User Guide
Synapse-Twitter User Guide
Synapse-Twitter adds new Storm commands to allow you to query the Twitter v2 API using your existing API Bearer token. In certain specific cases the v1.1 API is used until Twitter ports the functionality over to their v2 API.
Getting Started
Check with your Admin to enable permissions and find out if you need a personal Bearer Token or personal OAuth keys.
Examples
Setting your personal API key
To set-up a personal use Bearer Token:
> twitter.setup.apikey --self myapikey
Setting Synapse-Twitter API key for the current user.
Fetching User Profiles
Fetch a user profile from twitter:
> [inet:web:acct=(twitter.com, invisig0th)] | twitter.user.profile
inet:web:acct=twitter.com/invisig0th
.created = 2024/04/22 20:06:53.784
:name = visi
:signup = 2009/04/12 21:22:36.000
:site = twitter.com
:tagline = Founder @vtxproject
Father of the #APT1 Report @mandiant / @fireeye
Inventor of synapse, vivisect, UNCs, imphash, ...
DEFCON CTF Champion, Founder of Kenshoto
:user = invisig0th
:webpage = http://vertex.link/
Fetch a user profile without first creating a new node:
> twitter.user.profile --user vpEpiphyte
inet:web:acct=twitter.com/vpepiphyte
.created = 2024/04/22 20:06:54.048
:name = epiphyte
:signup = 2017/08/19 14:04:50.000
:site = twitter.com
:tagline = I pick up rocks and look underneath them
:user = vpepiphyte
Fetching Followers and Followings
Fetch an existing user’s followers:
> inet:web:acct=(twitter.com, invisig0th) | twitter.user.followers --size 3 --yield
inet:web:follows=('twitter.com/cybersecdad2014', 'twitter.com/invisig0th')
.created = 2024/04/22 20:06:54.334
:followee = twitter.com/invisig0th
:follower = twitter.com/cybersecdad2014
inet:web:follows=('twitter.com/nathan97832057', 'twitter.com/invisig0th')
.created = 2024/04/22 20:06:54.389
:followee = twitter.com/invisig0th
:follower = twitter.com/nathan97832057
inet:web:follows=('twitter.com/forewarnedyou', 'twitter.com/invisig0th')
.created = 2024/04/22 20:06:54.443
:followee = twitter.com/invisig0th
:follower = twitter.com/forewarnedyou
Add a new user and their followers:
> twitter.user.followers --user vtx_savage --size 5 --yield
inet:web:follows=('twitter.com/svcghost', 'twitter.com/vtx_savage')
.created = 2024/04/22 20:06:54.760
:followee = twitter.com/vtx_savage
:follower = twitter.com/svcghost
inet:web:follows=('twitter.com/secman_pl', 'twitter.com/vtx_savage')
.created = 2024/04/22 20:06:54.815
:followee = twitter.com/vtx_savage
:follower = twitter.com/secman_pl
inet:web:follows=('twitter.com/jonjon13131313', 'twitter.com/vtx_savage')
.created = 2024/04/22 20:06:54.869
:followee = twitter.com/vtx_savage
:follower = twitter.com/jonjon13131313
inet:web:follows=('twitter.com/malwaremayhem', 'twitter.com/vtx_savage')
.created = 2024/04/22 20:06:54.923
:followee = twitter.com/vtx_savage
:follower = twitter.com/malwaremayhem
inet:web:follows=('twitter.com/chompie1337', 'twitter.com/vtx_savage')
.created = 2024/04/22 20:06:54.977
:followee = twitter.com/vtx_savage
:follower = twitter.com/chompie1337
Get the profiles for the accounts a user is following:
> inet:web:acct=(twitter.com, invisig0th) | twitter.user.following --size 3 --yield
inet:web:follows=('twitter.com/invisig0th', 'twitter.com/oatmeal')
.created = 2024/04/22 20:06:55.197
:followee = twitter.com/oatmeal
:follower = twitter.com/invisig0th
inet:web:follows=('twitter.com/invisig0th', 'twitter.com/wesdrone')
.created = 2024/04/22 20:06:55.253
:followee = twitter.com/wesdrone
:follower = twitter.com/invisig0th
inet:web:follows=('twitter.com/invisig0th', 'twitter.com/cissp_googling')
.created = 2024/04/22 20:06:55.306
:followee = twitter.com/cissp_googling
:follower = twitter.com/invisig0th
Add a new user and who they’re following:
