Skip to main content

​
30-Day Baseline

Flare builds a rolling frequency baseline from your analysis history. Each time you run an analysis, Flare records how often every field value appeared. On subsequent runs, it compares the current batch against the last 30 days of data to surface what has changed.

​
Why it matters

Without historical context, an LLM analyzing a single batch of logs has to guess what’s “normal.” A SetIamPolicy call might be routine in your environment or a once-a-year event. The 30-day baseline removes the guesswork by giving Flare exact historical frequencies for every field value it has seen before. The result: fewer false positives on routine activity, higher confidence on genuine deviations, and automatic detection of new values that have never appeared in your environment.

​
How it works

1

Record

After each analysis (manual or scheduled), Flare records the frequency distribution of every field value in the log batch. For example: principalEmail: [email protected] appeared in 62% of events, [email protected] in 30%.
2

Compare

On the next analysis, Flare queries the last 30 days of recorded frequencies and computes the average percentage for each field value across all prior runs.
3

Annotate

The current batch frequencies are compared against the 30-day averages. Deviations are injected into the analysis context so Flare can calibrate anomaly scores based on what has actually changed.

​
Reading deviation indicators

When 30-day baseline data is available, anomaly explanations reference historical context. In the underlying analysis, each field value is annotated with its deviation from the baseline:

​
What the deviation levels mean

  • HIGH (above 20% shift) — something has clearly changed. A principal that normally accounts for 40% of activity now accounts for 65%, or a new actor appeared at 15%. Worth investigating.
  • MEDIUM (10-20% shift) — moderate change. Could be seasonal variation or the start of something. Flare considers these in scoring but they rarely drive Critical findings on their own.
  • LOW (5-10% shift) — minor fluctuation. Normal operational variance in most environments.
  • Stable (under 5% shift) — business as usual. Flare deprioritizes stable fields to focus on what actually changed.

​
Baseline coverage

The baseline gets more useful with every analysis you run:
Set up scheduled runs to build baseline coverage automatically. A daily scheduled run gives you 30 data points within a month — enough for reliable deviation scoring.

​
NEW values vs. First Seen

Both flag new activity, but at different levels:
  • First Seen badge — tracks whether a specific field value (e.g., a service account email) has ever appeared in a previous anomaly finding. Binary: seen or not seen.
  • NEW in baseline — tracks whether a value has appeared in any previous analysis (not just anomalies). The 30-day baseline covers all field values in the log batch, not just the ones flagged as anomalous.
A value can be “NEW in baseline” without being “First Seen” — it may have appeared in logs before but was never flagged as an anomaly.

​
Data retention

Frequency snapshots are tied to your analysis records and follow the same retention policy. Snapshots older than 37 days are eligible for cleanup. Only aggregate frequency data is stored (field name, value, count, percentage) — never raw log content.