Skip to main content

​
Quickstart

By the end of this guide, you’ll have connected a supported cloud or SaaS audit source and run your first anomaly analysis.
No credit card required. Flare is free during the open beta.

​
Choose a source

For early-access Google Workspace or GitHub Enterprise Cloud, follow the dedicated Workspace or GitHub setup guide, then select that source in New Analysis. These sources require administrator/owner access and support manual runs only. The cloud setup steps below are for GCP and AWS. You need one of the following:
  • GCP: A Google Cloud project with Cloud Audit Logs enabled, plus roles/logging.viewer on that project
  • AWS: Permission to create an IAM role in the AWS account, plus CloudTrail management events in the Region you want to analyze
1

Create your account

Go to tryflare.ai/sign-up and create your account. You’ll be redirected to the dashboard.
2

Connect your cloud

Navigate to Connectors in the sidebar and choose a provider.For GCP:
  1. Select Google Cloud Platform
  2. Click Continue through the provider info screen
  3. Click Connect with Google - this opens Google’s OAuth consent screen
  4. Sign in with your Google account and grant Flare read-only access to your Cloud Audit Logs
Once connected, you’ll see a green “GCP connected” confirmation with your Google email.
Flare requests only logging.read scope - it cannot modify your GCP resources.
For AWS:
  1. Select Amazon Web Services
  2. Click Generate role instructions
  3. In AWS IAM, create the recommended role with the trust and permissions policies Flare provides
  4. Paste the role ARN into Flare, choose the CloudTrail event-history Region, and click Test and connect AWS
Flare validates the role before saving the connector. It assumes the role with short-lived credentials and never asks for an AWS access key. See AWS Connector for the complete setup.
3

Run your first analysis

Click Run analysis from the Connectors page, or go to Analyses > New Analysis. Then:
  1. Name your analysis - e.g., “Production audit - May 29”
  2. Select GCP Audit Logs or AWS CloudTrail as the source
  3. Set the scope - enter a GCP Project ID, or confirm the connected AWS account and Region
  4. Choose a time window - start with “Last 24h” for a quick first scan
  5. Click Fetch & Analyze
Flare will fetch your audit activity and run the analysis. This typically takes 15-60 seconds depending on event volume.
4

Review your findings

Once complete, you’ll see:
  • An AI summary describing the overall patterns detected
  • Ranked anomalies scored from 0-100, categorized as Critical, High, Medium, or Low
  • Source evidence for each finding - up to five selected source-event excerpts that support it
  • A “First Seen” badge on anomalies involving values that have never appeared in your environment
Click any anomaly to expand it and see the baseline vs. query frequency comparison and selected source evidence.
5

Ask follow-up questions

Use the Flare Intelligence chat panel on the right side of the results page. Flare uses the retained summary, findings and conversation history to answer questions like:
  • “Why is this anomalous?”
  • “What should I investigate first?”
  • “Is this a known attack pattern?”
  • “What are the remediation steps?”

​
What’s next

Set up scheduled runs

Automatically analyze your logs every 1h, 6h, or 24h

Upload log files

Analyze logs from any source by uploading JSON, NDJSON, CSV, or text files

Understand results

Learn how to read anomaly scores, categories, and evidence

GCP setup details

Permissions, troubleshooting, and reconnecting

AWS setup details

IAM trust, CloudTrail scope, and troubleshooting