> twitter.user.following --user vpEpiphyte --yield
inet:web:follows=('twitter.com/vpepiphyte', 'twitter.com/iamdevloper')
.created = 2024/04/22 20:06:55.530
:followee = twitter.com/iamdevloper
:follower = twitter.com/vpepiphyte
inet:web:follows=('twitter.com/vpepiphyte', 'twitter.com/kdenizen')
.created = 2024/04/22 20:06:55.585
:followee = twitter.com/kdenizen
:follower = twitter.com/vpepiphyte
inet:web:follows=('twitter.com/vpepiphyte', 'twitter.com/virustotal')
.created = 2024/04/22 20:06:55.640
:followee = twitter.com/virustotal
:follower = twitter.com/vpepiphyte
inet:web:follows=('twitter.com/vpepiphyte', 'twitter.com/williballenthin')
.created = 2024/04/22 20:06:55.697
:followee = twitter.com/williballenthin
:follower = twitter.com/vpepiphyte
inet:web:follows=('twitter.com/vpepiphyte', 'twitter.com/danielhbohannon')
.created = 2024/04/22 20:06:55.753
:followee = twitter.com/danielhbohannon
:follower = twitter.com/vpepiphyte
inet:web:follows=('twitter.com/vpepiphyte', 'twitter.com/matthewdunwoody')
.created = 2024/04/22 20:06:55.809
:followee = twitter.com/matthewdunwoody
:follower = twitter.com/vpepiphyte
inet:web:follows=('twitter.com/vpepiphyte', 'twitter.com/itsreallynick')
.created = 2024/04/22 20:06:55.864
:followee = twitter.com/itsreallynick
:follower = twitter.com/vpepiphyte
inet:web:follows=('twitter.com/vpepiphyte', 'twitter.com/_mhastings_')
.created = 2024/04/22 20:06:55.920
:followee = twitter.com/_mhastings_
:follower = twitter.com/vpepiphyte
inet:web:follows=('twitter.com/vpepiphyte', 'twitter.com/ryankaz42')
.created = 2024/04/22 20:06:55.975
:followee = twitter.com/ryankaz42
:follower = twitter.com/vpepiphyte
inet:web:follows=('twitter.com/vpepiphyte', 'twitter.com/_devonkerr_')
.created = 2024/04/22 20:06:56.030
:followee = twitter.com/_devonkerr_
:follower = twitter.com/vpepiphyte
inet:web:follows=('twitter.com/vpepiphyte', 'twitter.com/cglyer')
.created = 2024/04/22 20:06:56.085
:followee = twitter.com/cglyer
:follower = twitter.com/vpepiphyte
inet:web:follows=('twitter.com/vpepiphyte', 'twitter.com/vtxproject')
.created = 2024/04/22 20:06:56.139
:followee = twitter.com/vtxproject
:follower = twitter.com/vpepiphyte
inet:web:follows=('twitter.com/vpepiphyte', 'twitter.com/invisig0th')
.created = 2024/04/22 20:06:56.196
:followee = twitter.com/invisig0th
:follower = twitter.com/vpepiphyte
Fetching Tweets
Fetch a single user’s most recent tweets:
> inet:web:acct=(twitter.com, invisig0th) | twitter.user.tweets --size 3 --yield
WARNING: User has been suspended: [absoIute_units].
inet:web:post=5d5f0577cf52fcbe6263cc06b5bc4496
.created = 2024/04/22 20:06:56.443
:acct = twitter.com/invisig0th
:acct:site = twitter.com
:acct:user = invisig0th
:hashtags =
:mentions:users = twitter.com/vtxproject,twitter.com/wgibb
:text = RT @wgibb: @vtxproject spotted in the wild, analyzing geological formations. We can capture the knowledge of people going to specific place…
:time = 2021/08/17 18:30:29.000
:url = https://twitter.com/invisig0th/status/1427699369449566213
inet:web:post=69714194ea7ceb8138f0a621f3f2931b
.created = 2024/04/22 20:06:56.579
:acct = twitter.com/invisig0th
:acct:site = twitter.com
:acct:user = invisig0th
:hashtags =
:mentions:users = twitter.com/cons_owned
:text = RT @cons_owned: pic.twitter.com/XEi4gneKcq
:time = 2021/08/17 18:28:27.000
:url = https://twitter.com/invisig0th/status/1427698855840256000
inet:web:post=431942a6638f10a2929208907037c412
.created = 2024/04/22 20:06:56.749
:acct = twitter.com/invisig0th
:acct:site = twitter.com
:acct:user = invisig0th
:hashtags =
:mentions:users = twitter.com/khaledhosseini
:text = RT @khaledhosseini: The United States has a moral obligation. Admit as many Afghan refugees as possible.
