List Tenant Events
curl --request POST \
--url https://api.flare.io/firework/v4/events/tenant/_search \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"query": {},
"size": 123,
"from": "<string>",
"order": "<string>",
"filters": {
"severity": [
"<string>"
],
"type": [
"<string>"
],
"estimated_created_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"tags": [
"<string>"
],
"status": [
"<string>"
],
"is_ignored": true,
"is_remediated": true
}
}
'import requests
url = "https://api.flare.io/firework/v4/events/tenant/_search"
payload = {
"query": {},
"size": 123,
"from": "<string>",
"order": "<string>",
"filters": {
"severity": ["<string>"],
"type": ["<string>"],
"estimated_created_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"tags": ["<string>"],
"status": ["<string>"],
"is_ignored": True,
"is_remediated": True
}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
query: {},
size: 123,
from: '<string>',
order: '<string>',
filters: {
severity: ['<string>'],
type: ['<string>'],
estimated_created_at: {gt: '<string>', gte: '<string>', lt: '<string>', lte: '<string>'},
tags: ['<string>'],
status: ['<string>'],
is_ignored: true,
is_remediated: true
}
})
};
fetch('https://api.flare.io/firework/v4/events/tenant/_search', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flare.io/firework/v4/events/tenant/_search",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'query' => [
],
'size' => 123,
'from' => '<string>',
'order' => '<string>',
'filters' => [
'severity' => [
'<string>'
],
'type' => [
'<string>'
],
'estimated_created_at' => [
'gt' => '<string>',
'gte' => '<string>',
'lt' => '<string>',
'lte' => '<string>'
],
'tags' => [
'<string>'
],
'status' => [
'<string>'
],
'is_ignored' => true,
'is_remediated' => true
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flare.io/firework/v4/events/tenant/_search"
payload := strings.NewReader("{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"status\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flare.io/firework/v4/events/tenant/_search")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"status\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flare.io/firework/v4/events/tenant/_search")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"status\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}"
response = http.request(request)
puts response.read_body{
"items": [
{
"metadata": {
"estimated_created_at": "2019-09-20T16:30:37.589388Z",
"matched_at": "2019-09-21T10:15:22.123456Z",
"type": "listing",
"uid": "listing/apollon_market/9861",
"severity": "critical"
},
"tenant_metadata": {
"severity": {
"original": "low",
"override": "critical"
},
"tags": [
"important",
],
"notes": "This reason why this is tagged as 'important' is: ..."
},
"identifiers": [
{
"id": 1,
"name": "An identifier"
}
],
"highlights": {
"description": [
"Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
],
"title": [
"Bank Statement PSD <mark>Template</mark>"
]
}
}
],
"next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
}
Event Feeds
List Tenant Events
POST
/
firework
/
v4
/
events
/
tenant
/
_search
List Tenant Events
curl --request POST \
--url https://api.flare.io/firework/v4/events/tenant/_search \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"query": {},
"size": 123,
"from": "<string>",
"order": "<string>",
"filters": {
"severity": [
"<string>"
],
"type": [
"<string>"
],
"estimated_created_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"tags": [
"<string>"
],
"status": [
"<string>"
],
"is_ignored": true,
"is_remediated": true
}
}
'import requests
url = "https://api.flare.io/firework/v4/events/tenant/_search"
payload = {
"query": {},
"size": 123,
"from": "<string>",
"order": "<string>",
"filters": {
"severity": ["<string>"],
"type": ["<string>"],
"estimated_created_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"tags": ["<string>"],
"status": ["<string>"],
"is_ignored": True,
"is_remediated": True
}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
query: {},
size: 123,
from: '<string>',
order: '<string>',
filters: {
severity: ['<string>'],
type: ['<string>'],
estimated_created_at: {gt: '<string>', gte: '<string>', lt: '<string>', lte: '<string>'},
tags: ['<string>'],
status: ['<string>'],
is_ignored: true,
is_remediated: true
}
})
};
fetch('https://api.flare.io/firework/v4/events/tenant/_search', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flare.io/firework/v4/events/tenant/_search",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'query' => [
],
'size' => 123,
'from' => '<string>',
'order' => '<string>',
'filters' => [
'severity' => [
'<string>'
],
'type' => [
'<string>'
],
'estimated_created_at' => [
'gt' => '<string>',
'gte' => '<string>',
'lt' => '<string>',
'lte' => '<string>'
],
'tags' => [
'<string>'
],
'status' => [
'<string>'
],
'is_ignored' => true,
'is_remediated' => true
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flare.io/firework/v4/events/tenant/_search"
payload := strings.NewReader("{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"status\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flare.io/firework/v4/events/tenant/_search")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"status\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flare.io/firework/v4/events/tenant/_search")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"status\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}"
response = http.request(request)
puts response.read_body{
"items": [
{
"metadata": {
"estimated_created_at": "2019-09-20T16:30:37.589388Z",
"matched_at": "2019-09-21T10:15:22.123456Z",
"type": "listing",
"uid": "listing/apollon_market/9861",
"severity": "critical"
},
"tenant_metadata": {
"severity": {
"original": "low",
"override": "critical"
},
"tags": [
"important",
],
"notes": "This reason why this is tagged as 'important' is: ..."
