Connect read-only
Create a read-only IAM role using Flare’s CloudFormation template and protect role assumption with a connector-specific ExternalId.
Amazon Web Services security
AWS CloudTrail anomaly detection for small dev teams
Flare turns recent regional CloudTrail management-event history into ranked, explained findings—without complete-log retention, per-GB ingestion fees, or detection rules for your team to author.
Turn AWS audit activity into an investigation queue
Analyze recent regional management-event history available through CloudTrail LookupEvents. Flare does not claim to ingest every CloudTrail event or retain a complete copy of your logs.
Review ranked findings
Flare assesses current-window evidence with available historical context, then ranks noteworthy activity by severity and explains why it matters.
Investigate the evidence
Inspect selected source-event excerpts and ask follow-up questions using the retained analysis results and supporting evidence.
Useful audit-log answers without a SIEM project
Bounded access and retention
Flare uses read-only access and retains analysis results with selected supporting evidence—not a complete copy of your logs.
Using another source?
Explore GCP Audit Logs audit coverage, access requirements and availability.
Start with real evidence
See what changed in AWS.
Connect read-only or upload a focused JSON, NDJSON, CSV, or plain-text log file. Early access includes up to 10 analyses per day with no credit card required.
Get started