Flare Events
Overview
Flare Events provides exposure intelligence from clear, deep and dark web sources, including chat channels, forums, marketplaces, leaks, stealer logs, and lookalike domains. The intake normalizes Flare tenant feed events into ECS for correlation and detection in sekoia.io.
Architecture
- Vendor: Flare
- Product URL: https://flare.io/
- Technology type: Cloud (SaaS only)
- On-prem version: N/A
- Detection approach in Sekoia.io: Threat-oriented detections from ingested events
Flare exposes a unified tenant event feed where each event is identified by header.type. The connector consumes this single feed and forwards all supported subtypes to the Flare Events intake.
Event coverage
The integration covers the full tenant feed and supports multiple subtypes, including:
chat_message,attachmentforum_post,forum_topiclisting,sellerpasteleaked_credential,stealer_logsource_code,docker_imagedriller_profiledomainblog_postbucket,bucket_objectdocument(ransomleak)googleservice,social_mediaexperimental
Reference:
Focus on leaked credentials
For leaked_credential events, Flare data can originate from several source families (for example stealer_logs, url_login_pass, phishing_kits_credentials, named leaks, and combolists). This source context is exposed in the payload through source_id and data.leak_source.* fields.
Operationally:
stealer_logsand phishing-kit credentials can include richer event linkage (event_uid) in Flare datasets- named leaks include breach context (
breached_at,leaked_at,pii_tags) - combolists and ULP-style data are generally lower-context but still actionable for account exposure detection
Configure
Prerequisites
Before configuring the integration, ensure you have:
- An active Flare tenant
- A Flare API key with read access to tenant events
- Permissions in sekoia.io to create and manage intakes
- Outbound HTTPS access to
https://api.flare.io
Create Flare credentials
- Sign in to the Flare console.
- Go to
Settings>API Keys. - Create an API key with read scope on tenant events.
- Copy and store the API key securely.
For details on Flare authentication and token lifecycle, see the Flare Python SDK authentication guide.
Get the optional tenant ID
If your API key is scoped to multiple tenants, you can set tenant_id in the connector configuration.
- In the Flare web console URL, the tenant identifier appears in the tenant context (for example in tenant-scoped paths after selecting a tenant).
- Use that numeric value as
tenant_idin sekoia.io.
How collection works
The connector uses a scheduled PULL model with the official flareio SDK.
- It calls
POST /firework/v4/events/tenant/_searchto read event pages. - For each returned
items[].uid, it fetches the full activity payload viaGET /firework/v2/activities/{uid}(handled byFlareApiClient.scroll_events). - It forwards normalized events to the configured Sekoia.io intake.
Pagination and checkpoint behavior:
- Paging uses Flare
from/nextcursor semantics. - The connector persists the latest non-null
nextcursor in checkpoint storage. - On first run, it uses an initial lookback window (
estimated_created_at.gte) before switching to cursor-based incremental collection. - Empty
itemspages do not stop polling; collection ends only whennextis null or absent.
The connector also applies client-side throttling and relies on SDK retry logic for transient API errors (including HTTP 429).
Create your intake in sekoia.io
- Go to the Intakes page.
- Click
+ Intake. - Choose
Flare Events. - Give the intake a name and select the target entity.
- Configure the trigger account with:
api_key(required)tenant_id(optional)- Start the trigger
Fetch new events from Flare.
Instruction on Sekoia
Raw Events Samples
In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.
{
"data": {
"index": "blog_post",
"title": "Leak blog post",
"url": "https://example.com/blog/1",
"browser_url": "https://example.com/blog/1",
"description": "blog summary",
"content": "blog content body",
"actor": "user1",
"features": {
"domains": [
"example.com"
],
"emails": null,
"ip_addresses": null,
"urls": [
"https://example.com/blog/1"
],
"usernames": [
"user1"
]
}
},
"header": {
"uid": "blog_post/test/1",
"type": "blog_post",
"source": "test_blog",
"source_name": "Test Blog",
"timestamp": "2025-04-01T10:00:00Z",
"title": "Leak blog post",
"content_hash": "hash-blog",
"risk": {
"score": 2
},
"tags": [],
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-04-01T10:00:00Z",
"first_crawled_at": "2025-04-01T10:10:00Z",
"last_crawled_at": "2025-04-01T10:20:00Z",
"payload_digest": "hash-blog",
"scraped_at": "2025-04-01T10:21:00Z",
"source": "test_blog",
"flare_url": ""
}
}
{
"data": {
"index": "bucket",
"url": "https://example.com/bucket/sample",
"provider": "aws",
"name": "example-bucket",
"region": "eu-west-1",
"size": 1024,
"content_type": "text/plain",
"features": {
"domains": [
"example.com"
],
"emails": null,
"ip_addresses": null,
"urls": [
"https://example.com/bucket/sample"
],
"usernames": null
}
},
"header": {
"uid": "bucket/test/1",
"type": "bucket",
"source": "cloud_scan",
"source_name": "Cloud Scan",
"timestamp": "2025-04-02T12:00:00Z",
"title": "Public bucket",
"content_hash": "hash-bucket",
"risk": {
"score": 2
},
"tags": [],
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-04-02T12:00:00Z",
"first_crawled_at": "2025-04-02T12:01:00Z",
"last_crawled_at": "2025-04-02T12:02:00Z",
"payload_digest": "hash-bucket",
"scraped_at": "2025-04-02T12:03:00Z",
"source": "cloud_scan",
"flare_url": ""
}
}
{
"data": {
"index": "chat_message",
"actor": "user4",
"actor_id": "User1",
"actor_name": "user4",
"conversation_id": "7521757009",
"conversation_name": ".",
"message": "EXAMPLE FINANCIAL ALERT",
"posted_at": "2026-06-03T11:01:16+00:00",
"features": {
"domains": null,
"emails": null,
"ip_addresses": [
"192.0.2.0",
"198.51.100.1"
],
"urls": null,
"usernames": null
},
"sensitive_content": "phishing"
},
"header": {
"category_name": "Chat",
"content_hash": "fff986a8ff7b6eb126168f4816f61b1bcf97326b",
"risk": {
"score": 3
},
"source": "telegram_bot",
"source_name": "Telegram Bot Exfiltration",
"tags": [
"darkweb"
],
"timestamp": "2026-06-03T11:01:16+00:00",
"title": "user4 sent a message",
"type": "chat_message",
"uid": "chat_message/telegram_bot/7521757009/User1/c404688b",
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2026-06-03T11:01:16+00:00",
"first_crawled_at": "2026-06-03T12:02:56.514010+00:00",
"last_crawled_at": "2026-06-03T12:03:08.857547+00:00",
"payload_digest": "fff986a8ff7b6eb126168f4816f61b1bcf97326b",
"scraped_at": "2026-06-03T12:03:10.086932+00:00",
"source": "telegram_bot",
"flare_url": ""
}
}
{
"data": {
"index": "document",
"title": "Example Leak",
"url": "http://example.com/doc",
"content": "Leak description",
"main": "Leak summary",
"features": {
"domains": [
"example.com"
],
"emails": null,
"ip_addresses": null,
"urls": null,
"usernames": null
}
},
"header": {
"uid": "document/source/id",
"type": "document",
"source": "example_source",
"source_name": "Example Leak Source",
"timestamp": "2025-10-28T19:49:18.173119+00:00",
"title": "Example Leak",
"content_hash": "hash-doc",
"risk": {
"score": 3
},
"tags": [],
"victim_name": "Example Financial Institution",
"country": "France",
"state_code": "FR-IDF",
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-10-28T19:49:18.173119+00:00",
"first_crawled_at": "2024-11-29T15:03:18.015000+00:00",
"last_crawled_at": "2025-10-28T19:49:20.490310+00:00",
"payload_digest": "hash-doc",
"scraped_at": "2025-10-28T19:49:20.981763+00:00",
"source": "example_source",
"flare_url": ""
}
}
{
"data": {
"index": "domain",
"name": "example.com",
"registered_at": "2025-10-20T23:15:59+00:00",
"identifier_domain": [
"example.co.uk"
],
"feed": "dnstwist",
"cert_data": "present",
"subject": "CN=example.com",
"issuer": "CN=Example CA",
"features": {
"domains": [
"example.com"
],
"emails": null,
"ip_addresses": null,
"urls": null,
"usernames": null
}
},
"header": {
"type": "domain",
"uid": "domain/source/id",
"source": "example_source",
"source_name": "Example DNS Monitor",
"category_name": "domain",
"title": "example.com",
"timestamp": "2025-10-20T23:15:59+00:00",
"risk": {
"score": 1
},
"tags": [],
"content_hash": "hash-domain",
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-10-20T23:15:59+00:00",
"first_crawled_at": "2025-10-20T23:15:59+00:00",
"last_crawled_at": "2025-10-26T00:29:04+00:00",
"payload_digest": "hash-domain",
"scraped_at": "2025-10-26T00:29:04+00:00",
"source": "example_source",
"flare_url": ""
}
}
{
"data": {
"index": "driller_profile",
"username": "user987",
"realname": "User987",
"about": "about me",
"location": "test",
"website": "https://example.com",
"contact_info": {
"twitter": "@user987",
"email": "user987@example.com"
},
"groups": [
"group1"
],
"features": {
"domains": null,
"emails": [
"user987@example.com"
],
"ip_addresses": null,
"urls": null,
"usernames": null
}
},
"header": {
"uid": "driller_profile/github/user_987",
"type": "driller_profile",
"source": "github",
"source_name": "GitHub",
"timestamp": "2025-03-08T17:04:18Z",
"title": "User987",
"content_hash": "profilehash",
"risk": {
"score": 1
},
"tags": [],
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-03-08T17:04:18Z",
"first_crawled_at": "2025-02-10T05:04:09Z",
"last_crawled_at": "2025-03-08T17:04:19Z",
"payload_digest": "profilehash",
"scraped_at": "2025-03-08T17:04:19Z",
