# Threat Events ## Filter and list events `client.CloudforceOne.ThreatEvents.List(ctx, params) (*[]ThreatEventListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events` Use `datasetId=all` or `datasetId=*` to query all event datasets for the account (limited to 50). When `datasetId` is unspecified, events are listed from the default Cloudforce One Threat Events dataset. To list existing datasets, use the [`List Datasets`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint. ### Parameters - `params ThreatEventListParams` - `AccountID param.Field[string]` Path param: Account ID. - `Cursor param.Field[string]` Query param: Cursor for pagination. When provided, filters are embedded in the cursor so you only need to pass cursor and pageSize. Returned in the previous response's result_info.cursor field. Use cursor-based pagination for deep pagination (beyond 100,000 records) or for optimal performance. - `DatasetID param.Field[[]string]` Query param: Dataset IDs to query events from (array of UUIDs), or special value 'all' or '*' to query all event datasets for the account. If not provided, uses the default dataset. - `ForceRefresh param.Field[bool]` Query param - `Format param.Field[ThreatEventListParamsFormat]` Query param - `const ThreatEventListParamsFormatJson ThreatEventListParamsFormat = "json"` - `const ThreatEventListParamsFormatStix2 ThreatEventListParamsFormat = "stix2"` - `const ThreatEventListParamsFormatTaxii ThreatEventListParamsFormat = "taxii"` - `Order param.Field[ThreatEventListParamsOrder]` Query param - `const ThreatEventListParamsOrderAsc ThreatEventListParamsOrder = "asc"` - `const ThreatEventListParamsOrderDesc ThreatEventListParamsOrder = "desc"` - `OrderBy param.Field[string]` Query param - `Page param.Field[float64]` Query param: Page number (1-indexed) for offset-based pagination. Limited to offset of 100,000 records. For deep pagination, use cursor-based pagination instead. - `PageSize param.Field[float64]` Query param: Number of results per page. Maximum 25,000. - `Search param.Field[[]ThreatEventListParamsSearch]` Query param - `Field string` Event field to search on. Allowed: attacker, attackerCountry, category, createdAt, date, event, indicator, indicatorType, killChain, mitreAttack, tags, targetCountry, targetIndustry, tlp, uuid. - `Op ThreatEventListParamsSearchOp` Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'tags', op:'in', value:['malware','apt']}. - `const ThreatEventListParamsSearchOpEquals ThreatEventListParamsSearchOp = "equals"` - `const ThreatEventListParamsSearchOpNot ThreatEventListParamsSearchOp = "not"` - `const ThreatEventListParamsSearchOpGt ThreatEventListParamsSearchOp = "gt"` - `const ThreatEventListParamsSearchOpGte ThreatEventListParamsSearchOp = "gte"` - `const ThreatEventListParamsSearchOpLt ThreatEventListParamsSearchOp = "lt"` - `const ThreatEventListParamsSearchOpLte ThreatEventListParamsSearchOp = "lte"` - `const ThreatEventListParamsSearchOpLike ThreatEventListParamsSearchOp = "like"` - `const ThreatEventListParamsSearchOpContains ThreatEventListParamsSearchOp = "contains"` - `const ThreatEventListParamsSearchOpStartsWith ThreatEventListParamsSearchOp = "startsWith"` - `const ThreatEventListParamsSearchOpEndsWith ThreatEventListParamsSearchOp = "endsWith"` - `const ThreatEventListParamsSearchOpIn ThreatEventListParamsSearchOp = "in"` - `const ThreatEventListParamsSearchOpFind ThreatEventListParamsSearchOp = "find"` - `Value ThreatEventListParamsSearchValueUnion` Search value. String or number for most operators. Array for 'in' operator (max 100 items). - `UnionString` - `UnionFloat` - `type ThreatEventListParamsSearchValueArray []ThreatEventListParamsSearchValueArrayUnion` - `UnionString` - `UnionFloat` - `Source param.Field[ThreatEventListParamsSource]` Query param: Read backend. 'do' (default) reads Durable Object storage. 