Integrations

Bring security telemetry into Flarehawk.

10 of 15 connectors are live today. Search or filter the catalog to find the security sources your team already runs.

15 of 15 integrations

Live

Cloudflare

Monitor Cloudflare Logpush datasets across zone and account assets.

Edge & CDNView

Coming soon

Amazon Web Services

Ingest CloudTrail management events, IAM and Identity Center sign-ins, VPC flow logs, and WAF web ACL requests from an AWS account.

Cloud

Coming soon

Google Cloud

Ingest Cloud Audit admin activity, IAM and service account changes, VPC flow logs, and Cloud Armor policy requests from a GCP project.

Cloud

Live

Okta

Ingest Okta System Log identity and administrative telemetry.

Identity & SaaSConnect

Live

Microsoft 365 & Entra ID

Ingest Microsoft Entra ID sign-in and directory audit logs plus Microsoft 365 unified and Exchange mailbox audit activity from a single tenant connection.

Identity & SaaSConnect

Live

Google Workspace

Ingest Google Workspace login, admin, Gmail, and Drive audit telemetry.

Identity & SaaSConnect

Live

Akamai

Ingest Akamai edge security, SIEM, and DataStream telemetry.

Edge & CDNConnect

Live

Imperva

Ingest Imperva WAF and API Security telemetry.

Edge & CDNConnect

Coming soon

Fortinet

Ingest FortiGate firewall logs so perimeter allow and deny decisions sit alongside edge and identity evidence in one timeline.

Network & Endpoint

Coming soon

Palo Alto Networks

Ingest Palo Alto threat and firewall logs so blocked exploits and perimeter activity join the same investigation timeline.

Network & Endpoint

Coming soon

Cisco

Ingest Cisco Secure Firewall logs to correlate perimeter enforcement with the edge and identity signals already in Flarehawk.

Network & Endpoint

Live

Ingest Zscaler Zero Trust Exchange telemetry — ZIA Internet Access (web, firewall, DNS, Client Connector tunnels) via Cloud NSS, and ZPA Private Access user activity via LSS — into one network investigation timeline.

Network & EndpointConnect

Live

Fastly

Monitor Fastly edge HTTP and WAF telemetry with API-managed HTTPS log streaming to Flarehawk.

Edge & CDNView

Live

Auth0

Ingest Auth0 tenant logs for identity authentication, MFA, and administrative events.

Identity & SaaSConnect

Live

Custom source

Ingest logs from platforms without a native Flarehawk connector. Currently supports the Splunk HEC protocol; request other protocols from support.

CustomConnect

Need a source that is not here yet?

Request an integration

Availability follows the same provider catalog as the dashboard and ingest pipeline.

Principles

How Flarehawk chooses integrations

The roadmap focuses on sources that improve investigation quality, response confidence, and retained evidence.

Security context first

Integrations should add useful investigation context, not just another unfiltered event stream.

Evidence stays queryable

Telemetry should remain searchable, retainable, and attached to incident narratives.

Response paths matter

Flarehawk prioritizes sources that can support practical remediation and follow-up workflows.

Start free

See how much Flarehawk can save you.

Find suspicious activity

Connect a telemetry source free. No credit card, no sales call.