"source": "github",
"flare_url": ""
}
}
{
"data": {
"index": "experimental",
"title": "Darknet App Listing",
"content": "Dark web-style app marketplace entry",
"data": {
"app_name": "DarkChat AI"
},
"features": {
"domains": null,
"emails": null,
"ip_addresses": null,
"urls": null,
"usernames": null
}
},
"header": {
"uid": "experimental/darknet/example",
"type": "experimental",
"source": "darknet_market_scrape",
"source_name": "Darknet Market Scrape",
"timestamp": "2025-10-01T23:57:51.346759+00:00",
"title": "Darknet App Listing",
"content_hash": "hash-exp",
"risk": {
"score": 3
},
"tags": [
"darkweb"
],
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-10-01T23:57:51.346759+00:00",
"first_crawled_at": "2025-10-01T23:57:51.346759+00:00",
"last_crawled_at": "2025-10-01T23:57:51.346759+00:00",
"payload_digest": "hash-exp",
"scraped_at": "2025-10-01T23:57:51.347503+00:00",
"source": "darknet_market_scrape",
"flare_url": ""
}
}
{
"data": {
"index": "experimental",
"title": "Experimental listing",
"content": "sample experimental content",
"data": {
"app_name": "Test App"
},
"features": {
"domains": null,
"emails": null,
"ip_addresses": null,
"urls": null,
"usernames": null
}
},
"header": {
"uid": "experimental/test/missing-risk",
"type": "experimental",
"source": "test_source",
"source_name": "Test Source",
"timestamp": "2025-10-01T23:57:51.346759+00:00",
"title": "Experimental listing",
"content_hash": "hash-exp-missing-risk",
"risk": null,
"tags": [],
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-10-01T23:57:51.346759+00:00",
"first_crawled_at": "2025-10-01T23:57:51.346759+00:00",
"last_crawled_at": "2025-10-01T23:57:51.346759+00:00",
"payload_digest": "hash-exp-missing-risk",
"scraped_at": "2025-10-01T23:57:51.347503+00:00",
"source": "test_source",
"flare_url": ""
}
}
{
"data": {
"index": "forum_post",
"actor": "user2",
"actor_id": "User2",
"actor_name": "user2",
"url": "https://example.com/post/1",
"browser_url": "https://example.com/post/1",
"content": "sample forum content",
"posted_at": "2025-10-28T18:50:57+00:00",
"topic_id": "9999",
"topic_title": "Leaked DB",
"category_name": "Databases",
"category_path_name": "Leaks/Databases",
"features": {
"domains": [
"example.com"
],
"emails": [
"a@example.com"
],
"ip_addresses": null,
"urls": [
"https://example.com"
],
"usernames": [
"user2"
]
}
},
"header": {
"type": "forum_post",
"uid": "forum_post/source/id",
"source": "darkforums",
"source_name": "DarkForums",
"category_name": "Databases",
"title": "Leaked DB",
"timestamp": "2025-10-28T13:20:57+00:00",
"risk": {
"score": 3
},
"tags": [
"darkweb"
],
"content_hash": "abc",
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-10-28T13:20:57+00:00",
"first_crawled_at": "2025-10-28T19:00:57+00:00",
"last_crawled_at": "2025-10-28T19:01:00+00:00",
"payload_digest": "abc",
"scraped_at": "2025-10-28T19:01:02+00:00",
"source": "darkforums",
"flare_url": ""
}
}
{
"data": {
"index": "google",
"url": "https://example.com/search/result",
"title": "Search result title",
"snippet": "search result snippet",
"features": {
"domains": [
"example.com"
],
"emails": null,
"ip_addresses": null,
"urls": [
"https://example.com/search/result"
],
"usernames": null
}
},
"header": {
"uid": "google/test/1",
"type": "google",
"source": "google_monitor",
"source_name": "Google Monitor",
"timestamp": "2025-04-03T09:00:00Z",
"title": "Search result",
"content_hash": "hash-google",
"risk": {
"score": 1
},
"tags": [],
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-04-03T09:00:00Z",
"first_crawled_at": "2025-04-03T09:01:00Z",
"last_crawled_at": "2025-04-03T09:02:00Z",
"payload_digest": "hash-google",
"scraped_at": "2025-04-03T09:03:00Z",
"source": "google_monitor",
"flare_url": ""
}
}
{
"data": {
"index": "leaked_credential",
"identity_name": "example_user@example.com",
"password": "[REDACTED]",
"domain": "example.com",
"imported_at": "2026-03-05T05:48:05.031000+00:00",
"leak_id": 406285232303,
"leak_source": {
"id": "combolists",
"name": "Combolists"
},
"features": {
"domains": [
"example.com"
],
"emails": [
"example_user@example.com"
],
"ip_addresses": null,
"urls": null,
"usernames": null
}
},
"header": {
"category_name": "Leaked Credential",
"content_hash": "5f59f9014eb1121f56701d818f482091c04e1b93",
"risk": {
"score": 4
},
"source": "combolists",
"source_name": "Combolists",
"tags": [],
"timestamp": "2026-03-05T05:48:05.031000+00:00",
"title": "",
"type": "leaked_credential",
"uid": "leaked_credential/combolists/9492d3cb",
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2026-03-05T05:48:05.031000+00:00",
"first_crawled_at": "2026-03-05T05:49:52.429348+00:00",
"last_crawled_at": "2026-03-05T05:49:52.429348+00:00",
"payload_digest": "5f59f9014eb1121f56701d818f482091c04e1b93",
"scraped_at": "2026-03-05T05:49:52.429348+00:00",
"source": "combolists",
"flare_url": ""
}
}
{
"data": {
"index": "listing",
"actor": "user1",
"actor_id": "user1",
"seller_name": "user1",
"seller_id": "user1",
"url": "https://example.com/item/123",
"title": "Listing title",
"description": "Listing description",
"price": "75.00",
"currency": "usd",
"ship_from": [
"United States"
],
"ship_to": [
"Worldwide"
],
"escrow": true,
"stock_count": 42,
"classification": {
"classes": {
"is_phishing": true
},
"types": {
"is_data": true
}
},
"features": {
"domains": null,
"emails": null,
"ip_addresses": null,
"urls": null,
"usernames": null
}
},
"header": {
"type": "listing",
"uid": "listing/source/id",
"source": "dark_market",
"source_name": "Dark Market",
"category_name": "",
"title": "Listing title",
"timestamp": "2025-03-12T09:15:00Z",
"risk": {
"score": 3
},
"tags": [],
"content_hash": "hash-listing",
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-03-12T09:15:00Z",
"first_crawled_at": "2025-03-12T09:15:00Z",
"last_crawled_at": "2025-03-14T16:30:00Z",
"payload_digest": "hash-listing",
"scraped_at": "2025-03-14T16:31:00Z",
"source": "dark_market",
"flare_url": ""
}
}
{
"data": {
"index": "paste",
"actor": "user1",
"actor_name": "user1",
"url": "https://example.com/abc",
"title": "Leaked Credentials Paste",
"content": "paste content",
"syntax": "text",
"expire_at": "2025-03-28T00:00:00Z",
"features": {
"domains": [
"example.com"
],
"emails": null,
"ip_addresses": null,
"urls": [
"https://example.com/leak"
],
"usernames": null
}
},
"header": {
"type": "paste",
"uid": "paste/source/id",
"source": "paste_site",
"source_name": "Paste Site",
"category_name": "",
"title": "Leaked Credentials Paste",
"timestamp": "2025-03-18T00:00:00Z",
"risk": {
"score": 2
},
"tags": [],
"content_hash": "hash-paste",
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-03-18T00:00:00Z",
"first_crawled_at": "2025-03-18T09:00:00Z",
"last_crawled_at": "2025-03-18T09:00:00Z",
"payload_digest": "hash-paste",
"scraped_at": "2025-03-18T09:00:30Z",
"source": "paste_site",
"flare_url": ""
}
}
{
"data": {
"index": "seller",
"actor_name": "user3",
"actor_id": "user3",
"url": "http://example.com/seller/12345",
"rating": [
"4.5"
],
"listings_count": 12,
"features": {
"domains": null,
"emails": null,
"ip_addresses": null,
"urls": null,
"usernames": null
}
},
"header": {
"uid": "seller/dark_market/user3",
"type": "seller",
"source": "dark_market",
"source_name": "Dark Market",
"timestamp": "2025-03-25T17:20:23Z",
"title": "user3",
"content_hash": "sellerhash",
"risk": {
"score": 3
},
"tags": [],
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-03-25T17:20:23Z",
"first_crawled_at": "2025-01-10T16:35:15Z",
"last_crawled_at": "2025-03-25T17:21:05Z",
"payload_digest": "sellerhash",
"scraped_at": "2025-03-25T17:21:06Z",
"source": "dark_market",
"flare_url": ""
}
}
{
"data": {
"index": "service",
"host": "srv.example.com",
"port": 443,
"service_name": "https",
"banner": "nginx",
"features": {
"domains": [
"srv.example.com"
],
"emails": null,
"ip_addresses": [
"198.51.100.2"
],
"urls": null,
"usernames": null
}
},
"header": {
"uid": "service/source/id",
"type": "service",
"source": "open_web",
"source_name": "Open Web Service Scan",
"timestamp": "2025-10-01T12:00:00Z",
"title": "Exposed service",
"content_hash": "hash-service",
"risk": {
"score": 2
},
"tags": [],
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-10-01T12:00:00Z",
"first_crawled_at": "2025-10-01T12:00:01Z",
"last_crawled_at": "2025-10-01T12:00:02Z",
"payload_digest": "hash-service",
"scraped_at": "2025-10-01T12:00:03Z",
"source": "open_web",
"flare_url": ""
}
}
{
"data": {
"index": "social_media",
"actor_name": "user1",
"url": "https://example.com/post/123",
"platform": "x",
"features": {
"domains": [
"example.com"
],
"emails": null,
"ip_addresses": null,
"urls": [
"https://example.com/post/123"
],
"usernames": [
"user1"
]
}
},
"header": {
"uid": "social_media/test/1",
"type": "social_media",
"source": "social_monitor",
"source_name": "Social Monitor",
"timestamp": "2025-04-04T08:00:00Z",
"title": "Social post",
"content_hash": "hash-social",
"risk": {
"score": 2
},
"tags": [],
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-04-04T08:00:00Z",
"first_crawled_at": "2025-04-04T08:01:00Z",
"last_crawled_at": "2025-04-04T08:02:00Z",
"payload_digest": "hash-social",
"scraped_at": "2025-04-04T08:03:00Z",
"source": "social_monitor",
"flare_url": ""
}
}
{
"data": {
"index": "docker_image",
"url": "https://example.com/r/exampleorg/webapp",
"digest": "sha256:abc",
"architecture": "amd64",
"os": "test",
"os_version": "",