:time = 2021/08/16 22:13:38.000
:url = https://twitter.com/invisig0th/status/1427393138088456194
Fetch a new account and it’s most recent tweets:
> twitter.user.tweets --size 3 --user vtx_savage --yield
inet:web:post=577e4822c148ac6d572f8a7cd417c841
.created = 2024/04/22 20:06:57.034
:acct = twitter.com/vtx_savage
:acct:site = twitter.com
:acct:user = vtx_savage
:hashtags =
:mentions:users = twitter.com/boburnham,twitter.com/ericalikestech,twitter.com/vtxproject,twitter.com/whoisjonhlu
:text = @whoisjonhlu @ericalikestech @boburnham @vtxproject pic.twitter.com/6zkxlRnHgs
:time = 2021/08/20 14:23:14.000
:url = https://twitter.com/vtx_savage/status/1428724310399766539
inet:web:post=2d8a6d59948ebc8dec53d922c33a0218
.created = 2024/04/22 20:06:57.257
:acct = twitter.com/vtx_savage
:acct:site = twitter.com
:acct:user = vtx_savage
:hashtags =
:mentions:users = twitter.com/vtxproject,twitter.com/whoisjonhlu
:text = @whoisjonhlu @vtxproject pic.twitter.com/clpr2Dg8My
:time = 2021/08/17 14:54:24.000
:url = https://twitter.com/vtx_savage/status/1427644989731921928
inet:web:post=e19a70269ad941c43ab167e7fc757377
.created = 2024/04/22 20:06:57.443
:acct = twitter.com/vtx_savage
:acct:site = twitter.com
:acct:user = vtx_savage
:hashtags = #vtxinthewild,#vtxitw
:mentions:users = twitter.com/vtxproject,twitter.com/whoisjonhlu
:text = @whoisjonhlu @vtxproject #vtxinthewild or #vtxitw ?
:time = 2021/08/17 14:41:11.000
:url = https://twitter.com/vtx_savage/status/1427641665347592201
Fetch a tweet (and its associated user) via the tweet ID:
> twitter.tweets.byid 1456591769185959938 --yield
inet:web:post=6e7d3c5085f7034406ad875c2e51df34
.created = 2024/04/22 20:06:57.735
:acct = twitter.com/invisig0th
:acct:site = twitter.com
:acct:user = invisig0th
:hashtags =
:text = It's 0day xmas on the Internet today!
( used to *love* these back in the day. SIGILL ftw! ) pic.twitter.com/5yx77420Po
:time = 2021/11/05 11:58:34.000
:url = https://twitter.com/invisig0th/status/1456591769185959938
As these tweets are being pulled down, the text of each tweet is scrapped for any additional nodes using the logic from $lib.scrape. To pivot to the scrapped nodes, follow the refs light edge:
> twitter.tweets.byid 1540590647022915584 --yield | -(refs)> * | limit 5
inet:url=https://twitter.com/abuse_ch/status/1540590647022915584/photo/1
.created = 2024/04/22 20:06:58.343
:base = https://twitter.com/abuse_ch/status/1540590647022915584/photo/1
:fqdn = twitter.com
:params =
:path = /abuse_ch/status/1540590647022915584/photo/1
:port = 443
:proto = https
inet:server=tcp://2.58.56.247:80
.created = 2024/04/22 20:06:58.392
:ipv4 = 2.58.56.247
:port = 80
:proto = tcp
inet:fqdn=bazaar.abuse.ch
.created = 2024/04/22 20:06:58.249
:domain = abuse.ch
:host = bazaar
:issuffix = false
:iszone = false
:zone = abuse.ch
inet:server=tcp://74.201.28.166:6606
.created = 2024/04/22 20:06:58.413
:ipv4 = 74.201.28.166
:port = 6606
:proto = tcp
inet:fqdn=urlhaus.abuse.ch
.created = 2024/04/22 20:06:58.216
:domain = abuse.ch
:host = urlhaus
:issuffix = false
:iszone = false
:zone = abuse.ch
Pulling Tweets en masse
Synapse-Twitter supports adding accounts to a monitoring list to automatically fetch the latest tweets for each account in the list.
