> ## Documentation Index
> Fetch the complete documentation index at: https://api.docs.flare.io/llms.txt
> Use this file to discover all available pages before exploring further.
# Retrieve Event V2 (Beta)
export const name_0 = "Retrieve Event V2"
{/*
If you are in pyro:
- If this file changes, you should also modify the API docs.
- https://github.com/flared/docs-api/
If you are in mintlify:
- Don't edit this directly, edit the generator in pyro.
- pyro/pyro/mintlify/test_firework_event_models.py
*/}
```json Blog Post theme={null}
{
"event_type": "blog_post",
"metadata": {
"estimated_created_at": "2025-01-01T00:00:00",
"flare_url": "https://app.flare.io/#/uid",
"matched_at": null,
"severity": "info",
"uid": "index/source/id"
},
"data": {
"url": "https://www.blog_name.com/post_slug",
"content": "Post content",
"description": "Post description",
"posted_at": "2025-01-01T00:00:00"
}
}
```
{/*
If you are in pyro:
- If this file changes, you should also modify the API docs.
- https://github.com/flared/docs-api/
If you are in mintlify:
- Don't edit this directly, edit the generator in pyro.
- pyro/pyro/mintlify/test_firework_event_models.py
*/}
```json Bucket theme={null}
{
"event_type": "bucket",
"metadata": {
"estimated_created_at": "2025-01-01T00:00:00",
"flare_url": "https://app.flare.io/#/uid",
"matched_at": null,
"severity": "info",
"uid": "index/source/id"
},
"data": {
"url": "https://bucket.public.com/file.txt",
"bucket": {
"host": "bucket.public.com",
"provider": "s3"
}
}
}
```
{/*
If you are in pyro:
- If this file changes, you should also modify the API docs.
- https://github.com/flared/docs-api/
If you are in mintlify:
- Don't edit this directly, edit the generator in pyro.
- pyro/pyro/mintlify/test_firework_event_models.py
*/}
```json Chat Message theme={null}
{
"event_type": "chat_message",
"data": {
"posted_at": "2025-01-01T00:00:00",
"actor": {
"id": "7432892726",
"name": "chatty_cathy"
},
"context": {
"conversation_id": "end_index",
"conversation_name": "interesting chat"
},
"content": "This is the content of the message",
"parent_context": {
"parent_uid": "parent_uid",
"parent_type": "parent_type"
},
"forward_info": {
"forwarded_from": "forwarded_from",
"forwarded_from_author_id": "forwarded_from_author_id",
"forwarded_from_chat_id": 1,
"forwarded_from_conversation_id": "forwarded_from_conversation_id",
"forwarded_from_user_id": 1,
"forwarded_from_username": "forwarded_from_username",
"forwarded_message_time": "2025-01-01T00:00:00"
},
"was_forwarded": false
},
"metadata": {
"estimated_created_at": "2025-01-01T00:00:00",
"flare_url": "https://app.flare.io/#/uid",
"matched_at": null,
"severity": "info",
"uid": "index/source/id"
}
}
```
{/*
If you are in pyro:
- If this file changes, you should also modify the API docs.
- https://github.com/flared/docs-api/
If you are in mintlify:
- Don't edit this directly, edit the generator in pyro.
- pyro/pyro/mintlify/test_firework_event_models.py
*/}
```json Credit Card theme={null}
{
"event_type": "cc",
"data": {
"bank": "Bank of the North",
"bin": "12345",
"brand": "VISA",
"country": "NP",
"expiration": "2030-05-01T00:00:00",
"owner": "BOW",
"state_code": "SW",
"zip": "H0H0H0",
"has_cvv": true,
"has_date_of_birth": false,
"has_mother_maiden_name": false,
"has_phone": true,
"has_pin": null,
"has_ssn": false,
"has_track_1": null,
"has_vbv": null
},
"metadata": {
"estimated_created_at": "2025-01-01T00:00:00",
"flare_url": "https://app.flare.io/#/uid",
"matched_at": null,
"severity": "info",
"uid": "index/source/id"
}
}
```
{/*
If you are in pyro:
- If this file changes, you should also modify the API docs.
- https://github.com/flared/docs-api/
If you are in mintlify:
- Don't edit this directly, edit the generator in pyro.
- pyro/pyro/mintlify/test_firework_event_models.py
*/}
```json Forum Post theme={null}
{
"event_type": "forum_post",
"data": {
"actor": {
"id": "123456",
"name": "John Doe"
},
"context": {
"category_name": "Food & Drink",
"topic_id": "1010",
"topic_title": "Top 10 Pasta Recipes"
},
"posted_at": "2025-01-01T00:00:00",
"content": "These are my favourite recipes for pasta!",
"url": "https://forum.com/post/1010"
},
"metadata": {
"estimated_created_at": "2025-01-01T00:00:00",
"flare_url": "https://app.flare.io/#/uid",
"matched_at": null,
"severity": "info",
"uid": "index/source/id"
}
}
```
{/*
If you are in pyro:
- If this file changes, you should also modify the API docs.
