Don’t see the source you need? Use Notify me on coming-soon providers in the connection picker, email [email protected], or use the live chat in the dashboard.
Available integrations
Cloudflare
Connect with OAuth or an API token. Flarehawk provisions managed Logpush for Enterprise zones and a managed Worker for Pro and Business plans.
Microsoft 365 & Entra ID — Beta
Connect with a single admin-consent OAuth flow. Ingest Entra sign-in and audit logs plus Microsoft 365 unified and mailbox audit activity for identity threat detection and data-access monitoring.
Google Workspace
Connect through managed administrator OAuth. Ingest Login, Admin, Drive, and Gmail activity with per-source health, analytics, and identity, audit, data-access, and email detections.
Fastly — Beta
Connect Fastly edge services with an API token. Flarehawk provisions HTTPS real-time logging for HTTP and Next-Gen WAF telemetry.
Akamai — Beta
Connect Akamai properties with EdgeGrid credentials for managed DataStream and SIEM ingestion, with provider-specific manual exact-IP response guidance.
Okta — System Log
Install from the Okta Integration Network, paste API Service client credentials, and follow the configuration guide for System Log ingestion, identity analytics, and remediation.
Zscaler — Beta
Stream Zscaler Zero Trust Exchange telemetry — ZIA Cloud NSS (web, firewall, DNS, tunnels) and ZPA user activity — into Flarehawk for network investigation.
How ingestion works
Regardless of source, every integration delivers events into the same Flarehawk pipeline:1
Authenticate the source
You connect the upstream tool (for example, a Cloudflare account API token) so Flarehawk can read events on your behalf.
2
Provision delivery
Flarehawk automatically configures the right delivery mode for your environment — for example, a Logpush job for Enterprise Cloudflare zones, or a managed Worker for non-Enterprise zones.
3
Ingest events in real time
Events flow into Flarehawk over HTTPS. Each event is authenticated, validated, and stored before being analyzed by the detection pipeline.
4
Analyze and alert
Detection rules and ML models run on every batch. Alerts surface in the dashboard within two minutes of the event occurring upstream.