API Reference

Cloudforce One

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Threat Events

Filter and list events

client.CloudforceOne.ThreatEvents.List(ctx, params) (*[]ThreatEventListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events

Reads an event

Deprecated

client.CloudforceOne.ThreatEvents.Get(ctx, eventID, query) (*ThreatEventGetResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/{event_id}

Creates a new event

client.CloudforceOne.ThreatEvents.New(ctx, params) (*ThreatEventNewResponse, error)

POST/accounts/{account_id}/cloudforce-one/events/create

Updates an event

client.CloudforceOne.ThreatEvents.Edit(ctx, eventID, params) (*ThreatEventEditResponse, error)

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}

Creates bulk events

client.CloudforceOne.ThreatEvents.BulkNew(ctx, params) (*ThreatEventBulkNewResponse, error)

POST/accounts/{account_id}/cloudforce-one/events/create/bulk

Creates bulk DOS event with relationships and indicators

Deprecated

client.CloudforceOne.ThreatEvents.BulkNewRelationships(ctx, params) (*ThreatEventBulkNewRelationshipsResponse, error)

POST/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships

Threat EventsAggregate

Aggregate events by single or multiple columns with optional date filtering

client.CloudforceOne.ThreatEvents.Aggregate.List(ctx, params) (*ThreatEventAggregateListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/aggregate

Threat EventsGraphql

GraphQL endpoint for event aggregation

client.CloudforceOne.ThreatEvents.Graphql.New(ctx, body) (*ThreatEventGraphqlNewResponse, error)

POST/accounts/{account_id}/cloudforce-one/events/graphql

Threat EventsGraph

Query graph neighborhood from R2 Data Catalog

client.CloudforceOne.ThreatEvents.Graph.List(ctx, params) (*ThreatEventGraphListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/graph

Threat EventsQueries

List all saved event queries

client.CloudforceOne.ThreatEvents.Queries.List(ctx, query) (*[]ThreatEventQueryListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/queries

Create a saved event query

client.CloudforceOne.ThreatEvents.Queries.New(ctx, params) (*ThreatEventQueryNewResponse, error)

POST/accounts/{account_id}/cloudforce-one/events/queries/create

Read a saved event query

client.CloudforceOne.ThreatEvents.Queries.Get(ctx, queryID, query) (*ThreatEventQueryGetResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Update a saved event query

client.CloudforceOne.ThreatEvents.Queries.Edit(ctx, queryID, params) (*ThreatEventQueryEditResponse, error)

PATCH/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Delete a saved event query

client.CloudforceOne.ThreatEvents.Queries.Delete(ctx, queryID, body) error

DELETE/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Threat EventsRelationships

Filter and list events related to specific event

client.CloudforceOne.ThreatEvents.Relationships.List(ctx, eventID, params) (*[]ThreatEventRelationshipListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships

Threat EventsIndicators

Lists indicators across multiple datasets

client.CloudforceOne.ThreatEvents.Indicators.List(ctx, params) (*ThreatEventIndicatorListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/indicators

Threat EventsIndicatorsAggregate

Aggregate indicators by column(s)

client.CloudforceOne.ThreatEvents.Indicators.Aggregate.List(ctx, params) (*ThreatEventIndicatorAggregateListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/indicators/aggregate

Threat EventsIndicatorsTypes

Lists indicator types across multiple datasets

client.CloudforceOne.ThreatEvents.Indicators.Types.List(ctx, params) (*ThreatEventIndicatorTypeListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/indicator-types

Threat EventsIndicatorsBy Dataset

Lists indicators

Deprecated

client.CloudforceOne.ThreatEvents.Indicators.ByDataset.List(ctx, datasetID, params) (*ThreatEventIndicatorByDatasetListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators

Reads an indicator

client.CloudforceOne.ThreatEvents.Indicators.ByDataset.Get(ctx, datasetID, indicatorID, query) (*ThreatEventIndicatorByDatasetGetResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}

Threat EventsIndicatorsBy DatasetTags

List mirrored tags for an indicator dataset

client.CloudforceOne.ThreatEvents.Indicators.ByDataset.Tags.List(ctx, datasetID, query) (*[]ThreatEventIndicatorByDatasetTagListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags

Threat EventsAttackers

Lists attackers across multiple datasets

client.CloudforceOne.ThreatEvents.Attackers.List(ctx, params) (*ThreatEventAttackerListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/attackers

Threat EventsCategories

Lists categories across multiple datasets

client.CloudforceOne.ThreatEvents.Categories.List(ctx, params) (*[]ThreatEventCategoryListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/categories

Reads a category

client.CloudforceOne.ThreatEvents.Categories.Get(ctx, categoryID, query) (*ThreatEventCategoryGetResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Creates a new category

client.CloudforceOne.ThreatEvents.Categories.New(ctx, params) (*ThreatEventCategoryNewResponse, error)

POST/accounts/{account_id}/cloudforce-one/events/categories/create

Updates a category

client.CloudforceOne.ThreatEvents.Categories.Edit(ctx, categoryID, params) (*ThreatEventCategoryEditResponse, error)

PATCH/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Deletes a category

client.CloudforceOne.ThreatEvents.Categories.Delete(ctx, categoryID, body) (*ThreatEventCategoryDeleteResponse, error)

DELETE/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Threat EventsCategoriesCatalog

Lists categories

client.CloudforceOne.ThreatEvents.Categories.Catalog.List(ctx, query) (*[]ThreatEventCategoryCatalogListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/categories/catalog

Threat EventsCountries

Retrieves countries information for all countries

client.CloudforceOne.ThreatEvents.Countries.List(ctx, query) (*[]ThreatEventCountryListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/countries

