> ## Documentation Index
> Fetch the complete documentation index at: https://api.docs.flare.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Explain Identifier Event

Provides evidence as to how an event matches to an identifier, clarifying why an event is or is not found within a feed.


## OpenAPI

````yaml firework-v4-openapi get /firework/v4/events/identifiers/{identifier_id}/_explain
openapi: 3.1.0
info:
  title: Firework API
  version: v4
servers:
  - url: https://api.flare.io
security:
  - BearerAuth: []
paths:
  /firework/v4/events/identifiers/{identifier_id}/_explain:
    get:
      tags:
        - public
        - team=data-engineering
      summary: Explain Identifier Event
      operationId: explain_identifier_event_events_identifiers__identifier_id___explain_get
      parameters:
        - name: identifier_id
          in: path
          required: true
          schema:
            type: integer
            title: Identifier Id
        - name: event_uid
          in: query
          required: true
          schema:
            type: string
            title: Event Uid
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventExplanation'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    EventExplanation:
      properties:
        event_uid:
          type: string
          title: Event Uid
          description: The uid of the explained event
        identifier_id:
          type: integer
          title: Identifier Id
          description: The id of the identifier the event is being explained for
        identifier_query:
          $ref: '#/components/schemas/IdentifierQueryVerdict'
          description: The verdict of the identifier's search query
        categories:
          $ref: '#/components/schemas/CategoryVerdict'
          description: The verdict of the event category check
        severity:
          $ref: '#/components/schemas/SeverityVerdict'
          description: The verdict of the event severity check
        matching_policies:
          $ref: '#/components/schemas/MatchingPolicyVerdict'
          description: The verdict of the matching policies check
        tenant_ignored_terms:
          $ref: '#/components/schemas/IgnoredTermsVerdict'
          description: The verdict of the tenant's ignored terms check
        global_policies:
          $ref: '#/components/schemas/GlobalPolicyVerdict'
          description: The verdict of the global policies check
        maybe_rate_limited:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Maybe Rate Limited
          description: Whether the event may have been suppressed due to rate limiting
        would_match:
          type: boolean
          title: Would Match
          description: Whether the event would have matched the identifier overall
      type: object
      required:
        - event_uid
        - identifier_id
        - identifier_query
        - categories
        - severity
        - matching_policies
        - tenant_ignored_terms
        - global_policies
        - would_match
      title: EventExplanation
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    IdentifierQueryVerdict:
      properties:
        matched:
          type: boolean
          title: Matched
          description: >-
            Whether the identifier's own search query matched the event. See
            'matched_uid' for the document the terms were found in
        applicable:
          type: boolean
          title: Applicable
          description: Whether the identifier has its own search query to check
        search_terms:
          items:
            type: string
          type: array
          title: Search Terms
          description: >-
            The terms from the identifier's own search query used to match the
            event
        highlights:
          additionalProperties:
            items:
              type: string
            type: array
          type: object
          title: Highlights
          description: >-
            Excerpts of the fields the identifier's terms matched, with each
            match wrapped in <mark> tags. The keys are field names on the
            document identified by 'matched_uid'
        matched_uid:
          anyOf:
            - type: string
            - type: 'null'
          title: Matched Uid
          description: >-
            The uid of the document the identifier's terms were found in.
