From 3c101142a491dfc3590608268cdb47e139022a82 Mon Sep 17 00:00:00 2001 From: Matei Date: Thu, 23 Jul 2026 10:31:32 -0400 Subject: [PATCH 1/5] import bot event code snippet --- docs/snippets/event_model_examples/bot.mdx | 38 +++++++++++++++++++ .../event_model_examples/events_overview.mdx | 24 ++++++++++++ 2 files changed, 62 insertions(+) create mode 100644 docs/snippets/event_model_examples/bot.mdx diff --git a/docs/snippets/event_model_examples/bot.mdx b/docs/snippets/event_model_examples/bot.mdx new file mode 100644 index 0000000..a45e9ab --- /dev/null +++ b/docs/snippets/event_model_examples/bot.mdx @@ -0,0 +1,38 @@ +{/* + If you are in pyro: + - If this file changes, you should also modify the API docs. + - https://github.com/flared/docs-api/ + + If you are in mintlify: + - Don't edit this directly, edit the generator in pyro. + - pyro/pyro/mintlify/test_firework_event_models.py +*/} + +```json Bot +{ + "event_type": "bot", + "data": { + "name": "Russian Market - Stealer Logs - Vidar", + "url": "https://app.flare.io/#/bot/russian_market/dfFYMYdF", + "actor": { + "id": "dfFYMYdF" + }, + "victim_information": { + "country_code": "NL", + "location": "Netherlands - North Holland", + "isp": "Vodafone Ziggo", + "installed_at": "2026-04-30T00:00:00", + "os": "Windows 11 Home" + }, + "price": "10.00", + "currency": "usd" + }, + "metadata": { + "estimated_created_at": "2025-01-01T00:00:00", + "flare_url": "https://app.flare.io/#/uid", + "matched_at": null, + "severity": "info", + "uid": "index/source/id" + } +} +``` diff --git a/docs/snippets/event_model_examples/events_overview.mdx b/docs/snippets/event_model_examples/events_overview.mdx index 9497515..6c50f33 100644 --- a/docs/snippets/event_model_examples/events_overview.mdx +++ b/docs/snippets/event_model_examples/events_overview.mdx @@ -10,8 +10,12 @@ import BlogPost from '/snippets/event_model_examples/blog_post.mdx' +import Bot from '/snippets/event_model_examples/bot.mdx' + import Bucket from '/snippets/event_model_examples/bucket.mdx' +import BucketObject from '/snippets/event_model_examples/bucket_object.mdx' + import ChatMessage from '/snippets/event_model_examples/chat_message.mdx' import CreditCard from '/snippets/event_model_examples/credit_card.mdx' @@ -22,30 +26,50 @@ import DockerRepository from '/snippets/event_model_examples/docker_repository.m import ForumPost from '/snippets/event_model_examples/forum_post.mdx' +import InvalidCredential from '/snippets/event_model_examples/invalid_credential.mdx' + +import Leak from '/snippets/event_model_examples/leak.mdx' + +import LeakedCredential from '/snippets/event_model_examples/leaked_credential.mdx' + import Listing from '/snippets/event_model_examples/listing.mdx' import LookalikeDomain from '/snippets/event_model_examples/lookalike_domain.mdx' +import MitigatedCredential from '/snippets/event_model_examples/mitigated_credential.mdx' + import Paste from '/snippets/event_model_examples/paste.mdx' import RansomLeak from '/snippets/event_model_examples/ransom_leak.mdx' +import Service from '/snippets/event_model_examples/service.mdx' + import SocialMediaAccount from '/snippets/event_model_examples/social_media_account.mdx' import StealerLog from '/snippets/event_model_examples/stealer_log.mdx' +import ValidCredential from '/snippets/event_model_examples/valid_credential.mdx' + + + + + + + + + \ No newline at end of file From d1af8da7c5983509b47a74f5d7624d85e2a46898 Mon Sep 17 00:00:00 2001 From: Matei Date: Thu, 23 Jul 2026 11:09:41 -0400 Subject: [PATCH 2/5] Create bot description page --- docs/docs.json | 1 + docs/event-types-v2/bot.mdx | 10 ++++++++++ docs/snippets/event_model_examples/bot.mdx | 18 +++++++++--------- 3 files changed, 20 insertions(+), 9 deletions(-) create mode 100644 