To add an existing account node to the list of accounts being monitored:
> inet:web:acct=(twitter.com, invisig0th) | twitter.feed.adduser
inet:web:acct=twitter.com/invisig0th
.created = 2024/04/22 20:06:53.784
:name = visi
:signup = 2009/04/12 21:22:36.000
:site = twitter.com
:tagline = Founder @vtxproject
Father of the #APT1 Report @mandiant / @fireeye
Inventor of synapse, vivisect, UNCs, imphash, ...
DEFCON CTF Champion, Founder of Kenshoto
:user = invisig0th
:webpage = http://vertex.link/
To fetch a new account and add it to the list:
> twitter.feed.adduser --user vpEpiphyte
inet:web:acct=twitter.com/vpepiphyte
.created = 2024/04/22 20:06:54.048
:name = epiphyte
:signup = 2017/08/19 14:04:50.000
:site = twitter.com
:tagline = I pick up rocks and look underneath them
:user = vpepiphyte
To list the current accounts being monitored:
> twitter.feed.list
User: invisig0th Last tweet id: 1
User: vpepiphyte Last tweet id: 1
To remove a user from the list of accounts being monitored:
> twitter.feed.deluser --user invisig0th
Removed feed user twitter.com/invisig0th with offset 1
inet:web:acct=twitter.com/invisig0th
.created = 2024/04/22 20:06:53.784
:name = visi
:signup = 2009/04/12 21:22:36.000
:site = twitter.com
:tagline = Founder @vtxproject
Father of the #APT1 Report @mandiant / @fireeye
Inventor of synapse, vivisect, UNCs, imphash, ...
DEFCON CTF Champion, Founder of Kenshoto
:user = invisig0th
:webpage = http://vertex.link/
To pull down tweets for a single account being watched:
> [inet:web:acct=(twitter.com, vtx_savage)] | twitter.feed.adduser
inet:web:acct=twitter.com/vtx_savage
.created = 2024/04/22 20:06:54.583
:name = vtx_savage
:signup = 2021/05/24 19:59:21.000
:site = twitter.com
:tagline = analyst @vtxproject
tweets are my own
:user = vtx_savage
> twitter.feed.pull --user vtx_savage --size 3 --yield
inet:web:post=577e4822c148ac6d572f8a7cd417c841
.created = 2024/04/22 20:06:57.034
:acct = twitter.com/vtx_savage
:acct:site = twitter.com
:acct:user = vtx_savage
:hashtags =
:mentions:users = twitter.com/boburnham,twitter.com/ericalikestech,twitter.com/vtxproject,twitter.com/whoisjonhlu
:text = @whoisjonhlu @ericalikestech @boburnham @vtxproject pic.twitter.com/6zkxlRnHgs
:time = 2021/08/20 14:23:14.000
:url = https://twitter.com/vtx_savage/status/1428724310399766539
inet:web:post=2d8a6d59948ebc8dec53d922c33a0218
.created = 2024/04/22 20:06:57.257
:acct = twitter.com/vtx_savage
:acct:site = twitter.com
:acct:user = vtx_savage
:hashtags =
:mentions:users = twitter.com/vtxproject,twitter.com/whoisjonhlu
:text = @whoisjonhlu @vtxproject pic.twitter.com/clpr2Dg8My
:time = 2021/08/17 14:54:24.000
:url = https://twitter.com/vtx_savage/status/1427644989731921928
inet:web:post=e19a70269ad941c43ab167e7fc757377
.created = 2024/04/22 20:06:57.443
:acct = twitter.com/vtx_savage
:acct:site = twitter.com
:acct:user = vtx_savage
:hashtags = #vtxinthewild,#vtxitw
:mentions:users = twitter.com/vtxproject,twitter.com/whoisjonhlu
:text = @whoisjonhlu @vtxproject #vtxinthewild or #vtxitw ?
:time = 2021/08/17 14:41:11.000
:url = https://twitter.com/vtx_savage/status/1427641665347592201
Much like the other commands to fetch tweets, as these tweets are being pulled down, the text of each tweet is scrapped for any additional nodes using the logic from $lib.scrape.
To pull down tweets for all the accounts being monitored, but skipping scrapping for each of the tweets:
> twitter.feed.adduser --user invisig0th
inet:web:acct=twitter.com/invisig0th
.created = 2024/04/22 20:06:53.784
:name = visi
:signup = 2009/04/12 21:22:36.000
:site = twitter.com
:tagline = Founder @vtxproject
Father of the #APT1 Report @mandiant / @fireeye
Inventor of synapse, vivisect, UNCs, imphash, ...
