Skip to content

V4/Events: Add RansomLeak Data & Field Explanations #163

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ihassanein wants to merge 2 commits into from
Closed

V4/Events: Add RansomLeak Data & Field Explanations #163

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
503d96d
add stealer log response fields + move data to smaller files to import
ihassanein Jan 27, 2026
1aa2b64
add field specifics for Ransom Leak events
ihassanein Jan 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
205 changes: 17 additions & 188 deletions docs/api-reference/v4/endpoints/get-event.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,136 +3,23 @@ title: "Get Event"
api: "GET https://api.flare.io/firework/v4/events/"
authMethod: "bearer"
---
import BlogPostFieldData from '/snippets/event-data/blog-post-fields.mdx'
import BlogPostModelData from '/snippets/event-data/blog-post-model.mdx'
import CreditCardFieldData from '/snippets/event-data/credit-card-fields.mdx'
import CreditCardModelData from '/snippets/event-data/credit-card-model.mdx'
import RansomLeakFieldData from '/snippets/event-data/ransomleak-fields.mdx'
import RansomLeakModelData from '/snippets/event-data/ransomleak-model.mdx'
import StealerLogFieldData from '/snippets/event-data/stealer-log-fields.mdx'
import StealerLogModelData from '/snippets/event-data/stealer-log-model.mdx'

Returns data for a specific event.

<Panel>
<ResponseExample>
```json Blog Post
{
"data": {
"url": "<string>",
"content": "<string>",
"description": "<string>",
"posted_at": "2025-01-01T00:00:00.000000+00:00"
},
"metadata": {
"estimated_created_at": "2023-11-07T05:31:56Z",
"flare_url": "<string>",
"matched_at": "2023-11-07T05:31:56Z",
"severity": "info",
"uid": "<string>"
},
"event_type": "blog_post",
}
```
```json Financial
{
"data": {
"bank": "<string>",
"bin": "<integer>",
"brand": "<string>",
"country": "<string>",
"expiration": "2030-05-01T00:00:00+00:00",
"owner": "<string>",
"state_code": "<string>",
"zip": "<string>",
"has_cvv": "<boolean>",
"has_date_of_birth": "<boolean>",
"has_mother_maiden_name": "<boolean>",
"has_phone": "<boolean>",
"has_pin": "<boolean>",
"has_ssn": "<boolean>",
"has_track_1": "<boolean>",
"has_vbv": "<boolean>"
},
"metadata": {
"estimated_created_at": "2023-11-07T05:31:56Z",
"flare_url": "<string>",
"matched_at": "2023-11-07T05:31:56Z",
"severity": "info",
"uid": "<string>"
},
"event_type": "cc",
}
```
```json Ransom Leak
{
"data": {
"victim_information": {
"name": "<string>",
"display_name": "<string>",
"domain": "<string>",
"alternative_domains": "[<string>]",
"industry": "<string>",
"employee_count": "<integer>",
"city": "<string>",
"state": "<string>",
"country": "<string>",
"latitude": "<float>",
"longitude": "<float>"
}
"url": "<string>",
"response_url": "<string>",
"title": "<string>",
"content": "<string",
"body": "<string>",
},
"metadata": {
"estimated_created_at": "2023-11-07T05:31:56Z",
"flare_url": "<string>",
"matched_at": "2023-11-07T05:31:56Z",
"severity": "info",
"uid": "<string>"
},
"event_type": "listing",
}
```
```json Stealer Log
{
"data": {
"victim_information": {
"ip_address": "<string>",
"ip_network": "<string>",
"username": "<string>",
"country_code": "<string>",
"zip_code": "<string>",
"location": "<string>",
"hwid": "<string>",
"current_language": "<string>",
"screensize_width": 123,
"screensize_height": 123,
"timezone": "<string>",
"os": "<string>",
"uac": "<string>",
"process_elevation": "<string>",
"available_keyboards": [
"<string>"
],
"hardware": [
"<string>"
],
"anti_viruses": [
"<string>"
]
},
"malware_information": {
"malware_family": "<string>",
"build_id": "<string>",
"file_location": "<string>",
"infected_at": "2023-11-07T05:31:56Z"
}
},
"metadata": {
"estimated_created_at": "2023-11-07T05:31:56Z",
"flare_url": "<string>",
"matched_at": "2023-11-07T05:31:56Z",
"severity": "info",
"uid": "<string>"
},
"event_type": "stealer_log"
}
```
<BlogPostModelData />
<CreditCardModelData />
<RansomLeakModelData />
<StealerLogModelData />
</ResponseExample>
</Panel>