Threat EventsCrons

Threat EventsDatasets

Lists all datasets in an account

client.CloudforceOne.ThreatEvents.Datasets.List(ctx, params) (*[]ThreatEventDatasetListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/dataset

Reads a dataset

client.CloudforceOne.ThreatEvents.Datasets.Get(ctx, datasetID, query) (*ThreatEventDatasetGetResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Creates a dataset

client.CloudforceOne.ThreatEvents.Datasets.New(ctx, params) (*ThreatEventDatasetNewResponse, error)

POST/accounts/{account_id}/cloudforce-one/events/dataset/create

Updates an existing dataset

client.CloudforceOne.ThreatEvents.Datasets.Edit(ctx, datasetID, params) (*ThreatEventDatasetEditResponse, error)

PATCH/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Delete a dataset

client.CloudforceOne.ThreatEvents.Datasets.Delete(ctx, datasetID, body) (*ThreatEventDatasetDeleteResponse, error)

DELETE/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Reads raw data for an event by UUID

client.CloudforceOne.ThreatEvents.Datasets.Raw(ctx, datasetID, eventID, query) (*ThreatEventDatasetRawResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}

Threat EventsDatasetsHealth

Threat EventsDatasetsEvents

Reads an event

client.CloudforceOne.ThreatEvents.Datasets.Events.Get(ctx, datasetID, eventID, query) (*ThreatEventDatasetEventGetResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}

Threat EventsIndicator Types

Lists all indicator types

Deprecated

client.CloudforceOne.ThreatEvents.IndicatorTypes.List(ctx, query) (*ThreatEventIndicatorTypeListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/indicatorTypes

Threat EventsRaw

Reads data for a raw event

client.CloudforceOne.ThreatEvents.Raw.Get(ctx, eventID, rawID, query) (*ThreatEventRawGetResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

Updates a raw event

client.CloudforceOne.ThreatEvents.Raw.Edit(ctx, eventID, rawID, params) (*ThreatEventRawEditResponse, error)

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

Threat EventsRelate

Removes an event reference

client.CloudforceOne.ThreatEvents.Relate.Delete(ctx, eventID, body) (*ThreatEventRelateDeleteResponse, error)

DELETE/accounts/{account_id}/cloudforce-one/events/relate/{event_id}

Threat EventsTags

Lists all tags (SoT)

client.CloudforceOne.ThreatEvents.Tags.List(ctx, params) (*ThreatEventTagListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/tags

Creates a new tag

client.CloudforceOne.ThreatEvents.Tags.New(ctx, params) (*ThreatEventTagNewResponse, error)

POST/accounts/{account_id}/cloudforce-one/events/tags/create

Updates a tag (SoT)

client.CloudforceOne.ThreatEvents.Tags.Edit(ctx, tagUUID, params) (*ThreatEventTagEditResponse, error)

PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

Deletes a tag (SoT)

client.CloudforceOne.ThreatEvents.Tags.Delete(ctx, tagUUID, body) (*ThreatEventTagDeleteResponse, error)

DELETE/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

Threat EventsTagsCategories

Lists all tag categories (SoT)

client.CloudforceOne.ThreatEvents.Tags.Categories.List(ctx, params) (*ThreatEventTagCategoryListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/tags/categories

Creates a new tag category (SoT)

client.CloudforceOne.ThreatEvents.Tags.Categories.New(ctx, params) (*ThreatEventTagCategoryNewResponse, error)

POST/accounts/{account_id}/cloudforce-one/events/tags/categories/create

Updates a tag category (SoT)

client.CloudforceOne.ThreatEvents.Tags.Categories.Edit(ctx, categoryUUID, params) (*ThreatEventTagCategoryEditResponse, error)

PATCH/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

Deletes a tag category (SoT)

client.CloudforceOne.ThreatEvents.Tags.Categories.Delete(ctx, categoryUUID, body) (*ThreatEventTagCategoryDeleteResponse, error)

DELETE/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

Threat EventsTagsIndicators

List indicators related to a tag

client.CloudforceOne.ThreatEvents.Tags.Indicators.List(ctx, tagUUID, params) (*ThreatEventTagIndicatorListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators

Threat EventsTagsIndicatorsBy Dataset

List indicators related to a tag within a dataset (deprecated)

Deprecated

client.CloudforceOne.ThreatEvents.Tags.Indicators.ByDataset.List(ctx, datasetID, tagUUID, params) (*ThreatEventTagIndicatorByDatasetListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators

Threat EventsEvent Tags

Adds a tag to an event

client.CloudforceOne.ThreatEvents.EventTags.New(ctx, eventID, params) (*ThreatEventEventTagNewResponse, error)

POST/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create

Removes a tag from an event

client.CloudforceOne.ThreatEvents.EventTags.Delete(ctx, eventID, body) (*ThreatEventEventTagDeleteResponse, error)

DELETE/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}

Threat EventsTarget Industries

Lists target industries across multiple datasets

client.CloudforceOne.ThreatEvents.TargetIndustries.List(ctx, params) (*ThreatEventTargetIndustryListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries

Threat EventsTarget IndustriesBy Dataset

Lists all target industries for a specific dataset

client.CloudforceOne.ThreatEvents.TargetIndustries.ByDataset.List(ctx, datasetID, query) (*ThreatEventTargetIndustryByDatasetListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries

Threat EventsTarget IndustriesCatalog

Lists all target industries from industry map catalog

client.CloudforceOne.ThreatEvents.TargetIndustries.Catalog.List(ctx, query) (*ThreatEventTargetIndustryCatalogListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog

Threat EventsInsights