DEFCON CTF Champion, Founder of Kenshoto
:user = invisig0th
:webpage = http://vertex.link/
> twitter.feed.pull --size 10 --yield --all --skip-scrape
WARNING: User has been suspended: [absoIute_units].
inet:web:post=1ba03d1448b5928a96d386ce5456806f
.created = 2024/04/22 20:07:00.499
:acct = twitter.com/invisig0th
:acct:site = twitter.com
:acct:user = invisig0th
:hashtags =
:mentions:users = twitter.com/vtxproject
:text = RT @vtxproject: Synapse Power-Ups allow analysts to extend the system’s functionality, enrich their analysis, integrate additional data, &…
:time = 2021/08/25 20:19:44.000
:url = https://twitter.com/invisig0th/status/1430625964048805888
inet:web:post=9113aa57c1484f0f06e7527d101f7508
.created = 2024/04/22 20:07:00.595
:acct = twitter.com/invisig0th
:acct:site = twitter.com
:acct:user = invisig0th
:hashtags =
:mentions:users = twitter.com/ccsdevio
:text = RT @ccsdevio: IT👏IS👏NOT👏A👏"personal decision" twitter.com/Chrissy__Dee/s…
:time = 2021/08/24 22:53:27.000
:url = https://twitter.com/invisig0th/status/1430302259360014340
inet:web:post=e704961836228f5b07e5b58b656a1538
.created = 2024/04/22 20:07:00.729
:acct = twitter.com/invisig0th
:acct:site = twitter.com
:acct:user = invisig0th
:hashtags =
:mentions:users = twitter.com/_devonkerr_,twitter.com/invisig0th
:text = RT @_devonkerr_: @invisig0th Never doubt it, also please be polish vodka
:time = 2021/08/24 22:24:12.000
:url = https://twitter.com/invisig0th/status/1430294899757289476
inet:web:post=fb6118d88d2cef29d0fc18dd12d3f4cd
.created = 2024/04/22 20:07:00.847
:acct = twitter.com/invisig0th
:acct:site = twitter.com
:acct:user = invisig0th
:hashtags =
:mentions:users = twitter.com/invisig0th,twitter.com/jamierbutler
:text = RT @jamierbutler: @invisig0th Yes
:time = 2021/08/24 21:57:12.000
:url = https://twitter.com/invisig0th/status/1430288103604883464
inet:web:post=90485888ec7702cea69395914ce5c7bf
.created = 2024/04/22 20:07:00.966
:acct = twitter.com/invisig0th
:acct:site = twitter.com
:acct:user = invisig0th
:hashtags =
:mentions:users = twitter.com/adriendb,twitter.com/femmeshoto
:text = @adriendb A man after @femmeshoto 's heart
:time = 2021/08/24 21:56:54.000
:url = https://twitter.com/invisig0th/status/1430288031437701121
inet:web:post=3ae3aa97843984bb519e49b380c43f65
.created = 2024/04/22 20:07:01.085
:acct = twitter.com/invisig0th
:acct:site = twitter.com
:acct:user = invisig0th
:hashtags =
:mentions:users = twitter.com/casperinous,twitter.com/invisig0th
:text = RT @Casperinous: @invisig0th Working undercover to increase your water consumption :P
:time = 2021/08/24 21:55:00.000
:url = https://twitter.com/invisig0th/status/1430287550766276615
inet:web:post=c57105285cef7750fb83a66f2e3077f2
.created = 2024/04/22 20:07:01.205
:acct = twitter.com/invisig0th
:acct:site = twitter.com
:acct:user = invisig0th
:hashtags =
:text = Vodka and caviar. Dinner of champions... ?
