Fleak joins the Databricks startup accelerator. See the announcement

A security data lake that's query-ready on arrival.

Fleak normalizes every source to OCSF before it lands, then writes it to Databricks, Snowflake, Amazon Security Lake, BigQuery, ClickHouse, or S3 as typed Parquet or Delta. Hunters query fields, not raw JSON.

Book a demo See how it works
  • Databricks
  • Snowflake
  • Amazon Security Lake
  • BigQuery
  • ClickHouse
  • Amazon S3

60–80%

SIEM ingest reduction

high-volume telemetry lands in the lake instead

Up to 50%

Storage cost reduction

duplicates dropped before they're written

0

Copies kept by Fleak

data moves in memory, straight into your lake

Landing logs is cheap.
Querying raw logs is not.

Raw vendor logs in a lake are a backlog, not a dataset. Every hunt starts with parsing, and every schema change breaks a table.

Raw JSON is a swamp

Each vendor's nested JSON lands as-is. Hunters rewrite the same field extractions in every query, and joins across sources need a data engineer.

Schema changes break tables

A vendor adds a field or changes a type. The write fails or the column silently drops, and nobody notices until a hunt comes back empty.

Two pipelines, two truths

One pipeline feeds the SIEM and another feeds the lake, each with its own parser. The counts never reconcile and every change is made twice.

OCSF in, typed tables out,
schema enforced on write.

Fleak parses and normalizes in flight, so what lands in the lake is already a table: typed columns, OCSF field names, one schema across every source.

OCSF tables, not raw blobs

Every source lands normalized to OCSF classes, so a hunt across Okta, CloudTrail, and your firewall is one query over one set of fields.

Every lake and warehouse

Databricks through Unity Catalog or Zerobus streaming, Snowflake with Snowpipe Streaming, Amazon Security Lake, BigQuery, ClickHouse, Apache Iceberg tables, S3, Azure Blob, and GCS.

Open, typed formats

Write Parquet or Delta Lake, partitioned by date and typed against the schema. No proprietary format between you and your data.

Schema enforced on write

Outputs enforce the destination schema as records are written. A record that doesn't fit goes to a dead-letter queue, not into your table.

Tiered by value

The same stream feeds the SIEM's hot path, hot lake tables for hunting, and compressed archive storage for retention.

Your storage, your account

Data lands in your own buckets and tables, next to the rest of your analytics. Fleak keeps no copy, so leaving never means a migration.

Schema evolution, logged

When a source adds a field, the table gains a column before the batch lands, and every schema change is audit-logged.

Bronze to gold

Land raw events, then curated OCSF tables, following the medallion pattern your data team already runs.

Streaming without staging

Stream into Snowflake and Databricks with backpressure, retries, and exactly-once delivery handled for you. No staging layer to operate.

Stop parsing at query time.

Normalize once in flight. Every query, dashboard, and agent starts from typed OCSF fields.

Read the docs Book a demo

The Brain shapes.
The Muscle lands it.

The Brain generates the OCSF mapping and the table schema from samples. The Muscle writes every event deterministically, in memory, straight into your lake. Nothing is staged and nothing is stored by Fleak.

Lake and warehouse destinations

  • Databricks
  • Snowflake
  • Amazon Security Lake
  • BigQuery
  • ClickHouse

A day of firewall, EDR, and identity logs.
Where does each event belong?

SIEM

Hot path

Only the event types that drive real-time detections. Normalized, so correlation rules stay simple.

Lakehouse

Hunt

Full-fidelity OCSF tables in Delta or Parquet. Threat hunters and AI agents query typed fields.

Object storage

Retain

Compliance retention at object-storage prices, in a schema an auditor can still query next year.

The lake gets the full corpus, already normalized. The SIEM gets what needs real-time correlation. Both read the same schema.

"A data lake is only cheaper than a SIEM if the data in it is usable. Normalize before it lands, and every query starts from a table."
Fleak is in the Databricks AI accelerator →

Security data lake · Fleak Platform

Bring your lake and your noisiest source.

30-minute working session. We'll land it in your lake as an OCSF table.

Read the docs Book a demo

Explore Related

Observability

Observability that scales with value

Logs to metrics, trace sampling, cost per team.

See Detail →
AI agents & MCP

Pipelines in plain English, data over MCP

A copilot for engineers. An MCP server for agents.

See Detail →
AI observability

Every agent session on the record

Normalize, mask, and route AI agent telemetry.

See Detail →