Chats and Forum Posts
Chats
Chat events are messages ingested from encrypted and semi-public messaging platforms, primarily Telegram and ICQ, where threat actors coordinate in real time. This sub-category captures stealer log distribution, initial access brokering, and service advertisements, often providing earlier warning than a corresponding marketplace listing.
Updates to Chat Events
(Coming soon)
Chat events can contain attachments which are files shared directly within a chat message, commonly used by threat actors to distribute malware, stealer logs, or stolen data. Each attachment added after the parent event is ingested is treated as a new event.
For example, a single chat message where an attachment was added after the parent event, will have two events in the Events feed. One for the main event and one for when an attachment was added. Each attachment event carries its own metadata and can be scored, filtered, and actioned independently.
This affects two areas of your workflow:
- Precise analysis: Each attachment is evaluated on its own characteristics, so a high-risk file is not diluted by a low-risk message, or the reverse.
- Accurate searching: Attachments matching specific criteria can be found directly, without false matches from the parent chat message.
Attachment events and their parent chat message are linked through the Associated Events section in the event summary, allowing you to navigate between the two and see the full context of what was shared.
Learn more about ChatsLearn more about Chats
Accessing Events via API
The chat_message search type returns both the chat_message and attachment events. If you consume Flare data programmatically, it is recommended to review any downstream automation, SIEM rules, or ticketing workflows that consume this event type.
Forum Posts
Underground forums are spaces where threat actors discuss, collaborate, and advertise, covering topics ranging from hacking and fraud to data breach announcements and initial access brokering. Each event includes the message body, author alias, thread context, and extracted indicators. Forums are often where deals are struck before they surface on marketplaces.
Learn more about Forum PostsLearn more about Forum Posts
Labels in Chat Messages and Forum Posts
Flare collects a large volume of forum and chat activity, and a single mention of your organization can mean very different things: a data breach offered for sale, a fraud scheme, or simply a passing reference in an unrelated conversation. To help you tell these apart, the forum threads and chat channels are analyzed and labels are assigned which describe what the conversation is about and what its author is trying to do.
explaining what these labels are, how to search for them, and how to use them in Severity Rules and Matching Policies to prioritize the events that matter most to you.
