Skip to main content

​
Conversational Follow-up

The GitHub App audit report has no saved analysis or follow-up chat. This page describes the saved analysis flow.
Every analysis in Flare includes a chat panel where you can ask questions about the findings. Flare uses the retained analysis metadata, summary, findings, scores and conversation history to help you understand what was detected and decide what to investigate next. The chat request does not include source-event excerpts; inspect those separately in the results panel when verifying a finding.

​
How to use it

The Flare Intelligence panel appears on the right side of any analysis results page. Type a question in the input field and press Enter or click Send. Flare includes up to 20 saved messages as conversation context, so you can ask follow-up questions that build on previous answers. Restate important details when a longer conversation moves beyond that context.

​
Good questions to ask

​
Understanding findings

  • “Why is SetIamPolicy anomalous?”
  • “What does a spike in PERMISSION_DENIED errors mean?”
  • “Is this service account supposed to be accessing this resource?”
  • “What’s the difference between the baseline and query frequency?”

​
Prioritizing response

  • “What should I investigate first?”
  • “Which of these findings is the most urgent?”
  • “Is this a known attack pattern?”
  • “Could this be a false positive?”

​
Taking action

  • “What are the remediation steps?”
  • “What GCP or AWS commands should I run to investigate this?”
  • “Which CloudTrail fields should I verify in AWS?”
  • “How do I revoke this service account key?”
  • “What should I tell my team about this?”

​
Getting context

  • “Can you summarize the attack timeline?”
  • “What other indicators should I check?”
  • “How does this compare to normal activity?”
  • “What would this look like if it were legitimate?”

​
Quick reply chips

After each Flare response, you’ll see suggested follow-up questions as clickable chips. These are contextual - they change based on what anomalies were found and what you’ve already discussed. Common chips include:
  • “What are the remediation steps?”
  • “How urgent is this?”
  • “Can you elaborate?”
  • “What other indicators should I check?”
Click any chip to send it as your next question.

​
Tips

  • Be specific. “Why is finding #3 anomalous?” gets a better answer than “explain the results.”
  • Ask about actions. Flare can suggest provider-specific GCP or AWS commands, investigation steps, and remediation procedures.
  • Use it for reporting. Ask Flare to summarize findings for a non-technical audience, or to draft an incident report.
  • Conversation persists. Your chat history is saved with the analysis - come back later and pick up where you left off.