List Identifier Group's Events
curl --request POST \
--url https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"query": {},
"size": 123,
"from": "<string>",
"order": "<string>",
"filters": {
"severity": [
"<string>"
],
"type": [
"<string>"
],
"estimated_created_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"tags": [
"<string>"
],
"is_ignored": true,
"is_remediated": true
}
}
'import requests
url = "https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search"
payload = {
"query": {},
"size": 123,
"from": "<string>",
"order": "<string>",
"filters": {
"severity": ["<string>"],
"type": ["<string>"],
"estimated_created_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"tags": ["<string>"],
"is_ignored": True,
"is_remediated": True
}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
query: {},
size: 123,
from: '<string>',
order: '<string>',
filters: {
severity: ['<string>'],
type: ['<string>'],
estimated_created_at: {gt: '<string>', gte: '<string>', lt: '<string>', lte: '<string>'},
tags: ['<string>'],
is_ignored: true,
is_remediated: true
}
})
};
fetch('https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'query' => [
],
'size' => 123,
'from' => '<string>',
'order' => '<string>',
'filters' => [
'severity' => [
'<string>'
],
'type' => [
'<string>'
],
'estimated_created_at' => [
'gt' => '<string>',
'gte' => '<string>',
'lt' => '<string>',
'lte' => '<string>'
],
'tags' => [
'<string>'
],
'is_ignored' => true,
'is_remediated' => true
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search"
payload := strings.NewReader("{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}"
response = http.request(request)
puts response.read_body{
"items": [
{
"metadata": {
"estimated_created_at": "2019-09-20T16:30:37.589388Z",
"matched_at": "2019-09-21T10:15:22.123456Z",
"type": "listing",
"uid": "listing/apollon_market/9861",
"severity": "critical"
},
"tenant_metadata": {
"severity": {
"original": "low",
"override": "critical"
},
"tags": [
"important",
],
"notes": "This reason why this is tagged as 'important' is: ..."
},
"identifiers": [
{
"id": 1,
"name": "An identifier"
}
],
"highlights": {
"description": [
"Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
],
"title": [
"Bank Statement PSD <mark>Template</mark>"
]
}
}
],
"next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
}
Event Feeds
List Identifier Group's Events
POST
/
firework
/
v4
/
events
/
identifier_groups
/
{identifier_group_id}
/
_search
List Identifier Group's Events
curl --request POST \
--url https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"query": {},
"size": 123,
"from": "<string>",
"order": "<string>",
"filters": {
"severity": [
"<string>"
],
"type": [
"<string>"
],
"estimated_created_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"tags": [
"<string>"
],
"is_ignored": true,
"is_remediated": true
}
}
'import requests
url = "https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search"
payload = {
"query": {},
"size": 123,
"from": "<string>",
"order": "<string>",
"filters": {
"severity": ["<string>"],
"type": ["<string>"],
"estimated_created_at": {
"gt": "<string>",
"gte": "<string>",
"lt": "<string>",
"lte": "<string>"
},
"tags": ["<string>"],
"is_ignored": True,
"is_remediated": True
}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
query: {},
size: 123,
from: '<string>',
order: '<string>',
filters: {
severity: ['<string>'],
type: ['<string>'],
estimated_created_at: {gt: '<string>', gte: '<string>', lt: '<string>', lte: '<string>'},
tags: ['<string>'],
is_ignored: true,
is_remediated: true
}
})
};
fetch('https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'query' => [
],
'size' => 123,
'from' => '<string>',
'order' => '<string>',
'filters' => [
'severity' => [
'<string>'
],
'type' => [
'<string>'
],
'estimated_created_at' => [
'gt' => '<string>',
'gte' => '<string>',
'lt' => '<string>',
'lte' => '<string>'
],
'tags' => [
'<string>'
],
'is_ignored' => true,
'is_remediated' => true
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search"
payload := strings.NewReader("{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.flare.io/firework/v4/events/identifier_groups/{identifier_group_id}/_search")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"query\": {},\n \"size\": 123,\n \"from\": \"<string>\",\n \"order\": \"<string>\",\n \"filters\": {\n \"severity\": [\n \"<string>\"\n ],\n \"type\": [\n \"<string>\"\n ],\n \"estimated_created_at\": {\n \"gt\": \"<string>\",\n \"gte\": \"<string>\",\n \"lt\": \"<string>\",\n \"lte\": \"<string>\"\n },\n \"tags\": [\n \"<string>\"\n ],\n \"is_ignored\": true,\n \"is_remediated\": true\n }\n}"
response = http.request(request)
puts response.read_body{
"items": [
{
"metadata": {
"estimated_created_at": "2019-09-20T16:30:37.589388Z",
"matched_at": "2019-09-21T10:15:22.123456Z",
"type": "listing",
"uid": "listing/apollon_market/9861",
"severity": "critical"
},
"tenant_metadata": {
"severity": {
"original": "low",
"override": "critical"
},
"tags": [
"important",
],
"notes": "This reason why this is tagged as 'important' is: ..."
