Skip to main content
Flarehawk ingests security events from the tools that already sit in front of your applications — no agents to install, no code to deploy. Once you connect a source through one of our integrations, HTTP request and security events flow directly into the platform. From there, Flarehawk analyzes every batch of events in real time using a combination of statistical detection rules and machine learning models, and surfaces the results in the dashboard as alerts, analytics, and searchable raw events.

​
The data flow

1

Your source sends events to Flarehawk

You connect an upstream security tool through one of our integrations. Flarehawk automatically provisions the right delivery mode for your environment, so events stream to a Flarehawk ingest endpoint over HTTPS. No agents or SDKs are involved on your infrastructure.
2

Flarehawk receives and validates the batch

Each incoming batch is authenticated using your ingest token. Flarehawk validates the event format, parses each record, and stores the raw events so you can search and download them later from the Logs page.
3

Detection rules and ML models run on the batch

Immediately after ingestion, Flarehawk evaluates the batch against your asset’s active detection rules. Statistical rules check for deviations from learned baselines. On the Complete tier, ML ensemble models also run — analyzing behavioral sequences, temporal patterns, and multi-signal combinations.
4

Alerts are generated and enriched

When a rule fires, Flarehawk creates an alert within two minutes of the event batch arriving. Before the alert appears in your dashboard, it is enriched with IP geolocation data, ASN information, and abuse reputation scores, giving you immediate context about the source.
5

Dashboard surfaces alerts and analytics

The Flarehawk dashboard shows you open alerts with full evidence detail, time-series analytics across your traffic, and access to raw events for deeper investigation. You can acknowledge alerts, mark false positives, and download events filtered by time, IP, or path.

​
What Flarehawk analyzes

Flarehawk processes two complementary event datasets from each connected source: Both datasets feed into the same detection pipeline, so rules can correlate traffic volume anomalies with security activity patterns. See Integrations for the list of supported sources and the specific datasets each one delivers.

​
Detection latency

Flarehawk targets an end-to-end detection latency of under two minutes — from the moment your source delivers an event batch to the moment an alert appears in your dashboard.
Actual latency depends on your source’s delivery interval plus Flarehawk’s analysis time. For most assets, alerts appear within 60–90 seconds of the underlying events occurring upstream.

​
No infrastructure changes required

You do not need to change your application, modify DNS, or route traffic through Flarehawk. The platform reads events that your existing security tools already generate. Your end users are unaffected, and there is no latency impact on your origin.
If you have multiple assets or properties, you can add each one as a separate asset in Flarehawk and monitor them independently from the same dashboard.