What is Flare
Flare connects to your cloud audit logs and uses AI to surface anomalous access patterns, privilege escalations, and unusual API behavior - ranked by severity and explained in plain English.How it works
1
Connect your cloud
OAuth into GCP in under 60 seconds. Flare gets read-only access to your Cloud Audit Logs. Your logs stay in GCP - Flare never stores raw log data.
2
Flare analyzes your logs
Flare scans access patterns across your audit logs, compares against historical baselines, and surfaces anomalies ranked by severity (Critical, High, Medium, Low).
3
Investigate conversationally
Ask follow-up questions about any finding. Flare has full context from the analysis and can explain what happened, why it matters, and what to do next.
What Flare detects
Flare looks for patterns that traditional rule-based tools miss:- Privilege escalations - unexpected IAM policy changes, role grants, service account key creation
- Unusual access patterns - API calls from new IP ranges, Tor exit nodes, unfamiliar user agents
- Permission anomalies - spikes in PERMISSION_DENIED errors that suggest reconnaissance
- Behavioral shifts - service accounts acting outside their normal patterns
- First-seen activity - field values that have never appeared in your environment before
Key principles
Zero data retention
Your logs are analyzed in memory and never stored. Flare keeps only the anomaly findings, not the raw logs.
No ingestion fees
Unlike traditional SIEMs, Flare reads directly from your cloud provider. No log forwarding, no per-GB costs.
Plain English explanations
Every anomaly comes with a human-readable explanation of what happened and why it matters.
30-day baseline
Flare tracks field value frequencies across a rolling 30-day window, so it can flag deviations from what’s normal — not just what’s new.
Supported cloud providers
You can also upload log files directly (JSON, CSV, or plain text) from any source.
Next steps
Quickstart
Get up and running in 5 minutes
Live demo
See Flare analyze a simulated privilege escalation attack