:time = 2021/08/24 21:53:03.000
:url = https://twitter.com/invisig0th/status/1430287062331166725
inet:web:post=b80dbc1da2f6e59ef6920220181a1911
.created = 2024/04/22 20:07:01.278
:acct = twitter.com/invisig0th
:acct:site = twitter.com
:acct:user = invisig0th
:hashtags =
:mentions:users = twitter.com/b1ack0ut,twitter.com/invisig0th
:text = RT @b1ack0ut: I think I just discovered how @invisig0th really got his handle. pic.twitter.com/8KTwH6KZZY
:time = 2021/08/24 14:54:20.000
:url = https://twitter.com/invisig0th/status/1430181688206925828
inet:web:post=98af8fb8816e25d760e36a7db61b67cc
.created = 2024/04/22 20:07:01.433
:acct = twitter.com/invisig0th
:acct:site = twitter.com
:acct:user = invisig0th
:hashtags =
:mentions:users = twitter.com/bloodberry_tart
:text = RT @bloodberry_tart: brutal lol pic.twitter.com/YPLMQriFRh
:time = 2021/08/23 14:43:28.000
:url = https://twitter.com/invisig0th/status/1429816565399232523
inet:web:post=533c36b99615c6cff7ff695ee835ab27
.created = 2024/04/22 20:07:01.565
:acct = twitter.com/invisig0th
:acct:site = twitter.com
:acct:user = invisig0th
:hashtags = #lawtwitter
:mentions:users = twitter.com/nunesalt
:text = RT @NunesAlt: #LawTwitter, help me out. Is this illegal? twitter.com/ronfilipkowski…
:time = 2021/08/23 11:36:56.000
:url = https://twitter.com/invisig0th/status/1429769621859704839
Searching for Tweets
To ingest the tweets related to a search query:
> twitter.search.tweets vertexproject --yield --size 3
inet:web:post=90299ae1714dcb9241c1184dd4a696a9
.created = 2024/04/22 20:07:01.898
:acct = twitter.com/vtxproject
:acct:site = twitter.com
:acct:user = vtxproject
:hashtags =
:mentions:users = twitter.com/vtx_savage,twitter.com/vtxproject
:text = RT @vtxproject: Join us later this week for our next What’s New webinar presented by @vtx_savage & featuring Story Templates! https://t.co/…
:time = 2021/10/26 00:50:00.000
:url = https://twitter.com/vtxproject/status/1452799641725116417
inet:web:post=f538a2dc2a75bed0372fdb967d7cad00
.created = 2024/04/22 20:07:02.206
:acct = twitter.com/cybersec_feeds
:acct:site = twitter.com
:acct:user = cybersec_feeds
:hashtags =
:mentions:users = twitter.com/vtx_savage,twitter.com/vtxproject
:text = RT @vtxproject: Join us later this week for our next What’s New webinar presented by @vtx_savage & featuring Story Templates! https://t.co/…
:time = 2021/10/25 14:12:56.000
:url = https://twitter.com/cybersec_feeds/status/1452639318573522956
inet:web:post=bed07d7b1aadffc7185daba595c2afbd
.created = 2024/04/22 20:07:02.415
:acct = twitter.com/vtxproject
:acct:site = twitter.com
:acct:user = vtxproject
:hashtags = #cybersecurity,#infosec,#threatintel
:mentions:users = twitter.com/vtx_savage
:text = Join us later this week for our next What’s New webinar presented by @vtx_savage & featuring Story Templates! v.vtx.lk/luma #infosec #CyberSecurity #threatintel
:time = 2021/10/25 12:24:19.000
:url = https://twitter.com/vtxproject/status/1452611983925207050
These tweets will be linked to an it:exec:query node via a -(found)> light edges:
> it:exec:query:text="vertexproject" -(found)> * | limit 5
inet:web:post=90299ae1714dcb9241c1184dd4a696a9
.created = 2024/04/22 20:07:01.898
:acct = twitter.com/vtxproject
:acct:site = twitter.com
:acct:user = vtxproject
:hashtags =
:mentions:users = twitter.com/vtx_savage,twitter.com/vtxproject
:text = RT @vtxproject: Join us later this week for our next What’s New webinar presented by @vtx_savage & featuring Story Templates! https://t.co/…
:time = 2021/10/26 00:50:00.000
:url = https://twitter.com/vtxproject/status/1452799641725116417
inet:web:post=bed07d7b1aadffc7185daba595c2afbd
.created = 2024/04/22 20:07:02.415
:acct = twitter.com/vtxproject
:acct:site = twitter.com
:acct:user = vtxproject
:hashtags = #cybersecurity,#infosec,#threatintel
:mentions:users = twitter.com/vtx_savage
