Skip to content

C33 - Events - Add docs for new V2 Events endpoints #234

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jenip13 merged 1 commit into from
Jul 16, 2026
Merged

C33 - Events - Add docs for new V2 Events endpoints #234

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
245 changes: 244 additions & 1 deletion docs/api-reference/spec/firework-v4-openapi.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -417,12 +417,21 @@
{
"$ref": "#/components/schemas/ForumPostEvent"
},
{
"$ref": "#/components/schemas/InvalidCredentialEvent"
},
{
"$ref": "#/components/schemas/LeakedCredentialEvent"
},
{
"$ref": "#/components/schemas/ListingEvent"
},
{
"$ref": "#/components/schemas/LookalikeDomainEvent"
},
{
"$ref": "#/components/schemas/MitigatedCredentialEvent"
},
{
"$ref": "#/components/schemas/PasteEvent"
},
Expand All @@ -434,6 +443,9 @@
},
{
"$ref": "#/components/schemas/pyro__findings__stealerlogs__datamodels__StealerLogEvent"
},
{
"$ref": "#/components/schemas/ValidCredentialEvent"
}
],
"discriminator": {
Expand All @@ -444,12 +456,16 @@
"chat_message": "#/components/schemas/ChatMessageEvent",
"cc": "#/components/schemas/FinancialEvent",
"forum_post": "#/components/schemas/ForumPostEvent",
"invalid_credential": "#/components/schemas/InvalidCredentialEvent",
"leaked_credential": "#/components/schemas/LeakedCredentialEvent",
"listing": "#/components/schemas/ListingEvent",
"lookalike": "#/components/schemas/LookalikeDomainEvent",
"mitigated_credential": "#/components/schemas/MitigatedCredentialEvent",
"paste": "#/components/schemas/PasteEvent",
"ransomleak": "#/components/schemas/RansomLeakEvent",
"social_media_account": "#/components/schemas/SocialMediaEvent",
"stealer_log": "#/components/schemas/pyro__findings__stealerlogs__datamodels__StealerLogEvent"
"stealer_log": "#/components/schemas/pyro__findings__stealerlogs__datamodels__StealerLogEvent",
"valid_credential": "#/components/schemas/ValidCredentialEvent"
}
}
},
Expand Down Expand Up @@ -2608,6 +2624,7 @@
"driller_profile",
"driller_source_code",
"entity_classification",
"entity_summarization",
"event",
"experimental",
"forum_category",
Expand Down Expand Up @@ -4418,6 +4435,32 @@
],
"title": "CredentialActionTarget"
},
"CredentialEventData": {
"properties": {
"identity_name": {
"type": "string",
"title": "Identity Name",
"description": "The email or username associated with the credential."
},
"credential_hash": {
"type": "string",
"title": "Credential Hash",
"description": "A hash uniquely identifying the credential."
},
"tenant_integration_id": {
"type": "string",
"title": "Tenant Integration Id",
"description": "The UUID of the tenant's IdP integration that validated the credential."
}
},
"type": "object",
"required": [
"identity_name",
"credential_hash",
"tenant_integration_id"
],
"title": "CredentialEventData"
},
"CredentialsData": {
"properties": {
"type": {
Expand Down Expand Up @@ -7192,6 +7235,28 @@
],
"title": "IntelType"
},
"InvalidCredentialEvent": {
"properties": {
"event_type": {
"type": "string",
"const": "invalid_credential",
"title": "Event Type",
"default": "invalid_credential"
},
"metadata": {
"$ref": "#/components/schemas/EventMetadata"
},
"data": {
"$ref": "#/components/schemas/CredentialEventData"
}
},
"type": "object",
"required": [
"metadata",
"data"
],
"title": "Invalid Credential"
},
"IpQuery": {
"properties": {
"type": {
Expand Down Expand Up @@ -7274,6 +7339,80 @@
],
"title": "Language"
},
"LeakedCredentialEvent": {
"properties": {
"event_type": {
"type": "string",
"const": "leaked_credential",
"title": "Event Type",
"default": "leaked_credential"
},
"metadata": {
"$ref": "#/components/schemas/EventMetadata"
},
"data": {
"$ref": "#/components/schemas/LeakedCredentialEventData"
}
},
"type": "object",
"required": [
"metadata",
"data"
],
"title": "Leaked Credential"
},
"LeakedCredentialEventData": {
"properties": {
"identity_name": {
"type": "string",
"title": "Identity Name",
"description": "The email or username associated with the leaked credential."