'r2catalog' reads R2 Data Catalog (admin-only, experimental; supports a subset of search fields — no 'tags'). - `const ThreatEventListParamsSourceDo ThreatEventListParamsSource = "do"` - `const ThreatEventListParamsSourceR2catalog ThreatEventListParamsSource = "r2catalog"` ### Returns - `type ThreatEventListResponse []ThreatEventListResponse` - `Attacker string` - `AttackerCountry string` - `AttackerCountryAlpha3 string` - `Category string` - `DatasetID string` - `Date string` - `Event string` - `HasChildren bool` - `Indicator string` - `IndicatorType string` - `IndicatorTypeID float64` - `KillChain float64` - `MitreAttack []string` - `MitreCapec []string` - `NumReferenced float64` - `NumReferences float64` - `RawID string` - `Referenced []string` - `ReferencedIDs []float64` - `References []string` - `ReferencesIDs []float64` - `Tags []string` - `TargetCountry string` - `TargetCountryAlpha3 string` - `TargetIndustry string` - `TLP string` - `UUID string` - `Insight string` - `ReleasabilityID string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) threatEvents, err := client.CloudforceOne.ThreatEvents.List(context.TODO(), cloudforce_one.ThreatEventListParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", threatEvents) } ``` #### Response ```json [ { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ] ``` ## Reads an event `client.CloudforceOne.ThreatEvents.Get(ctx, eventID, query) (*ThreatEventGetResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/{event_id}` This Method is deprecated. Please use /events/dataset/:dataset_id/events/:event_id instead. ### Parameters - `eventID string` Event UUID. - `query ThreatEventGetParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventGetResponse struct{…}` - `Attacker string` - `AttackerCountry string` - `AttackerCountryAlpha3 string` - `Category string` - `DatasetID string` - `Date string` - `Event string` - `HasChildren bool` - `Indicator string` - `IndicatorType string` - `IndicatorTypeID float64` - `KillChain float64` - `MitreAttack []string` - `MitreCapec []string` - `NumReferenced float64` - `NumReferences float64` - `RawID string` - `Referenced []string` - `ReferencedIDs []float64` - `References []string` - `ReferencesIDs []float64` - `Tags []string` - `TargetCountry string` - `TargetCountryAlpha3 string` - `TargetIndustry string` - `TLP string` - `UUID string` - `Insight string` - `ReleasabilityID string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) threatEvent, err := client.CloudforceOne.ThreatEvents.Get( context.TODO(), "event_id", cloudforce_one.ThreatEventGetParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", threatEvent.UUID) } ``` #### Response ```json { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ``` ## Creates a new event `client.CloudforceOne.ThreatEvents.New(ctx, params) (*ThreatEventNewResponse, error)` **post** `/accounts/{account_id}/cloudforce-one/events/create` To create a dataset, see the [`Create Dataset`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create/) endpoint. When `datasetId` parameter is unspecified, it will be created in a default dataset named `Cloudforce One Threat Events`. ### Parameters - `params ThreatEventNewParams` - `PathAccountID param.Field[string]` Path param: Account ID. - `Category param.Field[string]` Body param - `Date param.Field[Time]` Body param - `Event param.Field[string]` Body param - `Raw param.Field[ThreatEventNewParamsRaw]` Body param - `Data map[string, unknown]` - `Source string` - `TLP string` - `TLP param.Field[string]` Body param - `BodyAccountID param.Field[float64]` Body param - `Attacker param.Field[string]` Body param - `AttackerCountry param.Field[string]` Body param - `DatasetID param.Field[string]` Body param - `Indicator param.Field[string]` Body param - `Indicators param.Field[[]ThreatEventNewParamsIndicator]` Body param: Array of indicators for this event. Supports multiple indicators per event for complex scenarios. - `IndicatorType string` The type of indicator (e.g., DOMAIN, IP, JA3, HASH) - `Value string` The indicator value (e.g., domain name, IP address, hash) - `IndicatorType param.Field[string]` Body param - `Insight param.Field[string]` Body param - `Tags param.Field[[]string]` Body param - `TargetCountry param.Field[string]` Body param - `TargetIndustry