diff --git a/docs/api-reference/spec/firework-v4-openapi.json b/docs/api-reference/spec/firework-v4-openapi.json
index aa270ae..bb32a11 100644
--- a/docs/api-reference/spec/firework-v4-openapi.json
+++ b/docs/api-reference/spec/firework-v4-openapi.json
@@ -405,6 +405,9 @@
{
"$ref": "#/components/schemas/BlogPostEvent"
},
+ {
+ "$ref": "#/components/schemas/BotEvent"
+ },
{
"$ref": "#/components/schemas/BucketEvent"
},
@@ -418,13 +421,13 @@
"$ref": "#/components/schemas/FinancialEvent"
},
{
- "$ref": "#/components/schemas/DockerRepositoryEvent"
+ "$ref": "#/components/schemas/DockerImageEvent"
},
{
- "$ref": "#/components/schemas/ForumPostEvent"
+ "$ref": "#/components/schemas/DockerRepositoryEvent"
},
{
- "$ref": "#/components/schemas/DockerImageEvent"
+ "$ref": "#/components/schemas/ForumPostEvent"
},
{
"$ref": "#/components/schemas/InvalidCredentialEvent"
@@ -467,6 +470,7 @@
"propertyName": "event_type",
"mapping": {
"blog_post": "#/components/schemas/BlogPostEvent",
+ "bot": "#/components/schemas/BotEvent",
"bucket": "#/components/schemas/BucketEvent",
"bucket_object": "#/components/schemas/BucketObjectEvent",
"chat_message": "#/components/schemas/ChatMessageEvent",
@@ -3660,6 +3664,175 @@
],
"title": "Blog Post"
},
+ "BotEvent": {
+ "properties": {
+ "event_type": {
+ "type": "string",
+ "const": "bot",
+ "title": "Event Type",
+ "default": "bot"
+ },
+ "data": {
+ "$ref": "#/components/schemas/BotEventData"
+ },
+ "metadata": {
+ "$ref": "#/components/schemas/EventMetadata"
+ }
+ },
+ "type": "object",
+ "required": [
+ "data",
+ "metadata"
+ ],
+ "title": "Bot"
+ },
+ "BotEventActor": {
+ "properties": {
+ "id": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Id",
+ "description": "The ID of the seller that put the bot up for sale."
+ }
+ },
+ "type": "object",
+ "title": "BotEventActor"
+ },
+ "BotEventData": {
+ "properties": {
+ "name": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Name",
+ "description": "The name of the bot listing."
+ },
+ "url": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Url",
+ "description": "The URL of the bot listing on the marketplace."
+ },
+ "actor": {
+ "$ref": "#/components/schemas/BotEventActor",
+ "description": "Data about the seller of the bot listing."
+ },
+ "victim_information": {
+ "$ref": "#/components/schemas/BotVictimInformation",
+ "description": "Collection of data about the victim's infected device."
+ },
+ "price": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Price",
+ "description": "The price of the bot listing."
+ },
+ "currency": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Currency",
+ "description": "The currency for the bot listing price."
+ }
+ },
+ "type": "object",
+ "title": "BotEventData"
+ },
+ "BotVictimInformation": {
+ "properties": {
+ "country_code": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Country Code",
+ "description": "The country code tied to the infected device."
+ },
+ "location": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Location",
+ "description": "The location of the infected device."
+ },
+ "isp": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Isp",
+ "description": "The ISP of the infected device."
+ },
+ "installed_at": {
+ "anyOf": [
+ {
+ "type": "string",
+ "format": "date-time"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Installed At",
+ "description": "The date and time the malware was installed on the infected device."
+ },
+ "os": {
+ "anyOf": [
+ {
+ "type": "string"
+ },
+ {
+ "type": "null"
+ }
+ ],
+ "title": "Os",
+ "description": "The operating system of the infected device."