- https://github.com/flared/docs-api/
If you are in mintlify:
- Don't edit this directly, edit the generator in pyro.
- pyro/pyro/mintlify/test_firework_event_models.py
*/}
```json Listing theme={null}
{
"event_type": "listing",
"data": {
"url": "http://b14ckm4rk3t.onion/product/123456789",
"title": "Something for sale",
"content": "Long item description",
"currency": "eur",
"escrow": true,
"price": 38.0,
"ship_to": [
"Europe"
],
"ship_from": [
"Spain"
],
"stock_count": 5,
"actor": {
"id": "ddc591f1257ab24eee28435286945abc0520",
"name": "goodie_seller"
},
"classification": {
"classes": {
"is_carding": false,
"is_bypass": true,
"is_ident_fraud": false,
"is_doc_fraud": true,
"is_phishing": true,
"is_money_xfer": true,
"is_cashout": false,
"is_virt_currency": false,
"is_hacking": false,
"is_misc_financial": false
},
"types": {
"is_guide": false,
"is_service": false,
"is_software": true,
"is_hardware": false,
"is_data": false
}
},
"context": {
"category_name": "Goodies"
}
},
"metadata": {
"estimated_created_at": "2025-01-01T00:00:00",
"flare_url": "https://app.flare.io/#/uid",
"matched_at": null,
"severity": "info",
"uid": "index/source/id"
}
}
```
{/*
If you are in pyro:
- If this file changes, you should also modify the API docs.
- https://github.com/flared/docs-api/
If you are in mintlify:
- Don't edit this directly, edit the generator in pyro.
- pyro/pyro/mintlify/test_firework_event_models.py
*/}
```json Lookalike Domain theme={null}
{
"event_type": "lookalike",
"data": {
"domain": "importante.com",
"registered_at": "2025-01-01T00:00:00",
"identifier_domains": [
"important.co"
],
"feed": null,
"cert_data": null,
"subject": null,
"issuer": "/C=US/CN=R3/O=Let's Encrypt"
},
"metadata": {
"estimated_created_at": "2025-01-01T00:00:00",
"flare_url": "https://app.flare.io/#/uid",
"matched_at": null,
"severity": "info",
"uid": "index/source/id"
}
}
```
{/*
If you are in pyro:
- If this file changes, you should also modify the API docs.
- https://github.com/flared/docs-api/
If you are in mintlify:
- Don't edit this directly, edit the generator in pyro.
- pyro/pyro/mintlify/test_firework_event_models.py
*/}
```json Paste theme={null}
{
"event_type": "paste",
"data": {
"url": "https://www.scribd.com/document/244878934/Final-Research",
"title": "Final Research",
"content": "a very long and passionate text",
"actor": {
"id": "Whydontweknowper",
"name": "Marcelo"
},
"expires_at": "2023-01-01T00:00:00Z",
"syntax": "python"
},
"metadata": {
"estimated_created_at": "2025-01-01T00:00:00",
"flare_url": "https://app.flare.io/#/uid",
"matched_at": null,
"severity": "info",
"uid": "index/source/id"
}
}
```
{/*
If you are in pyro:
- If this file changes, you should also modify the API docs.
- https://github.com/flared/docs-api/
If you are in mintlify:
- Don't edit this directly, edit the generator in pyro.
- pyro/pyro/mintlify/test_firework_event_models.py
*/}
```json Ransom Leak theme={null}
{
"event_type": "ransomleak",
"data": {
"url": "http://payupnow.onion/leaks.php",
"response_url": "http://payupnow.onion/leaks.php",
"title": "Leak Name - Victim Name",
"content": "Ransom Leak Listing Content",
"body": "Ransom Leak Listing Body",
"victim_information": {
"name": "Victim Name",
"display_name": "Victim Name",
"domain": "victim-domain.com",
"alternative_domains": [
"victim.co"
],
"industry": "Non-Profit",
"employee_count": 1,
"city": "New York",
"state": "New York",
"country": "USA",
"latitude": 123.456,
"longitude": 123.456
}
},
"metadata": {
"estimated_created_at": "2025-01-01T00:00:00",
"flare_url": "https://app.flare.io/#/uid",
"matched_at": null,
"severity": "info",
"uid": "index/source/id"
}
}
```
{/*
If you are in pyro:
- If this file changes, you should also modify the API docs.
- https://github.com/flared/docs-api/
If you are in mintlify:
- Don't edit this directly, edit the generator in pyro.