"size": 19240105,
"last_pushed_at": "2025-03-20T19:58:52Z",
"last_pulled_at": "2025-03-20T19:58:54Z",
"tag": [
{
"name": "latest",
"repository_name": "exampleorg/webapp"
}
],
"content": "dockerfile content",
"features": {
"domains": [
"example.com"
],
"emails": [
"maintainer@example.com"
],
"ip_addresses": null,
"urls": null,
"usernames": null
}
},
"header": {
"type": "docker_image",
"uid": "docker_image/source/id",
"source": "dockerhub",
"source_name": "Docker Hub",
"category_name": "Docker Image",
"title": "Docker Image image_12345",
"timestamp": "2025-03-20T19:58:52Z",
"risk": {
"score": 1
},
"tags": [],
"content_hash": "hash-src",
"contains_secrets": false,
"secrets_metadata": [],
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-03-20T19:58:52Z",
"first_crawled_at": "2025-03-20T20:00:00Z",
"last_crawled_at": "2025-03-20T20:00:00Z",
"payload_digest": "hash-src",
"scraped_at": "2025-03-20T20:00:15Z",
"source": "dockerhub",
"flare_url": ""
}
}
{
"data": {
"index": "stealer_log",
"credentials": [
{
"username": "user1@example.com"
}
],
"cookies": [
{
"name": "datr"
}
],
"user_information": {
"ip_address": "198.51.100.1",
"country_code": "BR",
"zip_code": "01000-000",
"location": "test",
"username": "test",
"hwid": "HWID-REDACTED-0001",
"os": "Windows 11"
},
"malware_information": {
"malware_family": "vidar",
"infection_date": "2025-10-24T03:51:00+00:00"
},
"features": {
"domains": [
"example.com"
],
"emails": [
"user1@example.com"
],
"ip_addresses": [
"198.51.100.1"
],
"urls": null,
"usernames": [
"test"
]
}
},
"header": {
"category_name": "Infected Device",
"content_hash": "f8fbcbf034e346eedf2a8abed80b883433ddccaf",
"credential_count": 17,
"risk": {
"score": 3
},
"source": "stealer_logs",
"source_name": "Stealer Logs",
"tags": [],
"timestamp": "2025-10-24T03:51:00+00:00",
"title": "",
"type": "stealer_log",
"uid": "stealer_log/stealer_logs/sample_log_doc_000002",
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-10-24T03:51:00+00:00",
"first_crawled_at": "2025-10-28T18:35:15.095033+00:00",
"last_crawled_at": "2025-10-28T18:35:15.095033+00:00",
"payload_digest": "f8fbcbf034e346eedf2a8abed80b883433ddccaf",
"scraped_at": "2025-10-28T18:35:17.333487+00:00",
"source": "stealer_logs",
"flare_url": ""
}
}
{
"data": {
"index": "stealer_log",
"credentials": [
{
"username": "user1@example.com"
}
],
"cookies": [
{
"name": "datr"
}
],
"user_information": null,
"malware_information": {
"malware_family": "vidar",
"infection_date": "2025-10-24T03:51:00+00:00"
},
"features": {
"domains": [
"example.com"
],
"emails": [
"user1@example.com"
],
"ip_addresses": [
"198.51.100.1"
],
"urls": null,
"usernames": null
}
},
"header": {
"category_name": "Infected Device",
"content_hash": "hash-stealer-missing-userinfo",
"credential_count": 1,
"risk": {
"score": 3
},
"source": "stealer_logs",
"source_name": "Stealer Logs",
"tags": [],
"timestamp": "2025-10-24T03:51:00+00:00",
"title": "",
"type": "stealer_log",
"uid": "stealer_log/stealer_logs/missing_user_info",
"ignored_at": null,
"remediated_at": null
},
"metadata": {
"estimated_created_at": "2025-10-24T03:51:00+00:00",
"first_crawled_at": "2025-10-28T18:35:15.095033+00:00",
"last_crawled_at": "2025-10-28T18:35:15.095033+00:00",
"payload_digest": "hash-stealer-missing-userinfo",
"scraped_at": "2025-10-28T18:35:17.333487+00:00",
"source": "stealer_logs",
"flare_url": ""
}
}
Detection section
The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.
No related built-in rules was found. This message is automatically generated.
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
Application logs |
Flare tenant feed events and alerts. |
Web logs |
Exposures observed from clear/deep/dark web sources. |
Third-party application logs |
Events collected from third-party platforms (chats, forums, marketplaces). |
In details, the following table denotes the type of events produced by this integration.
| Name | Values |
|---|---|
| Kind | alert |
| Category | threat |
| Type | indicator |
Transformed Events Samples after Ingestion
This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.
{
"message": "{\"data\":{\"index\":\"blog_post\",\"title\":\"Leak blog post\",\"url\":\"https://example.com/blog/1\",\"browser_url\":\"https://example.com/blog/1\",\"description\":\"blog summary\",\"content\":\"blog content body\",\"actor\":\"user1\",\"features\":{\"domains\":[\"example.com\"],\"emails\":null,\"ip_addresses\":null,\"urls\":[\"https://example.com/blog/1\"],\"usernames\":[\"user1\"]}},\"header\":{\"uid\":\"blog_post/test/1\",\"type\":\"blog_post\",\"source\":\"test_blog\",\"source_name\":\"Test Blog\",\"timestamp\":\"2025-04-01T10:00:00Z\",\"title\":\"Leak blog post\",\"content_hash\":\"hash-blog\",\"risk\":{\"score\":2},\"tags\":[],\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-04-01T10:00:00Z\",\"first_crawled_at\":\"2025-04-01T10:10:00Z\",\"last_crawled_at\":\"2025-04-01T10:20:00Z\",\"payload_digest\":\"hash-blog\",\"scraped_at\":\"2025-04-01T10:21:00Z\",\"source\":\"test_blog\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-04-01T10:20:00Z",
"hash": "hash-blog",
"kind": "alert",
"outcome": "unknown",
"provider": "Test Blog",
"reason": "Leak blog post",
"risk_score": 2,
"severity": 40,
"start": "2025-04-01T10:10:00Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-04-01T10:00:00Z",
"flare": {
"events": {
"blog_post": {
"browser_url": "https://example.com/blog/1",
"content": "blog content body",
"description": "blog summary",
"title": "Leak blog post"
},
"index": "blog_post",
"payload_digest": "hash-blog",
"scraped_at": "2025-04-01T10:21:00Z",
"source": "test_blog",
"source_name": "Test Blog",
"type": "blog_post",
"uid": "blog_post/test/1",
"usernames": [
"user1"
]
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"hash-blog"
],
"user": [
"user1"
]
},
"tags": [],
"threat": {
"indicator": {
"url": {
"domain": "example.com",
"full": "https://example.com/blog/1"
}
}
},
"url": {
"domain": "example.com",
"full": "https://example.com/blog/1",
"path": "/blog/1",
"port": 443,
"registered_domain": "example.com",
"scheme": "https",
"top_level_domain": "com"
},
"user": {
"name": "user1"
}
}
{
"message": "{\"data\":{\"index\":\"bucket\",\"url\":\"https://example.com/bucket/sample\",\"provider\":\"aws\",\"name\":\"example-bucket\",\"region\":\"eu-west-1\",\"size\":1024,\"content_type\":\"text/plain\",\"features\":{\"domains\":[\"example.com\"],\"emails\":null,\"ip_addresses\":null,\"urls\":[\"https://example.com/bucket/sample\"],\"usernames\":null}},\"header\":{\"uid\":\"bucket/test/1\",\"type\":\"bucket\",\"source\":\"cloud_scan\",\"source_name\":\"Cloud Scan\",\"timestamp\":\"2025-04-02T12:00:00Z\",\"title\":\"Public bucket\",\"content_hash\":\"hash-bucket\",\"risk\":{\"score\":2},\"tags\":[],\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-04-02T12:00:00Z\",\"first_crawled_at\":\"2025-04-02T12:01:00Z\",\"last_crawled_at\":\"2025-04-02T12:02:00Z\",\"payload_digest\":\"hash-bucket\",\"scraped_at\":\"2025-04-02T12:03:00Z\",\"source\":\"cloud_scan\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-04-02T12:02:00Z",
"hash": "hash-bucket",
"kind": "alert",
"outcome": "unknown",
"provider": "Cloud Scan",
"reason": "Public bucket",
"risk_score": 2,
"severity": 40,
"start": "2025-04-02T12:01:00Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-04-02T12:00:00Z",
"cloud": {
"provider": "aws",
"region": "eu-west-1"
},
"flare": {
"events": {
"bucket": {
"content_type": "text/plain",
"name": "example-bucket",
"size_bytes": 1024
},
"index": "bucket",
"payload_digest": "hash-bucket",
"scraped_at": "2025-04-02T12:03:00Z",
"source": "cloud_scan",
"source_name": "Cloud Scan",
"type": "bucket",
"uid": "bucket/test/1"
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"hash-bucket"
]
},
"tags": [],
"threat": {
"indicator": {
"url": {
"domain": "example.com",
"full": "https://example.com/bucket/sample"
}
}
},
"url": {
"domain": "example.com",
"full": "https://example.com/bucket/sample",
"path": "/bucket/sample",
"port": 443,
"registered_domain": "example.com",
"scheme": "https",
"top_level_domain": "com"
}
}
{
"message": "{\"data\":{\"index\":\"chat_message\",\"actor\":\"user4\",\"actor_id\":\"User1\",\"actor_name\":\"user4\",\"conversation_id\":\"7521757009\",\"conversation_name\":\".\",\"message\":\"EXAMPLE FINANCIAL ALERT\",\"posted_at\":\"2026-06-03T11:01:16+00:00\",\"features\":{\"domains\":null,\"emails\":null,\"ip_addresses\":[\"192.0.2.0\",\"198.51.100.1\"],\"urls\":null,\"usernames\":null},\"sensitive_content\":\"phishing\"},\"header\":{\"category_name\":\"Chat\",\"content_hash\":\"fff986a8ff7b6eb126168f4816f61b1bcf97326b\",\"risk\":{\"score\":3},\"source\":\"telegram_bot\",\"source_name\":\"Telegram Bot Exfiltration\",\"tags\":[\"darkweb\"],\"timestamp\":\"2026-06-03T11:01:16+00:00\",\"title\":\"user4 sent a message\",\"type\":\"chat_message\",\"uid\":\"chat_message/telegram_bot/7521757009/User1/c404688b\",\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2026-06-03T11:01:16+00:00\",\"first_crawled_at\":\"2026-06-03T12:02:56.514010+00:00\",\"last_crawled_at\":\"2026-06-03T12:03:08.857547+00:00\",\"payload_digest\":\"fff986a8ff7b6eb126168f4816f61b1bcf97326b\",\"scraped_at\":\"2026-06-03T12:03:10.086932+00:00\",\"source\":\"telegram_bot\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2026-06-03T12:03:08.857547Z",
"hash": "fff986a8ff7b6eb126168f4816f61b1bcf97326b",
"kind": "alert",