},
"imported_at": {
"type": "string",
"format": "date-time",
"title": "Imported At",
"description": "When the credential was imported into Flare."
},
"password": {
"type": "string",
"title": "Password",
"description": "The leaked password, or its hash if not available in cleartext."
},
"source": {
"$ref": "#/components/schemas/LeakedCredentialEventSource",
"description": "The source the credential was leaked from."
}
},
"type": "object",
"required": [
"identity_name",
"imported_at",
"password",
"source"
],
"title": "LeakedCredentialEventData"
},
"LeakedCredentialEventSource": {
"properties": {
"id": {
"type": "string",
"title": "Id",
"description": "The identifier of the leak source category."
},
"name": {
"type": "string",
"title": "Name",
"description": "The name of the leak source category."
}
},
"type": "object",
"required": [
"id",
"name"
],
"title": "LeakedCredentialEventSource"
},
"LeakedCredentialsBulkActionType": {
"type": "string",
"enum": [
Expand Down Expand Up @@ -7701,6 +7840,60 @@
],
"title": "MatchingPolicyType"
},
"MitigatedCredentialEvent": {
"properties": {
"event_type": {
"type": "string",
"const": "mitigated_credential",
"title": "Event Type",
"default": "mitigated_credential"
},
"metadata": {
"$ref": "#/components/schemas/EventMetadata"
},
"data": {
"$ref": "#/components/schemas/MitigatedCredentialEventData"
}
},
"type": "object",
"required": [
"metadata",
"data"
],
"title": "Mitigated Credential"
},
"MitigatedCredentialEventData": {
"properties": {
"identity_name": {
"type": "string",
"title": "Identity Name",
"description": "The email or username associated with the credential."
},
"credential_hash": {
"type": "string",
"title": "Credential Hash",
"description": "A hash uniquely identifying the credential."
},
"tenant_integration_id": {
"type": "string",
"title": "Tenant Integration Id",
"description": "The UUID of the tenant's IdP integration that validated the credential."
},
"mitigation_action": {
"type": "string",
"title": "Mitigation Action",
"description": "The action the tenant's IdP integration took to mitigate the credential"
}
},
"type": "object",
"required": [
"identity_name",
"credential_hash",
"tenant_integration_id",
"mitigation_action"
],
"title": "MitigatedCredentialEventData"
},
"NameData": {
"properties": {
"type": {
Expand Down Expand Up @@ -9892,6 +10085,34 @@
],
"title": "SubdomainTag"
},
"Tag": {
"properties": {
"name": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Name"
},
"repository_name": {
"anyOf": [
{
"type": "string"
},
{
"type": "null"
}
],
"title": "Repository Name"
}
},
"type": "object",
"title": "Tag"
},
"TenantMetadataResponse": {
"properties": {
"uid": {
Expand Down Expand Up @@ -10134,6 +10355,28 @@
],
"title": "UsernameQuery"
},
"ValidCredentialEvent": {
"properties": {
"event_type": {
"type": "string",
"const": "valid_credential",
"title": "Event Type",
"default": "valid_credential"
},
"metadata": {
"$ref": "#/components/schemas/EventMetadata"
},
"data": {
"$ref": "#/components/schemas/CredentialEventData"
}
},
"type": "object",
"required": [
"metadata",
"data"
],
"title": "Valid Credential"
},
"ValidationError": {
"properties": {
"loc": {
Expand Down
8 changes: 6 additions & 2 deletions docs/docs.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -328,11 +328,15 @@
"event-types-v2/chat-message",
"event-types-v2/domain",
"event-types-v2/forum-post",
"event-types-v2/invalid-credential",
"event-types-v2/leaked-credential",
"event-types-v2/listing",
"event-types-v2/mitigated-credential",
"event-types-v2/paste",
"event-types-v2/ransom-leak",
"event-types-v2/social-media-account",
"event-types-v2/stealer-log"
"event-types-v2/stealer-log",
"event-types-v2/valid-credential"
]
}
]
Expand Down Expand Up @@ -622,4 +626,4 @@
"destination": "/api-reference/v2/endpoints/identifiers/get-fireworkv2assetsgroups-feed"
}
]
}
}
9 changes: 9 additions & 0 deletions docs/event-types-v2/invalid-credential.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
---
title: "Invalid Credential"
---

