs userIdentity.arn. Entra ID logs userPrincipalName. Without one schema, UEBA scores three people instead of one.

Templates stop at the popular sources

Prebuilt mappings cover CloudTrail and Okta. The regional firewall, the in-house app, and the OT gateway still need someone to write the mapping by hand.

Mappings break quietly

A vendor renames a field or OCSF ships a new version. The mapping keeps running, the field goes null, and the detection stops firing without an error.

OCSF mappings,
templated, generated, maintained.

Use a template where one exists and generate the mapping where none does. Either way your team approves the rules, a deterministic engine runs them, and Fleak repairs them when the source drifts.

211 templates, version-pinned

Start from community templates for CloudTrail, Security Hub, Cisco ASA, Windows, Zeek, and more, each pinned to an OCSF version. Contribute your own back to ocsf.ai.

AI mapping for everything else

For a source with no template, the Brain reads sample logs, generates the parser and the field-by-field rules, and gets about 90% of fields right on the first pass.

Mixed logs, sorted first

Paste a bulk mix of formats. Fleak groups the logs by type and generates one mapping per group.

Validated, reviewed, versioned

Output is validated against the schema. Your engineer edits any rule, regenerates any field, and approves the version that ships.

Any target schema

Map to OCSF, Google UDM, Elastic ECS, Microsoft ASIM, Splunk CIM, or the internal schema your detections already use. Automate it all through the API.

Delivered where detections run

Send normalized events to Splunk, Microsoft Sentinel, Palo Alto XSIAM, Amazon Security Lake, Databricks, or Snowflake, at 8,000 events/sec per CPU.

Confidence on every field

Each generated mapping carries a confidence score per field, so reviewers spend their time on the fields that need a human.

Nothing silently dropped

Fields that don't map cleanly are classified, kept with the event, and flagged for extension instead of disappearing.

Any format in

JSON, key-value, CEF, LEEF, XML, CSV, pipe-delimited, and unstructured logs, parsed without hand-written regex or grok.

Write the detection once.

Every source you onboard next inherits it, because every source arrives in the same schema.

Browse the templates Book a demo

From raw log to OCSF
in four steps.

01 / Bring sample logs

Pick a template or paste samples. JSON, syslog, CEF, LEEF, key-value, CSV, XML, and free-text logs all work.

02 / Generate the mapping

The Brain proposes the OCSF class, the parser, and the rule for every field it finds, in about 3 minutes.

03 / Validate and approve

Check the output against the schema, regenerate any field that's wrong, and approve the rules.

04 / Normalize every event

Zephflow runs the mapping in-stream and routes OCSF events to every destination that needs them.

The Brain maps.
The Muscle normalizes.

The Brain works on samples: it writes the parser and the mapping rules, then validates them against the schema. The Muscle runs the approved rules deterministically on every production event, so the same input always produces the same OCSF record.

OCSF consumers that inherit the work

  • Splunk
  • Microsoft Sentinel
  • Amazon Security Lake
  • Databricks
  • AI SOC agents

A failed AWS console login and a failed Windows logon arrive.
What does the detection rule see?

Raw

Two schemas

eventName ConsoleLogin with responseElements.ConsoleLogin Failure in one. EventID 4625 with a status code in the other. Two rules for one behavior.

OCSF

Class 3002

Both become Authentication events with activity Logon and status Failure. One rule covers the cloud console and the domain controller.

Trust model

Reviewed

Rules generated from samples, validated against the schema, and approved by your engineer before any production event runs through them.

Write the detection once against OCSF. Every source you onboard next inherits it, including the ones nobody publishes a template for.

"Same AI engine, same SOC, same prompts. Only the data shape changed. After OCSF normalization, detection fidelity moved from Tier 1 to Tier 3 with about 40% lower token cost."
Read the benchmark →

Joint Fleak + Gruve benchmark, 2026

Bring a source with no OCSF template.

30-minute working session. We map it live and show you the OCSF output.

Read the docs Book a demo

Explore Related

Enrichment

Context in every event

Identity, asset, threat intel, and geo context in flight.

See Detail →
PII masking

Mask sensitive data in flight

Detectors, custom patterns, hashing, and quarantine.

See Detail →
Pipeline lifecycle

Test, version, and roll back

Pipelines built and shipped like software.

See Detail →