Falcon documentation

Falcon User Manual

This manual provides guidance on Falcon features and workflows, helping users understand how the system works and how to use it in daily investigation tasks.

About Falcon

Falcon is a comprehensive investigation management system (IMS) designed to support the full investigation lifecycle. All system activities are organized within a structured workflow based on Clients, Investigations, and Searches.

Login

To access Falcon, open the system URL, enter your login credentials, and then confirm access with the required Access Card code.

Dashboard

The Dashboard provides a role-based overview of key system information and available actions. The set of visible sections depends on the user role.

Notifications^BETA

The notification bell displays system events relevant to the user role.

Search List

The Search List page is the main workspace for monitoring existing searches, filtering them, creating new searches, archiving completed results, and removing selected records.

Search Lifecycle

Every search moves through a defined status flow from creation to completion or failure.

• New searches remain in Pending for up to 5 minutes.
• During Pending, the search can be canceled. In that case, the status becomes Canceled, and tokens allocated for the search are refunded.
• After the waiting period, the search enters the queue and starts in In Progress.
• When completed successfully, the status becomes Done.
• If the search fails, the status becomes Problem.

New Search

The New Search page allows users to create and execute search queries within an investigation. All searches are performed within the context of a specific investigation, which serves as a container for related queries and results.

Required Fields

To start a search, the following fields must be completed:

• Investigation — defines the investigation in which the search will be executed and where results will be stored.
• Search Queries — the value or phrase to be searched.
• Search Scope — defines the data source where the search will be performed.

Search Query

Falcon supports multiple query types depending on the required search logic. Each type defines how the system processes and matches the provided query.

Search Scope

^* All data is sourced from publicly available open-source intelligence (OSINT).

Wildcard Search

Wildcard search allows partial matching using the * symbol.

• * matches any single character or digit
• 5345**67*87 — matches variations of numeric values (e.g. phone numbers)
• S**[email protected] — matches variations of the email username

Wildcard Behavior

• In phone numbers, * replaces digits only
• In email addresses, * works only in the part before @

Additional Settings

Search Accuracy

Search Accuracy controls how precisely Falcon matches the provided query.

• ON — Exact Match
  Returns only exact matches of the specified query, without additional characters before or after it. The match must be bounded by delimiters such as: [ ], space, tab, or punctuation characters (e.g. ! " # $ % & ( ) , / : ; < = > ? \ ^ { | } ~ +).
  

  Examples:

  • [email protected] → returns only [email protected]
  • +972543322211 → returns only +972543322211
  • 0543223444 → returns only 0543223444
• OFF — Partial Match
  Returns results where the query appears as part of a larger string.

  Examples:

  • [email protected] → may return:
    • mary.[email protected]
    • fry.[email protected].br
    • [email protected]
  • 3331234567 → may return:
    • +393331234567
    • abc3331234567xyz
    • 8q037569ey580008877676755433333123456713489774hjfjjfj
    • 3331234567

Schedule

The Schedule setting defines when the search will be executed.

All scheduled executions are based on UTC.

Bulk Query Upload (.txt)

The Upload a ".txt" file button allows you to import multiple search queries at once instead of entering them manually.

• Supports up to 50 queries per file
• Each query is treated as a separate search request

Supported separators:

• New line (each query on a new line)
• Comma (,)
• Semicolon (;)
• Vertical bar (|)

Behavior:

• After upload, queries are automatically added to the search form

Example:

john smith
jane doe
[email protected], +1 234 567 890
company name; username123
passport number | tax id

Search Results

The Search Results page displays the output of a completed search and provides tools for reviewing, filtering, analyzing, and exporting the data. Each search run generates a result set that can be explored through multiple tabs.

Header Information

Provides key details about the executed search:

• Query — the searched value or phrase
• Search Scope — data source used (Databases, Logs, Documents)
• Search Accuracy — matching mode (Exact or Partial)
• Created At / Finish At — execution timestamps
• Investigation — investigation where the search was performed

Result Files

Each completed search execution is stored as a separate result file. For scheduled searches, multiple result files may be generated over time.

Result Tabs

Operators ^BETA

Clients ^BETA

The Clients module allows users to create and manage client profiles that can be linked to investigations and searches.

Investigations list

An Investigation is a central workspace used to organize all operational activity related to a specific case. It serves as a place to store case-related information and brings together all search queries performed within the investigation.

All searches in Falcon must be created within an investigation, making it the primary container for executing searches and managing results.

Find in Investigation ^BETA

This feature helps the user locate a query inside completed search results within a selected investigation.

AI Detective^BETA

AI Detective is an automated investigation workflow that performs search and analysis based on a single query. It simplifies the investigation process by automatically collecting and structuring relevant data.

How it works

• A single query is used as the starting point
• The system automatically launches searches across database sources
• Results are processed and structured into a table of frequent occurrences and a relationship graph, providing a clear view of key data and connections.

Capabilities

• Automated search execution
• Data aggregation from multiple search queries executed automatically.
• Structured presentation of findings
• Reduced need for manual analysis

New AI Detective ^BETA

The New AI Detective page allows creating a smart investigation based on a single query. The system automatically launches multiple related searches, aggregates the data, and structures the results for analysis.

AI Detective Details ^BETA

The AI Detective Details page provides full information about a specific smart investigation, including its configuration, metadata, and execution status.

AI Detective Results ^BETA

The AI Detective Results page displays processed data generated by the smart investigation. It provides a structured overview of key findings and visualizes relationships between entities discovered during automated searches.

FAQ