​

Running an Analysis

There are two ways to run an analysis in Flare: live fetch from a connected cloud provider, or file upload from any source.

​

From a connected GCP connector

If you’ve already connected GCP, this is the fastest path.

1. Go to Analyses > New Analysis (or click Run analysis from the Connectors page)
2. Name your analysis - a descriptive name helps when reviewing history later (e.g., “Prod audit - May 29”)
3. Select GCP Audit Logs as the source
4. Choose “Fetch live” - this appears when you have an active GCP connector
5. Enter your GCP Project ID - the project you want to scan
6. Select a time window:

7. Click Fetch & Analyze

Flare fetches up to 1,000 of the most recent audit log entries in your selected window, then runs the analysis.

​

From a connected AWS connector

If you’ve already connected AWS:

1. Go to Analyses > New Analysis
2. Name your analysis
3. Select AWS CloudTrail as the source
4. Choose Fetch live and confirm the connected account and Region
5. Select a time window, starting with Last 24h
6. Click Fetch & Analyze

Flare reads up to 200 recent regional CloudTrail management events through LookupEvents. CloudTrail event history is generally available for approximately 90 days. Data events, CloudTrail Lake queries, and organization-wide aggregation are not part of the current live connector.

​

From Workspace or GitHub

After connecting an enabled Workspace or GitHub Enterprise Cloud source, select it in New Analysis. Confirm the connected customer or organization, name the run and choose a window of up to 30 days. Flare retains up to 1,000 unique in-window provider records for analysis. Provider requests have separate byte, page and time bounds and may read additional duplicate or out-of-window records. Workspace divides its retained-record budget across login, admin and token streams. These sources use the verified connector scope and manual runs only. File uploads, scheduled runs and deploy webhooks are not supported under these source labels. Review the coverage panel for truncation and provider delays; an empty query is not proof of no activity.

​

From a file upload

If you don’t have a connector set up, or want to analyze logs from a different source:

1. Go to Analyses > New Analysis
2. Name your analysis
3. Select the log source that matches your log origin, including GCP Audit Logs or AWS CloudTrail
4. Drop or browse for your log file (JSON, NDJSON, CSV, or plain text, up to 2 MB)
5. Optionally set an Account or Project ID and Time Window for context
6. Click Run Analysis

See File Upload for format details and preparation tips.

​

During analysis

While Flare is running, you’ll see a loading state with a progress message. Analysis typically takes:

• 15-30 seconds for small log sets (under 200 entries)
• 30-60 seconds for larger sets (200-1,000 entries)
• 1-2 minutes for very large sets that require multiple analysis passes

You can navigate away - the analysis runs in the background. Check the Analyses page to see when it completes.

​

Daily limit

During the open beta, each account can run 10 analyses per day. The counter resets at midnight UTC. Only successful or in-progress user-triggered analyses consume those 10 visible slots. Failed runs release the slot. A separate 30-attempt daily safety limit counts failed attempts as well, preventing repeated retries from creating unbounded processing load. You can check your remaining quota at the top of the New Analysis page, which shows “X of 10 analyses today.”

​

Analysis history

All your analyses are saved in Analyses in the sidebar. Each entry shows:

• Analysis name and source
• When it was run
• Status (Complete, Analyzing, or Failed)
• Number of anomalies found (or “Clean” if zero)

Click any analysis to view the full results. You can delete analyses you no longer need.