"outcome": "unknown",
"provider": "Telegram Bot Exfiltration",
"reason": "user4 sent a message",
"risk_score": 3,
"severity": 60,
"start": "2026-06-03T12:02:56.514010Z",
"type": [
"indicator"
]
},
"@timestamp": "2026-06-03T11:01:16Z",
"flare": {
"events": {
"category": "Chat",
"chat_message": {
"content": "EXAMPLE FINANCIAL ALERT",
"conversation_id": "7521757009",
"conversation_name": ".",
"posted_at": "2026-06-03T11:01:16+00:00",
"sensitive_content": "phishing"
},
"index": "chat_message",
"payload_digest": "fff986a8ff7b6eb126168f4816f61b1bcf97326b",
"scraped_at": "2026-06-03T12:03:10.086932+00:00",
"source": "telegram_bot",
"source_name": "Telegram Bot Exfiltration",
"type": "chat_message",
"uid": "chat_message/telegram_bot/7521757009/User1/c404688b"
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"fff986a8ff7b6eb126168f4816f61b1bcf97326b"
],
"user": [
"user4"
]
},
"tags": [
"darkweb"
],
"threat": {
"indicator": {
"ip": "192.0.2.0",
"provider": "user4"
}
},
"user": {
"id": "User1",
"name": "user4"
}
}
{
"message": "{\"data\":{\"index\":\"document\",\"title\":\"Example Leak\",\"url\":\"http://example.com/doc\",\"content\":\"Leak description\",\"main\":\"Leak summary\",\"features\":{\"domains\":[\"example.com\"],\"emails\":null,\"ip_addresses\":null,\"urls\":null,\"usernames\":null}},\"header\":{\"uid\":\"document/source/id\",\"type\":\"document\",\"source\":\"example_source\",\"source_name\":\"Example Leak Source\",\"timestamp\":\"2025-10-28T19:49:18.173119+00:00\",\"title\":\"Example Leak\",\"content_hash\":\"hash-doc\",\"risk\":{\"score\":3},\"tags\":[],\"victim_name\":\"Example Financial Institution\",\"country\":\"France\",\"state_code\":\"FR-IDF\",\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-10-28T19:49:18.173119+00:00\",\"first_crawled_at\":\"2024-11-29T15:03:18.015000+00:00\",\"last_crawled_at\":\"2025-10-28T19:49:20.490310+00:00\",\"payload_digest\":\"hash-doc\",\"scraped_at\":\"2025-10-28T19:49:20.981763+00:00\",\"source\":\"example_source\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-10-28T19:49:20.490310Z",
"hash": "hash-doc",
"kind": "alert",
"outcome": "unknown",
"provider": "Example Leak Source",
"reason": "Example Leak",
"risk_score": 3,
"severity": 60,
"start": "2024-11-29T15:03:18.015000Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-10-28T19:49:18.173119Z",
"destination": {
"geo": {
"country_name": "France",
"region_iso_code": "FR-IDF"
}
},
"flare": {
"events": {
"index": "document",
"payload_digest": "hash-doc",
"ransomleak": {
"content": "Leak description",
"title": "Example Leak",
"victim_name": "Example Financial Institution"
},
"scraped_at": "2025-10-28T19:49:20.981763+00:00",
"source": "example_source",
"source_name": "Example Leak Source",
"type": "document",
"uid": "document/source/id",
"victim_name": "Example Financial Institution"
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"organization": {
"name": "Example Financial Institution"
},
"related": {
"hash": [
"hash-doc"
]
},
"tags": [],
"threat": {
"indicator": {
"url": {
"domain": "example.com"
}
}
},
"url": {
"domain": "example.com",
"full": "http://example.com/doc",
"path": "/doc",
"port": 80,
"registered_domain": "example.com",
"scheme": "http",
"top_level_domain": "com"
}
}
{
"message": "{\"data\":{\"index\":\"domain\",\"name\":\"example.com\",\"registered_at\":\"2025-10-20T23:15:59+00:00\",\"identifier_domain\":[\"example.co.uk\"],\"feed\":\"dnstwist\",\"cert_data\":\"present\",\"subject\":\"CN=example.com\",\"issuer\":\"CN=Example CA\",\"features\":{\"domains\":[\"example.com\"],\"emails\":null,\"ip_addresses\":null,\"urls\":null,\"usernames\":null}},\"header\":{\"type\":\"domain\",\"uid\":\"domain/source/id\",\"source\":\"example_source\",\"source_name\":\"Example DNS Monitor\",\"category_name\":\"domain\",\"title\":\"example.com\",\"timestamp\":\"2025-10-20T23:15:59+00:00\",\"risk\":{\"score\":1},\"tags\":[],\"content_hash\":\"hash-domain\",\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-10-20T23:15:59+00:00\",\"first_crawled_at\":\"2025-10-20T23:15:59+00:00\",\"last_crawled_at\":\"2025-10-26T00:29:04+00:00\",\"payload_digest\":\"hash-domain\",\"scraped_at\":\"2025-10-26T00:29:04+00:00\",\"source\":\"example_source\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-10-26T00:29:04Z",
"hash": "hash-domain",
"kind": "alert",
"outcome": "unknown",
"provider": "Example DNS Monitor",
"reason": "example.com",
"risk_score": 1,
"severity": 20,
"start": "2025-10-20T23:15:59Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-10-20T23:15:59Z",
"dns": {
"question": {
"name": "example.com",
"registered_domain": "example.com",
"top_level_domain": "com"
}
},
"flare": {
"events": {
"category": "domain",
"domain": {
"cert_data": "present",
"feed": "dnstwist",
"identifier_domain": [
"example.co.uk"
],
"registered_at": "2025-10-20T23:15:59+00:00"
},
"index": "domain",
"payload_digest": "hash-domain",
"scraped_at": "2025-10-26T00:29:04+00:00",
"source": "example_source",
"source_name": "Example DNS Monitor",
"type": "domain",
"uid": "domain/source/id"
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"hash-domain"
],
"hosts": [
"example.com"
]
},
"tags": [],
"threat": {
"indicator": {
"url": {
"domain": "example.com"
}
}
},
"tls": {
"server": {
"x509": {
"issuer": {
"distinguished_name": "CN=Example CA"
},
"subject": {
"distinguished_name": "CN=example.com"
}
}
}
},
"url": {
"domain": "example.com",
"registered_domain": "example.com",
"top_level_domain": "com"
}
}
{
"message": "{\"data\":{\"index\":\"driller_profile\",\"username\":\"user987\",\"realname\":\"User987\",\"about\":\"about me\",\"location\":\"test\",\"website\":\"https://example.com\",\"contact_info\":{\"twitter\":\"@user987\",\"email\":\"user987@example.com\"},\"groups\":[\"group1\"],\"features\":{\"domains\":null,\"emails\":[\"user987@example.com\"],\"ip_addresses\":null,\"urls\":null,\"usernames\":null}},\"header\":{\"uid\":\"driller_profile/github/user_987\",\"type\":\"driller_profile\",\"source\":\"github\",\"source_name\":\"GitHub\",\"timestamp\":\"2025-03-08T17:04:18Z\",\"title\":\"User987\",\"content_hash\":\"profilehash\",\"risk\":{\"score\":1},\"tags\":[],\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-03-08T17:04:18Z\",\"first_crawled_at\":\"2025-02-10T05:04:09Z\",\"last_crawled_at\":\"2025-03-08T17:04:19Z\",\"payload_digest\":\"profilehash\",\"scraped_at\":\"2025-03-08T17:04:19Z\",\"source\":\"github\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-03-08T17:04:19Z",
"hash": "profilehash",
"kind": "alert",
"outcome": "unknown",
"provider": "GitHub",
"reason": "User987",
"risk_score": 1,
"severity": 20,
"start": "2025-02-10T05:04:09Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-03-08T17:04:18Z",
"flare": {
"events": {
"emails": [
"user987@example.com"
],
"index": "driller_profile",
"payload_digest": "profilehash",
"profile": {
"about": "about me",
"groups": [
"group1"
],
"twitter": "@user987"
},
"scraped_at": "2025-03-08T17:04:19Z",
"source": "github",
"source_name": "GitHub",
"type": "driller_profile",
"uid": "driller_profile/github/user_987"
}
},
"host": {
"geo": {
"name": "test"
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"profilehash"
],
"user": [
"user987"
]
},
"tags": [],
"user": {
"email": "user987@example.com",
"full_name": "User987",
"name": "user987"
}
}
{
"message": "{\"data\":{\"index\":\"experimental\",\"title\":\"Darknet App Listing\",\"content\":\"Dark web-style app marketplace entry\",\"data\":{\"app_name\":\"DarkChat AI\"},\"features\":{\"domains\":null,\"emails\":null,\"ip_addresses\":null,\"urls\":null,\"usernames\":null}},\"header\":{\"uid\":\"experimental/darknet/example\",\"type\":\"experimental\",\"source\":\"darknet_market_scrape\",\"source_name\":\"Darknet Market Scrape\",\"timestamp\":\"2025-10-01T23:57:51.346759+00:00\",\"title\":\"Darknet App Listing\",\"content_hash\":\"hash-exp\",\"risk\":{\"score\":3},\"tags\":[\"darkweb\"],\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-10-01T23:57:51.346759+00:00\",\"first_crawled_at\":\"2025-10-01T23:57:51.346759+00:00\",\"last_crawled_at\":\"2025-10-01T23:57:51.346759+00:00\",\"payload_digest\":\"hash-exp\",\"scraped_at\":\"2025-10-01T23:57:51.347503+00:00\",\"source\":\"darknet_market_scrape\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-10-01T23:57:51.346759Z",
"hash": "hash-exp",
"kind": "alert",
"outcome": "unknown",
"provider": "Darknet Market Scrape",
"reason": "Darknet App Listing",
"risk_score": 3,
"severity": 60,
"start": "2025-10-01T23:57:51.346759Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-10-01T23:57:51.346759Z",
"flare": {
"events": {
"experimental": {
"raw": "{\"content\": \"Dark web-style app marketplace entry\", \"data\": {\"app_name\": \"DarkChat AI\"}, \"features\": {\"domains\": null, \"emails\": null, \"ip_addresses\": null, \"urls\": null, \"usernames\": null}, \"index\": \"experimental\", \"title\": \"Darknet App Listing\"}"
},
"index": "experimental",
"payload_digest": "hash-exp",
"scraped_at": "2025-10-01T23:57:51.347503+00:00",
"source": "darknet_market_scrape",
"source_name": "Darknet Market Scrape",
"type": "experimental",
"uid": "experimental/darknet/example"
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"hash-exp"
]
},
"tags": [
"darkweb"
]
}
{
