Fleak joins the Databricks startup accelerator. See the announcement

Investigate across every store. Without moving the data first.

Fleak searches normalized security data where it already lives: the lake, object storage, and your SIEMs. Ask in plain English, follow the AI's next step, and keep the whole investigation in one notebook.

Book a demo See how it works
  • Search in place
  • Natural-language queries
  • AI-guided investigation
  • Notebooks
  • Scheduled searches
  • OCSF

0

Rehydration jobs

data is searched where it already lives

1

Schema across stores

every source normalized to OCSF on the way in

~40%

Lower token cost

for AI agents querying normalized data (Gruve)

The answer is in the archive.
The tools can't reach it.

Investigations stall when the data that matters sits outside the SIEM, in a different format, behind a rehydration ticket.

Rehydrate before you can ask

Archived logs have to be re-ingested before anyone can search them. The incident waits on a data engineering task.

Five stores, five query languages

SPL in one place, KQL in another, SQL in the lake. Every pivot is a translation exercise.

Investigations in screenshots

Queries, findings, and notes are spread across tabs and chat threads, so nobody can reproduce how the conclusion was reached.

Ask the question once,
across everywhere the data lives.

Because Fleak normalized the data on the way in, one query works across the lake, the archive, and the SIEM, and humans and agents read the same fields.

Search in place

Query data in S3, Azure Blob, Google Cloud Storage, Amazon Security Lake, Databricks, Snowflake, and Elasticsearch without rehydrating or re-indexing it.

Plain English, or SQL, KQL, and SPL

Ask what happened in plain English, or drop into SQL, KQL, or SPL. Fleak routes each query to the right engine for the store and explains the results.

AI-guided investigation

The Brain suggests the next pivot, correlates entities across sources, and pulls context from your tickets and runbooks.

Notebooks

Keep queries, charts, and notes for an investigation in one shared notebook, start from templates, and export it to the incident ticket.

Dashboards and scheduled searches

Turn a search into a dashboard or a scheduled alert that notifies Slack, PagerDuty, email, or a webhook.

Send findings back

Push the events an investigation found back through the pipeline into the SIEM or a case, normalized and enriched.

Cost shown before you run

See the data scanned and the estimated cost before a query runs. No surprise cloud bill.

An investigation agent

Hand the agent a lead, such as an alert, an IOC, or a ticket. It searches, adds context, and returns a timeline with every step cited back to source.

One catalog for every store

Managed, bring-your-own, and federated stores appear in one catalog, with schemas inferred and fields documented with sample values.

You can't search what you never kept.

Keep it all in cheap storage, normalized, and search it in place when the incident needs it.

Read the docs Book a demo

The Brain asks.
The data answers in place.

The Brain turns a question into queries against each store and stitches the results into one timeline. Because every source was normalized to OCSF on the way in, the same field means the same thing in every store.

Searches across

  • Amazon S3
  • Amazon Security Lake
  • Databricks
  • Snowflake
  • Elasticsearch
  • Splunk

Did this compromised account touch anything else last quarter?
Where do you look?

Without Fleak

Days

Request a rehydration of 90 days of archived logs, wait for the job, then translate the query into three languages.

With Fleak

Minutes

Ask once. The query runs against the lake, the archive, and the SIEM in place, on the same OCSF fields.

Record

Notebook

Every query, result, and note is saved in the investigation notebook and exported to the case.

Investigate across every store with one question. Nothing is rehydrated, and every step is on the record.

"An investigation shouldn't wait on a data engineering ticket. Normalize on the way in, and search where the data already lives."

Investigations · Fleak Platform

Bring the question you couldn't answer last incident.

30-minute working session. We'll show how it gets answered across your stores.

Read the docs Book a demo

Explore Related

Monitoring

Know a pipeline broke before the dashboard does

Throughput, errors, field health, and alerts.

See Detail →
SIEM migration

Run both SIEMs, cut over by source

Every source dual-shipped from one pipeline.

See Detail →
SIEM evaluation

Evaluate SIEMs on your own data

Every candidate fed the same live events.

See Detail →