:text = Join us later this week for our next What’s New webinar presented by @vtx_savage & featuring Story Templates! v.vtx.lk/luma #infosec #CyberSecurity #threatintel
:time = 2021/10/25 12:24:19.000
:url = https://twitter.com/vtxproject/status/1452611983925207050
inet:web:post=f538a2dc2a75bed0372fdb967d7cad00
.created = 2024/04/22 20:07:02.206
:acct = twitter.com/cybersec_feeds
:acct:site = twitter.com
:acct:user = cybersec_feeds
:hashtags =
:mentions:users = twitter.com/vtx_savage,twitter.com/vtxproject
:text = RT @vtxproject: Join us later this week for our next What’s New webinar presented by @vtx_savage & featuring Story Templates! https://t.co/…
:time = 2021/10/25 14:12:56.000
:url = https://twitter.com/cybersec_feeds/status/1452639318573522956
To search for tweets based on a specific hashtag:
> twitter.search.tweets "#cyberattack" --yield --size 3
inet:web:post=ab501449364967e79cb320b24d9b4238
.created = 2024/04/22 20:07:02.916
:acct = twitter.com/cyberiqs_
:acct:site = twitter.com
:acct:user = cyberiqs_
:hashtags = #cisa,#cloudsecurity,#cyber,#cyberattack,#cybernews,#cybersecurity,#hacking,#infosec,#infosecurity,#malware,#ransomware,#threathunting,#threatintel,#threatintelligence,#uber,#uberbreach,#uberhack,#uberhacked,#zerotrust
:text = White House Seeks Advice on Cyber #infosec #infosecurity #cybersecurity #threatintel #threatintelligence #hacking #cybernews #cyberattack #cloudsecurity #malware #ransomware #cyber #threathunting #ZeroTrust #CISA #uber #uberhack #uberbreach #uberhacked
cyberiqs.com/latestnews
:time = 2022/10/05 15:27:45.000
:url = https://twitter.com/cyberiqs_/status/1577681957328134144
inet:web:post=d97ff1a298800fe30e56d2fe22d336a7
.created = 2024/04/22 20:07:03.096
:acct = twitter.com/cyberiqs_
:acct:site = twitter.com
:acct:user = cyberiqs_
:hashtags = #cisa,#cloudsecurity,#cyber,#cyberattack,#cybernews,#cybersecurity,#hacking,#infosec,#infosecurity,#malware,#ransomware,#threathunting,#threatintel,#threatintelligence,#uber,#uberbreach,#uberhack,#uberhacked,#zerotrust
:text = Migrant Digital Justice Toolkit #infosec #infosecurity #cybersecurity #threatintel #threatintelligence #hacking #cybernews #cyberattack #cloudsecurity #malware #ransomware #cyber #threathunting #ZeroTrust #CISA #uber #uberhack #uberbreach #uberhacked
cyberiqs.com/latestnews
:time = 2022/10/05 15:27:44.000
:url = https://twitter.com/cyberiqs_/status/1577681955914661891
inet:web:post=6bc3d12b3bdc5b8df4cc178439e7f289
.created = 2024/04/22 20:07:03.276
:acct = twitter.com/cyberiqs_
:acct:site = twitter.com
:acct:user = cyberiqs_
:hashtags = #cisa,#cloudsecurity,#cyber,#cyberattack,#cybernews,#cybersecurity,#hacking,#infosec,#infosecurity,#malware,#ransomware,#threathunting,#threatintel,#threatintelligence,#uber,#uberbreach,#uberhack,#uberhacked,#zerotrust
:text = How the Online Safety Bill puts a #infosec #infosecurity #cybersecurity #threatintel #threatintelligence #hacking #cybernews #cyberattack #cloudsecurity #malware #ransomware #cyber #threathunting #ZeroTrust #CISA #uber #uberhack #uberbreach #uberhacked
cyberiqs.com/latestnews
:time = 2022/10/05 15:27:35.000
:url = https://twitter.com/cyberiqs_/status/1577681914735067137
For more information on how to build a query for the Twitter v2 API, please see the Twitter search documentation.
Automating Feed Pulling
To pull the tweets for feed users on a regular basis, a cron job can be created to automate the process:
> cron.add --daily 12:00 { twitter.feed.pull }
Created cron job: 2e32a0a3b872fbee2269c30fec929bac
Which will pull in all the latest tweets for every user enrolled in the Synapse-Twitter feed on a daily basis at 12:00 UTC.
Searching for Users
Synapse-Twitter supports searching for users, but because the search functionality has not been ported over to the v2 version of the Twitter API, search functionality requires extra API keys in order for Synapse-Twitter to interact with the v1.1 version of the Twitter API.