- pyro/pyro/mintlify/test_firework_event_models.py
*/}
```json Social Media Account theme={null}
{
"event_type": "social_media_account",
"data": {
"url": "https://social.net/user/coolgi",
"site": "SocialNet",
"username": "john_nolan"
},
"metadata": {
"estimated_created_at": "2025-01-01T00:00:00",
"flare_url": "https://app.flare.io/#/uid",
"matched_at": null,
"severity": "info",
"uid": "index/source/id"
}
}
```
{/*
If you are in pyro:
- If this file changes, you should also modify the API docs.
- https://github.com/flared/docs-api/
If you are in mintlify:
- Don't edit this directly, edit the generator in pyro.
- pyro/pyro/mintlify/test_firework_event_models.py
*/}
```json Stealer Log theme={null}
{
"event_type": "stealer_log",
"data": {
"victim_information": {
"ip_address": "127.0.0.1",
"ip_network": "127.0.0.0/8",
"username": "admin",
"country_code": "USA",
"zip_code": null,
"location": null,
"hwid": null,
"current_language": "en-US",
"screensize_width": 1920,
"screensize_height": 1080,
"timezone": "UTC+7",
"os": "Windows 10 22H2 Pro (Build 19045) (64 Bit)",
"uac": null,
"process_elevation": false,
"available_keyboards": [
"en-US"
],
"hardware": [
"CPU: Intel(R) Core(TM) i3-10105F CPU @ 3.70GHz (4 cores, 8 threads)",
"RAM: 31.92 GB",
"HOSTNAME: DESKTOP-123456"
],
"anti_viruses": [
"Windows Defender",
"Avast Antivirus"
]
},
"malware_information": {
"malware_family": "Lumastealer",
"build_id": "1234567890",
"file_location": "C:\\Windows\\System32\\malware.exe",
"infected_at": "2025-01-01T00:00:00"
}
},
"metadata": {
"estimated_created_at": "2025-01-01T00:00:00",
"flare_url": "https://app.flare.io/#/uid",
"matched_at": null,
"severity": "info",
"uid": "index/source/id"
}
}
```
The {name_0} endpoint is still in beta and is subject to change.
## OpenAPI
````yaml firework-v4-openapi get /firework/v4/events/
openapi: 3.1.0
info:
title: Firework API
version: v4
servers:
- url: https://api.flare.io
security:
- BearerAuth: []
paths:
/firework/v4/events/:
get:
tags:
- public
- team=integration
summary: Get Event
operationId: get_event_events__get
parameters:
- name: uid
in: query
required: true
schema:
type: string
title: Uid
responses:
'200':
description: Successful Response
content:
application/json:
schema:
oneOf:
- $ref: '#/components/schemas/BlogPostEvent'
- $ref: '#/components/schemas/BucketEvent'
- $ref: '#/components/schemas/ChatMessageEvent'
- $ref: '#/components/schemas/FinancialEvent'
- $ref: '#/components/schemas/ForumPostEvent'
- $ref: '#/components/schemas/ListingEvent'
- $ref: '#/components/schemas/LookalikeDomainEvent'
- $ref: '#/components/schemas/PasteEvent'
- $ref: '#/components/schemas/RansomLeakEvent'
- $ref: '#/components/schemas/SocialMediaEvent'
- $ref: >-
#/components/schemas/pyro__findings__stealerlogs__datamodels__StealerLogEvent
discriminator:
propertyName: event_type
mapping:
blog_post:
$ref: '#/components/schemas/BlogPostEvent'
bucket:
$ref: '#/components/schemas/BucketEvent'
chat_message:
$ref: '#/components/schemas/ChatMessageEvent'
cc:
$ref: '#/components/schemas/FinancialEvent'
forum_post:
$ref: '#/components/schemas/ForumPostEvent'
listing:
$ref: '#/components/schemas/ListingEvent'
lookalike:
$ref: '#/components/schemas/LookalikeDomainEvent'
paste:
$ref: '#/components/schemas/PasteEvent'
ransomleak:
$ref: '#/components/schemas/RansomLeakEvent'
social_media_account:
$ref: '#/components/schemas/SocialMediaEvent'
stealer_log:
$ref: >-
#/components/schemas/pyro__findings__stealerlogs__datamodels__StealerLogEvent
title: Response Get Event Events Get
'422':
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
components:
schemas:
BlogPostEvent:
properties:
event_type:
type: string
const: blog_post
title: Event Type
default: blog_post
metadata:
$ref: '#/components/schemas/EventMetadata'
data:
$ref: '#/components/schemas/BlogPostData'
type: object
required:
- metadata
- data
title: Blog Post
BucketEvent:
properties:
event_type:
type: string
const: bucket
title: Event Type
default: bucket
metadata:
$ref: '#/components/schemas/EventMetadata'
data:
$ref: '#/components/schemas/BucketEventData'
type: object
required:
- metadata
- data
title: Bucket
ChatMessageEvent:
properties:
event_type:
type: string
const: chat_message
title: Event Type
default: chat_message
data:
$ref: '#/components/schemas/ChatMessageEventData'
metadata:
$ref: '#/components/schemas/EventMetadata'
type: object
required:
- data
- metadata
title: Chat Message
FinancialEvent:
properties:
event_type:
type: string
const: cc
title: Event Type
default: cc
data:
$ref: '#/components/schemas/FinancialEventData'
