List Identifier Group's Events
curl --request POST \
--url https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"query": {},
"size": 123,
"from": "<string>",
"sort": "<string>",
"order": "<string>",
"filters": {
"severity": [
"<string>"
],
"type": [
"<string>"
],
"estimated_created_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"matched_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"tags": [
"<string>"
],
"status": [
"<string>"
],
"is_ignored": true,
"is_remediated": true
}
}
'import requests
url = "https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search"
payload = {
"query": {},
"size": 123,
"from": "<string>",
"sort": "<string>",
"order": "<string>",
"filters": {
"severity": ["<string>"],
"type": ["<string>"],
"estimated_created_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"matched_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"tags": ["<string>"],
"status": ["<string>"],
"is_ignored": True,
"is_remediated": True
}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
query: {},
size: 123,
from: '<string>',
sort: '<string>',
order: '<string>',
filters: {
severity: ['<string>'],
type: ['<string>'],
estimated_created_at: {gt: '<string>', gte: '<string>', lt: '<string>', lte: '<string>'},
matched_at: {gt: '<string>', gte: '<string>', lt: '<string>', lte: '<string>'},
tags: ['<string>'],
status: ['<string>'],
is_ignored: true,
is_remediated: true
}
})
};
fetch('https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'query' => [
],
'size' => 123,
'from' => '<string>',
'sort' => '<string>',
'order' => '<string>',
'filters' => [
'severity' => [
'<string>'
],
'type' => [
'<string>'
],
'estimated_created_at' => [
'gt' => '<string>',
'gte' => '<string>',
'lt' => '<string>',
'lte' => '<string>'
],
'matched_at' => [
'gt' => '<string>',
'gte' => '<string>',
'lt' => '<string>',
'lte' => '<string>'
],
'tags' => [
'<string>'
],
'status' => [
'<string>'
],
'is_ignored' => true,
'is_remediated' => true
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search"
payload := strings.NewReader("{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"sort\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"matched_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"status\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"sort\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"matched_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"status\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"sort\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"matched_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"status\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}"
response = http.request(request)
puts response.read_body{
"items": [
{
"metadata": {
"estimated_created_at": "2019-09-20T16:30:37.589388Z",
"matched_at": "2019-09-21T10:15:22.123456Z",
"type": "listing",
"uid": "listing/apollon_market/9861",
"severity": "critical"
},
"tenant_metadata": {
"severity": {
"original": "low",
"override": "critical"
},
"tags": [
"important",
],
"notes": "This reason why this is tagged as 'important' is: ..."
},
"identifiers": [
{
"id": 1,
"name": "An identifier"
}
],
"highlights": {
"description": [
"Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
],
"title": [
"Bank Statement PSD <mark>Template</mark>"
]
}
}
],
"next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
}
Event Feeds
List Identifier Group's Events
POST
/
firework
/
v4
/
events
/
identifier_groups
/
{identifier_group_id}
/
_search
List Identifier Group's Events
curl --request POST \
--url https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"query": {},
"size": 123,
"from": "<string>",
"sort": "<string>",
"order": "<string>",
"filters": {
"severity": [
"<string>"
],
"type": [
"<string>"
],
"estimated_created_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"matched_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"tags": [
"<string>"
],
"status": [
"<string>"
],
"is_ignored": true,
"is_remediated": true
}
}
'import requests
url = "https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search"
payload = {
"query": {},
"size": 123,
"from": "<string>",
"sort": "<string>",
"order": "<string>",
"filters": {
"severity": ["<string>"],
"type": ["<string>"],
"estimated_created_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"matched_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"tags": ["<string>"],
"status": ["<string>"],
"is_ignored": True,
"is_remediated": True
}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
query: {},
size: 123,
from: '<string>',
sort: '<string>',
order: '<string>',
filters: {
severity: ['<string>'],
type: ['<string>'],
estimated_created_at: {gt: '<string>', gte: '<string>', lt: '<string>', lte: '<string>'},
matched_at: {gt: '<string>', gte: '<string>', lt: '<string>', lte: '<string>'},
tags: ['<string>'],
status: ['<string>'],
is_ignored: true,
is_remediated: true
}
})
};
fetch('https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'query' => [
],
'size' => 123,
'from' => '<string>',
'sort' => '<string>',
'order' => '<string>',
'filters' => [
'severity' => [
'<string>'
],
'type' => [
'<string>'
],
'estimated_created_at' => [
'gt' => '<string>',
'gte' => '<string>',
'lt' => '<string>',
'lte' => '<string>'
],
'matched_at' => [
'gt' => '<string>',
'gte' => '<string>',
'lt' => '<string>',
'lte' => '<string>'
],
'tags' => [
'<string>'
],
'status' => [
'<string>'
],
'is_ignored' => true,
'is_remediated' => true
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search"
payload := strings.NewReader("{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"sort\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"matched_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"status\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"sort\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"matched_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"status\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"sort\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"matched_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"status\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}"
response = http.request(request)
puts response.read_body{
"items": [
{
"metadata": {
"estimated_created_at": "2019-09-20T16:30:37.589388Z",
"matched_at": "2019-09-21T10:15:22.123456Z",
"type": "listing",
"uid": "listing/apollon_market/9861",
"severity": "critical"
},
"tenant_metadata": {
"severity": {
"original": "low",
"override": "critical"
},
"tags": [
"important",
],
"notes": "This reason why this is tagged as 'important' is: ..."