+ }
+ },
+ "type": "object",
+ "title": "BotVictimInformation"
+ },
"BrandData": {
"properties": {
"type": {
diff --git a/docs/docs.json b/docs/docs.json
index b1381eb..b7fed61 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -324,6 +324,7 @@
"pages": [
"event-types-v2/overview",
"event-types-v2/blog-post",
+ "event-types-v2/bot",
"event-types-v2/bucket",
"event-types-v2/bucket-object",
"event-types-v2/chat-message",
diff --git a/docs/event-types-v2/bot.mdx b/docs/event-types-v2/bot.mdx
new file mode 100644
index 0000000..153b8d8
--- /dev/null
+++ b/docs/event-types-v2/bot.mdx
@@ -0,0 +1,10 @@
+---
+title: "Bot"
+---
+
+import BotExample from '/snippets/event_model_examples/bot.mdx'
+
+The `bot` event represents a compromised device (a “bot”) listed for sale on a dark-web marketplace (for example, “Russian Market”), where attackers sell access to machines infected by information stealer malware.
+Each document corresponds to a single infected device, with the victim's environment (OS, ISP, location) and the listing details describing where the bot is offered and its price.
+
+
diff --git a/docs/event-types-v2/overview.mdx b/docs/event-types-v2/overview.mdx
index ca4d967..a35bcdf 100644
--- a/docs/event-types-v2/overview.mdx
+++ b/docs/event-types-v2/overview.mdx
@@ -8,25 +8,26 @@ description: "Overview of all Flare API event types"
Currently these event type models are supported on the
[Retrieve Event V2 Endpoint ](/api-reference/v4/endpoints/get-event)
-| Event Type | Documentation |
-| -------------- | ----------------------------------------------------------------------------------- |
-| `blog_post` | [Blog Post ](/event-types-v2/blog-post) |
-| `bucket` | [Bucket ](/event-types-v2/bucket) |
-| `bucket_object` | [Bucket Object ](/event-types-v2/bucket-object) |
-| `chat_message` | [Chat Message ](/event-types-v2/chat-message) |
-| `credit_card` | [Chat Message ](/event-types-v2/chat-message) |
-| `docker_repository`| [Docker Repository ](/event-types-v2/docker-repository) |
-| `document` | [Ransomleak (document) ](/event-types-v2/ransom-leak) |
-| `docker Image` | [Docker Image ](/event-types-v2/docker-image) |
-| `domain` | [Lookalike Domain (domain) ](/event-types-v2/domain) |
-| `forum_post` | [Forum Post & Topic ](/event-types-v2/forum-post) |
-| `invalid_credential` | [Invalid Credential ](/event-types-v2/invalid-credential) |
-| `leak` | [Leak ](/event-types-v2/leak) |
-| `leaked_credential` | [Leaked Credential ](/event-types-v2/leaked-credential) |
-| `listing` | [Listing ](/event-types-v2/listing) |
-| `mitigated_credential` | [Mitigated Credential ](/event-types-v2/mitigated-credential) |
-| `paste` | [Paste ](/event-types-v2/paste) |
-| `stealer_log` | [Stealer Log ](/event-types-v2/stealer-log) |
-| `social_media` | [Social media ](/event-types-v2/social-media-account) |
-| `service` | [Service ](/event-types-v2/service) |
-| `valid_credential` | [Valid Credential ](/event-types-v2/valid-credential) |
+| Event Type | Documentation |
+| --------------------- | --------------------------------------------------------------------------------------------- |
+| `blog_post` | [Blog Post ](/event-types-v2/blog-post) |
+| `bot` | [Bot ](/event-types-v2/bot) |
+| `bucket` | [Bucket ](/event-types-v2/bucket) |
+| `bucket_object` | [Bucket Object ](/event-types-v2/bucket-object) |
+| `chat_message` | [Chat Message ](/event-types-v2/chat-message) |
+| `credit_card` | [Chat Message ](/event-types-v2/chat-message) |
+| `docker_repository` | [Docker Repository ](/event-types-v2/docker-repository) |
+| `document` | [Ransomleak (document) ](/event-types-v2/ransom-leak) |
+| `docker Image` | [Docker Image ](/event-types-v2/docker-image) |
+| `domain` | [Lookalike Domain (domain) ](/event-types-v2/domain) |
+| `forum_post` | [Forum Post & Topic ](/event-types-v2/forum-post) |
+| `invalid_credential` | [Invalid Credential ](/event-types-v2/invalid-credential) |
+| `leak` | [Leak ](/event-types-v2/leak) |
+| `leaked_credential` | [Leaked Credential ](/event-types-v2/leaked-credential) |
+| `listing` | [Listing ](/event-types-v2/listing) |
+| `mitigated_credential` | [Mitigated Credential ](/event-types-v2/mitigated-credential) |
+| `paste` | [Paste ](/event-types-v2/paste) |
+| `stealer_log` | [Stealer Log ](/event-types-v2/stealer-log) |
+| `social_media` | [Social media ](/event-types-v2/social-media-account) |
+| `service` | [Service ](/event-types-v2/service) |
+| `valid_credential` | [Valid Credential ](/event-types-v2/valid-credential) |
diff --git a/docs/snippets/event_model_examples/bot.mdx b/docs/snippets/event_model_examples/bot.mdx
new file mode 100644
index 0000000..5a0044e
--- /dev/null
+++ b/docs/snippets/event_model_examples/bot.mdx
@@ -0,0 +1,38 @@
+{/*
+ If you are in pyro:
+ - If this file changes, you should also modify the API docs.