Expand All @@ -147,74 +34,16 @@ Returns data for a specific event.
Response fields differ based on event type as follows:
<Tabs>
<Tab title="Blog Post">
<ResponseField name="data" type="object" required>
Blog Post Event Data
<Expandable defaultOpen>
<ResponseField name="url" type="string">
Url of the specific blog post.
</ResponseField>
<ResponseField name="content" type="string">
Content of the Blog Post.
</ResponseField>
<ResponseField name="description" type="string" optional>
Blog Post description, if provided.
</ResponseField>
<ResponseField name="posted_at" type="date">
The date the blog post was posted on the web.
</ResponseField>
</Expandable>
</ResponseField>
<BlogPostFieldData />
</Tab>
<Tab title="Financial">
<ResponseField name="data" type="object" required>
Financial Event Data
<Expandable defaultOpen>
<ResponseField name="bank" type="string">
Name of the bank related to the card/information leak.
</ResponseField>
<ResponseField name="bin" type="integer">
Associated BIN to a leaked credit card.
</ResponseField>
<ResponseField name="brand" type="string">
Major brand of the leaked credit card.
Ex: VISA
</ResponseField>
<ResponseField name="country" type="string">
The country of origin of the leaked card/information.
</ResponseField>
<ResponseField name="expiration" type="date">
Expiration of the leaked card.
</ResponseField>
<ResponseField name="owner" type="string">
Name of the owner found on the card.
</ResponseField>
<ResponseField name="state_code" type="string">
Initials of the state tied to the card. This is included for American leaked cards.
</ResponseField>
<ResponseField name="zip" type="string">
Zip code of the address attached to the leaked card. This is included for American leaked cards.
</ResponseField>
<ResponseField name="has_cvv" type="boolean">
When true, this means that the leaked data includes the CVV of the leaked card.
</ResponseField>
</Expandable>
</ResponseField>
<Tab title="Credit Card">
<CreditCardFieldData />
</Tab>
<Tab title="Ransom Leak">
<ResponseField name="data" type="object" required>
RansomLeak Event Data
<Expandable>
<ResponseField name="url" type="string" />
</Expandable>
</ResponseField>
<RansomLeakFieldData />
</Tab>
<Tab title="Stealer Log">
<ResponseField name="data" type="object" required>
Stealer Log Event Data
<Expandable>
<ResponseField name="url" type="string" />
</Expandable>
</ResponseField>
<StealerLogFieldData />
</Tab>
</Tabs>

