--- title: Events slug: events description: Learn how Flare's Events feature allows you to effortlessly collect and view data based on Identifiers. Dive into detailed reports summarizing the collected data for individual Identifiers or groups. Take advantage of various actions like marking events a docTags: createdAt: 2023-09-29T19:02:38.656Z --- Events represent malicious activity surfaced for the assets you monitor across the clear and dark web and other illicit data sources. Each Event is where investigation of a potential threat begins, giving you a structured starting point to detect, investigate, and respond. All Events collected by Flare make up the Events Feed, which is organized into two views: - **Tenant Feed:** This shows the Events that match your Identifiers, such as a domain, IP address, or keyword. For more information, see [The Tenant Feed](docId\:DtLs7NX5g-qWOdcS3YdPD). - **Global Search:** This covers every collected Event and lets you search across all of them, including those that do not match your Identifiers. For more information, see [Global Search](docId\:duvcX_VwNIAJEylLLrnI0). ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/SizFTJ_SGONQGpCGpN9RH_image.png) Each Event brings together the context you need to assess and prioritize it, so you can fully understand a potential threat. An Event provides the following information: - **What was found:** The nature of the exposure, along with supporting details such as the indicator, file, URL, domain, or port involved, and a preview of the raw content. - **Where it was found**: The source or location the Event was collected from. - **Who is involved**: Who is affected, such as your organization, a third party, or an employee, and the actor or author responsible for the activity. - **When it was collected**: The date the data was ingested and matched to your Tenant. - **Why it matters**: Its Severity and the potential impact on your organization. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/RP_WgCdBIR2skwKd7d-9R_5ws-for-events.png) *** ## The Events Feed Walkthrough The new Events Feed has been re-architected to give you the full context behind every threat event in one place, so you can investigate faster and protect your organization with confidence. Click through the following demo to learn how to use the new Events Feed. :::Iframe{iframeHeight="0" code="
Flare has re-architected its Events Feed to consolidate threat event context in one place. The new feed replaces the old one permanently on November 15th, with the option to revert to the previous version until that date. The feed supports per-event display customization, such as toggling the content preview and creation date fields on or off. Each event includes a preview tab that summarizes what was found, where it was discovered, and the responsible party. An example shown is a keyword match on RaidForums related to the 2024 NPD breach. Clicking an event opens its full card with complete details. A new Recent bar tracks events opened during an investigation session, allowing quick navigation between related items. Hovering over an actor's handle displays a preview of intelligence Flare has collected on that actor. Clicking the handle adds the actor profile to the Recent bar and shows additional details about the actor's activity history and context. The workflow demonstrated follows an investigation from a RaidForums keyword match through to the original stealer log event containing credentials linked to the NPD breach, using the Recent bar to pivot between related events during the investigation.
"} ::: :::hint{type="info"} Click the **Try the New Events **toggle to switch to the new layout, and use the **Give Feedback **button to share your thoughts. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/JflFafxj0N8xjA08kxOge_image.png" size="50" isUploading="false" width="462" height="76" darkWidth="462" darkHeight="76" position="flex-start" showCaption="false"} Toggle back to the old layout anytime until **November 23rd**, when the new feed becomes permanent.  ::: *** # The Tenant Feed Events are matched to your Tenant Feed through the Identifiers configured in your Tenants. As data sources are scanned continuously, an Event is matched whenever collected data matches an Identifier's parameters. Common triggers include: - Leaked data, such as credentials or internal documents - Vulnerability detections on exposed infrastructure - Brand impersonation, such as Lookalike domains, or mentions on illicit forums - Exposed identities, including credentials, active sessions, and personally identifiable information (PII) Each row in the Tenant Feed is one Event and shows the name, the Identifier the Event is matched to, the source the Event was collected from, and the date the Event was matched to your Tenant Feed. ## Viewing Event Details There are two ways to view the details of an Event, expand it inline, or open the details panel. :::Heading{depth="3" indent="1"} Expand an Event Inline ::: :::Paragraph{indent="1"} Click the expand icon :inlineImage[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/BIFAKqVJQ8c_yRtrlW6hE_expand-icon.png" alt caption width="52" height="52"} for an event to reveal a summary of its context directly in the feed, organized into the following sections: ::: ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/9OeWnoN65D1dfSy3xXaMW_image.png" size="100" isUploading="false" width="1704" height="320" darkWidth="1704" darkHeight="320" showCaption="false" indent="1"} - **What was found?** describes what the Event contains, with a **Content Preview** of the full Event content beneath it. - **Where was this found?** shows where the Event was collected, such as the room or source, as a link. - **Who did this?** shows the responsible entity, such as the actor or author, as a link. :::hint{type="info" indent="1"} **Tip:** Click the Expand All icon to expand all Events in the feed all together. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/mqA8HplbeoksV4htikTi4_image.png" size="50" isUploading="false" width="602" height="136" darkWidth="602" darkHeight="136" position="flex-start" showCaption="false"} ::: :::Heading{depth="3" indent="1"} Open the Details Panel ::: :::Paragraph{indent="1"} Click an Event to open the details panel on the right and view complete Event data. The tabs available for an event depend on its type. Summary, Content, Secrets, AI Assist, and Advanced are available for most events. Other tabs appear only when they apply. For example, Leaked Files appear for ransomware events, and Takedown for events eligible for a takedown request. ::: ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/YmNRTsyumXj92S7zaB14P_image.png" size="100" isUploading="false" width="2092" height="1316" darkWidth="2092" darkHeight="1316" showCaption="false" indent="1"} :::hint{type="info"} **Threat Cards** Entities within an Event, such as the actor or author and other surfaced objects, are shown as links that lead to further context. Where available, hovering over an entity displays a Threat Card showing quick information about that entity. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/YrTIDKp1q7NZdwsjyDizU_image.png" size="90" isUploading="false" width="1252" height="662" darkWidth="1252" darkHeight="662" position="flex-start" showCaption="false"} ::: *** # Event Actions You can act on an Event from the **Actions** column in the feed and from the **Actions** menu in the details panel. The Actions column in the Tenant Feed provides access to quick actions on each row. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/FIc_8Th68ztgZtSChukxb_image.png" size="80" isUploading="false" width="840" height="374" darkWidth="840" darkHeight="374" position="flex-start" showCaption="false"} The Actions menu in the details panel provides a full set of actions for the Event. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/JZY466JT13mfYiRoZqDmV_image.png" size="90" isUploading="false" width="1026" height="346" darkWidth="1026" darkHeight="346" position="flex-start" showCaption="false"} ## Sharing an Event The share option copies a shareable link to the Event to your clipboard. You can then share this link with a stakeholder. When they open it, they are routed to the correct Tenant context and the Event opens directly, without needing to search for it or navigate the feed manually. This is useful when you need to flag an Event for review, escalate findings, or collaborate on a response. ## Marking Events as Remediated When you have taken action to address an Event, mark it as remediated so that it is hidden from the feed. To restore visibility of remediated Events, choose the remediated option in the **Status** filter. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/Yr28G36wEgn2zGVI1XlVM_image.png" size="60" isUploading="false" width="712" height="690" darkWidth="712" darkHeight="690" position="flex-start" showCaption="false"} ## Ignoring Events Ignoring an Event excludes it from your feeds. To view all ignored Events, choose the **Ignored** option in the **Status** filter. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/jzdyDevk_TapRZd10t9YM_image.png" size="60" isUploading="false" width="668" height="700" darkWidth="668" darkHeight="700" position="flex-start" showCaption="false"} :::hint{type="info"} **Changes to the Events Feed** An Event that was previously remediated or ignored will not reappear in the feed in most cases, unless a difference in its content is detected. Some Event types have particular behaviors, as described below. - **Infected Devices (stealer logs):** A previously matched stealer log can reappear when a new source reposts the original stealer log, or when a change is detected in the content of the stealer log, which is treated as a new Event. - **Open Web:** GitHub Events can reappear when the GitHub repository being queried changes. Because the entire page is queried again, the section that includes your Identifier can appear again alongside the parts that changed. For GitHub, you can use ignore term policies to ignore specific GitHub authors and projects. See Policies. - **Leaked Credentials:** - When you remediate a Leaked Credential Event in the feed, or a credential item in the Credentials Browser, future instances of the same credential pair appear as remediated in both places and are filtered out of the default view. - The severity of a remediated Leaked Credential Event is lowered if it reappears. - When you ignore a Leaked Credential Event in the feed, or a credential item in the Credentials Browser, future credentials related to the same email or username are ignored as well, in both the Tenant Feed and the Credentials Browser. ::: *** ## Adjusting Severity, Tags, and Notes You can manually adjust change an Event's severity and add any relevant tags and notes from the details panel. Open the Event, then edit its **Severity**, **Tags**, and **Notes** in the **Summary** tab. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/FaBX1jSAJvVaxZEhqBmVY_image.png" size="90" isUploading="false" width="1032" height="688" darkWidth="1032" darkHeight="688" position="flex-start" showCaption="false"} *** ## Searching and Filtering Events The search bar at the top of the Events page searches within Flare's existing data. Use the **Tenant** selector to the left of the search field to choose which Tenant to search, then enter a query in the **Search in existing data** field. ![](https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/6oAGNfhbCO_yni6KvL0Ge_image.png) Refine results using the filters below the search bar: - **Status** controls whether new, remediated, and ignored Events are shown. - **Creation Date** sets the date range of the Events shown. - **Severity** sets which severity levels are shown. - **Categories** sets which Event categories are shown. - **Tags** filters by the tags applied to Events. - **Attributes** filters by Event attributes. The active filter count and the **Clear** button appear below the filters. Click **Clear** to remove all active filters. Above the results, you can set **Sort by** to change the order of the feed, set **Display** to change how many Events appear per page, and click **Export events** to export the current results. ## Exporting Events To export your Events, click **Export events** from the Tenant Feed. The basic export includes all metadata and a content preview. Exporting the full content of Events increases the size of the export and should be utilized as needed. ::Image[]{src="https://api.archbee.com/api/optimize/wtmLmyh6YG71yn5qVtkMM/4fwr7Lh187dl82kJ7iW0Q_image.png" size="90" isUploading="false" width="1104" height="344" darkWidth="1104" darkHeight="344" position="flex-start" showCaption="false"}