Documentation Index
Fetch the complete documentation index at: https://docs.tryflare.ai/llms.txt
Use this file to discover all available pages before exploring further.
Scheduled Runs
Scheduled runs let you automatically analyze your audit logs on a recurring basis - every hour, every 6 hours, or once a day. Each run fetches the latest logs from your connected cloud provider and runs a full anomaly analysis without any manual action.Scheduled runs require an active cloud connector. Set up your GCP connector first.
Setting up a schedule
- Go to Connectors
- Select your connected GCP connector
- In the Scheduled analysis section below the connected status, choose a frequency:
| Frequency | Analyzes | Best for |
|---|---|---|
| Every hour | Logs from the last 1 hour | Active incident monitoring, high-change environments |
| Every 6 hours | Logs from the last 6 hours | Regular security posture checks |
| Every 24 hours | Logs from the last 24 hours | Daily security review (recommended) |
- Click Enable
How it works
When a scheduled run fires:- Flare fetches your most recent audit logs for the configured time window
- Runs a full anomaly analysis (same pipeline as manual analyses)
- Compares findings against your historical baseline
- Saves the results as a new analysis in your history
Managing your schedule
Changing frequency
From the Connectors page, use the frequency dropdown in the Scheduled analysis section and click Update. The next run will use the new frequency.Disabling
Click Disable in the Scheduled analysis section. This pauses the schedule without deleting it. You can re-enable at any time.Viewing results
All scheduled analysis results appear in your Analyses history alongside manual analyses. There’s no separate view - everything is in one place.Limits
- Maximum 5 active schedules per account - one per connector is typical
- No daily limit impact - scheduled runs do not count against your 10-per-day manual analysis quota
- One active schedule per connector - changing the frequency replaces the previous schedule
Connection requirements
Scheduled runs depend on an active cloud connector. If your GCP connection expires or is revoked:- The scheduled run will detect the expired connection
- Flare automatically pauses the schedule to avoid repeated failures
- You’ll see the connector status change to “Expired” on the Connectors page
- After reconnecting, re-enable the schedule from the Connectors page
Tips
- Start with daily. A 24-hour schedule is the best balance of coverage and cost for most environments. Move to 6h or 1h if you need faster detection.
- Check your history. Scheduled runs build your baseline over time. The more analyses you run, the better Flare gets at distinguishing genuinely new activity from normal patterns.
- Combine with manual analysis. Use scheduled runs for ongoing monitoring and manual analyses for ad-hoc investigation of specific time windows or incidents.