},
"identifiers": [
{
"id": 1,
"name": "An identifier"
}
],
"highlights": {
"description": [
"Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
],
"title": [
"Bank Statement PSD <mark>Template</mark>"
]
}
}
],
"next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
}
Returns a list of events matching the identifiers of an identifier group.
Learn more about Event Source Filters .
Guides
See the guide for using this endpoint: Exporting a Tenant’s Events .{
"items": [
{
"metadata": {
"estimated_created_at": "2019-09-20T16:30:37.589388Z",
"matched_at": "2019-09-21T10:15:22.123456Z",
"type": "listing",
"uid": "listing/apollon_market/9861",
"severity": "critical"
},
"tenant_metadata": {
"severity": {
"original": "low",
"override": "critical"
},
"tags": [
"important",
],
"notes": "This reason why this is tagged as 'important' is: ..."
},
"identifiers": [
{
"id": 1,
"name": "An identifier"
}
],
"highlights": {
"description": [
"Bank Statement PSD <mark>Template</mark>\r\n\r\nWe promise:\r\n- Your order will be delivered instantly."
],
"title": [
"Bank Statement PSD <mark>Template</mark>"
]
}
}
],
"next": "WzE1Njg5OTcwMzc1ODksICJsaXN0aW5nL2Fwb2xsb25fbWFya2V0Lzk4NjEiXQ%3D%3D"
}
Paging
This endpoint supports the Flare standard paging pattern .Body Parameters
object
One of the supported queries.
{
"type": "domain",
"fqdn": "<string>"
}
{
"type": "email",
"email": "<string>"
}
{
"type": "keyword",
"keyword": "<string>"
}
{
"type": "query_string",
"query_string": "<string>"
}
{
"type": "username",
"username": "<string>"
}
{
"type": "github_repository",
"repo_owner": "<string>"
"repo_name": "<string>"
}
{
"type": "brand",
"name": "<string>"
}
{
"type": "name",
"first_name": "<string>"
"last_name": "<string>"
"is_strict": "<boolean>"
}
{
"type": "bin",
"bin": "<string>"
}
{
"type": "ip",
"ip": "<string>"
}
{
"type": "credentials",
"username": "<string>"
"password": "<string>"
}
{
"type": "secret",
"secret": "<string>"
}
{
"type": "azure_tenant",
"tenant_id": "<string>"
}
number
Limit number of events that will be returned. (Max 10)
string
The
next value from the last response.string
default:"desc"
The order in which the results will be returned.
Show valid order values
Show valid order values
asc
descobject
Hide child attributes
Hide child attributes
string[]
If a string value is specified, results will contain events that have a greater than or equal severity. Otherwise, if an array of severities is specified, results will only contain events that exactly match one of them.
Show valid severity values
Show valid severity values
info
low
medium
high
criticalstring[]
Show valid type values
Show valid type values
illicit_networks
open_web
leak
domain
listing
forum_content
blog_content
profile
chat_message
ransomleak
infected_devices
financial_data
paste
social_media
source_code
google
service
bucketsobject
Show child attributes
Show child attributes
string
Matches values greater than the specified timestamp.Format: ISO-8601
string
Matches values greater than or equal to the specified timestamp.Format: ISO-8601
string
Matches values lesser than the specified timestamp.Format: ISO-8601
string
Matches values lesser than or equal to the specified timestamp.Format: ISO-8601
string[]
If provided, results will be filtered on the tags.
bool
If set to true, results will be filtered to be events that have been ignored.
bool
If set to true, results will be filtered to be events that have been remediated.
Path Parameters
int
required
The ID of the group.
Was this page helpful?
⌘I