"message": "{\"data\":{\"index\":\"experimental\",\"title\":\"Experimental listing\",\"content\":\"sample experimental content\",\"data\":{\"app_name\":\"Test App\"},\"features\":{\"domains\":null,\"emails\":null,\"ip_addresses\":null,\"urls\":null,\"usernames\":null}},\"header\":{\"uid\":\"experimental/test/missing-risk\",\"type\":\"experimental\",\"source\":\"test_source\",\"source_name\":\"Test Source\",\"timestamp\":\"2025-10-01T23:57:51.346759+00:00\",\"title\":\"Experimental listing\",\"content_hash\":\"hash-exp-missing-risk\",\"risk\":null,\"tags\":[],\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-10-01T23:57:51.346759+00:00\",\"first_crawled_at\":\"2025-10-01T23:57:51.346759+00:00\",\"last_crawled_at\":\"2025-10-01T23:57:51.346759+00:00\",\"payload_digest\":\"hash-exp-missing-risk\",\"scraped_at\":\"2025-10-01T23:57:51.347503+00:00\",\"source\":\"test_source\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-10-01T23:57:51.346759Z",
"hash": "hash-exp-missing-risk",
"kind": "alert",
"outcome": "unknown",
"provider": "Test Source",
"reason": "Experimental listing",
"start": "2025-10-01T23:57:51.346759Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-10-01T23:57:51.346759Z",
"flare": {
"events": {
"experimental": {
"raw": "{\"content\": \"sample experimental content\", \"data\": {\"app_name\": \"Test App\"}, \"features\": {\"domains\": null, \"emails\": null, \"ip_addresses\": null, \"urls\": null, \"usernames\": null}, \"index\": \"experimental\", \"title\": \"Experimental listing\"}"
},
"index": "experimental",
"payload_digest": "hash-exp-missing-risk",
"scraped_at": "2025-10-01T23:57:51.347503+00:00",
"source": "test_source",
"source_name": "Test Source",
"type": "experimental",
"uid": "experimental/test/missing-risk"
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"hash-exp-missing-risk"
]
},
"tags": []
}
{
"message": "{\"data\":{\"index\":\"forum_post\",\"actor\":\"user2\",\"actor_id\":\"User2\",\"actor_name\":\"user2\",\"url\":\"https://example.com/post/1\",\"browser_url\":\"https://example.com/post/1\",\"content\":\"sample forum content\",\"posted_at\":\"2025-10-28T18:50:57+00:00\",\"topic_id\":\"9999\",\"topic_title\":\"Leaked DB\",\"category_name\":\"Databases\",\"category_path_name\":\"Leaks/Databases\",\"features\":{\"domains\":[\"example.com\"],\"emails\":[\"a@example.com\"],\"ip_addresses\":null,\"urls\":[\"https://example.com\"],\"usernames\":[\"user2\"]}},\"header\":{\"type\":\"forum_post\",\"uid\":\"forum_post/source/id\",\"source\":\"darkforums\",\"source_name\":\"DarkForums\",\"category_name\":\"Databases\",\"title\":\"Leaked DB\",\"timestamp\":\"2025-10-28T13:20:57+00:00\",\"risk\":{\"score\":3},\"tags\":[\"darkweb\"],\"content_hash\":\"abc\",\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-10-28T13:20:57+00:00\",\"first_crawled_at\":\"2025-10-28T19:00:57+00:00\",\"last_crawled_at\":\"2025-10-28T19:01:00+00:00\",\"payload_digest\":\"abc\",\"scraped_at\":\"2025-10-28T19:01:02+00:00\",\"source\":\"darkforums\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-10-28T19:01:00Z",
"hash": "abc",
"kind": "alert",
"outcome": "unknown",
"provider": "DarkForums",
"reason": "Leaked DB",
"risk_score": 3,
"severity": 60,
"start": "2025-10-28T19:00:57Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-10-28T13:20:57Z",
"flare": {
"events": {
"category": "Databases",
"emails": [
"a@example.com"
],
"forum": {
"browser_url": "https://example.com/post/1",
"category_name": "Databases",
"category_path": "Leaks/Databases",
"content": "sample forum content",
"posted_at": "2025-10-28T18:50:57+00:00",
"topic_id": "9999",
"topic_title": "Leaked DB"
},
"index": "forum_post",
"payload_digest": "abc",
"scraped_at": "2025-10-28T19:01:02+00:00",
"source": "darkforums",
"source_name": "DarkForums",
"type": "forum_post",
"uid": "forum_post/source/id",
"usernames": [
"user2"
]
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"abc"
],
"user": [
"user2"
]
},
"tags": [
"darkweb"
],
"threat": {
"indicator": {
"url": {
"domain": "example.com",
"full": "https://example.com"
}
}
},
"url": {
"domain": "example.com",
"full": "https://example.com/post/1",
"path": "/post/1",
"port": 443,
"registered_domain": "example.com",
"scheme": "https",
"top_level_domain": "com"
},
"user": {
"id": "User2",
"name": "user2"
}
}
{
"message": "{\"data\":{\"index\":\"google\",\"url\":\"https://example.com/search/result\",\"title\":\"Search result title\",\"snippet\":\"search result snippet\",\"features\":{\"domains\":[\"example.com\"],\"emails\":null,\"ip_addresses\":null,\"urls\":[\"https://example.com/search/result\"],\"usernames\":null}},\"header\":{\"uid\":\"google/test/1\",\"type\":\"google\",\"source\":\"google_monitor\",\"source_name\":\"Google Monitor\",\"timestamp\":\"2025-04-03T09:00:00Z\",\"title\":\"Search result\",\"content_hash\":\"hash-google\",\"risk\":{\"score\":1},\"tags\":[],\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-04-03T09:00:00Z\",\"first_crawled_at\":\"2025-04-03T09:01:00Z\",\"last_crawled_at\":\"2025-04-03T09:02:00Z\",\"payload_digest\":\"hash-google\",\"scraped_at\":\"2025-04-03T09:03:00Z\",\"source\":\"google_monitor\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-04-03T09:02:00Z",
"hash": "hash-google",
"kind": "alert",
"outcome": "unknown",
"provider": "Google Monitor",
"reason": "Search result",
"risk_score": 1,
"severity": 20,
"start": "2025-04-03T09:01:00Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-04-03T09:00:00Z",
"flare": {
"events": {
"google": {
"content": "search result snippet",
"title": "Search result title"
},
"index": "google",
"payload_digest": "hash-google",
"scraped_at": "2025-04-03T09:03:00Z",
"source": "google_monitor",
"source_name": "Google Monitor",
"type": "google",
"uid": "google/test/1"
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"hash-google"
]
},
"tags": [],
"threat": {
"indicator": {
"url": {
"domain": "example.com",
"full": "https://example.com/search/result"
}
}
},
"url": {
"domain": "example.com",
"full": "https://example.com/search/result",
"path": "/search/result",
"port": 443,
"registered_domain": "example.com",
"scheme": "https",
"top_level_domain": "com"
}
}
{
"message": "{\"data\":{\"index\":\"leaked_credential\",\"identity_name\":\"example_user@example.com\",\"password\":\"[REDACTED]\",\"domain\":\"example.com\",\"imported_at\":\"2026-03-05T05:48:05.031000+00:00\",\"leak_id\":406285232303,\"leak_source\":{\"id\":\"combolists\",\"name\":\"Combolists\"},\"features\":{\"domains\":[\"example.com\"],\"emails\":[\"example_user@example.com\"],\"ip_addresses\":null,\"urls\":null,\"usernames\":null}},\"header\":{\"category_name\":\"Leaked Credential\",\"content_hash\":\"5f59f9014eb1121f56701d818f482091c04e1b93\",\"risk\":{\"score\":4},\"source\":\"combolists\",\"source_name\":\"Combolists\",\"tags\":[],\"timestamp\":\"2026-03-05T05:48:05.031000+00:00\",\"title\":\"\",\"type\":\"leaked_credential\",\"uid\":\"leaked_credential/combolists/9492d3cb\",\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2026-03-05T05:48:05.031000+00:00\",\"first_crawled_at\":\"2026-03-05T05:49:52.429348+00:00\",\"last_crawled_at\":\"2026-03-05T05:49:52.429348+00:00\",\"payload_digest\":\"5f59f9014eb1121f56701d818f482091c04e1b93\",\"scraped_at\":\"2026-03-05T05:49:52.429348+00:00\",\"source\":\"combolists\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2026-03-05T05:49:52.429348Z",
"hash": "5f59f9014eb1121f56701d818f482091c04e1b93",
"kind": "alert",
"outcome": "unknown",
"provider": "Combolists",
"risk_score": 4,
"severity": 80,
"start": "2026-03-05T05:49:52.429348Z",
"type": [
"indicator"
]
},
"@timestamp": "2026-03-05T05:48:05.031000Z",
"flare": {
"events": {
"category": "Leaked Credential",
"emails": [
"example_user@example.com"
],
"index": "leaked_credential",
"leaked_credential": {
"imported_at": "2026-03-05T05:48:05.031000+00:00",
"leak_id": "406285232303",
"leak_source_id": "combolists",
"leak_source_name": "Combolists",
"password_present": true
},
"payload_digest": "5f59f9014eb1121f56701d818f482091c04e1b93",
"scraped_at": "2026-03-05T05:49:52.429348+00:00",
"source": "combolists",
"source_name": "Combolists",
"type": "leaked_credential",
"uid": "leaked_credential/combolists/9492d3cb"
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"5f59f9014eb1121f56701d818f482091c04e1b93"
],
"hosts": [
"example.com"
],
"user": [
"example_user@example.com"
]
},
"tags": [],
"threat": {
"indicator": {
"url": {
"domain": "example.com"
}
}
},
"url": {
"domain": "example.com",
"registered_domain": "example.com",
"top_level_domain": "com"
},
"user": {
"email": "example_user@example.com",
"name": "example_user@example.com"
}
}
{
"message": "{\"data\":{\"index\":\"listing\",\"actor\":\"user1\",\"actor_id\":\"user1\",\"seller_name\":\"user1\",\"seller_id\":\"user1\",\"url\":\"https://example.com/item/123\",\"title\":\"Listing title\",\"description\":\"Listing description\",\"price\":\"75.00\",\"currency\":\"usd\",\"ship_from\":[\"United States\"],\"ship_to\":[\"Worldwide\"],\"escrow\":true,\"stock_count\":42,\"classification\":{\"classes\":{\"is_phishing\":true},\"types\":{\"is_data\":true}},\"features\":{\"domains\":null,\"emails\":null,\"ip_addresses\":null,\"urls\":null,\"usernames\":null}},\"header\":{\"type\":\"listing\",\"uid\":\"listing/source/id\",\"source\":\"dark_market\",\"source_name\":\"Dark Market\",\"category_name\":\"\",\"title\":\"Listing title\",\"timestamp\":\"2025-03-12T09:15:00Z\",\"risk\":{\"score\":3},\"tags\":[],\"content_hash\":\"hash-listing\",\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-03-12T09:15:00Z\",\"first_crawled_at\":\"2025-03-12T09:15:00Z\",\"last_crawled_at\":\"2025-03-14T16:30:00Z\",\"payload_digest\":\"hash-listing\",\"scraped_at\":\"2025-03-14T16:31:00Z\",\"source\":\"dark_market\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-03-14T16:30:00Z",
