Skip to main content
POST
/
firework
/
v2
/
search
/
cURL
curl --request POST \
  --url https://api.flare.io/firework/v2/search/ \
  --header 'Authorization: Bearer <token>'
{
  "items": [
    {}
  ],
  "links": {
    "next": "<string>"
  },
  "nb_hits": 123,
  "search_after": "<string>"
}
DEPRECATED: This endpoint should be replaced by /firework/v4/events/global/_search
This endpoint is subject to quotas and is subject to the Search ratelimiting tier. See Rate Limits and Quotas .

Authorizations

​
Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Query Parameters

​
fields
string[]

Fields to includes in the results in a dotted form. For example, "data.actor_name" will include items similar to:json "items": [{ "data": { "actor_name": "Seller123" } }]

By default, all fields are included in the response.
​
time
string

The time parameter is used to limit results to those found in the provided time span.

Expected format : from@to

Example value : 2019-09-03T04:00:00.000Z@2019-09-14T04:00:00.000Z

​
size
integer
default:10

The size parameter is used to limit the number of results returned for the search query.

​
search_after
string

The search_after parameter is used to paginate through results.

To get the first page of results, omit this parameter. Afterward, include the search_after parameter in your next request with the latest response's search_after value to get the next page of results.

​
from
string

The from parameter is used to paginate through results.

To get the first page of results, omit this parameter. Afterward, include the from parameter in your next request with the latest response's next value to get the next page of results.

​
tags
string[]

User defined tags used to filter search results

​
tags_query_operator
string

User defined operator to apply to tags filter

​
types
string[]

Type of activities to search through.

Expected values : attachment, listing, ransomleak, forum_post, forum_topic, forum_profile, blog_post, seller, paste, leak, chat_message, domain, bot, stealer_log, infected_devices, driller, driller_forum_topic, driller_forum_post, driller_profile, cc, ccbin, financial_data, leaked_data, leaked_file, document, account, actor, forum_content, blog_content, profile, leaked_credential, illicit_networks, open_web, domains, leaks, social_media_account, social_media, source_code, source_code_secrets_np, source_code_secrets, source_code_files, docker, stack_exchange, google, service, driller_host, buckets, bucket, bucket_object, whois, stealer_log_cookie, cookie, pii, experimental

Some search types contain others

  • illicit_networks: stealer_log, listing, chat_message, financial_data, bot, forum_post, seller, ransomleak, forum_topic, forum_profile, blog_post
  • open_web: stack_exchange, docker, social_media_account, google, source_code_files, bucket_object, paste, bucket, service, source_code_secrets
  • leaks: leak
  • domains: domain
​
experimental_types
string[]

Type of experimental activities to search through.

​
event_action
enum<string>
Available options:
default,
ignored,
remediated,
risk_score_edited,
exclude_ignored,
ignored_or_remediated
​
event_actions
string[]
​
risks
integer[]
​
order
enum<string>
default:desc
Available options:
asc,
desc
​
sort_by
enum<string>
default:created
Available options:
created,
indexed,
updated,
alertable-materialized,
materialized,
searchable
​
use_global_policies
boolean
default:true
​
time_zone
string

The time zone used to compute the statistics.

​
query
string

Query used to filter results. Search query uses the Lucene query syntax.

​
has_modified_risk_score
boolean
default:false
​
has_notes
boolean
default:false

Response

Returns the search result(s).

​
items
object[]
​
links
object
​
nb_hits
integer
​
search_after
string