metadata:
$ref: '#/components/schemas/EventMetadata'
type: object
required:
- data
- metadata
title: Credit Card
ForumPostEvent:
properties:
event_type:
type: string
const: forum_post
title: Event Type
default: forum_post
data:
$ref: '#/components/schemas/ForumPostData'
metadata:
$ref: '#/components/schemas/EventMetadata'
type: object
required:
- data
- metadata
title: Forum Post
ListingEvent:
properties:
event_type:
type: string
const: listing
title: Event Type
default: listing
data:
$ref: '#/components/schemas/ListingEventData'
metadata:
$ref: '#/components/schemas/EventMetadata'
type: object
required:
- data
- metadata
title: Listing
LookalikeDomainEvent:
properties:
event_type:
type: string
const: lookalike
title: Event Type
default: lookalike
data:
$ref: '#/components/schemas/LookalikeDomainEventData'
metadata:
$ref: '#/components/schemas/EventMetadata'
type: object
required:
- data
- metadata
title: Lookalike Domain
PasteEvent:
properties:
event_type:
type: string
const: paste
title: Event Type
default: paste
data:
$ref: '#/components/schemas/PasteEventData'
metadata:
$ref: '#/components/schemas/EventMetadata'
type: object
required:
- data
- metadata
title: Paste
RansomLeakEvent:
properties:
event_type:
type: string
const: ransomleak
title: Event Type
default: ransomleak
data:
$ref: '#/components/schemas/RansomLeakEventData'
metadata:
$ref: '#/components/schemas/EventMetadata'
type: object
required:
- data
- metadata
title: Ransom Leak
SocialMediaEvent:
properties:
event_type:
type: string
const: social_media_account
title: Event Type
default: social_media_account
data:
$ref: '#/components/schemas/SocialMediaEventData'
metadata:
$ref: '#/components/schemas/EventMetadata'
type: object
required:
- data
- metadata
title: Social Media Account
pyro__findings__stealerlogs__datamodels__StealerLogEvent:
properties:
event_type:
type: string
const: stealer_log
title: Event Type
default: stealer_log
data:
$ref: '#/components/schemas/StealerLogEventData'
metadata:
$ref: '#/components/schemas/EventMetadata'
type: object
required:
- data
- metadata
title: Stealer Log
HTTPValidationError:
properties:
detail:
items:
$ref: '#/components/schemas/ValidationError'
type: array
title: Detail
type: object
title: HTTPValidationError
EventMetadata:
properties:
estimated_created_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Estimated Created At
flare_url:
type: string
maxLength: 2083
minLength: 1
format: uri
title: Flare Url
matched_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Matched At
severity:
$ref: '#/components/schemas/EventSeverity'
uid:
type: string
title: Uid
type: object
required:
- estimated_created_at
- flare_url
- matched_at
- severity
- uid
title: EventMetadata
BlogPostData:
properties:
url:
anyOf:
- type: string
- type: 'null'
title: Url
description: The URL of the blog post.
content:
anyOf:
- type: string
- type: 'null'
title: Content
description: The content of the blog post.
description:
anyOf:
- type: string
- type: 'null'
title: Description
description: The description of the blog post.
posted_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Posted At
description: The date and time the blog post was posted.
type: object
required:
- url
- content
- description
- posted_at
title: BlogPostData
BucketEventData:
properties:
url:
anyOf:
- type: string
- type: 'null'
title: Url
description: The URL to the bucket.
bucket:
$ref: '#/components/schemas/BucketData'
type: object
required:
- url
- bucket
title: BucketEventData
ChatMessageEventData:
properties:
posted_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Posted At
description: The time the chat message was posted.
actor:
$ref: >-
#/components/schemas/pyro__findings__chat_messages__datamodels__ChatMessageEventData__Actor
description: Collection of data about the actor of the chat message.
context:
$ref: >-
#/components/schemas/pyro__findings__chat_messages__datamodels__ChatMessageEventData__Context
description: Collection of data about the context of the chat message.
content:
anyOf:
- type: string
- type: 'null'
title: Content
description: The content of the chat message.
parent_context:
$ref: '#/components/schemas/ParentContext'
description: Collection of data about the context of the parent chat message.
forward_info:
$ref: '#/components/schemas/ForwardInfo'
description: >-
Collection of data about the forward information of the chat
message.
was_forwarded:
anyOf:
- type: boolean
- type: 'null'
title: Was Forwarded
description: Whether the chat message was forwarded.