            Usually the event's own uid; for events that merge attached files
            into their content it can be the uid of one of those files. Null
            when 'matched' is false
      type: object
      required:
        - matched
        - applicable
        - search_terms
        - highlights
      title: IdentifierQueryVerdict
    CategoryVerdict:
      properties:
        event_category:
          $ref: '#/components/schemas/ActivityModelName'
          description: The category of the event
        allowed_categories:
          items:
            $ref: '#/components/schemas/SearchType'
          type: array
          title: Allowed Categories
          description: The categories the identifier is configured to monitor
        matched:
          type: boolean
          title: Matched
          description: Whether the event's category is among the allowed categories
        applicable:
          type: boolean
          title: Applicable
          description: Whether the identifier has any allowed categories configured
      type: object
      required:
        - event_category
        - allowed_categories
        - matched
        - applicable
      title: CategoryVerdict
    SeverityVerdict:
      properties:
        event_severity:
          $ref: '#/components/schemas/RiskScore'
          description: >-
            The severity computed for the event from the currently active
            scoring rules
        allowed_severities:
          items:
            $ref: '#/components/schemas/RiskScore'
          type: array
          title: Allowed Severities
          description: The severities the identifier is configured to alert on
        matched:
          type: boolean
          title: Matched
          description: Whether the event's severity is among the allowed severities
        applicable:
          type: boolean
          title: Applicable
          description: Whether the identifier has any allowed severities configured
        matched_rules:
          items:
            $ref: '#/components/schemas/SeverityRuleMatch'
          type: array
          title: Matched Rules
          description: >-
            The scoring rules that matched the event and contributed to its
            severity
      type: object
      required:
        - event_severity
        - allowed_severities
        - matched
        - applicable
        - matched_rules
      title: SeverityVerdict
    MatchingPolicyVerdict:
      properties:
        policies:
          items:
            $ref: '#/components/schemas/MatchingPolicyMatch'
          type: array
          title: Policies
          description: The matching policies assigned to the identifier
        applicable:
          type: boolean
          title: Applicable
          description: Whether the identifier has any matching policies assigned
      type: object
      required:
        - policies
        - applicable
      title: MatchingPolicyVerdict
    IgnoredTermsVerdict:
      properties:
        policies:
          items:
            $ref: '#/components/schemas/IgnoredTermsPolicyMatch'
          type: array
          title: Policies
          description: The tenant's ignored terms policies
        applicable:
          type: boolean
          title: Applicable
          description: Whether the tenant has any ignored terms policies configured
      type: object
      required:
        - policies
        - applicable
      title: IgnoredTermsVerdict
    GlobalPolicyVerdict:
      properties:
        policies:
          items:
            $ref: '#/components/schemas/GlobalPolicyMatch'
          type: array
          title: Policies
          description: The global policies considered for this event's category
        applicable:
          type: boolean
          title: Applicable
          description: >-
            Whether a global policy applies to this event's category and is
            enabled for the tenant
      type: object
      required:
        - policies
        - applicable
      title: GlobalPolicyVerdict
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
    ActivityModelName:
      type: string
      enum:
        - account
        - actor
        - actor_summary
        - ad
        - attachment
        - blog_post
        - bot
        - bucket
        - bucket_object
        - cc
        - cc_bases
        - chat_message
        - cookie
        - docker_image
        - docker_repository
        - document
        - domain
        - domain_certificate
        - domain_favicon
        - domain_dns_records
        - domain_ip_address
        - domain_screenshot
        - domain_title
        - domain_whois_rdap
        - driller
        - driller_forum_post
        - driller_forum_topic
        - driller_google
        - driller_profile
        - driller_source_code
        - entity_classification
        - entity_summarization
        - event
        - experimental
        - forum_category
        - forum_post
        - forum_profile
        - forum_topic
        - host
        - intelligence_object
        - invalid_credential
        - leak
        - leaked_credential
        - leaked_data
        - leaked_file
        - listing
        - lookalike
        - mitigated_credential
        - paste
        - ransomleak
        - ransomleak_file_listing
        - score_event
        - sdo_attack_pattern
        - sdo_campaign
        - sdo_identity
        - sdo_indicator
        - sdo_infrastructure
        - sdo_location
        - sdo_malware
        - sdo_relationship
        - sdo_external_report
        - sdo_threat_actor
        - sdo_threat_actor_group
        - sdo_tool
