> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tryflare.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Scheduled Runs

> Set up recurring automated analysis on your cloud audit logs

# Scheduled Runs

Scheduled runs let you automatically analyze your audit logs on a recurring basis - every hour, every 6 hours, or once a day. Each run fetches the latest logs from your connected cloud provider and runs a full anomaly analysis without any manual action.

<Note>
  Scheduled runs require an active cloud connector. Set up your [GCP connector](/connectors/gcp) first.
</Note>

## Setting up a schedule

1. Go to **Connectors**
2. Select your connected GCP connector
3. In the **Scheduled analysis** section below the connected status, choose a frequency:

| Frequency          | Analyzes                    | Best for                                             |
| ------------------ | --------------------------- | ---------------------------------------------------- |
| **Every hour**     | Logs from the last 1 hour   | Active incident monitoring, high-change environments |
| **Every 6 hours**  | Logs from the last 6 hours  | Regular security posture checks                      |
| **Every 24 hours** | Logs from the last 24 hours | Daily security review (recommended)                  |

4. Click **Enable**

That's it. Flare will run the first analysis at the scheduled time and continue at the selected interval.

## How it works

When a scheduled run fires:

1. Flare fetches your most recent audit logs for the configured time window
2. Runs a full anomaly analysis (same pipeline as manual analyses)
3. Compares findings against your historical baseline
4. Saves the results as a new analysis in your history

Each scheduled analysis appears in your **Analyses** list with the name format: "Hourly scan - GCP" (or "6-hour scan" / "Daily scan").

## Managing your schedule

### Changing frequency

From the Connectors page, use the frequency dropdown in the Scheduled analysis section and click **Update**. The next run will use the new frequency.

### Disabling

Click **Disable** in the Scheduled analysis section. This pauses the schedule without deleting it. You can re-enable at any time.

### Viewing results

All scheduled analysis results appear in your **Analyses** history alongside manual analyses. There's no separate view - everything is in one place.

## Limits

* **Maximum 5 active schedules per account** - one per connector is typical
* **No daily limit impact** - scheduled runs do not count against your 10-per-day manual analysis quota
* **One active schedule per connector** - changing the frequency replaces the previous schedule

## Connection requirements

Scheduled runs depend on an active cloud connector. If your GCP connection expires or is revoked:

* The scheduled run will detect the expired connection
* Flare automatically **pauses the schedule** to avoid repeated failures
* You'll see the connector status change to "Expired" on the Connectors page
* After reconnecting, re-enable the schedule from the Connectors page

## Tips

* **Start with daily.** A 24-hour schedule is the best balance of coverage and cost for most environments. Move to 6h or 1h if you need faster detection.
* **Check your history.** Scheduled runs build your baseline over time. The more analyses you run, the better Flare gets at distinguishing genuinely new activity from normal patterns.
* **Combine with manual analysis.** Use scheduled runs for ongoing monitoring and manual analyses for ad-hoc investigation of specific time windows or incidents.