Actor Intelligence

what is actor intelligence? actor intelligence provides a centralized view of an actor observed within the flare platform it helps analysts investigate behavior patterns, assess risk, and pivot across relevant activity it's designed to support a range of security workflows such as threat actor investigations, behavioral trend analysis, false positive validation, and pivoting between events tied to the same actor how do i view actor intelligence? intelligence is accessible by clicking on any underlined actor name found within event cards ⚠️ important actors are scoped to the specific source and context in which they appear flare does not guarantee that a username or handle seen across multiple sources or platforms belongs to the same individual by default, all analysis is based on the actor + source combination from which you accessed the intelligence proceed with caution when making cross source attributions tabs overview actor intelligence is organized into tabs each tab focuses on a different aspect of the actor's presence and behavior activity tab this tab provides a visual breakdown of the actor’s timeline, volume, and behavior across supported sources key sections actor metadata shows the actor's source and the first and last observed timestamps activity breakdown a bar chart showing volume of posts or events over time filterable by category and date range annotated with first/last observed messages most recent events a table view of the actor’s latest associated events, including date category (e g forum topic, forum post, chat message) source (e g kiwi farms , telegram) severity (e g info, medium) the direct link to view the full event activity breakdown chart visualizes the volume of activity over time (daily, weekly, or custom range) helps identify spikes, drop offs, or single day bursts of activity filterable by category and date range annotated with first/last observed messages analysis tab this tab provides deeper insight into the actor's behavior, intent, and communication style it is available for both forum based and chat based (e g telegram) actors key sections analysis metadata displays the timeframe covered by the analysis and the number of events included profile summary provides insight into the actor's behavior, tone, and intent based on their observed posts or messages overview displays the actor's handle and associated source activity is analyzed per actor + source combination main activities & motives describes the primary themes discussed by the actor and their recurring topics of interest outlines the actor's likely motivation — whether financial, ideological, social, or curiosity driven — and helps assess whether the actor poses a credible threat potential associations indicates whether there is any observed association with known threat groups, malware families, or criminal services if no affiliations are detected, that is explicitly stated weekly discussion heatmap displays posting behavior by hour and weekday analysts can toggle between timezones to normalize patterns across geographies darker blocks indicate higher message frequency helps assess timezone alignment, shift based activity, or consistency analysts can toggle timezones to normalize patterns across geographies darker blocks = higher message frequency post analysis interprets the actor's behavioral cadence, including peak activity windows and most active days/hours timezone inference based on observed peaks, with candidate timezones and confidence levels activity volume over time, including seasonal trends and escalation patterns weekday vs weekend distribution network tab we have detailed documentation for the network tab docid\ airw6pql9vcwxcjsydslh