To use the Twitter search functionality, you need four keys, a consumer key, the associated consumer secret, an access token, and the associated access token secret.
To set the four OAuth keys needed for search functionality:
> twitter.setup.oauth MyConsumerKey MyConsumerSecret MyAccessToken MyAccessTokenSecret
Setting Synapse-Twitter OAuth keys for all users.
To use the search functionality to search for users based on a query:
> twitter.search.users "invisi" --yield --size 3
inet:web:acct=twitter.com/invisibooks
.created = 2024/04/22 20:07:03.768
:avatar = sha256:2e03c03e079c63ed36f938d6af615784293ac6faf2dff9818a1217b0972748bc
:loc = picton/halifax
:name = invisibooks
:site = twitter.com
:tagline = making books like you don't even know #invisibooks IG: https://t.co/p43ZOtRcJf
:user = invisibooks
:webpage = https://t.co/VKvyftlG3t
inet:web:acct=twitter.com/invisicollege
.created = 2024/04/22 20:07:04.034
:avatar = sha256:6449e259c9b0019fe98077a9b185b2cb54aee5d9d5076145509b3cf097719a53
:loc = unknown kadath, athens ga
:name = bonnicula
:site = twitter.com
:tagline = Bonnie Sentinel ⚧ Witchcraft, Art, Podcasting, Permaculture. She/her https://t.co/UBlt4fmkrs Ѫ
Disinfo (RIP)
Out There Radio
Owner/Operator @awesomepossumc1
:user = invisicollege
inet:web:acct=twitter.com/eu_lover
.created = 2024/04/22 20:07:04.295
:avatar = sha256:e2050d9696b8ef8eba429f63c4ed0c122b12222069573d2d952da6bd0c927625
:loc = somewhere you won’t see me
:name = ⚫️ visibly angry invisi-jojo 🐝 🇪🇺 3.5%
:site = twitter.com
:tagline = EU citizen #FBPE 🇪🇺, legal eagle, rejoiner, politically homeless hardline centrist. Manc Francophile. Invisible. She/her
:user = eu_lover
All users returned from that query will be linked together via an it:exec:query node using -(found)> light edges:
> it:exec:query:text="invisi" -(found)> * | limit 5
inet:web:acct=twitter.com/invisibooks
.created = 2024/04/22 20:07:03.768
:avatar = sha256:2e03c03e079c63ed36f938d6af615784293ac6faf2dff9818a1217b0972748bc
:loc = picton/halifax
:name = invisibooks
:site = twitter.com
:tagline = making books like you don't even know #invisibooks IG: https://t.co/p43ZOtRcJf
:user = invisibooks
:webpage = https://t.co/VKvyftlG3t
inet:web:acct=twitter.com/invisicollege
.created = 2024/04/22 20:07:04.034
:avatar = sha256:6449e259c9b0019fe98077a9b185b2cb54aee5d9d5076145509b3cf097719a53
:loc = unknown kadath, athens ga
:name = bonnicula
:site = twitter.com
:tagline = Bonnie Sentinel ⚧ Witchcraft, Art, Podcasting, Permaculture. She/her https://t.co/UBlt4fmkrs Ѫ
Disinfo (RIP)
Out There Radio
Owner/Operator @awesomepossumc1
:user = invisicollege
inet:web:acct=twitter.com/eu_lover
.created = 2024/04/22 20:07:04.295
:avatar = sha256:e2050d9696b8ef8eba429f63c4ed0c122b12222069573d2d952da6bd0c927625
:loc = somewhere you won’t see me
:name = ⚫️ visibly angry invisi-jojo 🐝 🇪🇺 3.5%
:site = twitter.com
:tagline = EU citizen #FBPE 🇪🇺, legal eagle, rejoiner, politically homeless hardline centrist. Manc Francophile. Invisible. She/her
:user = eu_lover
Use of meta:source nodes
Synapse-Twitter uses a meta:source node and -(seen)> light
weight edges to track nodes observed from the Twitter API.
> meta:source=8359f150c6f163bc9a41662e665350af
meta:source=8359f150c6f163bc9a41662e665350af
.created = 2024/04/22 20:06:53.914
:name = twitter api
Storm can be used to filter nodes to include/exclude nodes which have been observed by Synapse-Twitter. The following example shows how to filter the results of a query to include only results observed by Synapse-Twitter:
> #cool.tag.lift +{ <(seen)- meta:source=8359f150c6f163bc9a41662e665350af }