---
title: Actor Intelligence
slug: actor-intelligence
docTags: 
createdAt: 2025-07-30T14:16:38.113Z
---

## What is Actor Intelligence?

Actor Intelligence provides a centralized view of an actor observed within the Flare platform. It helps analysts investigate behavior patterns, assess risk, and pivot across relevant activity.

It's designed to support a range of security workflows such as threat actor investigations, behavioral trend analysis, false positive validation, and pivoting between events tied to the same actor.

## How Do I View Actor Intelligence?

Intelligence is accessible by clicking on any *underlined* actor name found within:

- **Event Cards**

:::hint{type="warning"}
⚠️ Important: Actors are scoped to the specific source and context in which they appear. Flare does not guarantee that a username or handle seen across multiple sources or platforms belongs to the same individual.


By default, all analysis is based on the Actor + Source combination from which you accessed the Intelligence. Proceed with caution when making cross-source attributions.
:::

## Tabs Overview

Actor Intelligence is organized into tabs. Each tab focuses on a different aspect of the actor's presence and behavior.

### Activity Tab

This tab provides a visual breakdown of the actor’s timeline, volume, and behavior across supported sources.

**Key Sections**

- **Actor Metadata**: Shows the actor's source and the first and last observed timestamps.
- **Activity Breakdown**: A bar chart showing volume of posts or events over time. Filterable by category and date range. Annotated with first/last observed messages.
- **Most Recent Events**: A table view of the actor’s latest associated events, including:
  - `Date`
  - `Category` (e.g. forum\_topic, forum\_post, chat\_message)
  - `Source` (e.g. *kiwi\_farms*, telegram)
  - `Severity` (e.g. INFO, MEDIUM)
  - The **Direct link** to view the full event

### Activity Breakdown Chart

Visualizes the **volume of activity** over time (daily, weekly, or custom range). Helps identify spikes, drop-offs, or single-day bursts of activity.

![](https://api.archbee.com/api/optimize/c3rdtVdXd3RrWUDgyZZoG-gbdqnD_W_P_1RY8ca-6Ax-20250814-181313.png)

- Filterable by category and date range
- Annotated with first/last observed messages

***

### Analysis Tab

This tab provides deeper insight into the actor's behavior, intent, and communication style. It is available for both forum-based and chat-based (e.g. Telegram) actors.

**Key Sections**

**Analysis Metadata:** Displays the timeframe covered by the analysis and the number of events included.

**Profile Summary:** Provides insight into the actor's behavior, tone, and intent based on their observed posts or messages.

- **Overview:** Displays the actor's handle and associated source. Activity is analyzed per actor + source combination.
- **Main Activities & Motives:** Describes the primary themes discussed by the actor and their recurring topics of interest. Outlines the actor's likely motivation — whether financial, ideological, social, or curiosity-driven — and helps assess whether the actor poses a credible threat.
- **Potential Associations:** Indicates whether there is any observed association with known threat groups, malware families, or criminal services. If no affiliations are detected, that is explicitly stated.

![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/3uOHMC6sPH1Xh4jgZFHkJ-20260205-205312.png)

***

### Weekly Discussion Heatmap

Displays posting behavior by hour and weekday. Analysts can toggle between timezones to normalize patterns across geographies. Darker blocks indicate higher message frequency.

- Helps assess timezone alignment, shift-based activity, or consistency
- Analysts can toggle timezones to normalize patterns across geographies
- Darker blocks = higher message frequency

**Post Analysis:** Interprets the actor's behavioral cadence, including:

- Peak activity windows and most active days/hours
- Timezone inference based on observed peaks, with candidate timezones and confidence levels
- Activity volume over time, including seasonal trends and escalation patterns
- Weekday vs. weekend distribution

![](https://api.archbee.com/api/optimize/c3rdtVdXd3RrWUDgyZZoG-BhvS0k04HOXcC0Cn2siao-20250814-181135.png)

### Network Tab

We have detailed documentation for the Network tab [here](docId\:aIRW6PqL9vcWXCJSYdslH).