Payload Schema - FalconFeeds

New Threat Feed Event

Triggered when a new threat feed post is published.

{
  "eventType": "string",
  "eventTriggeredAt": "string",
  "data": {
    "uuid": "string",
    "title": "string",
    "content": "string",
    "category": "string",
    "threatActors": [
      {
        "uuid": "string",
        "name": "string",
        "description": "string"
      }
    ],
    "network": "string",
    "victims": [
      {
        "type": "string",
        "values": ["string"]
      }
    ],
    "screenshotLinks": ["string"], // omitted when no screenshots
    "maskedScreenshotLinks": ["string"], // omitted when no masked screenshots
    "publishedTimestampInMilliseconds": "number",
    "publishedURL": "string",
    "isReportedByVictim": "boolean",
    "isThreatActorClaimed": "boolean",
    "victimConfirmedPost": {
      "title": "string",
      "content": "string",
      "category": "string",
      "publishedAt": "string",
      "discoveredAt": "string",
      "sourceUrl": "string"
    }
  }
}

Field Reference

Field	Type	Description
`eventType`	`string`	Type of event. For threat feed webhooks this is always `NEW_POST`.
`eventTriggeredAt`	`string`	Timestamp of when the event was triggered, in UTC format.
`data`	`object`	Object containing full details of the new threat feed post.
`data.uuid`	`string`	Unique identifier for the post.
`data.title`	`string`	Title of the post.
`data.content`	`string`	Content body of the post.
`data.category`	`string`	Category of the post (e.g. `ransomware`, `data-breach`).
`data.threatActors`	`array \| null`	Threat actors associated with this post. `null` when none are linked.
`data.threatActors[].uuid`	`string`	Unique identifier for the threat actor.
`data.threatActors[].name`	`string`	Name of the threat actor.
`data.threatActors[].description`	`string`	Description of the threat actor.
`data.network`	`string`	Network on which the post was published (e.g. `TOR`).
`data.victims`	`array \| null`	Victim details categorised by type. `null` when no victims are identified.
`data.victims[].type`	`string`	Victim category type (`Organization`, `Industry`, `Country`, `Site`).
`data.victims[].values`	`array`	List of victim values for the given type.
`data.screenshotLinks`	`array`	URLs to screenshot images. Omitted when empty.
`data.maskedScreenshotLinks`	`array`	URLs to masked/redacted screenshot images. Omitted when empty.
`data.publishedTimestampInMilliseconds`	`number`	Timestamp of when the post was published, in milliseconds. Defaults to `0` when unavailable.
`data.publishedURL`	`string`	Source URL of the published post.
`data.isReportedByVictim`	`boolean`	Whether the victim has officially reported the incident.
`data.isThreatActorClaimed`	`boolean`	Whether a threat actor has claimed responsibility for the post.
`data.victimConfirmedPost`	`object \| null`	Victim’s official confirmation post details, if available. `null` when not confirmed.
`data.victimConfirmedPost.title`	`string`	Title of the victim’s confirmation post.
`data.victimConfirmedPost.content`	`string`	Content of the victim’s confirmation post.
`data.victimConfirmedPost.category`	`string`	Category of the victim’s confirmation post.
`data.victimConfirmedPost.publishedAt`	`string`	Timestamp of when the victim published the confirmation, in UTC format.
`data.victimConfirmedPost.discoveredAt`	`string`	Timestamp of when the confirmation was discovered, in UTC format.
`data.victimConfirmedPost.sourceUrl`	`string`	URL to the victim’s confirmation source.