Expand Down
17 changes: 17 additions & 0 deletions docs/snippets/event-data/blog-post-fields.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
<ResponseField name="data" type="object" required>
Blog Post Event Data
<Expandable defaultOpen>
<ResponseField name="url" type="string">
Url of the specific blog post.
</ResponseField>
<ResponseField name="content" type="string">
Content of the Blog Post.
</ResponseField>
<ResponseField name="description" type="string">
Blog Post description, if provided.
</ResponseField>
<ResponseField name="posted_at" type="date">
The date the blog post was posted on the web.
</ResponseField>
</Expandable>
</ResponseField>
18 changes: 18 additions & 0 deletions docs/snippets/event-data/blog-post-model.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
```json Blog Post
{
"data": {
"url": "<string>",
"content": "<string>",
"description": "<string>",
"posted_at": "2025-01-01T00:00:00.000000+00:00"
},
"metadata": {
"estimated_created_at": "2023-11-07T05:31:56Z",
"flare_url": "<string>",
"matched_at": "2023-11-07T05:31:56Z",
"severity": "info",
"uid": "<string>"
},
"event_type": "blog_post",
}
```
33 changes: 33 additions & 0 deletions docs/snippets/event-data/credit-card-fields.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
<ResponseField name="data" type="object" required>
Credit Card Event Data
<Expandable defaultOpen>
<ResponseField name="bank" type="string">
Name of the bank related to the card/information leak.
</ResponseField>
<ResponseField name="bin" type="integer">
Associated BIN to a leaked credit card.
</ResponseField>
<ResponseField name="brand" type="string">
Major brand of the leaked credit card.
Ex: VISA
</ResponseField>
<ResponseField name="country" type="string">
The country of origin of the leaked card/information.
</ResponseField>
<ResponseField name="expiration" type="date">
Expiration of the leaked card.
</ResponseField>
<ResponseField name="owner" type="string">
Name of the owner found on the card.
</ResponseField>
<ResponseField name="state_code" type="string">
Initials of the state tied to the card. This is included for American leaked cards.
</ResponseField>
<ResponseField name="zip" type="string">
Zip code of the address attached to the leaked card. This is included for American leaked cards.
</ResponseField>
<ResponseField name="has_cvv" type="boolean">
When true, this means that the leaked data includes the CVV of the leaked card.
</ResponseField>
</Expandable>
</ResponseField>
30 changes: 30 additions & 0 deletions docs/snippets/event-data/credit-card-model.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
```json Credit Card
{
"data": {
"bank": "<string>",
"bin": "<integer>",
"brand": "<string>",
"country": "<string>",
"expiration": "2030-05-01T00:00:00+00:00",
"owner": "<string>",
"state_code": "<string>",
"zip": "<string>",
"has_cvv": "<boolean>",
"has_date_of_birth": "<boolean>",
"has_mother_maiden_name": "<boolean>",
"has_phone": "<boolean>",
"has_pin": "<boolean>",
"has_ssn": "<boolean>",
"has_track_1": "<boolean>",
"has_vbv": "<boolean>"
},
"metadata": {
"estimated_created_at": "2023-11-07T05:31:56Z",
"flare_url": "<string>",
"matched_at": "2023-11-07T05:31:56Z",
"severity": "info",
"uid": "<string>"
},
"event_type": "cc",
}
```
33 changes: 33 additions & 0 deletions docs/snippets/event-data/ransomleak-fields.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
<ResponseField name="data" type="object" required>
RansomLeak Event Data
<Expandable defaultOpen>
<ResponseField name="victim_information" type="object">
<Expandable>
<ResponseField name="name" type="string">
Name of the affected entity, this could be a company or a person.
</ResponseField>
<ResponseField name="display_name" type="string" />
<ResponseField name="domain" type="string" />
<ResponseField name="alternative_domains" type="string[]" />
<ResponseField name="industry" type="string">
Industry of operation of the victim. Ex: Healthcare
</ResponseField>
<ResponseField name="employee_count" type="integer">
Enployee count of the ransomed entity.
</ResponseField>
<ResponseField name="city" type="string">
City of operations of the entity's Headquarters.
</ResponseField>
<ResponseField name="state" type="string" />
<ResponseField name="country" type="string" />
<ResponseField name="latitude" type="float" />
<ResponseField name="longitude" type="float" />
</Expandable>
</ResponseField>
<ResponseField name="url" type="string" />
<ResponseField name="response_url" type="string" />
<ResponseField name="title" type="string" />
<ResponseField name="content" type="string" />
<ResponseField name="body" type="string" />
</Expandable>
</ResponseField>
32 changes: 32 additions & 0 deletions docs/snippets/event-data/ransomleak-model.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
```json Ransom Leak
{
"data": {
"victim_information": {
"name": "<string>",
"display_name": "<string>",
"domain": "<string>",
"alternative_domains": "[<string>]",
"industry": "<string>",
"employee_count": "<integer>",
"city": "<string>",
"state": "<string>",
"country": "<string>",
"latitude": "<float>",
"longitude": "<float>"
},
"url": "<string>",
"response_url": "<string>",
"title": "<string>",
"content": "<string",
"body": "<string>",
},
"metadata": {
"estimated_created_at": "2023-11-07T05:31:56Z",
"flare_url": "<string>",
"matched_at": "2023-11-07T05:31:56Z",
"severity": "info",
"uid": "<string>"
},
"event_type": "ransomleak",
}
```
Loading