+ - https://github.com/flared/docs-api/
+
+ If you are in mintlify:
+ - Don't edit this directly, edit the generator in pyro.
+ - pyro/pyro/mintlify/test_firework_event_models.py
+*/}
+
+```json Bot
+{
+ "event_type": "bot",
+ "data": {
+ "name": "Hacker Market - Bots",
+ "url": "https://bot.market.com/market/bot/1234",
+ "actor": {
+ "id": "A1B2C3"
+ },
+ "victim_information": {
+ "country_code": "CA",
+ "location": "City, Country",
+ "isp": "Internet Service Provider",
+ "installed_at": "2026-07-22T00:00:00",
+ "os": "Windows 7"
+ },
+ "price": "19.99",
+ "currency": "usd"
+ },
+ "metadata": {
+ "estimated_created_at": "2025-01-01T00:00:00",
+ "flare_url": "https://app.flare.io/#/uid",
+ "matched_at": null,
+ "severity": "info",
+ "uid": "index/source/id"
+ }
+}
+```
diff --git a/docs/snippets/event_model_examples/events_overview.mdx b/docs/snippets/event_model_examples/events_overview.mdx
index 9497515..6c50f33 100644
--- a/docs/snippets/event_model_examples/events_overview.mdx
+++ b/docs/snippets/event_model_examples/events_overview.mdx
@@ -10,8 +10,12 @@
import BlogPost from '/snippets/event_model_examples/blog_post.mdx'
+import Bot from '/snippets/event_model_examples/bot.mdx'
+
import Bucket from '/snippets/event_model_examples/bucket.mdx'
+import BucketObject from '/snippets/event_model_examples/bucket_object.mdx'
+
import ChatMessage from '/snippets/event_model_examples/chat_message.mdx'
import CreditCard from '/snippets/event_model_examples/credit_card.mdx'
@@ -22,30 +26,50 @@ import DockerRepository from '/snippets/event_model_examples/docker_repository.m
import ForumPost from '/snippets/event_model_examples/forum_post.mdx'
+import InvalidCredential from '/snippets/event_model_examples/invalid_credential.mdx'
+
+import Leak from '/snippets/event_model_examples/leak.mdx'
+
+import LeakedCredential from '/snippets/event_model_examples/leaked_credential.mdx'
+
import Listing from '/snippets/event_model_examples/listing.mdx'
import LookalikeDomain from '/snippets/event_model_examples/lookalike_domain.mdx'
+import MitigatedCredential from '/snippets/event_model_examples/mitigated_credential.mdx'
+
import Paste from '/snippets/event_model_examples/paste.mdx'
import RansomLeak from '/snippets/event_model_examples/ransom_leak.mdx'
+import Service from '/snippets/event_model_examples/service.mdx'
+
import SocialMediaAccount from '/snippets/event_model_examples/social_media_account.mdx'
import StealerLog from '/snippets/event_model_examples/stealer_log.mdx'
+import ValidCredential from '/snippets/event_model_examples/valid_credential.mdx'
+
+
+
+
+
+
+
+
+
\ No newline at end of file