"hash": "hash-listing",
"kind": "alert",
"outcome": "unknown",
"provider": "Dark Market",
"reason": "Listing title",
"risk_score": 3,
"severity": 60,
"start": "2025-03-12T09:15:00Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-03-12T09:15:00Z",
"destination": {
"geo": {
"country_name": "Worldwide"
}
},
"flare": {
"events": {
"index": "listing",
"listing": {
"classes": [
"is_phishing"
],
"content": "Listing description",
"currency": "usd",
"escrow": true,
"price": "75.00",
"ship_from": [
"United States"
],
"ship_to": [
"Worldwide"
],
"stock_count": 42,
"title": "Listing title",
"types": [
"is_data"
]
},
"payload_digest": "hash-listing",
"scraped_at": "2025-03-14T16:31:00Z",
"source": "dark_market",
"source_name": "Dark Market",
"type": "listing",
"uid": "listing/source/id"
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"hash-listing"
],
"user": [
"user1"
]
},
"source": {
"geo": {
"country_name": "United States"
}
},
"tags": [],
"url": {
"domain": "example.com",
"full": "https://example.com/item/123",
"path": "/item/123",
"port": 443,
"registered_domain": "example.com",
"scheme": "https",
"top_level_domain": "com"
},
"user": {
"id": "user1",
"name": "user1"
}
}
{
"message": "{\"data\":{\"index\":\"paste\",\"actor\":\"user1\",\"actor_name\":\"user1\",\"url\":\"https://example.com/abc\",\"title\":\"Leaked Credentials Paste\",\"content\":\"paste content\",\"syntax\":\"text\",\"expire_at\":\"2025-03-28T00:00:00Z\",\"features\":{\"domains\":[\"example.com\"],\"emails\":null,\"ip_addresses\":null,\"urls\":[\"https://example.com/leak\"],\"usernames\":null}},\"header\":{\"type\":\"paste\",\"uid\":\"paste/source/id\",\"source\":\"paste_site\",\"source_name\":\"Paste Site\",\"category_name\":\"\",\"title\":\"Leaked Credentials Paste\",\"timestamp\":\"2025-03-18T00:00:00Z\",\"risk\":{\"score\":2},\"tags\":[],\"content_hash\":\"hash-paste\",\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-03-18T00:00:00Z\",\"first_crawled_at\":\"2025-03-18T09:00:00Z\",\"last_crawled_at\":\"2025-03-18T09:00:00Z\",\"payload_digest\":\"hash-paste\",\"scraped_at\":\"2025-03-18T09:00:30Z\",\"source\":\"paste_site\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-03-18T09:00:00Z",
"hash": "hash-paste",
"kind": "alert",
"outcome": "unknown",
"provider": "Paste Site",
"reason": "Leaked Credentials Paste",
"risk_score": 2,
"severity": 40,
"start": "2025-03-18T09:00:00Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-03-18T00:00:00Z",
"flare": {
"events": {
"index": "paste",
"paste": {
"content": "paste content",
"expire_at": "2025-03-28T00:00:00Z",
"syntax": "text",
"title": "Leaked Credentials Paste"
},
"payload_digest": "hash-paste",
"scraped_at": "2025-03-18T09:00:30Z",
"source": "paste_site",
"source_name": "Paste Site",
"type": "paste",
"uid": "paste/source/id"
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"hash-paste"
],
"user": [
"user1"
]
},
"tags": [],
"threat": {
"indicator": {
"url": {
"domain": "example.com",
"full": "https://example.com/leak"
}
}
},
"url": {
"domain": "example.com",
"full": "https://example.com/abc",
"path": "/abc",
"port": 443,
"registered_domain": "example.com",
"scheme": "https",
"top_level_domain": "com"
},
"user": {
"name": "user1"
}
}
{
"message": "{\"data\":{\"index\":\"seller\",\"actor_name\":\"user3\",\"actor_id\":\"user3\",\"url\":\"http://example.com/seller/12345\",\"rating\":[\"4.5\"],\"listings_count\":12,\"features\":{\"domains\":null,\"emails\":null,\"ip_addresses\":null,\"urls\":null,\"usernames\":null}},\"header\":{\"uid\":\"seller/dark_market/user3\",\"type\":\"seller\",\"source\":\"dark_market\",\"source_name\":\"Dark Market\",\"timestamp\":\"2025-03-25T17:20:23Z\",\"title\":\"user3\",\"content_hash\":\"sellerhash\",\"risk\":{\"score\":3},\"tags\":[],\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-03-25T17:20:23Z\",\"first_crawled_at\":\"2025-01-10T16:35:15Z\",\"last_crawled_at\":\"2025-03-25T17:21:05Z\",\"payload_digest\":\"sellerhash\",\"scraped_at\":\"2025-03-25T17:21:06Z\",\"source\":\"dark_market\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-03-25T17:21:05Z",
"hash": "sellerhash",
"kind": "alert",
"outcome": "unknown",
"provider": "Dark Market",
"reason": "user3",
"risk_score": 3,
"severity": 60,
"start": "2025-01-10T16:35:15Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-03-25T17:20:23Z",
"flare": {
"events": {
"index": "seller",
"payload_digest": "sellerhash",
"scraped_at": "2025-03-25T17:21:06Z",
"seller": {
"listings_count": 12,
"rating": [
"4.5"
]
},
"source": "dark_market",
"source_name": "Dark Market",
"type": "seller",
"uid": "seller/dark_market/user3"
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"sellerhash"
],
"user": [
"user3"
]
},
"tags": [],
"url": {
"domain": "example.com",
"full": "http://example.com/seller/12345",
"path": "/seller/12345",
"port": 80,
"registered_domain": "example.com",
"scheme": "http",
"top_level_domain": "com"
},
"user": {
"id": "user3",
"name": "user3"
}
}
{
"message": "{\"data\":{\"index\":\"service\",\"host\":\"srv.example.com\",\"port\":443,\"service_name\":\"https\",\"banner\":\"nginx\",\"features\":{\"domains\":[\"srv.example.com\"],\"emails\":null,\"ip_addresses\":[\"198.51.100.2\"],\"urls\":null,\"usernames\":null}},\"header\":{\"uid\":\"service/source/id\",\"type\":\"service\",\"source\":\"open_web\",\"source_name\":\"Open Web Service Scan\",\"timestamp\":\"2025-10-01T12:00:00Z\",\"title\":\"Exposed service\",\"content_hash\":\"hash-service\",\"risk\":{\"score\":2},\"tags\":[],\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-10-01T12:00:00Z\",\"first_crawled_at\":\"2025-10-01T12:00:01Z\",\"last_crawled_at\":\"2025-10-01T12:00:02Z\",\"payload_digest\":\"hash-service\",\"scraped_at\":\"2025-10-01T12:00:03Z\",\"source\":\"open_web\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-10-01T12:00:02Z",
"hash": "hash-service",
"kind": "alert",
"outcome": "unknown",
"provider": "Open Web Service Scan",
"reason": "Exposed service",
"risk_score": 2,
"severity": 40,
"start": "2025-10-01T12:00:01Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-10-01T12:00:00Z",
"destination": {
"address": "srv.example.com",
"port": 443
},
"flare": {
"events": {
"index": "service",
"payload_digest": "hash-service",
"scraped_at": "2025-10-01T12:00:03Z",
"service": {
"banner": "nginx"
},
"source": "open_web",
"source_name": "Open Web Service Scan",
"type": "service",
"uid": "service/source/id"
}
},
"host": {
"name": "srv.example.com"
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"hash-service"
]
},
"service": {
"name": "https"
},
"tags": [],
"threat": {
"indicator": {
"ip": "198.51.100.2",
"url": {
"domain": "srv.example.com"
}
}
}
}
{
"message": "{\"data\":{\"index\":\"social_media\",\"actor_name\":\"user1\",\"url\":\"https://example.com/post/123\",\"platform\":\"x\",\"features\":{\"domains\":[\"example.com\"],\"emails\":null,\"ip_addresses\":null,\"urls\":[\"https://example.com/post/123\"],\"usernames\":[\"user1\"]}},\"header\":{\"uid\":\"social_media/test/1\",\"type\":\"social_media\",\"source\":\"social_monitor\",\"source_name\":\"Social Monitor\",\"timestamp\":\"2025-04-04T08:00:00Z\",\"title\":\"Social post\",\"content_hash\":\"hash-social\",\"risk\":{\"score\":2},\"tags\":[],\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-04-04T08:00:00Z\",\"first_crawled_at\":\"2025-04-04T08:01:00Z\",\"last_crawled_at\":\"2025-04-04T08:02:00Z\",\"payload_digest\":\"hash-social\",\"scraped_at\":\"2025-04-04T08:03:00Z\",\"source\":\"social_monitor\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-04-04T08:02:00Z",
"hash": "hash-social",
"kind": "alert",
"outcome": "unknown",
"provider": "Social Monitor",
"reason": "Social post",
"risk_score": 2,
"severity": 40,
"start": "2025-04-04T08:01:00Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-04-04T08:00:00Z",
"flare": {
"events": {
"index": "social_media",
"payload_digest": "hash-social",
"scraped_at": "2025-04-04T08:03:00Z",
"social_media": {
"platform": "x"
},
"source": "social_monitor",
"source_name": "Social Monitor",
"type": "social_media",
"uid": "social_media/test/1",
"usernames": [
"user1"
]
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"hash-social"
],
"user": [
"user1"
]
},
"tags": [],
"threat": {
"indicator": {
"url": {
"domain": "example.com",
"full": "https://example.com/post/123"
}
}
},
"url": {
"domain": "example.com",
"full": "https://example.com/post/123",
"path": "/post/123",
"port": 443,
"registered_domain": "example.com",
"scheme": "https",
"top_level_domain": "com"
},
"user": {
"name": "user1"
}
}
{