docs/event-types-v2/bot.mdx diff --git a/docs/docs.json b/docs/docs.json index b1381eb..b7fed61 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -324,6 +324,7 @@ "pages": [ "event-types-v2/overview", "event-types-v2/blog-post", + "event-types-v2/bot", "event-types-v2/bucket", "event-types-v2/bucket-object", "event-types-v2/chat-message", diff --git a/docs/event-types-v2/bot.mdx b/docs/event-types-v2/bot.mdx new file mode 100644 index 0000000..153b8d8 --- /dev/null +++ b/docs/event-types-v2/bot.mdx @@ -0,0 +1,10 @@ +--- +title: "Bot" +--- + +import BotExample from '/snippets/event_model_examples/bot.mdx' + +The `bot` event represents a compromised device (a “bot”) listed for sale on a dark-web marketplace (for example, “Russian Market”), where attackers sell access to machines infected by information stealer malware. +Each document corresponds to a single infected device, with the victim's environment (OS, ISP, location) and the listing details describing where the bot is offered and its price. + + diff --git a/docs/snippets/event_model_examples/bot.mdx b/docs/snippets/event_model_examples/bot.mdx index a45e9ab..5a0044e 100644 --- a/docs/snippets/event_model_examples/bot.mdx +++ b/docs/snippets/event_model_examples/bot.mdx @@ -12,19 +12,19 @@ { "event_type": "bot", "data": { - "name": "Russian Market - Stealer Logs - Vidar", - "url": "https://app.flare.io/#/bot/russian_market/dfFYMYdF", + "name": "Hacker Market - Bots", + "url": "https://bot.market.com/market/bot/1234", "actor": { - "id": "dfFYMYdF" + "id": "A1B2C3" }, "victim_information": { - "country_code": "NL", - "location": "Netherlands - North Holland", - "isp": "Vodafone Ziggo", - "installed_at": "2026-04-30T00:00:00", - "os": "Windows 11 Home" + "country_code": "CA", + "location": "City, Country", + "isp": "Internet Service Provider", + "installed_at": "2026-07-22T00:00:00", + "os": "Windows 7" }, - "price": "10.00", + "price": "19.99", "currency": "usd" }, "metadata": { From c5c2521562703fe9d752d101bd2401324a3350e2 Mon Sep 17 00:00:00 2001 From: Matei Date: Thu, 23 Jul 2026 11:09:51 -0400 Subject: [PATCH 3/5] update event-types v2 table --- docs/event-types-v2/overview.mdx | 45 ++++++++++++++++---------------- 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/docs/event-types-v2/overview.mdx b/docs/event-types-v2/overview.mdx index ca4d967..a35bcdf 100644 --- a/docs/event-types-v2/overview.mdx +++ b/docs/event-types-v2/overview.mdx @@ -8,25 +8,26 @@ description: "Overview of all Flare API event types" Currently these event type models are supported on the [Retrieve Event V2 Endpoint ](/api-reference/v4/endpoints/get-event) -| Event Type | Documentation | -| -------------- | ----------------------------------------------------------------------------------- | -| `blog_post` | [Blog Post ](/event-types-v2/blog-post) | -| `bucket` | [Bucket ](/event-types-v2/bucket) | -| `bucket_object` | [Bucket Object ](/event-types-v2/bucket-object) | -| `chat_message` | [Chat Message ](/event-types-v2/chat-message) | -| `credit_card` | [Chat Message ](/event-types-v2/chat-message) | -| `docker_repository`| [Docker Repository ](/event-types-v2/docker-repository) | -| `document` | [Ransomleak (document) ](/event-types-v2/ransom-leak) | -| `docker Image` | [Docker Image ](/event-types-v2/docker-image) | -| `domain` | [Lookalike Domain (domain) ](/event-types-v2/domain) | -| `forum_post` | [Forum Post & Topic ](/event-types-v2/forum-post) | -| `invalid_credential` | [Invalid Credential ](/event-types-v2/invalid-credential) | -| `leak` | [Leak ](/event-types-v2/leak) | -| `leaked_credential` | [Leaked Credential ](/event-types-v2/leaked-credential) | -| `listing` | [Listing ](/event-types-v2/listing) | -| `mitigated_credential` | [Mitigated Credential ](/event-types-v2/mitigated-credential) | -| `paste` | [Paste ](/event-types-v2/paste) | -| `stealer_log` | [Stealer Log ](/event-types-v2/stealer-log) | -| `social_media` | [Social media ](/event-types-v2/social-media-account) | -| `service` | [Service ](/event-types-v2/service) | -| `valid_credential` | [Valid Credential ](/event-types-v2/valid-credential) | +| Event Type | Documentation | +| --------------------- | --------------------------------------------------------------------------------------------- | +| `blog_post` | [Blog Post ](/event-types-v2/blog-post) | +| `bot` | [Bot ](/event-types-v2/bot) | +| `bucket` | [Bucket ](/event-types-v2/bucket) | +| `bucket_object` | [Bucket Object ](/event-types-v2/bucket-object) | +| `chat_message` | [Chat Message ](/event-types-v2/chat-message) | +| `credit_card` | [Chat Message ](/event-types-v2/chat-message) | +| `docker_repository` | [Docker Repository ](/event-types-v2/docker-repository) | +| `document` | [Ransomleak (document) ](/event-types-v2/ransom-leak) | +| `docker Image` | [Docker Image ](/event-types-v2/docker-image) | +| `domain` | [Lookalike Domain (domain) ](/event-types-v2/domain) | +| `forum_post` | [Forum Post & Topic ](/event-types-v2/forum-post) | +| `invalid_credential` | [Invalid Credential ](/event-types-v2/invalid-credential) | +| `leak` | [Leak ](/event-types-v2/leak) | +| `leaked_credential` | [Leaked Credential ](/event-types-v2/leaked-credential) | +| `listing` | [Listing ](/event-types-v2/listing) | +| `mitigated_credential` | [Mitigated Credential ](/event-types-v2/mitigated-credential) | +| `paste` | [Paste ](/event-types-v2/paste) | +| `stealer_log` | [Stealer Log ](/event-types-v2/stealer-log) | +| `social_media` | [Social media ](/event-types-v2/social-media-account) | +| `service` | [Service ](/event-types-v2/service) | +| `valid_credential` | [Valid Credential ](/event-types-v2/valid-credential) | From c167b5b4efaacbb8aa14c664f23d1a20f0db9e8b Mon Sep 17 00:00:00 2001 From: Matei Date: Thu, 23 Jul 2026 15:35:55 -0400 Subject: [PATCH 4/5] Update open API spec --- .../spec/firework-v4-openapi.json | 205 +++++++++++++++++- 1 file changed, 202 insertions(+), 3 deletions(-) diff --git a/docs/api-reference/spec/firework-v4-openapi.json b/docs/api-reference/spec/firework-v4-openapi.json index aa270ae..29ede08 100644 --- a/docs/api-reference/spec/firework-v4-openapi.json +++ b/docs/api-reference/spec/firework-v4-openapi.json @@ -405,6 +405,9 @@ { "$ref": "#/components/schemas/BlogPostEvent" }, + { + "$ref": "#/components/schemas/BotEvent" + }, { "$ref": "#/components/schemas/BucketEvent" }, @@ -418,13 +421,13 @@ "$ref": "#/components/schemas/FinancialEvent" }, { - "$ref": "#/components/schemas/DockerRepositoryEvent" + "$ref": "#/components/schemas/DockerImageEvent" }, { - "$ref": "#/components/schemas/ForumPostEvent" + "$ref": "#/components/schemas/DockerRepositoryEvent" }, { - "$ref": "#/components/schemas/DockerImageEvent" + "$ref": "#/components/schemas/ForumPostEvent" }, { "$ref": "#/components/schemas/InvalidCredentialEvent" @@ -467,6 +470,7 @@ "propertyName": "event_type", "mapping": { "blog_post": "#/components/schemas/BlogPostEvent", + "bot": "#/components/schemas/BotEvent", "bucket": "#/components/schemas/BucketEvent", "bucket_object": "#/components/schemas/BucketObjectEvent", "chat_message": "#/components/schemas/ChatMessageEvent", @@ -3660,6 +3664,175 @@ ], "title": "Blog Post" }, + "BotEvent": { + "properties": { + "event_type": { + "type": "string", + "const": "bot", + "title": "Event Type", + "default": "bot" + }, + "data": { + "$ref": "#/components/schemas/BotEventData" + }, + "metadata": { + "$ref": "#/components/schemas/EventMetadata" + } + }, + "type": "object", + "required": [ + "data", + "metadata" + ], + "title": "Bot" + }, + "BotEventActor": { + "properties": { + "id": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "title": "Id", + "description": "The ID of the seller that put the bot up for sale." + } + }, + "type": "object", + "title": "BotEventActor" + }, + "BotEventData": { + "properties": { + "name": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "title": "Name", + "description": "The name of the bot listing." + }, + "url": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "title": "Url", + "description": "The URL of the bot listing on the marketplace." + }, + "actor": { + "$ref": "#/components/schemas/BotEventActor", + "description": "Data about the seller of the bot listing." + }, + "victim_information": { + "$ref": "#/components/schemas/BotVictimInformation", + "description": "Collection of data about the victim's infected device." + }, + "price": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "title": "Price", + "description": "The price of the bot listing." + }, + "currency": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "title": "Currency", + "description": "The currency for the bot listing price." + } + }, + "type": "object", + "title": "BotEventData" + }, + "BotVictimInformation": { + "properties": { + "country_code": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "title": "Country Code", + "description": "The country code tied to the infected device." + }, + "location": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "title": "Location", + "description": "The location of the infected device." + }, + "isp": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "title": "Isp", + "description": "The ISP of the infected device." + }, + "installed_at": { + "anyOf": [ + { + "type": "string", + "format": "date-time" + }, + { + "type": "null" + } + ], + "title": "Installed At", + "description": "The date and time the malware was installed on the infected device." + }, + "os": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "title": "Os", + "description": "The operating system of the infected device." + } + }, + "type": "object", + "title": "BotVictimInformation" + }, "BrandData": { "properties": { "type": { @@ -10042,6 +10215,32 @@ ], "title": "RoleData" }, + "SandboxUploadPutUrlResponse": { + "properties": { + "upload_url": { + "type": "string", + "title": "Upload Url" + } + }, + "type": "object", + "required": [ + "upload_url" + ], + "title": "SandboxUploadPutUrlResponse" + }, + "SandboxUploadUrlRequest": { + "properties": { + "filename": { + "type": "string", + "title": "Filename" + } + }, + "type": "object", + "required": [ + "filename" + ], + "title": "SandboxUploadUrlRequest" + }, "SearchQueryData": { "properties": { "type": { From eeb92bbf19c811478a15a679afceff07e7a8c41d Mon Sep 17 00:00:00 2001 From: Matei Date: Thu, 23 Jul 2026 15:52:11 -0400 Subject: [PATCH 5/5] remove sandbox models --- .../spec/firework-v4-openapi.json | 26 ------------------- 1 file changed, 26 deletions(-) diff --git a/docs/api-reference/spec/firework-v4-openapi.json b/docs/api-reference/spec/firework-v4-openapi.json index 29ede08..bb32a11 100644 --- a/docs/api-reference/spec/firework-v4-openapi.json +++ b/docs/api-reference/spec/firework-v4-openapi.json @@ -10215,32 +10215,6 @@ ], "title": "RoleData" }, - "SandboxUploadPutUrlResponse": { - "properties": { - "upload_url": { - "type": "string", - "title": "Upload Url" - } - }, - "type": "object", - "required": [ - "upload_url" - ], - "title": "SandboxUploadPutUrlResponse" - }, - "SandboxUploadUrlRequest": { - "properties": { - "filename": { - "type": "string", - "title": "Filename" - } - }, - "type": "object", - "required": [ - "filename" - ], - "title": "SandboxUploadUrlRequest" - }, "SearchQueryData": { "properties": { "type": {