param.Field[string]` Body param ### Returns - `type ThreatEventNewResponse struct{…}` - `Attacker string` - `AttackerCountry string` - `AttackerCountryAlpha3 string` - `Category string` - `DatasetID string` - `Date string` - `Event string` - `HasChildren bool` - `Indicator string` - `IndicatorType string` - `IndicatorTypeID float64` - `KillChain float64` - `MitreAttack []string` - `MitreCapec []string` - `NumReferenced float64` - `NumReferences float64` - `RawID string` - `Referenced []string` - `ReferencedIDs []float64` - `References []string` - `ReferencesIDs []float64` - `Tags []string` - `TargetCountry string` - `TargetCountryAlpha3 string` - `TargetIndustry string` - `TLP string` - `UUID string` - `Insight string` - `ReleasabilityID string` ### Example ```go package main import ( "context" "fmt" "time" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) threatEvent, err := client.CloudforceOne.ThreatEvents.New(context.TODO(), cloudforce_one.ThreatEventNewParams{ PathAccountID: cloudflare.F("account_id"), Category: cloudflare.F("Domain Resolution"), Date: cloudflare.F(time.Now()), Event: cloudflare.F("An attacker registered the domain domain.com"), Raw: cloudflare.F(cloudforce_one.ThreatEventNewParamsRaw{ Data: cloudflare.F(map[string]interface{}{ "foo": "bar", }), }), TLP: cloudflare.F("amber"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", threatEvent.UUID) } ``` #### Response ```json { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ``` ## Updates an event `client.CloudforceOne.ThreatEvents.Edit(ctx, eventID, params) (*ThreatEventEditResponse, error)` **patch** `/accounts/{account_id}/cloudforce-one/events/{event_id}` Update an existing event by its identifier. ### Parameters - `eventID string` Event UUID. - `params ThreatEventEditParams` - `AccountID param.Field[string]` Path param: Account ID. - `DatasetID param.Field[string]` Body param: Dataset ID containing the event to update. - `Attacker param.Field[string]` Body param - `AttackerCountry param.Field[string]` Body param - `Category param.Field[string]` Body param - `CreatedAt param.Field[Time]` Body param - `Date param.Field[Time]` Body param - `Event param.Field[string]` Body param - `Indicator param.Field[string]` Body param - `IndicatorType param.Field[string]` Body param - `Insight param.Field[string]` Body param - `Raw param.Field[ThreatEventEditParamsRaw]` Body param - `Data map[string, unknown]` - `Source string` - `TLP string` - `TargetCountry param.Field[string]` Body param - `TargetIndustry param.Field[string]` Body param - `TLP param.Field[string]` Body param ### Returns - `type ThreatEventEditResponse struct{…}` - `Attacker string` - `AttackerCountry string` - `AttackerCountryAlpha3 string` - `Category string` - `DatasetID string` - `Date string` - `Event string` - `HasChildren bool` - `Indicator string` - `IndicatorType string` - `IndicatorTypeID float64` - `KillChain float64` - `MitreAttack []string` - `MitreCapec []string` - `NumReferenced float64` - `NumReferences float64` - `RawID string` - `Referenced []string` - `ReferencedIDs []float64` - `References []string` - `ReferencesIDs []float64` - `Tags []string` - `TargetCountry string` - `TargetCountryAlpha3 string` - `TargetIndustry string` - `TLP string` - `UUID string` - `Insight string` - `ReleasabilityID string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.CloudforceOne.ThreatEvents.Edit( context.TODO(), "event_id", cloudforce_one.ThreatEventEditParams{ AccountID: cloudflare.F("account_id"), DatasetID: cloudflare.F("9b769969-a211-466c-8ac3-cb91266a066a"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.UUID) } ``` #### Response ```json { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ``` ## Creates bulk events `client.CloudforceOne.ThreatEvents.BulkNew(ctx, params) (*ThreatEventBulkNewResponse, error)` **post** `/accounts/{account_id}/cloudforce-one/events/create/bulk` The `datasetId` parameter must be defined. To list existing datasets (and their IDs) in your account, use the [`List Datasets`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint. ### Parameters - `params ThreatEventBulkNewParams` - `AccountID param.Field[string]` Path param: Account ID. - `Data param.Field[[]ThreatEventBulkNewParamsData]` Body param - `Category string` - `Date Time` - `Event string` - `Raw ThreatEventBulkNewParamsDataRaw` - `Data map[string, unknown]` - `Source string` - `TLP string` - `TLP string` - `AccountID float64` - `Attacker string` - `AttackerCountry string` - `DatasetID string` - `Indicator string` - `Indicators []ThreatEventBulkNewParamsDataIndicator` Array of indicators for this event. Supports multiple indicators per event for complex scenarios. - `IndicatorType string` The type of indicator (e.g., DOMAIN, IP, JA3, HASH) - `Value string` The indicator value (e.g., domain name, IP address, hash) - `IndicatorType string` - `Insight string` - `Tags []string` - `TargetCountry string` - `TargetIndustry string` - `DatasetID param.Field[string]` Body param - `IncludeCreatedEvents param.Field[bool]` Body param: When true, response includes array of created event UUIDs and shard IDs. Useful for tracking which events were created and where. ### Returns - `type ThreatEventBulkNewResponse struct{…}` Detailed result of bulk event creation with auto-tag management - `CreatedEventsCount float64` Number of events created - `CreatedTagsCount float64` Number of new tags created in SoT - `ErrorCount float64` Number of errors encountered - `QueuedIndicatorsCount float64` Number of indicators queued for async processing - `CreateBulkEventsRequestID string` Correlation ID for async indicator processing - `CreatedEvents []ThreatEventBulkNewResponseCreatedEvent` Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true - `EventIndex float64` Original index in the input data array - `ShardID string` Dataset ID of the shard where the event was created - `UUID string` UUID of the created event - `Errors []ThreatEventBulkNewResponseError` Array of error details - `Error string` Error message - `EventIndex float64` Index of the event that caused the error ### Example ```go package main import ( "context" "fmt" "time" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.CloudforceOne.ThreatEvents.BulkNew(context.TODO(), cloudforce_one.ThreatEventBulkNewParams{ AccountID: cloudflare.F("account_id"), Data: cloudflare.F([]cloudforce_one.ThreatEventBulkNewParamsData{cloudforce_one.ThreatEventBulkNewParamsData{ Category: cloudflare.F("Domain Resolution"), Date: cloudflare.F(time.Now()), Event: cloudflare.F("An attacker registered the domain domain.com"), Raw: cloudflare.F(cloudforce_one.ThreatEventBulkNewParamsDataRaw{ Data: cloudflare.F(map[string]interface{}{ "foo": "bar", }), }), TLP: cloudflare.F("amber"), }}), DatasetID: cloudflare.F("durableObjectName"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.CreatedEventsCount) } ``` #### Response ```json { "createdEventsCount": 0, "createdTagsCount": 0, "errorCount": 0, "queuedIndicatorsCount": 0, "createBulkEventsRequestId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "createdEvents": [ { "eventIndex": 0, "shardId": "shardId", "uuid": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" } ], "errors": [ { "error": "error", "eventIndex": 0 } ] } ``` ## Creates bulk DOS event with relationships and indicators `client.CloudforceOne.ThreatEvents.BulkNewRelationships(ctx, params) (*ThreatEventBulkNewRelationshipsResponse, error)` **post** `/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships` This method is deprecated. Please use `event_create_bulk` instead ### Parameters - `params ThreatEventBulkNewRelationshipsParams` - `AccountID param.Field[string]` Path param: Account ID. - `Data param.Field[[]ThreatEventBulkNewRelationshipsParamsData]` Body param - `Category string` - `Date Time` - `Event string` - `Raw ThreatEventBulkNewRelationshipsParamsDataRaw` - `Data map[string, unknown]` - `Source string` - `TLP string` - `TLP string` - `AccountID float64` - `Attacker string` - `AttackerCountry string` - `DatasetID string` - `Indicator string` - `Indicators []ThreatEventBulkNewRelationshipsParamsDataIndicator` Array of indicators