},
"identifiers": [
{
"id": 1,
"name": "An identifier"
}
],
"highlights": {
"description": [
"Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
],
"title": [
"Bank Statement PSD <mark>Template</mark>"
]
}
}
],
"next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
}
Required API key permission: Read Tenant
Returns a list of events matching the identifiers of an identifier group.
Learn more about Event Source Filters .
Guides
See the guide for using this endpoint: Exporting a Tenant’s Events .{
"items": [
{
"metadata": {
"estimated_created_at": "2019-09-20T16:30:37.589388Z",
"matched_at": "2019-09-21T10:15:22.123456Z",
"type": "listing",
"uid": "listing/apollon_market/9861",
"severity": "critical"
},
"tenant_metadata": {
"severity": {
"original": "low",
"override": "critical"
},
"tags": [
"important",
],
"notes": "This reason why this is tagged as 'important' is: ..."
},
"identifiers": [
{
"id": 1,
"name": "An identifier"
}
],
"highlights": {
"description": [
"Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
],
"title": [
"Bank Statement PSD <mark>Template</mark>"
]
}
}
],
"next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
}
Paging
This endpoint supports the Flare standard paging pattern .Body Parameters
object
One of the supported queries. (optional)
{
"type": "domain",
"fqdn": "<string>"
}
{
"type": "email",
"email": "<string>"
}
{
"type": "keyword",
"keyword": "<string>"
}
{
"type": "query_string",
"query_string": "<string>"
}
{
"type": "username",
"username": "<string>"
}
{
"type": "github_repository",
"repo_owner": "<string>"
"repo_name": "<string>"
}
{
"type": "brand",
"name": "<string>"
}
{
"type": "name",
"first_name": "<string>"
"last_name": "<string>"
"is_strict": "<boolean>"
}
{
"type": "bin",
"bin": "<string>"
}
{
"type": "ip",
"ip": "<string>"
}
{
"type": "credentials",
"username": "<string>"
"password": "<string>"
}
{
"type": "secret",
"secret": "<string>"
}
{
"type": "azure_tenant",
"tenant_id": "<string>"
}
number
Limit number of events that will be returned. (Max 10)
string
The
next value from the last response.string
default:"matched_at"
Date field used to sort the results.
Show valid sort values
Show valid sort values
matched_at
estimated_created_atstring
default:"desc"
Sort order of the results by the
sort field.Show valid order values
Show valid order values
asc
descobject
Hide child attributes
Hide child attributes
string[]
If a string value is specified, results will contain events that have a greater than or equal severity. Otherwise, if an array of severities is specified, results will only contain events that exactly match one of them.
Show valid severity values
Show valid severity values
info
low
medium
high
criticalstring[]
Show valid type values
Show valid type values
illicit_networks
open_web
leak
valid_credential
invalid_credential
mitigated_credential
domain
lookalike_discovery
lookalike_title
lookalike_ip_address
lookalike_favicon
lookalike_screenshot
lookalike_dns
lookalike_whois_rdap
lookalike_ssl_certificate
listing
forum_content
blog_content
profile
chat_message
ransomleak
infected_devices
financial_data
paste
social_media
source_code
google
service
bucketsobject
Filters on the estimated date the event was created on its source.
Show child attributes
Show child attributes
string
Matches values greater than the specified timestamp.Format: ISO-8601
string
Matches values greater than or equal to the specified timestamp.Format: ISO-8601
string
Matches values lesser than the specified timestamp.Format: ISO-8601
string
Matches values lesser than or equal to the specified timestamp.Format: ISO-8601
object
Filters on the date the event was matched to the tenant’s identifiers.
Show child attributes
Show child attributes
string
Matches values greater than the specified timestamp.Format: ISO-8601
string
Matches values greater than or equal to the specified timestamp.Format: ISO-8601
string
Matches values lesser than the specified timestamp.Format: ISO-8601
string
Matches values lesser than or equal to the specified timestamp.Format: ISO-8601
string[]
If provided, results will be filtered on the tags.
string[]
If provided, results will only contain events that match one of the specified statuses.
Show valid status values
Show valid status values
open
ignored
remediatedbool
deprecated
If set to true, results will be filtered to be events that have been ignored.
bool
deprecated
If set to true, results will be filtered to be events that have been remediated.
Path Parameters
int
required
The ID of the group.
Was this page helpful?