type: object
title: ChatMessageEventData
FinancialEventData:
properties:
bank:
anyOf:
- type: string
- type: 'null'
title: Bank
description: The bank associated with the leaked credit card.
bin:
anyOf:
- type: string
- type: 'null'
title: Bin
description: The BIN (Bank Identification Number) of the credit card.
brand:
anyOf:
- type: string
- type: 'null'
title: Brand
description: 'The brand of the leakedcredit card. Ex: VISA'
country:
anyOf:
- type: string
- type: 'null'
title: Country
description: The country the leakedcredit card was issued in.
expiration:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Expiration
description: The expiration date of the leaked credit card.
owner:
anyOf:
- type: string
- type: 'null'
title: Owner
description: The owner of the leaked credit card.
state_code:
anyOf:
- type: string
- type: 'null'
title: State Code
description: The state code tied to the leaked credit card.
zip:
anyOf:
- type: string
- type: 'null'
title: Zip
description: The zip code tied to the leaked credit card.
has_cvv:
anyOf:
- type: boolean
- type: 'null'
title: Has Cvv
description: Whether the CVV was included in the leaked data.
has_date_of_birth:
anyOf:
- type: boolean
- type: 'null'
title: Has Date Of Birth
description: Whether the date of birth was included in the leaked data.
has_mother_maiden_name:
anyOf:
- type: boolean
- type: 'null'
title: Has Mother Maiden Name
description: Whether the mother's maiden name was included in the leaked data.
has_phone:
anyOf:
- type: boolean
- type: 'null'
title: Has Phone
description: Whether the phone number was included in the leaked data.
has_pin:
anyOf:
- type: boolean
- type: 'null'
title: Has Pin
description: Whether the card's PIN was included in the leaked data.
has_ssn:
anyOf:
- type: boolean
- type: 'null'
title: Has Ssn
description: Whether the card owner's SSN was included in the leaked data.
has_track_1:
anyOf:
- type: boolean
- type: 'null'
title: Has Track 1
description: >-
Whether the card's track 1 (magnetic stripe data) was included in
the leaked data.
has_vbv:
anyOf:
- type: boolean
- type: 'null'
title: Has Vbv
description: >-
Whether the card's VBV (Verified by Visa) data was included in the
leaked data.
type: object
required:
- bank
- bin
- brand
- country
- expiration
- owner
- state_code
- zip
- has_cvv
- has_date_of_birth
- has_mother_maiden_name
- has_phone
- has_pin
- has_ssn
- has_track_1
- has_vbv
title: FinancialEventData
ForumPostData:
properties:
actor:
$ref: >-
#/components/schemas/pyro__findings__forum_posts__datamodels__ForumPostData__Actor
description: Details about the author of the forum post.
context:
$ref: >-
#/components/schemas/pyro__findings__forum_posts__datamodels__ForumPostData__Context
description: Details about the context of the forum post.
posted_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Posted At
description: Date and time the forum post was made.
content:
anyOf:
- type: string
- type: 'null'
title: Content
description: Content of the forum post.
url:
anyOf:
- type: string
- type: 'null'
title: Url
description: URL to the forum post.
type: object
required:
- actor
- context
- posted_at
- content
- url
title: ForumPostData
ListingEventData:
properties:
url:
anyOf:
- type: string
- type: 'null'
title: Url
description: The URL to the listing.
title:
anyOf:
- type: string
- type: 'null'
title: Title
description: The title of the listing.
content:
anyOf:
- type: string
- type: 'null'
title: Content
description: The content within the listing.
currency:
anyOf:
- type: string
- type: 'null'
title: Currency
description: The currency expected in the listing.
escrow:
anyOf:
- type: boolean
- type: 'null'
title: Escrow
description: Whether the listing requires escrow.
price:
anyOf:
- type: number
- type: 'null'
title: Price
description: The price of the listing.
ship_to:
items:
type: string
type: array
title: Ship To
description: The countries eligible for shipping.
default: []
ship_from:
items:
type: string
type: array
title: Ship From
description: The countries eligible for shipping.
default: []
stock_count:
anyOf:
- type: integer
- type: 'null'
title: Stock Count
description: The quantity of the items or service in stock.
actor:
$ref: >-
#/components/schemas/pyro__findings__listing__datamodels__ListingEventData__Actor
description: Data about the seller.
classification:
$ref: '#/components/schemas/Classification'
description: Data about the possible classifications of the listing.
context:
$ref: >-
#/components/schemas/pyro__findings__listing__datamodels__ListingEventData__Context
description: Data offering context to the listing.
type: object
title: ListingEventData
LookalikeDomainEventData:
properties:
domain:
type: string
title: Domain
description: The domain of the lookalike domain.
registered_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Registered At
description: The date and time the lookalike domain was registered.
