From 0235fa141cf7b363aa9c4579e4fd6a3e6e714d24 Mon Sep 17 00:00:00 2001
From: Rytis Paulauskas <rytis.paulauskas@flare.io>
Date: Mon, 26 Oct 2026 10:45:32 -0400
Subject: [PATCH] Update lookalike documentation

---
 docs/advanced/event-source-filters.mdx        | 18 ++++++++++++
 docs/event-types/domain.mdx                   | 28 ++++++++++++++++---
 .../snippets/endpoint-event-search-common.mdx |  8 ++++++
 3 files changed, 50 insertions(+), 4 deletions(-)

diff --git a/docs/advanced/event-source-filters.mdx b/docs/advanced/event-source-filters.mdx
index 5701d46..7f87079 100644
--- a/docs/advanced/event-source-filters.mdx
+++ b/docs/advanced/event-source-filters.mdx
@@ -27,3 +27,21 @@ Base Types are divided into categories that correspond to the categories in the
 | forum_content | forum_post <br /> forum_topic |
 | profile | forum_profile <br /> seller |
 | infected_devices | bot <br /> stealer_log |
+
+## Lookalike domain types
+
+Each base type below selects one lookalike domain event type and belongs to no category.
+The `domain` base type returns all of them together.
+
+| Base Type | Event Type |
+| --------- | ---------- |
+| lookalike_discovery | domain |
+| lookalike_title | domain_title |
+| lookalike_ip_address | domain_ip_address |
+| lookalike_favicon | domain_favicon |
+| lookalike_screenshot | domain_screenshot |
+| lookalike_dns | domain_dns_records |
+| lookalike_whois_rdap | domain_whois_rdap |
+| lookalike_ssl_certificate | domain_certificate |
+
+Learn more about [Lookalike Domain events <Icon icon="book" size={16} />](/event-types/domain#querying-discovery-and-update-events).
diff --git a/docs/event-types/domain.mdx b/docs/event-types/domain.mdx
index 8d47aae..64f4d93 100644
--- a/docs/event-types/domain.mdx
+++ b/docs/event-types/domain.mdx
@@ -5,10 +5,30 @@ title: "Lookalike Domain (domain)"
 The `domain` type represents lookalike or typosquatted domains identified by Flare’s detection engines, often leveraging tools such as dnstwist.  
 These records capture information about suspicious domains that closely resemble legitimate organizations’ domains and could be used in phishing, brand impersonation, or malware campaigns.
 
-The `domain` event is also referred to as the discovery event: it is emitted when a lookalike domain is first discovered.
-It is complemented by the `domain_*` enrichment events documented below, which each carry the results of one enrichment (page title, IP addresses, favicon, screenshot, DNS records, WHOIS/RDAP data, SSL certificates) and reference the discovered domain through their `domain` field.
-
-<Note>Some of the below field types will not be available until after August 26th.</Note>
+The `domain` event is the **discovery event**, emitted when Flare first finds a lookalike domain.
+**Update events** follow it. Each one carries a single enrichment result and points back to the discovered domain through its `domain` field.
+
+## Querying discovery and update events
+
+Discovery and update events are distinct types. Request each one you need by its `type` filter value, for example `"type": ["lookalike_discovery", "lookalike_title"]`.
+
+| Event type           | `type` filter value         |
+| -------------------- | --------------------------- |
+| `domain`             | `lookalike_discovery`       |
+| `domain_title`       | `lookalike_title`           |
+| `domain_ip_address`  | `lookalike_ip_address`      |
+| `domain_favicon`     | `lookalike_favicon`         |
+| `domain_screenshot`  | `lookalike_screenshot`      |
+| `domain_dns_records` | `lookalike_dns`             |
+| `domain_whois_rdap`  | `lookalike_whois_rdap`      |
+| `domain_certificate` | `lookalike_ssl_certificate` |
+
+<Note>
+`lookalike_discovery` alone, or no `type` filter, returns discovery events only.
+`domain` and the `domains` category return discovery and update events together.
+</Note>
+
+DNS records, WHOIS/RDAP and SSL certificate events require Extended Lookalike Domain Monitoring.
 
 ## domain
 
diff --git a/docs/snippets/endpoint-event-search-common.mdx b/docs/snippets/endpoint-event-search-common.mdx
index 32a5747..f18aea6 100644
--- a/docs/snippets/endpoint-event-search-common.mdx
+++ b/docs/snippets/endpoint-event-search-common.mdx
@@ -187,6 +187,14 @@ This endpoint supports the
         `invalid_credential`
         `mitigated_credential`
         `domain`
+        `lookalike_discovery`
+        `lookalike_title`
+        `lookalike_ip_address`
+        `lookalike_favicon`
+        `lookalike_screenshot`
+        `lookalike_dns`
+        `lookalike_whois_rdap`
+        `lookalike_ssl_certificate`
         `listing`
         `forum_content`
         `blog_content`