},
"identifiers": [
{
"id": 1,
"name": "An identifier"
}
],
"highlights": {
"description": [
"Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
],
"title": [
"Bank Statement PSD <mark>Template</mark>"
]
}
}
],
"next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
}
Returns a list of events matching the identifiers of the current tenant.
Learn more about Event Source Filters .
Guides
See the guide for using this endpoint: Exporting a Tenant’s Events .{
"items": [
{
"metadata": {
"estimated_created_at": "2019-09-20T16:30:37.589388Z",
"matched_at": "2019-09-21T10:15:22.123456Z",
"type": "listing",
"uid": "listing/apollon_market/9861",
"severity": "critical"
},
"tenant_metadata": {
"severity": {
"original": "low",
"override": "critical"
},
"tags": [
"important",
],
"notes": "This reason why this is tagged as 'important' is: ..."
},
"identifiers": [
{
"id": 1,
"name": "An identifier"
}
],
"highlights": {
"description": [
"Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
],
"title": [
"Bank Statement PSD <mark>Template</mark>"
]
}
}
],
"next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
}
Paging
This endpoint supports the Flare standard paging pattern .Body Parameters
object
One of the supported queries. (optional)
{
"type": "domain",
"fqdn": "<string>"
}
{
"type": "email",
"email": "<string>"
}
{
"type": "keyword",
"keyword": "<string>"
}
{
"type": "query_string",
"query_string": "<string>"
}
{
"type": "username",
"username": "<string>"
}
{
"type": "github_repository",
"repo_owner": "<string>"
"repo_name": "<string>"
}
{
"type": "brand",
"name": "<string>"
}
{
"type": "name",
"first_name": "<string>"
"last_name": "<string>"
"is_strict": "<boolean>"
}
{
"type": "bin",
"bin": "<string>"
}
{
"type": "ip",
"ip": "<string>"
}
{
"type": "credentials",
"username": "<string>"
"password": "<string>"
}
{
"type": "secret",
"secret": "<string>"
}
{
"type": "azure_tenant",
"tenant_id": "<string>"
}
number
Limit number of events that will be returned. (Max 10)
string
The
next value from the last response.string
default:"desc"
Sort order of the results by matched date (
matched_at).Show valid order values
Show valid order values
asc
descobject
Hide child attributes
Hide child attributes
string[]
If a string value is specified, results will contain events that have a greater than or equal severity. Otherwise, if an array of severities is specified, results will only contain events that exactly match one of them.
Show valid severity values
Show valid severity values
info
low
medium
high
criticalstring[]
Show valid type values
Show valid type values
illicit_networks
open_web
leak
valid_credential
invalid_credential
mitigated_credential
domain
listing
forum_content
blog_content
profile
chat_message
ransomleak
infected_devices
financial_data
paste
social_media
source_code
google
service
bucketsobject
Show child attributes
Show child attributes
string
Matches values greater than the specified timestamp.Format: ISO-8601
string
Matches values greater than or equal to the specified timestamp.Format: ISO-8601
string
Matches values lesser than the specified timestamp.Format: ISO-8601
string
Matches values lesser than or equal to the specified timestamp.Format: ISO-8601
string[]
If provided, results will be filtered on the tags.
string[]
If provided, results will only contain events that match one of the specified statuses.
Show valid status values
Show valid status values
open
ignored
remediatedbool
deprecated
If set to true, results will be filtered to be events that have been ignored.
bool
deprecated
If set to true, results will be filtered to be events that have been remediated.
Was this page helpful?