> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryflare.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> AI-powered anomaly detection for cloud audit logs

# What is Flare

Flare connects to your cloud audit logs and uses AI to surface anomalous access patterns, privilege escalations, and unusual API behavior - ranked by severity and explained in plain English.

## How it works

<Steps>
  <Step title="Connect your cloud">
    OAuth into GCP in under 60 seconds. Flare gets read-only access to your Cloud Audit Logs. Your logs stay in GCP - Flare never stores raw log data.
  </Step>

  <Step title="Flare analyzes your logs">
    Flare scans access patterns across your audit logs, compares against historical baselines, and surfaces anomalies ranked by severity (Critical, High, Medium, Low).
  </Step>

  <Step title="Investigate conversationally">
    Ask follow-up questions about any finding. Flare has full context from the analysis and can explain what happened, why it matters, and what to do next.
  </Step>
</Steps>

## What Flare detects

Flare looks for patterns that traditional rule-based tools miss:

* **Privilege escalations** - unexpected IAM policy changes, role grants, service account key creation
* **Unusual access patterns** - API calls from new IP ranges, Tor exit nodes, unfamiliar user agents
* **Permission anomalies** - spikes in PERMISSION\_DENIED errors that suggest reconnaissance
* **Behavioral shifts** - service accounts acting outside their normal patterns
* **First-seen activity** - field values that have never appeared in your environment before

## Key principles

<CardGroup cols={2}>
  <Card title="Zero data retention" icon="shield-check">
    Your logs are analyzed in memory and never stored. Flare keeps only the anomaly findings, not the raw logs.
  </Card>

  <Card title="No ingestion fees" icon="receipt">
    Unlike traditional SIEMs, Flare reads directly from your cloud provider. No log forwarding, no per-GB costs.
  </Card>

  <Card title="Plain English explanations" icon="message">
    Every anomaly comes with a human-readable explanation of what happened and why it matters.
  </Card>

  <Card title="30-day baseline" icon="chart-line">
    Flare tracks field value frequencies across a rolling 30-day window, so it can flag deviations from what's normal -- not just what's new.
  </Card>
</CardGroup>

## Supported cloud providers

| Provider              | Status      | Log type                                                      |
| --------------------- | ----------- | ------------------------------------------------------------- |
| Google Cloud Platform | Available   | Cloud Audit Logs (Admin Activity, Data Access, System Events) |
| Amazon Web Services   | Coming soon | CloudTrail                                                    |
| Microsoft Azure       | Coming soon | Activity Logs                                                 |

You can also [upload log files](/connectors/file-upload) directly (JSON, CSV, or plain text) from any source.

## Next steps

<CardGroup cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Get up and running in 5 minutes
  </Card>

  <Card title="Live demo" icon="play" href="https://tryflare.ai/demo">
    See Flare analyze a simulated privilege escalation attack
  </Card>
</CardGroup>