Skip to main content

​
FAQ

Flare does not retain the complete input log set after analysis. It stores the analysis results - including findings, scores, and explanations - plus up to five selected source-event excerpts for each finding so you can review the evidence. These results and excerpts are retained until you delete the analysis or close your account. The separate GitHub App report does not save raw events or findings; its results disappear when you leave or refresh the page.
For GCP core audit analysis, Flare requires roles/logging.viewer. Data Access logs are optional and additionally require roles/logging.privateLogViewer or access to a customer-approved log view. For AWS, Flare assumes a customer-created IAM role that allows only cloudtrail:LookupEvents. The AWS trust policy requires the connector’s unique ExternalId. Flare never asks for or stores AWS access keys. The GitHub App requires organization Administration read-only access and verification by an organization owner. See the GCP Connector and AWS Connector guides for details.
During the open beta, each account can run 10 manual analyses per day in the saved analysis flow. The counter resets at midnight UTC. Scheduled runs do not count against this limit. GitHub App reports use their own per-report window and fetch limits; provider rate limits also apply.
Yes, uploaded files are limited to 2 MB. For larger log sets, filter your export to a specific time window or log type before uploading. See File Upload for tips.
Flare uses AI analysis together with current-window evidence and available historical context. It tracks field values across analyses over time - such as the IP addresses, service accounts, and API methods observed in your environment - so new values, unusual frequencies, and suspicious patterns can inform each finding. Flare ranks findings from 0-100; the score reflects the available evidence and context rather than a fixed baseline-deviation formula. GitHub App reports instead apply deterministic rules and show review priorities without numeric anomaly scores.
Every time you run an analysis, Flare records how often each field value appeared (e.g., “this service account was in 40% of events”). On subsequent analyses, it provides the current frequency, 30-day rolling history, and first-seen context to help assess the activity. Deviations are evidence for the analysis, not a deterministic scoring formula. The more representative analyses you run, the more useful the historical context becomes. Set up scheduled runs to build coverage automatically. See 30-Day Baseline for full details. GitHub App reports do not contribute to or use this history.
A “First Seen” badge means the flagged value, such as an IP address, IAM identity, service account, or API action, has never appeared in previous analyses for that environment. It is a strong signal that something genuinely new is happening. The First Seen system gets more accurate with each analysis you run.
Yes. You can upload log files directly in JSON, NDJSON, CSV, or plain text format. GCP and AWS connectors support their documented automation; Workspace analysis and GitHub App reports run on demand. Upload is a separate flow and is not supported by the GitHub App report.
If your OAuth token is revoked or expires, Flare marks the connector as “Expired” and pauses any active schedules. Your analysis history is preserved. Go to Connectors and click Reconnect GCP to re-authenticate. See GCP Connector troubleshooting for common causes.
Flare marks the AWS connector inactive when the customer role is deleted or its trust or permissions policy no longer allows access. Your analysis history is preserved. Restore the generated role policies or reconnect AWS with the current role ARN. See AWS Connector troubleshooting.
CloudTrail event history is regional. Confirm the Region selected on the connector and try a wider time window. The current live connector reads management events through LookupEvents; data events, CloudTrail Lake, S3 trail files, and activity from other Regions are outside that live query.
Flare supports Google Cloud Platform Cloud Audit Logs and recent regional AWS CloudTrail management event history. Workspace login/admin/token reports support manual analysis. GitHub Enterprise Cloud organization web events use separate on-demand deterministic reports, capped at a completed 24-hour window and three pages or 300 fetched events. See the Workspace and GitHub requirements. Azure Activity Logs remain on the roadmap. You can also analyze logs from any provider by uploading them as files.
Flare is free during the open beta. Pricing details for Free and Pro plans will be shared before the beta ends. There are no ingestion fees - Flare reads directly from your cloud provider.
Traditional SIEMs (Splunk, Elastic, etc.) commonly require you to forward and store logs, configure detections, and pay based on data volume. Flare reads the requested activity from your cloud provider, does not require customers to author detection rules, and charges nothing for data volume. Flare is purpose-built for anomaly detection in cloud audit logs - it’s not a general-purpose log management platform.
Yes. You can delete individual analyses from the Analyses page. Disconnecting GCP removes the stored OAuth tokens; disconnecting AWS removes the stored role configuration. Disconnecting Workspace removes its encrypted credentials; revoke its Google grant separately to remove provider-side access. Disconnecting the GitHub App report removes the installation/organization mapping in Flare. It stores no GitHub user or installation token. Uninstall the App in GitHub to revoke provider-side access. To delete your account entirely, contact Flare Support.