Detection Tiers

Flarehawk offers two detection tiers: Basic and Complete. The tier you select for an asset controls which detection rules and machine learning models run against that asset’s logs. You set the tier per asset, not per organization, so you can mix tiers across different domains based on their traffic volume and sensitivity.

Basic
Complete

Basic gives you 25 statistical detection rules covering the most common traffic anomalies and security events. Every rule compares current traffic patterns against an adaptive baseline. When traffic deviates beyond the configured threshold, an alert fires.Best for: lower-volume domains, internal tools, staging environments, and Free or Basic plan accounts.

Rules included

Category	Rules
Traffic anomalies	Traffic spike (RPM), bandwidth anomaly, response time outlier
Error rates	Elevated 5xx ratio, path-specific 5xx spike, rate limit violations
Authentication	Brute-force detection, authentication abuse (CUSUM)
Behavioral	Rare path spike, rare user-agent spike, IP rate spike, IP + path rate spike
WAF	WAF rule burst
Threat intel	AbuseIPDB blacklist matching
Enrichment	IP geolocation and ASN

Statistical methods adapt over time using a rolling baseline calibrated from your own traffic history, so thresholds automatically adjust to your domain’s normal patterns.

Complete includes all 25 statistical rules from the Basic tier plus 13 additional rules and a full ML ensemble. The ML models run alongside the statistical rules on every log batch and can surface subtle anomalies that statistical thresholds miss — particularly multi-signal behavioral shifts and temporal patterns.Best for: high-value production domains, customer-facing APIs, e-commerce, and any asset where early detection justifies the additional compute.

Additional rules

Detection	What it covers
Behavioral anomaly	Learns normal traffic patterns and flags multi-dimensional deviations
Temporal anomaly	Detects attacks that unfold gradually over time
Sequence anomaly	Identifies unusual request ordering and coordinated patterns
Ensemble anomaly	Combines signals from all ML models into a single high-confidence score
Graph-based anomaly	Identifies unusual relationships between IPs, paths, and user agents
Geographic anomaly	Detects shifts in the geographic distribution of your traffic
HTTP method anomaly	Flags unusual HTTP method usage

The ensemble rule is the primary ML signal. It aggregates scores from the individual models and adjusts based on false positive feedback you submit, improving accuracy over time.

ML models require a calibration period after an asset is first created or after the tier is upgraded. During calibration, statistical rules remain active. Full ML coverage begins once the models have observed enough traffic to establish reliable baselines.

Tier comparison

	Basic	Complete
Statistical rules	25	25
ML ensemble rules	—	13
Total rules	25	38
Adaptive baselines	Yes	Yes
IP geolocation enrichment	Yes	Yes
AbuseIPDB reputation	Yes	Yes
ML calibration period	—	Yes
Recommended volume	Low to medium	Any

Changing an asset’s tier

You can upgrade or downgrade a tier at any time from the asset’s settings page.

Open the asset settings

In the dashboard, navigate to Settings and select the asset you want to change.

Select the new tier

Under Detection, choose either Basic or Complete from the tier selector.

Save the change

Click Save. The new tier takes effect on the next log batch processed for that asset. There is no downtime or interruption to log ingestion during the change.

Downgrading from Complete to Basic stops ML model inference on future batches. Existing alerts generated by ML rules remain visible in your alert history.

Get Started

Core Concepts

Dashboard

Notifications

Detection

Flarehawk Intel

Billing

Rules included

Additional rules

Tier comparison

Changing an asset’s tier

​Rules included

​Additional rules

​Tier comparison

​Changing an asset’s tier

Rules included

Additional rules

Tier comparison

Changing an asset’s tier