identifier_domains:
anyOf:
- items:
type: string
type: array
- type: 'null'
title: Identifier Domains
description: Domain identifiers matching the lookalike domains
feed:
anyOf:
- type: string
- type: 'null'
title: Feed
description: The feed where the lookalike domain was found
cert_data:
anyOf:
- additionalProperties: true
type: object
- type: 'null'
title: Cert Data
description: The certificate data of the lookalike domain.
subject:
anyOf:
- type: string
- type: 'null'
title: Subject
description: The subject of the certificate of the lookalike domain.
issuer:
anyOf:
- type: string
- type: 'null'
title: Issuer
description: The issuer of the certificate of the lookalike domain.
type: object
required:
- domain
- registered_at
- identifier_domains
- feed
- cert_data
- subject
- issuer
title: LookalikeDomainEventData
PasteEventData:
properties:
url:
anyOf:
- type: string
- type: 'null'
title: Url
title:
anyOf:
- type: string
- type: 'null'
title: Title
content:
anyOf:
- type: string
- type: 'null'
title: Content
actor:
anyOf:
- $ref: >-
#/components/schemas/pyro__findings__paste__datamodels__PasteEventData__Actor
- type: 'null'
expires_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Expires At
syntax:
anyOf:
- type: string
- type: 'null'
title: Syntax
type: object
title: PasteEventData
RansomLeakEventData:
properties:
url:
anyOf:
- type: string
- type: 'null'
title: Url
description: The URL of the ransom leak post.
response_url:
anyOf:
- type: string
- type: 'null'
title: Response Url
description: The URL of the response to the ransom leak post.
title:
anyOf:
- type: string
- type: 'null'
title: Title
description: The title of the ransom leak post.
content:
anyOf:
- type: string
- type: 'null'
title: Content
description: The content of the ransom leak post.
body:
anyOf:
- type: string
- type: 'null'
title: Body
description: The body of the ransom leak post.
victim_information:
anyOf:
- $ref: >-
#/components/schemas/pyro__findings__ransomleaks__datamodels__VictimInformation
- type: 'null'
description: The information relating to the victim of the ransom leak.
type: object
required:
- url
- response_url
- title
- content
- body
- victim_information
title: RansomLeakEventData
SocialMediaEventData:
properties:
url:
anyOf:
- type: string
- type: 'null'
title: Url
description: The URL to the profile page of the social media account.
site:
anyOf:
- type: string
- type: 'null'
title: Site
description: The name of the platform where the account was found.
username:
anyOf:
- type: string
- type: 'null'
title: Username
description: The username of the account that was found.
type: object
title: SocialMediaEventData
StealerLogEventData:
properties:
victim_information:
anyOf:
- $ref: >-
#/components/schemas/pyro__findings__stealerlogs__datamodels__VictimInformation
- type: 'null'
description: >-
Collection of data that relates to the victim and their infected
device.
malware_information:
anyOf:
- $ref: '#/components/schemas/MalwareInformation'
- type: 'null'
description: >-
Collection of data that relates to the malware that was used to
infect the victim's device.
type: object
required:
- victim_information
- malware_information
title: StealerLogEventData
ValidationError:
properties:
loc:
items:
anyOf:
- type: string
- type: integer
type: array
title: Location
msg:
type: string
title: Message
type:
type: string
title: Error Type
input:
title: Input
ctx:
type: object
title: Context
type: object
required:
- loc
- msg
- type
title: ValidationError
EventSeverity:
type: string
enum:
- info
- low
- medium
- high
- critical
title: EventSeverity
BucketData:
properties:
host:
anyOf:
- type: string
- type: 'null'
title: Host
description: The host of the bucket.
provider:
anyOf:
- type: string
- type: 'null'
title: Provider
description: The provider of the bucket.
type: object
required:
- host
- provider
title: BucketData
pyro__findings__chat_messages__datamodels__ChatMessageEventData__Actor:
properties:
id:
anyOf:
- type: string
- type: 'null'
title: Id
description: The ID of the chat message author.
name:
anyOf:
- type: string
- type: 'null'
title: Name
description: The username of the chat message author.
type: object
title: Actor
pyro__findings__chat_messages__datamodels__ChatMessageEventData__Context:
properties:
conversation_id:
anyOf:
- type: string
- type: 'null'
title: Conversation Id
description: The ID of the conversation where the chat message was found.
conversation_name:
anyOf:
- type: string
- type: 'null'
title: Conversation Name
description: The name of the conversation where the chat message was found.
type: object
title: Context
ParentContext:
properties:
parent_uid:
anyOf:
- type: string
- type: 'null'
title: Parent Uid
parent_type:
anyOf:
- type: string
- type: 'null'
title: Parent Type
type: object
title: ParentContext
ForwardInfo:
properties:
forwarded_from:
anyOf:
- type: string
- type: 'null'
title: Forwarded From
description: The username of the chat message forwarder.