        - sdo_vulnerability
        - secret
        - seller
        - service
        - social_media_account
        - source_code_observation
        - source_code_secret
        - stealer_log
        - attachment/telegram
        - threat_flow_summary
        - valid_credential
        - whois
      title: ActivityModelName
    SearchType:
      type: string
      enum:
        - attachment
        - listing
        - ransomleak
        - forum_post
        - forum_topic
        - forum_profile
        - blog_post
        - seller
        - paste
        - leak
        - chat_message
        - domain
        - bot
        - stealer_log
        - infected_devices
        - driller
        - driller_forum_topic
        - driller_forum_post
        - driller_profile
        - cc
        - ccbin
        - financial_data
        - leaked_data
        - leaked_file
        - document
        - account
        - actor
        - forum_content
        - blog_content
        - profile
        - leaked_credential
        - valid_credential
        - invalid_credential
        - mitigated_credential
        - illicit_networks
        - open_web
        - domains
        - intelligence_object
        - leaks
        - social_media_account
        - social_media
        - source_code
        - source_code_secrets_np
        - source_code_secrets
        - source_code_files
        - secret
        - docker
        - stack_exchange
        - google
        - service
        - driller_host
        - buckets
        - bucket
        - bucket_object
        - whois
        - ad
        - ads
        - cookie
        - pii
        - experimental
      title: SearchType
    RiskScore:
      type: integer
      enum:
        - 1
        - 2
        - 3
        - 4
        - 5
      title: RiskScore
    SeverityRuleMatch:
      properties:
        rule_id:
          type: string
          format: uuid
          title: Rule Id
          description: The id of the scoring rule
        name:
          type: string
          title: Name
          description: The name of the scoring rule
        source:
          $ref: '#/components/schemas/RuleSource'
          description: Whether the rule is a Flare-provided or tenant-defined rule
        severity:
          $ref: '#/components/schemas/RiskScore'
          description: The severity assigned to the event by this rule
        is_beta:
          type: boolean
          title: Is Beta
          description: Whether the rule is currently in beta
        is_override:
          type: boolean
          title: Is Override
          description: Whether the rule overrides the severity assigned by other rules
      type: object
      required:
        - rule_id
        - name
        - source
        - severity
        - is_beta
        - is_override
      title: SeverityRuleMatch
    MatchingPolicyMatch:
      properties:
        matching_policy_id:
          type: string
          format: uuid
          title: Matching Policy Id
          description: The id of the matching policy
        name:
          type: string
          title: Name
          description: The name of the matching policy
        type:
          $ref: '#/components/schemas/MatchingPolicyType'
          description: The type of the matching policy
        matched:
          type: boolean
          title: Matched
          description: Whether this matching policy matched the event
      type: object
      required:
        - matching_policy_id
        - name
        - type
        - matched
      title: MatchingPolicyMatch
    IgnoredTermsPolicyMatch:
      properties:
        ignored_terms_id:
          type: string
          format: uuid
          title: Ignored Terms Id
          description: The id of the tenant's ignored terms policy
        name:
          type: string
          title: Name
          description: The name of the ignored terms policy
        matched:
          type: boolean
          title: Matched
          description: Whether this ignored terms policy matched the event
      type: object
      required:
        - ignored_terms_id
        - name
        - matched
      title: IgnoredTermsPolicyMatch
    GlobalPolicyMatch:
      properties:
        policy:
          $ref: '#/components/schemas/GlobalPolicyEnum'
          description: The global policy considered for this event's category
        duplicate_uid:
          anyOf:
            - type: string
            - type: 'null'
          title: Duplicate Uid
          description: >-
            The uid of the event this event was identified as a duplicate of, if
            matched
        matched:
          type: boolean
          title: Matched
          description: Whether this global policy matched the event
      type: object
      required:
        - policy
        - duplicate_uid
        - matched
      title: GlobalPolicyMatch
    RuleSource:
      type: string
      enum:
        - flare
        - tenant
      title: RuleSource
    MatchingPolicyType:
      type: string
      enum:
        - INCLUDED_KEYWORDS
        - EXCLUDED_KEYWORDS
        - LUCENE_QUERY
        - ASTP_COOKIES
        - ASTP_DOMAIN
      title: MatchingPolicyType
    GlobalPolicyEnum:
      type: string
      enum:
        - identical_market_listings
        - identical_forum_posts
        - identical_chat_messages
        - identical_pastes
        - identical_stealer_logs
        - identical_attachments
        - similar_market_listings
        - similar_forum_posts
        - similar_chat_messages
        - similar_pastes
      title: GlobalPolicyEnum
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer

````