60–80%
SIEM ingest reduction
the rest retained in object storage
Fleak joins the Databricks startup accelerator. See the announcement
Public sector telemetry, retained, normalized, and in your control.
Fleak collects and normalizes logs across agencies, campuses, and departments, keeps full-fidelity data for mandated retention at storage prices, and routes only what detections need to the SIEM. It runs in your environment, including disconnected networks.
- M-21-31 logging
- Zero trust
- OCSF
- SIEM migration
- Air-gapped
- Higher education
30–50%
SOC spend reduction
every log routed to where its job gets done
6mo → 1wk
Time to onboard a source
legacy and custom systems included
Logging mandates grow.
Budgets don't.
Mandates call for more log categories, kept longer, from systems that span decades. A SIEM priced per gigabyte can't hold all of it.
Retention a SIEM can't afford
M-21-31 calls for 12 months of active storage and 18 more months of cold storage for many log categories. At SIEM prices, that money comes from detection.
A mix of eras
Mainframes, legacy applications, campus networks, and cloud services each log in their own format, and few of them were built to be monitored together.
Shared services, many tenants
Central IT serves departments and campuses with different policies, budgets, and tools, all through the same pipeline.
Mandate-ready logging,
at storage prices.
Fleak collects, normalizes, and retains what the mandate requires, and sends the SIEM only the slice detections use.
Built for logging mandates
Collect, normalize, and retain the log categories M-21-31 requires, with 12 months active and 18 months cold at object-storage prices.
Zero trust telemetry
Identity, device, network, and application logs land in one schema, ready for zero trust analytics and policy decisions.
Route by value
Detections get the event types they use. Everything else goes to full-fidelity storage, searchable in place.
Replay for investigations
Bring back any slice of retained data for an incident, an audit, or an inspector general request.
SIEM migration with parity
Ship every source to the old and new SIEM at the same time and cut over when the data matches.
Mask before sharing
Mask personal data before it reaches shared services, partner agencies, or contractors.
One fabric, many tenants
Run departments and campuses as isolated tenants with their own policies, overseen from one central console.
Inside your boundary
Deploy in your cloud, including government regions, on-prem, or air-gapped on disconnected networks.
Legacy to cloud
Normalize mainframe, legacy application, and cloud service logs into one schema, without rewriting a parser for each.
Keep everything the mandate requires.
Pay SIEM prices only for what detections use. Retain the rest for a fraction of the cost.
The Brain plans.
The Muscle retains.
The Brain maps every source to one schema and plans where each log category belongs. The Muscle routes and retains every event deterministically, inside your boundary.
Built for
- Federal civilian agencies
- Defense & intelligence
- State & local government
- Higher education
- Academic medical centers
An inspector general asks for 18 months of authentication logs.
Where are they?
Without Fleak
GoneOnly 90 days fit in the SIEM budget. The rest was never kept.
With Fleak
ReplayedEighteen months sit in cold storage in OCSF, and the slice the request needs is replayed in hours.
Cost
Storage ratesRetention priced like object storage, not like a SIEM.
Retain what the mandate requires, normalize it once, and replay it when someone asks.
"Logging mandates are a storage problem dressed up as a SIEM problem. Normalize once, retain cheaply, and replay on demand."
Public sector · Fleak Platform
Bring your logging mandate.
30-minute working session. We'll map your log categories to retention tiers and show the cost.
Explore Related
Store it cheap, replay it when it matters
A full-fidelity archive, replayed through the same pipeline.
See Detail →Run both SIEMs, cut over by source
Every source dual-shipped from one pipeline.
See Detail →OCSF tables in your lake on arrival
Databricks, Snowflake, BigQuery, ClickHouse, and S3.
See Detail →