"message": "{\"data\":{\"index\":\"docker_image\",\"url\":\"https://example.com/r/exampleorg/webapp\",\"digest\":\"sha256:abc\",\"architecture\":\"amd64\",\"os\":\"test\",\"os_version\":\"\",\"size\":19240105,\"last_pushed_at\":\"2025-03-20T19:58:52Z\",\"last_pulled_at\":\"2025-03-20T19:58:54Z\",\"tag\":[{\"name\":\"latest\",\"repository_name\":\"exampleorg/webapp\"}],\"content\":\"dockerfile content\",\"features\":{\"domains\":[\"example.com\"],\"emails\":[\"maintainer@example.com\"],\"ip_addresses\":null,\"urls\":null,\"usernames\":null}},\"header\":{\"type\":\"docker_image\",\"uid\":\"docker_image/source/id\",\"source\":\"dockerhub\",\"source_name\":\"Docker Hub\",\"category_name\":\"Docker Image\",\"title\":\"Docker Image image_12345\",\"timestamp\":\"2025-03-20T19:58:52Z\",\"risk\":{\"score\":1},\"tags\":[],\"content_hash\":\"hash-src\",\"contains_secrets\":false,\"secrets_metadata\":[],\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-03-20T19:58:52Z\",\"first_crawled_at\":\"2025-03-20T20:00:00Z\",\"last_crawled_at\":\"2025-03-20T20:00:00Z\",\"payload_digest\":\"hash-src\",\"scraped_at\":\"2025-03-20T20:00:15Z\",\"source\":\"dockerhub\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-03-20T20:00:00Z",
"hash": "hash-src",
"kind": "alert",
"outcome": "unknown",
"provider": "Docker Hub",
"reason": "Docker Image image_12345",
"risk_score": 1,
"severity": 20,
"start": "2025-03-20T20:00:00Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-03-20T19:58:52Z",
"flare": {
"events": {
"category": "Docker Image",
"contains_secrets": false,
"emails": [
"maintainer@example.com"
],
"index": "docker_image",
"payload_digest": "hash-src",
"scraped_at": "2025-03-20T20:00:15Z",
"source": "dockerhub",
"source_code": {
"architecture": "amd64",
"contains_secrets": false,
"content": "dockerfile content",
"digest": "sha256:abc",
"last_pulled_at": "2025-03-20T19:58:54Z",
"last_pushed_at": "2025-03-20T19:58:52Z",
"repositories": [
"exampleorg/webapp"
],
"secrets_metadata": [],
"size_bytes": 19240105,
"tags": [
"latest"
]
},
"source_name": "Docker Hub",
"type": "docker_image",
"uid": "docker_image/source/id"
}
},
"host": {
"os": {
"name": "test"
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"hash-src"
]
},
"tags": [],
"threat": {
"indicator": {
"url": {
"domain": "example.com"
}
}
},
"url": {
"domain": "example.com",
"full": "https://example.com/r/exampleorg/webapp",
"path": "/r/exampleorg/webapp",
"port": 443,
"registered_domain": "example.com",
"scheme": "https",
"top_level_domain": "com"
}
}
{
"message": "{\"data\":{\"index\":\"stealer_log\",\"credentials\":[{\"username\":\"user1@example.com\"}],\"cookies\":[{\"name\":\"datr\"}],\"user_information\":{\"ip_address\":\"198.51.100.1\",\"country_code\":\"BR\",\"zip_code\":\"01000-000\",\"location\":\"test\",\"username\":\"test\",\"hwid\":\"HWID-REDACTED-0001\",\"os\":\"Windows 11\"},\"malware_information\":{\"malware_family\":\"vidar\",\"infection_date\":\"2025-10-24T03:51:00+00:00\"},\"features\":{\"domains\":[\"example.com\"],\"emails\":[\"user1@example.com\"],\"ip_addresses\":[\"198.51.100.1\"],\"urls\":null,\"usernames\":[\"test\"]}},\"header\":{\"category_name\":\"Infected Device\",\"content_hash\":\"f8fbcbf034e346eedf2a8abed80b883433ddccaf\",\"credential_count\":17,\"risk\":{\"score\":3},\"source\":\"stealer_logs\",\"source_name\":\"Stealer Logs\",\"tags\":[],\"timestamp\":\"2025-10-24T03:51:00+00:00\",\"title\":\"\",\"type\":\"stealer_log\",\"uid\":\"stealer_log/stealer_logs/sample_log_doc_000002\",\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-10-24T03:51:00+00:00\",\"first_crawled_at\":\"2025-10-28T18:35:15.095033+00:00\",\"last_crawled_at\":\"2025-10-28T18:35:15.095033+00:00\",\"payload_digest\":\"f8fbcbf034e346eedf2a8abed80b883433ddccaf\",\"scraped_at\":\"2025-10-28T18:35:17.333487+00:00\",\"source\":\"stealer_logs\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-10-28T18:35:15.095033Z",
"hash": "f8fbcbf034e346eedf2a8abed80b883433ddccaf",
"kind": "alert",
"outcome": "unknown",
"provider": "Stealer Logs",
"risk_score": 3,
"severity": 60,
"start": "2025-10-28T18:35:15.095033Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-10-24T03:51:00Z",
"flare": {
"events": {
"category": "Infected Device",
"emails": [
"user1@example.com"
],
"index": "stealer_log",
"payload_digest": "f8fbcbf034e346eedf2a8abed80b883433ddccaf",
"scraped_at": "2025-10-28T18:35:17.333487+00:00",
"source": "stealer_logs",
"source_name": "Stealer Logs",
"stealer_log": {
"cookies_count": 1,
"credential_count": 17,
"credentials_count": 1,
"infection_date": "2025-10-24T03:51:00+00:00",
"malware_family": "vidar"
},
"type": "stealer_log",
"uid": "stealer_log/stealer_logs/sample_log_doc_000002",
"usernames": [
"test"
]
}
},
"host": {
"geo": {
"country_iso_code": "BR",
"name": "test",
"postal_code": "01000-000"
},
"id": "HWID-REDACTED-0001",
"ip": [
"198.51.100.1"
],
"os": {
"full": "Windows 11"
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"f8fbcbf034e346eedf2a8abed80b883433ddccaf"
],
"ip": [
"198.51.100.1"
],
"user": [
"test"
]
},
"source": {
"address": "198.51.100.1",
"ip": "198.51.100.1"
},
"tags": [],
"threat": {
"indicator": {
"ip": "198.51.100.1",
"url": {
"domain": "example.com"
}
},
"software": {
"name": "vidar"
}
},
"user": {
"name": "test"
}
}
{
"message": "{\"data\":{\"index\":\"stealer_log\",\"credentials\":[{\"username\":\"user1@example.com\"}],\"cookies\":[{\"name\":\"datr\"}],\"user_information\":null,\"malware_information\":{\"malware_family\":\"vidar\",\"infection_date\":\"2025-10-24T03:51:00+00:00\"},\"features\":{\"domains\":[\"example.com\"],\"emails\":[\"user1@example.com\"],\"ip_addresses\":[\"198.51.100.1\"],\"urls\":null,\"usernames\":null}},\"header\":{\"category_name\":\"Infected Device\",\"content_hash\":\"hash-stealer-missing-userinfo\",\"credential_count\":1,\"risk\":{\"score\":3},\"source\":\"stealer_logs\",\"source_name\":\"Stealer Logs\",\"tags\":[],\"timestamp\":\"2025-10-24T03:51:00+00:00\",\"title\":\"\",\"type\":\"stealer_log\",\"uid\":\"stealer_log/stealer_logs/missing_user_info\",\"ignored_at\":null,\"remediated_at\":null},\"metadata\":{\"estimated_created_at\":\"2025-10-24T03:51:00+00:00\",\"first_crawled_at\":\"2025-10-28T18:35:15.095033+00:00\",\"last_crawled_at\":\"2025-10-28T18:35:15.095033+00:00\",\"payload_digest\":\"hash-stealer-missing-userinfo\",\"scraped_at\":\"2025-10-28T18:35:17.333487+00:00\",\"source\":\"stealer_logs\",\"flare_url\":\"\"}}",
"event": {
"category": [
"threat"
],
"dataset": "flare.events",
"end": "2025-10-28T18:35:15.095033Z",
"hash": "hash-stealer-missing-userinfo",
"kind": "alert",
"outcome": "unknown",
"provider": "Stealer Logs",
"risk_score": 3,
"severity": 60,
"start": "2025-10-28T18:35:15.095033Z",
"type": [
"indicator"
]
},
"@timestamp": "2025-10-24T03:51:00Z",
"flare": {
"events": {
"category": "Infected Device",
"emails": [
"user1@example.com"
],
"index": "stealer_log",
"payload_digest": "hash-stealer-missing-userinfo",
"scraped_at": "2025-10-28T18:35:17.333487+00:00",
"source": "stealer_logs",
"source_name": "Stealer Logs",
"stealer_log": {
"cookies_count": 1,
"credential_count": 1,
"credentials_count": 1,
"infection_date": "2025-10-24T03:51:00+00:00",
"malware_family": "vidar"
},
"type": "stealer_log",
"uid": "stealer_log/stealer_logs/missing_user_info"
}
},
"observer": {
"product": "Flare",
"type": "threat-intel",
"vendor": "Flare"
},
"related": {
"hash": [
"hash-stealer-missing-userinfo"
]
},
"tags": [],
"threat": {
"indicator": {
"ip": "198.51.100.1",
"url": {
"domain": "example.com"
}
},
"software": {
"name": "vidar"
}
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
@timestamp |
date |
Date/time when the event originated. |
cloud.provider |
keyword |
Name of the cloud provider. |
cloud.region |
keyword |
Region in which this host, resource, or service is located. |
destination.address |
keyword |
Destination network address. |
destination.geo.country_name |
keyword |
Country name. |
destination.geo.region_iso_code |
keyword |
Region ISO code. |
destination.port |
long |
Port of the destination. |
dns.question.name |
keyword |
The name being queried. |
event.action |
keyword |
The action captured by the event. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.dataset |
keyword |
Name of the dataset. |
event.end |
date |
event.end contains the date when the event ended or when the activity was last observed. |
event.hash |
keyword |
Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. |
event.kind |
keyword |
The kind of the event. The highest categorization field in the hierarchy. |
event.outcome |
keyword |
The outcome of the event. The lowest level categorization field in the hierarchy. |
event.provider |
keyword |
Source of the event. |
event.reason |
keyword |
Reason why this event happened, according to the source |
event.risk_score |
float |
Risk score or priority of the event (e.g. security solutions). Use your system's original value here. |
event.severity |
long |
Numeric severity of the event. |
event.start |
date |
event.start contains the date when the event started or when the activity was first observed. |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
event.url |
keyword |
Event investigation URL |
flare.events.blog_post.browser_url |
keyword |
Blog post browser URL |
flare.events.blog_post.content |
keyword |
Blog post raw content |
flare.events.blog_post.description |
keyword |
Blog post description |
flare.events.blog_post.title |
keyword |
Blog post title |
flare.events.bucket.content_type |
keyword |
Bucket object content type |
flare.events.bucket.name |
keyword |
Bucket name |
flare.events.bucket.size_bytes |
long |
Bucket object size in bytes |
flare.events.category |
keyword |
High-level Flare category |
flare.events.chat_message.account |
keyword |
Chat account context |
flare.events.chat_message.attachments |
keyword |
Chat attachment metadata |
flare.events.chat_message.batch_id |
