What We Are Working On

welcome to our "what we're working on" page—a behind the scenes look at the exciting projects and improvements we’re building to enhance your flare experience here, you’ll find insights into our current initiatives, the context behind them, and what you can expect in the near future we’re sharing these updates to keep you informed, gather your feedback, and invite you to collaborate with us as we shape the future of flare important note while the goals described below are certain, the definite form and capabilities of the features delivered are subject to change reach out to our support team if you'd like more information looking ahead into q3 2026 as we continue to innovate and address your most pressing needs, here are some of the longer term projects we’re prioritizing in the coming quarter these initiatives are designed to improve workflows, expand data coverage, and deliver a more seamless experience with flare update events for chats and ransom leaks development on this feature is currently paused and will be resumed soon threat actors rarely publish everything at once a chat message may gain attachments after it first appears, and a ransomware post may add file listings well after the initial leak update events will capture this activity as it happens, so you can see how an exposure evolves over time rather than only its first appearance new events will be triggered by updates to previously ingested parent events, when a new attachment is added to a chat event a new file listing is added to a ransom leak event each update will surface a new event in the events feed, linked back to its parent event so the full context stays available because update events will carry their own metadata, they can be scored, filtered, and actioned independently of the parent this lets a high risk attachment or file listing stand out on its own rather than being diluted by the parent message or post extended lookalike domain monitoring this feature has been released see extended lookalike domain monitoring docid\ xbvmqdlrug836wqnsyb6l for more information we’re upgrading our lookalike domain and impersonation offering to provide more comprehensive protection against lookalike domains by moving beyond basic url matching to include visual similarity detection, we’ll expand our reach to catch even the most deceptive spoofs each lead will be enriched with deep metadata, such as mx records and whois data, to give you a clearer picture of the threat landscape coupled with new triage workflows and monitoring tools, these improvements will allow your team to prioritize, track, and neutralize brand threats with greater speed and precision a new lookalike domains browser will provide a per domain view of the lookalike domains detected for your organization, so you can browse, sort, filter, and search every detected domain, open a consolidated profile for any one of them, and act by viewing a site in the sandbox or submitting a takedown request update events for lookalike domains will appear in the events feed when changes are detected, surfacing changes to a detected domain over time rather than just the initial detection extended coverage will be added with datapulse and visual similarity detection with urlscan, along with greater enrichment for detecting changes like mx records and whois flare native sandboxing we’re bringing sandboxing directly into flare by providing fully integrated, flare native sandboxing experience that delivers powerful file analysis, enriched intelligence, and tighter investigative workflows no external tools required identity exposure management next steps we will be expanding common asked functionality like bulk password validation to allow an identifier to be able to evaluate all passwords they have seen on the dark web additionally we will be integrating additional idps such as okta lastly, we will provide posture management checks to understand common idp risks associated with your identities actor intelligence for telegram actor intelligence is expanding to telegram while our actor and forum thread analysis already gives you deep insight into threat actors across dark web forums, telegram has remained a blind spot soon, you'll be able to run comprehensive threat assessments on telegram actors see every channel they've been active on, track how engaged they are, monitor display name changes over time, identify potential victims, and map their relationships to other actors, all without switching tools or hunting across sources intelligence browser this feature has been released see intelligence browser docid 05uqcn5rinzdxddsrktmy for more information the intelligence browser brings all of flare's threat intelligence into one searchable catalog actors, forum threads, and soon other entities like iocs, all instantly discoverable no third party tools no complex integrations, just fast, frictionless access to the context you need click and pivot into any entity for a full breakdown activity history, in depth analysis, and relationships to other entities it's threat research without the friction, built for analysts who need answers fast customizable severity rules this feature has been released see severity rules docid\ ltsdxtp9ncx7 fohtdsmk for more information what's critical for one organization may be noise for another customizable scoring policies will give you direct control over how events are prioritized, letting you define severity levels based on what is important to you built on the same foundation as matching policies https //docs flare io/matching policies for identifiers , this feature is designed to reduce alert fatigue, improve analyst trust in the feed, and make flare feel purpose built for your context your feedback matters we’re excited about what’s ahead and look forward to your input as we shape these initiatives your insights and feedback are essential in helping us refine these projects to meet your needs and expectations stay tuned for updates and opportunities to participate in the development process!