Read where the logs live
Connect with read-only access. Use OAuth for Google Cloud or Workspace, and an IAM role for AWS. Workspace supports manual analysis.
Cloud and SaaS security
Make sense of
your audit logs.
Built for small development teams and businesses. Know what changed, why it matters, and where to look next. Flare turns cloud and SaaS audit activity into ranked findings with the evidence to investigate.
Early access No credit card required
10 analyses per day. See what’s included.G GCP Audit Logs ExampleA AWS CloudTrail Example
Prioritized for reviewImpact
02:14:03
GCPSetIamPolicy
97Owner granted across 12 production projects
02:14:09
AWSCreateAccessKey
91First seen for a dormant IAM identity
02:29:41
AWSConsoleLogin
76New network and no recent sign-in history
What should I investigate first?
Know what you’re connecting.
Cloud and SaaS connections use read-only access. Flare retains findings and selected supporting event excerpts, not complete raw log files. GitHub App reviews are saved for 90 days and use fixed rules without sending audit events to an AI provider. Other analysis flows send selected audit information to our AI provider.
Review access and data handlingStart with the source.
Your audit trail is already there. Give it the context it needs.
Explore coverageSecurity work starts with context.
Flare combines current evidence with available field-frequency and first-seen context to help you choose what to investigate.
Put activity in context
A 2 a.m. IAM change by a usually read-only account may matter. Flare explains the current evidence and available history.
Keep asking questions
Investigate each finding conversationally. Your saved findings and conversation history provide context for each follow-up.
Flare retains findings and selected supporting event excerpts, not complete raw log files. GitHub App reviews are saved for 90 days; their raw audit events are never stored.
Inside a finding
The evidence behind
every finding.
Flare connects the event to available historical context and identity fields in the selected evidence, then explains why it may matter.
What changed
A read-only service account granted Owner access to 12 production projects.
In this example, the operation happened at 2:14 a.m. and had not appeared in the available 30-day context.
First action
Verify the change in the source system. If it was unauthorized, follow your incident procedure to contain the identity and review affected projects.
Evidence
Normal3–4 / day
Observed847 / hour
- Identity
- deploy-reader@prod
- Usual behavior
- Storage reads only
- First seen
- Today, 02:14 UTC
Show me every permission this identity changed.
Security review, inside your pull request.
Available GitHub Actions integrations bring Flare into your workflow. PR security check reviews infrastructure changes with a Flare API key. No cloud connector required.
From a risky change to a specific next step.
- A pull request changes Terraform, CloudFormation or an IAM policy.
- Flare reviews the relevant diff and posts findings as a PR comment.
- Your team reviews the explanation and suggested fix before merge.
After every release
Deploy review
Compare cloud activity before and after every deploy. Surface risky IAM and infrastructure changes while the release context is still fresh.
During an incident
Incident scope
Choose a time window and reconstruct the sequence across services. Get the likely blast radius and next questions in one investigation.
Every week
Security changelog
Turn cloud audit activity into a concise weekly record of access, policy, and infrastructure changes your team can review.
Free during early access.
No credit card required. Current limits and supported sources are listed below.
- Analyses
- Up to 10 per day, shared with PR checks and incident-scope runs.
- Available sources
- AWS CloudTrail, Google Cloud and Google Workspace. Source-specific access requirements and collection limits apply.
- Before you connect
- Explore the demo with sample data, or review an infrastructure pull request using a Flare API key.
For current access terms or larger usage needs, contact Flare Support.
Get startedYour logs already know. Flare helps you see it.
Start with GCP, AWS or Google Workspace in Connectors. Review ranked findings, inspect the supporting evidence and ask what to investigate next.
Flare Security Review
1 critical · 2 high · 3 files analyzed
Critical
infra/iam.tf:23Overly broad IAM role
This binding grants
roles/editorto a service account.Suggested fix: Replace with a custom role or
See the source example on GitHubroles/cloudfunctions.developer, after verifying the permissions the workload needs.