keyword |
Chat crawl batch identifier |
flare.events.chat_message.content |
keyword |
Raw chat message content |
flare.events.chat_message.conversation_id |
keyword |
Chat conversation identifier |
flare.events.chat_message.conversation_link |
keyword |
Chat conversation link |
flare.events.chat_message.conversation_name |
keyword |
Chat conversation name |
flare.events.chat_message.posted_at |
date |
Original message post date |
flare.events.chat_message.sensitive_content |
keyword |
Sensitive content classification |
flare.events.chat_message.was_forwarded |
boolean |
Whether message was forwarded |
flare.events.contains_secrets |
boolean |
Event contains secrets flag |
flare.events.domain.cert_data |
keyword |
Domain certificate metadata |
flare.events.domain.feed |
keyword |
Domain source feed |
flare.events.domain.identifier_domain |
keyword |
Legitimate domain identifiers matched by Flare |
flare.events.domain.registered_at |
date |
Domain registration timestamp |
flare.events.emails |
keyword |
Email indicators extracted by Flare |
flare.events.es_score |
float |
Flare relevance score |
flare.events.experimental.raw |
keyword |
Raw JSON payload for unstable experimental events |
flare.events.external_url |
keyword |
External URL referenced by event |
flare.events.forum.browser_url |
keyword |
Forum browser URL |
flare.events.forum.category_name |
keyword |
Forum board name |
flare.events.forum.category_path |
keyword |
Forum board path |
flare.events.forum.content |
keyword |
Raw forum post content |
flare.events.forum.posted_at |
date |
Forum post timestamp |
flare.events.forum.topic_id |
keyword |
Forum topic identifier |
flare.events.forum.topic_title |
keyword |
Forum topic title |
flare.events.google.content |
keyword |
Google result snippet or content |
flare.events.google.title |
keyword |
Google result title |
flare.events.identifiers.id |
keyword |
Matched identifier IDs |
flare.events.identifiers.name |
keyword |
Matched identifier names |
flare.events.index |
keyword |
Flare index name |
flare.events.leaked_credential.breached_at |
date |
Leak breached_at timestamp |
flare.events.leaked_credential.imported_at |
date |
Credential import timestamp in Flare |
flare.events.leaked_credential.leak_id |
keyword |
Flare internal leak identifier |
flare.events.leaked_credential.leak_source_id |
keyword |
Leak source identifier |
flare.events.leaked_credential.leak_source_name |
keyword |
Leak source name |
flare.events.leaked_credential.leaked_at |
date |
Leak leaked_at timestamp |
flare.events.leaked_credential.password_present |
boolean |
Indicates if a leaked credential has a password value |
flare.events.leaked_credential.pii_tags |
keyword |
Leak PII categories |
flare.events.listing.classes |
keyword |
Listing class tags |
flare.events.listing.content |
keyword |
Marketplace listing raw description |
flare.events.listing.currency |
keyword |
Marketplace listing currency |
flare.events.listing.escrow |
boolean |
Listing escrow flag |
flare.events.listing.price |
keyword |
Marketplace listing price |
flare.events.listing.ship_from |
keyword |
Listing shipping origins |
flare.events.listing.ship_to |
keyword |
Listing shipping destinations |
flare.events.listing.stock_count |
long |
Listing stock count |
flare.events.listing.title |
keyword |
Marketplace listing title |
flare.events.listing.types |
keyword |
Listing type tags |
flare.events.notes |
keyword |
Tenant analyst notes |
flare.events.parent_id |
keyword |
Parent event identifier |
flare.events.parent_title |
keyword |
Parent event title |
flare.events.parent_uid |
keyword |
Parent event UID |
flare.events.paste.content |
keyword |
Raw paste content |
flare.events.paste.expire_at |
date |
Paste expiration timestamp |
flare.events.paste.syntax |
keyword |
Paste syntax name |
flare.events.paste.title |
keyword |
Paste title |
flare.events.payload_digest |
keyword |
Flare payload digest |
flare.events.profile.about |
keyword |
Profile biography text |
flare.events.profile.groups |
keyword |
Profile groups |
flare.events.profile.twitter |
keyword |
Profile twitter handle |
flare.events.ransomleak.content |
keyword |
Ransomleak document raw content |
flare.events.ransomleak.title |
keyword |
Ransomleak document title |
flare.events.ransomleak.victim_name |
keyword |
Ransomleak victim organization |
flare.events.scraped_at |
date |
Timestamp when Flare scraped the source |
flare.events.seller.listings_count |
long |
Seller listing count |
flare.events.seller.rating |
keyword |
Seller rating values |
flare.events.service.banner |
keyword |
Exposed service banner |
flare.events.severity_original |
keyword |
Tenant original severity value |
flare.events.severity_override |
keyword |
Tenant severity override value |
flare.events.social_media.platform |
keyword |
Social platform name |
flare.events.source |
keyword |
Flare internal source slug |
flare.events.source_code.architecture |
keyword |
Image architecture |
flare.events.source_code.contains_secrets |
boolean |
Source artifact contains secrets flag |
flare.events.source_code.content |
keyword |
Raw source code or Dockerfile content |
flare.events.source_code.digest |
keyword |
Source code or image digest |
flare.events.source_code.last_pulled_at |
date |
Source artifact last pull timestamp |
flare.events.source_code.last_pushed_at |
date |
Source artifact last push timestamp |
flare.events.source_code.repositories |
keyword |
Source artifact repositories |
flare.events.source_code.secrets_metadata |
keyword |
Source artifact secrets metadata |
flare.events.source_code.size_bytes |
long |
Size of source code artifact in bytes |
flare.events.source_code.tags |
keyword |
Source artifact tags |
flare.events.source_name |
keyword |
Human-readable Flare source name |
flare.events.stealer_log.anti_viruses |
keyword |
Infected host anti-virus list |
flare.events.stealer_log.build_id |
keyword |
Stealer malware build id |
flare.events.stealer_log.cookies_count |
long |
Number of cookie records extracted from payload |
flare.events.stealer_log.credential_count |
long |
Number of credentials in the stealer log |
flare.events.stealer_log.credentials_count |
long |
Number of credential records extracted from payload |
flare.events.stealer_log.currency |
keyword |
Stealer listing currency |
flare.events.stealer_log.files |
keyword |
Harvested file paths |
flare.events.stealer_log.hardware |
keyword |
Infected host hardware list |
flare.events.stealer_log.infection_date |
date |
Infection date from stealer metadata |
flare.events.stealer_log.installed_at |
date |
Stealer installed_at timestamp |
flare.events.stealer_log.isp |
keyword |
Infected host ISP |
flare.events.stealer_log.malware_family |
keyword |
Malware family from stealer metadata |
flare.events.stealer_log.price |
keyword |
Stealer listing price |
flare.events.stealer_log.screen_resolution |
keyword |
Infected host screen resolution |
flare.events.stealer_log.seller_id |
keyword |
Stealer listing seller id |
flare.events.stealer_log.sources |
keyword |
Stealer distribution sources |
flare.events.stealer_log.timezone |
keyword |
Infected host timezone |
flare.events.target_name |
keyword |
Resolved target name |
flare.events.type |
keyword |
Flare event subtype |
flare.events.uid |
keyword |
Stable unique Flare event identifier |
flare.events.usernames |
keyword |
Username indicators extracted by Flare |
flare.events.verb |
keyword |
Flare action verb |
flare.events.victim_name |
keyword |
Victim organization name when present |
host.geo.country_iso_code |
keyword |
Country ISO code. |
host.geo.name |
keyword |
User-defined description of a location. |
host.geo.postal_code |
keyword |
Postal code. |
host.id |
keyword |
Unique host id. |
host.ip |
ip |
Host ip addresses. |
host.name |
keyword |
Name of the host. |
host.os.full |
keyword |
Operating system name, including the version or code name. |
host.os.name |
keyword |
Operating system name, without the version. |
host.os.version |
keyword |
Operating system version as a raw string. |
observer.product |
keyword |
The product name of the observer. |
observer.type |
keyword |
The type of the observer the data is coming from. |
observer.vendor |
keyword |
Vendor name of the observer. |
organization.name |
keyword |
Organization name. |
service.name |
keyword |
Name of the service. |
source.geo.country_name |
keyword |
Country name. |
source.ip |
ip |
IP address of the source. |
tags |
keyword |
List of keywords used to tag each event. |
threat.indicator.ip |
ip |
Indicator IP address |
threat.indicator.provider |
keyword |
Indicator provider |
threat.indicator.url.domain |
keyword |
Domain of the url. |
threat.indicator.url.full |
wildcard |
Full unparsed URL. |
threat.software.name |
keyword |
Name of the software. |
tls.server.x509.issuer.distinguished_name |
keyword |
Distinguished name (DN) of issuing certificate authority. |
tls.server.x509.subject.distinguished_name |
keyword |
Distinguished name (DN) of the certificate subject entity. |
url.domain |
keyword |
Domain of the url. |
url.full |
wildcard |
Full unparsed URL. |
user.email |
keyword |
User email address. |
user.full_name |
keyword |
User's full name, if available. |
user.id |
keyword |
Unique identifier of the user. |
user.name |
keyword |
Short name or login of the user. |
For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.