Skip to main content

​
FAQ

Flare does not retain the complete input log set after analysis. It stores the analysis results - including findings, scores, and explanations - plus up to five selected source-event excerpts for each finding so you can review the evidence. These results and excerpts are retained until you delete the analysis or close your account.
For GCP core audit analysis, Flare requires roles/logging.viewer. Data Access logs are optional and additionally require roles/logging.privateLogViewer or access to a customer-approved log view. For AWS, Flare assumes a customer-created IAM role that allows only cloudtrail:LookupEvents. The AWS trust policy requires the connector’s unique ExternalId. Flare never asks for or stores AWS access keys. See the GCP Connector and AWS Connector guides for details.
During the open beta, each account can run 10 manual analyses per day. The counter resets at midnight UTC. Scheduled runs do not count against this limit.
Yes, uploaded files are limited to 2 MB. For larger log sets, filter your export to a specific time window or log type before uploading. See File Upload for tips.
Flare uses AI analysis together with current-window evidence and available historical context. It tracks field values across analyses over time - such as the IP addresses, service accounts, and API methods observed in your environment - so new values, unusual frequencies, and suspicious patterns can inform each finding. Flare ranks findings from 0-100; the score reflects the available evidence and context rather than a fixed baseline-deviation formula.
Every time you run an analysis, Flare records how often each field value appeared (e.g., “this service account was in 40% of events”). On subsequent analyses, it provides the current frequency, 30-day rolling history, and first-seen context to help assess the activity. Deviations are evidence for the analysis, not a deterministic scoring formula. The more representative analyses you run, the more useful the historical context becomes. Set up scheduled runs to build coverage automatically. See 30-Day Baseline for full details.
A “First Seen” badge means the flagged value, such as an IP address, IAM identity, service account, or API action, has never appeared in previous analyses for that environment. It is a strong signal that something genuinely new is happening. The First Seen system gets more accurate with each analysis you run.
Yes. You can upload log files directly in JSON, NDJSON, CSV, or plain text format. GCP and AWS connectors support their documented automation; Workspace and GitHub audit connectors support manual live fetching only, but file upload works without any connector setup.
If your OAuth token is revoked or expires, Flare marks the connector as “Expired” and pauses any active schedules. Your analysis history is preserved. Go to Connectors and click Reconnect GCP to re-authenticate. See GCP Connector troubleshooting for common causes.
Flare marks the AWS connector inactive when the customer role is deleted or its trust or permissions policy no longer allows access. Your analysis history is preserved. Restore the generated role policies or reconnect AWS with the current role ARN. See AWS Connector troubleshooting.
CloudTrail event history is regional. Confirm the Region selected on the connector and try a wider time window. The current live connector reads management events through LookupEvents; data events, CloudTrail Lake, S3 trail files, and activity from other Regions are outside that live query.
Flare supports Google Cloud Platform Cloud Audit Logs and recent regional AWS CloudTrail management event history. Workspace login/admin/token reports and GitHub Enterprise Cloud organization web events are in early access for manual analysis. See the Workspace and GitHub requirements. Azure Activity Logs remain on the roadmap. You can also analyze logs from any provider by uploading them as files.
Flare is free during the open beta. Pricing details for Free and Pro plans will be shared before the beta ends. There are no ingestion fees - Flare reads directly from your cloud provider.
Traditional SIEMs (Splunk, Elastic, etc.) commonly require you to forward and store logs, configure detections, and pay based on data volume. Flare reads the requested activity from your cloud provider, does not require customers to author detection rules, and charges nothing for data volume. Flare is purpose-built for anomaly detection in cloud audit logs - it’s not a general-purpose log management platform.
Yes. You can delete individual analyses from the Analyses page. Disconnecting GCP removes the stored OAuth tokens; disconnecting AWS removes the stored role configuration. Disconnecting Workspace or GitHub removes encrypted credentials and invalidates pending authorization attempts; revoke the grant separately in Google or GitHub to remove provider-side access. To delete your account entirely, contact Flare Support.