forwarded_from_author_id:
anyOf:
- type: string
- type: 'null'
title: Forwarded From Author Id
description: The ID of the chat message forwarder.
forwarded_from_chat_id:
anyOf:
- type: integer
- type: 'null'
title: Forwarded From Chat Id
description: The ID of the chat the message is being forwarded from.
forwarded_from_conversation_id:
anyOf:
- type: string
- type: 'null'
title: Forwarded From Conversation Id
description: The conversation ID the message is being forwarded from.
forwarded_from_user_id:
anyOf:
- type: integer
- type: 'null'
title: Forwarded From User Id
description: The ID of the user the message is being forwarded from.
forwarded_from_username:
anyOf:
- type: string
- type: 'null'
title: Forwarded From Username
description: The username of the user the message is being forwarded from.
forwarded_message_time:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Forwarded Message Time
description: The time the message was forwarded.
type: object
title: ForwardInfo
pyro__findings__forum_posts__datamodels__ForumPostData__Actor:
properties:
id:
anyOf:
- type: string
- type: 'null'
title: Id
description: >-
ID of the author of the forum post. These IDs relate to the forum
platform.
name:
anyOf:
- type: string
- type: 'null'
title: Name
description: Name of the author of the forum post.
type: object
required:
- id
- name
title: Actor
pyro__findings__forum_posts__datamodels__ForumPostData__Context:
properties:
category_name:
anyOf:
- type: string
- type: 'null'
title: Category Name
description: Category of the forum, these vary between forum platforms.
topic_id:
anyOf:
- type: string
- type: 'null'
title: Topic Id
description: Topic ID of the forum post.
topic_title:
anyOf:
- type: string
- type: 'null'
title: Topic Title
description: Title of the topic the post was made in.
type: object
required:
- category_name
- topic_id
- topic_title
title: Context
pyro__findings__listing__datamodels__ListingEventData__Actor:
properties:
id:
anyOf:
- type: string
- type: 'null'
title: Id
description: The ID of the seller.
name:
anyOf:
- type: string
- type: 'null'
title: Name
description: The name/username of the seller.
type: object
title: Actor
Classification:
properties:
classes:
$ref: '#/components/schemas/Classes'
description: Data about the classes identified in the listing.
types:
$ref: '#/components/schemas/Types'
description: Data about the possible listing type.
type: object
title: Classification
pyro__findings__listing__datamodels__ListingEventData__Context:
properties:
category_name:
anyOf:
- type: string
- type: 'null'
title: Category Name
description: The category of the listing, as seen on the market.
type: object
title: Context
pyro__findings__paste__datamodels__PasteEventData__Actor:
properties:
id:
anyOf:
- type: string
- type: 'null'
title: Id
name:
anyOf:
- type: string
- type: 'null'
title: Name
type: object
required:
- id
- name
title: Actor
pyro__findings__ransomleaks__datamodels__VictimInformation:
properties:
name:
anyOf:
- type: string
- type: 'null'
title: Name
description: >-
The name of the victim. This is the name of the company or
organization that was breached.
display_name:
anyOf:
- type: string
- type: 'null'
title: Display Name
domain:
anyOf:
- type: string
- type: 'null'
title: Domain
description: >-
The domain of the victim. This is the domain of the company or
organization that was breached.
alternative_domains:
anyOf:
- items:
type: string
type: array
- type: 'null'
title: Alternative Domains
industry:
anyOf:
- type: string
- type: 'null'
title: Industry
description: The industry of the company or organization that was breached.
employee_count:
anyOf:
- type: integer
- type: 'null'
title: Employee Count
description: >-
The number of employees of the company or organization that was
breached.
city:
anyOf:
- type: string
- type: 'null'
title: City
description: >-
The city of operation of the company or organization that was
breached.
state:
anyOf:
- type: string
- type: 'null'
title: State
description: >-
The state of operation of the company or organization that was
breached.
country:
anyOf:
- type: string
- type: 'null'
title: Country
description: >-
The country of operation of the company or organization that was
breached.
latitude:
anyOf:
- type: number
- type: 'null'
title: Latitude
longitude:
anyOf:
- type: number
- type: 'null'
title: Longitude
type: object
required:
- name
- display_name
- domain
- alternative_domains
- industry
- employee_count
- city
- state
- country
- latitude
- longitude
title: VictimInformation
pyro__findings__stealerlogs__datamodels__VictimInformation:
properties:
ip_address:
anyOf:
- type: string
format: ipvanyaddress
- type: 'null'
title: Ip Address
ip_network:
anyOf:
- type: string
format: ipvanynetwork
- type: 'null'
title: Ip Network
username:
anyOf:
- type: string
- type: 'null'
title: Username
description: The username of account accessed on the infected device.
country_code:
anyOf:
- type: string
- type: 'null'
title: Country Code
description: The country code tied to the infected device.