import InvalidCredentialExample from '/snippets/event_model_examples/invalid_credential.mdx'

The `invalid_credential` type represents a leaked credential that was checked against the tenant's identity provider integration, such as Microsoft Entra ID, and confirmed to to be invalid.

<InvalidCredentialExample />
9 changes: 9 additions & 0 deletions docs/event-types-v2/leaked-credential.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
---
title: "Leaked Credential"
---

import LeakedCredentialExample from '/snippets/event_model_examples/leaked_credential.mdx'

The `leaked_credential` type represents a single leaked identity and password pair, collected from sources such as breaches and combolists circulating on illicit networks.

<LeakedCredentialExample />
9 changes: 9 additions & 0 deletions docs/event-types-v2/mitigated-credential.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
---
title: "Mitigated Credential"
---

import MitigatedCredentialExample from '/snippets/event_model_examples/mitigated_credential.mdx'

The `mitigated_credential` type represents a compromised credential for which a mitigation action, such as disabling the account or revoking its sessions, was performed through the tenant's identity provider integration.

<MitigatedCredentialExample />
5 changes: 5 additions & 0 deletions docs/event-types-v2/overview.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,15 @@ Currently these event type models are supported on the
| `blog_post` | [Blog Post <Icon icon="book" size={16} />](/event-types-v2/blog-post) |
| `bucket` | [Bucket <Icon icon="book" size={16} />](/event-types-v2/bucket) |
| `chat_message` | [Chat Message <Icon icon="book" size={16} />](/event-types-v2/chat-message) |
| `credit_card` | [Chat Message <Icon icon="book" size={16} />](/event-types-v2/chat-message) |
| `document` | [Ransomleak (document) <Icon icon="book" size={16} />](/event-types-v2/ransom-leak) |
| `domain` | [Lookalike Domain (domain) <Icon icon="book" size={16} />](/event-types-v2/domain) |
| `forum_post` | [Forum Post & Topic <Icon icon="book" size={16} />](/event-types-v2/forum-post) |
| `invalid_credential` | [Invalid Credential <Icon icon="book" size={16} />](/event-types-v2/invalid-credential) |
| `leaked_credential` | [Leaked Credential <Icon icon="book" size={16} />](/event-types-v2/leaked-credential) |
| `listing` | [Listing <Icon icon="book" size={16} />](/event-types-v2/listing) |
| `mitigated_credential` | [Mitigated Credential <Icon icon="book" size={16} />](/event-types-v2/mitigated-credential) |
| `paste` | [Paste <Icon icon="book" size={16} />](/event-types-v2/paste) |
| `stealer_log` | [Stealer Log <Icon icon="book" size={16} />](/event-types-v2/stealer-log) |
| `social_media` | [Social media <Icon icon="book" size={16} />](/event-types-v2/social-media-account) |
| `valid_credential` | [Valid Credential <Icon icon="book" size={16} />](/event-types-v2/valid-credential) |
Loading
Loading