An Excluded Keyword policy removes events from the identifier's feed when they contain at least one of the specified keywords.

How it works: When you use an Excluded Keyword policy with keywords like keyword1 and keyword2, any event mentioning either of those terms will be excluded from the identifier's feed.

In Lucene query terms, this is equivalent to: AND NOT (keyword1 OR keyword2)

Configuration details: Add one or more keywords when creating the policy. Each policy supports multiple comma-separated keywords, up to a maximum of 50.

Use case examples:

Relationship to legacy Ignore Terms: If you previously used identifier-level ignore terms, they have been automatically migrated to Excluded Keyword policies. The behavior is identical.

Only events that match a configured search query will appear in the Identifier's feed. This policy type uses Flare's Lucene query syntax, allowing to target any searchable field within Flare's data models.

A Lucene Query policy applies a full search query as a filter. Only events matching the query will appear in the Identifier's feed.

How it works: Write a Lucene-syntax search query, and the identifier feed is filtered to show only events matching that query. This gives you the full power of query-based filtering for complex or highly specific scenarios, with faster results than a Query Identifier.

When to use:

Example 1: A domain Identifier for example.com should only show leaked credential events that include a URL. The Lucene Query Policy would be: _exists_:urls

Example 2: You want to exclude all events before a specific date. The policy query would be: metadata.estimated_created_at:[2026-01-01 TO *]

If you are already familiar with Flare's search syntax, writing Lucene Query Policies will feel natural. The same operators, field names, and syntax rules apply. For additional guidance regarding building Matching Policies with queries, see: Build Lucene Query PoliciesBuilding Lucene Query Policies.

A Lookalike Domain Strategies policy controls which lookalike domains appear in a domain Identifier's feed, based on the permutation strategy used to detect them.

How it works: Each Lookalike domain is detected through a permutation strategy, such as a removed character or a homoglyph substitution. When this policy is assigned to a domain Identifier, only lookalike domains detected with at least one of the selected strategies appear in the feed. All strategies are selected by default.

Configuration: Select one or more of the available strategies, or select all strategies to include all detected lookalike domains. For more information on each strategy, see Permutation strategies Permutation Strategies.

When to use:

Important: A Lookalike Domain Strategies policy is restrictive by design. Deselecting a strategy filters out every lookalike domain detected only through it, including potential threats. Review all Permutation strategiesPermutation Strategies before deselecting a strategy.