zip_code:
anyOf:
- type: string
- type: 'null'
title: Zip Code
location:
anyOf:
- type: string
- type: 'null'
title: Location
hwid:
anyOf:
- type: string
- type: 'null'
title: Hwid
description: The hardware ID of the infected device.
current_language:
anyOf:
- type: string
- type: 'null'
title: Current Language
description: The current language selected on the infected device.
screensize_width:
anyOf:
- type: integer
- type: 'null'
title: Screensize Width
description: The width of the screen in pixels.
screensize_height:
anyOf:
- type: integer
- type: 'null'
title: Screensize Height
description: The height of the screen in pixels.
timezone:
anyOf:
- type: string
- type: 'null'
title: Timezone
description: The timezone of the infected device.
os:
anyOf:
- type: string
- type: 'null'
title: Os
description: The operating system of the infected device.
uac:
anyOf:
- type: string
- type: 'null'
title: Uac
description: The user account control (UAC) setting of the infected device.
process_elevation:
anyOf:
- type: boolean
- type: 'null'
title: Process Elevation
description: >-
Whether operations during infection were elevated to administrator
privileges.
available_keyboards:
anyOf:
- items:
type: string
type: array
- type: 'null'
title: Available Keyboards
description: The available keyboard layouts on the infected device.
hardware:
anyOf:
- items:
type: string
type: array
- type: 'null'
title: Hardware
description: The hardware components of the infected device.
anti_viruses:
anyOf:
- items:
type: string
type: array
- type: 'null'
title: Anti Viruses
description: The anti-viruses installed on the infected device.
type: object
required:
- ip_address
- ip_network
- username
- country_code
- zip_code
- location
- hwid
- current_language
- screensize_width
- screensize_height
- timezone
- os
- uac
- process_elevation
- available_keyboards
- hardware
- anti_viruses
title: VictimInformation
MalwareInformation:
properties:
malware_family:
anyOf:
- type: string
- type: 'null'
title: Malware Family
description: The malware family used for device infection.
build_id:
anyOf:
- type: string
- type: 'null'
title: Build Id
description: The build ID of the malware used for device infection.
file_location:
anyOf:
- type: string
- type: 'null'
title: File Location
description: The file location of the malware used for device infection.
infected_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Infected At
description: >-
The date and time the malware was used to infect the victim's
device.
type: object
required:
- malware_family
- build_id
- file_location
- infected_at
title: MalwareInformation
Classes:
properties:
is_carding:
anyOf:
- type: boolean
- type: 'null'
title: Is Carding
description: Whether the listing is classified as carding.
is_bypass:
anyOf:
- type: boolean
- type: 'null'
title: Is Bypass
description: Whether the listing is classified as a bypass.
is_ident_fraud:
anyOf:
- type: boolean
- type: 'null'
title: Is Ident Fraud
description: Whether the listing is classified as identity fraud.
is_doc_fraud:
anyOf:
- type: boolean
- type: 'null'
title: Is Doc Fraud
description: Whether the listing is classified as document fraud.
is_phishing:
anyOf:
- type: boolean
- type: 'null'
title: Is Phishing
description: Whether the listing is classified as phishing.
is_money_xfer:
anyOf:
- type: boolean
- type: 'null'
title: Is Money Xfer
description: Whether the listing is classified as money transfer.
is_cashout:
anyOf:
- type: boolean
- type: 'null'
title: Is Cashout
description: Whether the listing is classified as a cashout.
is_virt_currency:
anyOf:
- type: boolean
- type: 'null'
title: Is Virt Currency
description: Whether the listing is classified as a virtual currency transaction.
is_hacking:
anyOf:
- type: boolean
- type: 'null'
title: Is Hacking
description: Whether the listing is classified as hacking activities.
is_misc_financial:
anyOf:
- type: boolean
- type: 'null'
title: Is Misc Financial
description: >-
Whether the listing is classified as miscellaneous financial
activities.
type: object
title: Classes
Types:
properties:
is_guide:
anyOf:
- type: boolean
- type: 'null'
title: Is Guide
description: 'Whether the listing is a guide. Ex: ''How to extort a website'''
is_service:
anyOf:
- type: boolean
- type: 'null'
title: Is Service
description: >-
Whether the listing is offering a service. Ex: 'I will help you
extort a website'
is_software:
anyOf:
- type: boolean
- type: 'null'
title: Is Software
description: >-
Whether the listing is offering software. Ex: 'I will sell you a
software to extort a website'
is_hardware:
anyOf:
- type: boolean
- type: 'null'
title: Is Hardware
description: >-
Whether the listing is offering hardware. Ex: 'I will sell you a
hardware'
is_data:
anyOf:
- type: boolean
- type: 'null'
title: Is Data
description: >-
Whether the listing is offering data. Ex: 'I will sell you victim
data'
type: object
title: Types
securitySchemes:
BearerAuth:
type: http
scheme: bearer
````