for this event. Supports multiple indicators per event for complex scenarios. - `IndicatorType string` The type of indicator (e.g., DOMAIN, IP, JA3, HASH) - `Value string` The indicator value (e.g., domain name, IP address, hash) - `IndicatorType string` - `Insight string` - `Tags []string` - `TargetCountry string` - `TargetIndustry string` - `DatasetID param.Field[string]` Body param ### Returns - `type ThreatEventBulkNewRelationshipsResponse struct{…}` Result of bulk relationship creation operation - `CreatedEventsCount float64` Number of events created - `CreatedIndicatorsCount float64` Number of indicators created - `CreatedRelationshipsCount float64` Number of relationships created - `ErrorCount float64` Number of errors encountered - `Errors []ThreatEventBulkNewRelationshipsResponseError` Array of error details - `Error string` Error message - `EventIndex float64` Index of the event that caused the error ### Example ```go package main import ( "context" "fmt" "time" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.CloudforceOne.ThreatEvents.BulkNewRelationships(context.TODO(), cloudforce_one.ThreatEventBulkNewRelationshipsParams{ AccountID: cloudflare.F("account_id"), Data: cloudflare.F([]cloudforce_one.ThreatEventBulkNewRelationshipsParamsData{cloudforce_one.ThreatEventBulkNewRelationshipsParamsData{ Category: cloudflare.F("Domain Resolution"), Date: cloudflare.F(time.Now()), Event: cloudflare.F("An attacker registered the domain domain.com"), Raw: cloudflare.F(cloudforce_one.ThreatEventBulkNewRelationshipsParamsDataRaw{ Data: cloudflare.F(map[string]interface{}{ "foo": "bar", }), }), TLP: cloudflare.F("amber"), }}), DatasetID: cloudflare.F("durableObjectName"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.CreatedEventsCount) } ``` #### Response ```json { "createdEventsCount": 0, "createdIndicatorsCount": 0, "createdRelationshipsCount": 0, "errorCount": 0, "errors": [ { "error": "error", "eventIndex": 0 } ] } ``` # Aggregate ## Aggregate events by single or multiple columns with optional date filtering `client.CloudforceOne.ThreatEvents.Aggregate.List(ctx, params) (*ThreatEventAggregateListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/aggregate` Aggregate threat events by one or more columns (e.g., attacker, targetIndustry) with optional date filtering and daily grouping. Supports multi-dimensional aggregation for cross-analysis. ### Parameters - `params ThreatEventAggregateListParams` - `AccountID param.Field[string]` Path param: Account ID. - `AggregateBy param.Field[string]` Query param: Column(s) to aggregate by - single column or comma-separated list (e.g., 'attacker', 'targetIndustry', 'attacker,targetIndustry') - `DatasetID param.Field[[]string]` Query param: Dataset ID(s) to filter by. Can be a single dataset ID, comma-separated list, or array. If not provided, uses default dataset - `EndDate param.Field[string]` Query param: End date for filtering (ISO 8601 format, e.g., '2024-12-31') - `GroupByDate param.Field[bool]` Query param: Whether to group results by date (daily aggregation) - `Limit param.Field[float64]` Query param: Maximum number of results to return - `StartDate param.Field[string]` Query param: Start date for filtering (ISO 8601 format, e.g., '2024-01-01') ### Returns - `type ThreatEventAggregateListResponse struct{…}` - `AggregateBy string` Column(s) that were aggregated by - `Aggregations []ThreatEventAggregateListResponseAggregation` Array of aggregation results with dynamic fields based on aggregateBy columns - `Count float64` Number of events for this aggregation - `Date string` Date (if groupByDate is true) - `Total float64` Total number of events in the aggregation - `DateRange ThreatEventAggregateListResponseDateRange` Date range used for filtering - `EndDate string` - `StartDate string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) aggregates, err := client.CloudforceOne.ThreatEvents.Aggregate.List(context.TODO(), cloudforce_one.ThreatEventAggregateListParams{ AccountID: cloudflare.F("account_id"), AggregateBy: cloudflare.F("aggregateBy"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", aggregates.AggregateBy) } ``` #### Response ```json { "aggregateBy": "aggregateBy", "aggregations": [ { "count": 0, "date": "date" } ], "total": 0, "dateRange": { "endDate": "endDate", "startDate": "startDate" } } ``` # Graphql ## GraphQL endpoint for event aggregation `client.CloudforceOne.ThreatEvents.Graphql.New(ctx, body) (*ThreatEventGraphqlNewResponse, error)` **post** `/accounts/{account_id}/cloudforce-one/events/graphql` Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation. ### Parameters - `body ThreatEventGraphqlNewParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventGraphqlNewResponse struct{…}` - `Data unknown` - `Errors []unknown` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) graphql, err := client.CloudforceOne.ThreatEvents.Graphql.New(context.TODO(), cloudforce_one.ThreatEventGraphqlNewParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", graphql.Data) } ``` #### Response ```json { "data": {}, "errors": [ {} ] } ``` # Graph ## Query graph neighborhood from R2 Data Catalog `client.CloudforceOne.ThreatEvents.Graph.List(ctx, params) (*ThreatEventGraphListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/graph` Expands the single-level relationship neighborhood of one or more seed nodes (event, indicator, or tag) from R2 Data Catalog. Seeds use compact id format (type:uuid), e.g. "event:550e8400-...". Multi-seed requests merge and deduplicate results server-side. Hydrates neighbor entities with summary data from Durable Objects. Supports filtering by relationship type and dataset scope. ### Parameters - `params ThreatEventGraphListParams` - `AccountID param.Field[string]` Path param: Account ID. - `Cursor param.Field[string]` Query param: Opaque pagination token. Only valid when seeds has exactly 1 entry; 400 otherwise. - `DatasetIDs param.Field[[]string]` Query param: Comma-separated dataset UUIDs to restrict neighbor scope. Intersected with ACL grants. - `Direction param.Field[string]` Query param: Edge direction relative to each seed: out (seed→neighbors), in (neighbors→seed), both (default). - `Expand param.Field[[]string]` Query param: Comma-separated list of response sections to expand (hydrate). Allowed: `nodes`. Omitting `expand` returns identifier-only nodes. - `Hydration param.Field[string]` Query param: Hydration strategy for neighbor nodes when expand=nodes is set. r2_join (default): use R2 JOIN query + DO fallback. do_only: use plain R2 query + hydrate all neighbors via Durable Objects. - `Limit param.Field[float64]` Query param: Max neighbors per seed (default: 100, max: 1000). Values above 1000 return 400. - `MaxNodes param.Field[float64]` Query param: Total accumulated node cap across all seeds (default: 500, max: 1000). Values above 1000 return 400. - `RelationshipTypes param.Field[[]string]` Query param: Comma-separated relationship types to filter by. Allowed: tagged_with, appears_in, related_to, caused_by, attributed_to. - `Seeds param.Field[[]string]` Query param: Comma-separated compact seed ids (type:uuid). Example: seeds=event:550e8400-...,indicator:661fa920-... Provide 1–50 entries; omitting seeds returns 400. ### Returns - `type ThreatEventGraphListResponse struct{…}` - `Edges []ThreatEventGraphListResponseEdge` - `ID string` Deterministic composite edge id (source→target:relationshipType) - `RelationshipType string` - `Source string` Compact id of the source node (type:uuid) - `SourceID string` - `SourceType string` - `Target string` Compact id of the target node (type:uuid) - `TargetID string` - `TargetType string` - `Node map[string, unknown]` Focal node object (legacy single-seed). Null when unavailable. - `Nodes []map[string, unknown]` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) graphs, err := client.CloudforceOne.ThreatEvents.Graph.List(context.TODO(), cloudforce_one.ThreatEventGraphListParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", graphs.Edges) } ``` #### Response ```json { "errors": [], "messages": [], "result": { "edges": [ { "id": "event:550e8400-e29b-41d4-a716-446655440000→indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04:appears_in", "relationshipType": "appears_in", "source": "event:550e8400-e29b-41d4-a716-446655440000", "sourceId": "550e8400-e29b-41d4-a716-446655440000", "sourceType": "event", "target": "indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04", "targetId": "661fa920-bbf3-4e71-9c55-2a3d8e7f1b04", "targetType": "indicator" } ], "node": null, "nodes": [ { "attacker": "APT28", "category": "intrusion", "datasetId": "a1b2c3d4-0001-4000-8000-000000000001", "date": "2026-06-01", "event": "Attacker registered domain evil.example.com", "id": "event:550e8400-e29b-41d4-a716-446655440000", "role": "focal", "type": "event", "uuid": "550e8400-e29b-41d4-a716-446655440000" }, { "datasetId": "a1b2c3d4-0001-4000-8000-000000000001", "id": "indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04", "indicatorType": "domain", "role": "focal", "type": "indicator", "uuid": "661fa920-bbf3-4e71-9c55-2a3d8e7f1b04", "value": "evil.example.com" }, { "categoryId": "threat-actor", "id": "tag:772af1c8-dc4a-4a29-b3e6-4f8c9d2a6e71", "type": "tag", "uuid": "772af1c8-dc4a-4a29-b3e6-4f8c9d2a6e71", "value": "APT28" } ] }, "result_info": { "count": 3, "cursor": null, "depth_reached": 1, "edge_count": 1, "has_more": false, "query_time_ms": 890, "seeds": [ "event:550e8400-e29b-41d4-a716-446655440000", "indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04" ], "total_count": 3, "truncated": false }, "success": true } ``` # Queries ## List all saved event queries `client.CloudforceOne.ThreatEvents.Queries.List(ctx, query) (*[]ThreatEventQueryListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/queries` Retrieve all saved event queries for the account ### Parameters - `query ThreatEventQueryListParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventQueryListResponse []ThreatEventQueryListResponse` - `ID int64` Unique identifier for the saved query - `AccountID int64` Account ID - `AlertEnabled bool` Whether alerts are enabled - `AlertRollupEnabled bool` Whether alert rollup is enabled - `CreatedAt string` Creation timestamp - `Name string` Name of the saved query - `QueryJson string` JSON string containing the query parameters - `RuleEnabled bool` Whether rule is enabled - `UpdatedAt string` Last update timestamp - `UserEmail string` Email of the user who created the query - `CustomThreatFeedID int64` Intel Indicator Feed ID (numeric) - `RuleListID string` WAF rules list ID for blocking - `RuleScope string` Scope for the rule ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) queries, err := client.CloudforceOne.ThreatEvents.Queries.List(context.TODO(), cloudforce_one.ThreatEventQueryListParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", queries) } ``` #### Response ```json [ { "id": 0, "account_id": 0, "alert_enabled": true, "alert_rollup_enabled": true, "created_at": "created_at", "name": "name", "query_json": "query_json", "rule_enabled": true, "updated_at": "updated_at", "user_email": "user_email", "custom_threat_feed_id": 0, "rule_list_id": "rule_list_id", "rule_scope": "rule_scope" } ] ``` ## Create a saved event query `client.CloudforceOne.ThreatEvents.Queries.New(ctx, params) (*ThreatEventQueryNewResponse, error)` **post** `/accounts/{account_id}/cloudforce-one/events/queries/create` Create a new saved event query for the account ### Parameters - `params ThreatEventQueryNewParams` - `AccountID param.Field[string]` Path param: Account ID. - `AlertEnabled param.Field[bool]` Body param: Enable alerts for this query - `AlertRollupEnabled param.Field[bool]` Body param: Enable alert rollup for this query - `Name param.Field[string]` Body param: Unique name for the saved query - `QueryJson param.Field[string]` Body param: JSON string containing the query parameters - `RuleEnabled param.Field[bool]` Body param: Enable rule for this query - `RuleScope param.Field[string]` Body param: Scope for the rule ### Returns - `type ThreatEventQueryNewResponse struct{…}` - `ID int64` Unique identifier for the saved query - `AccountID int64` Account ID - `AlertEnabled bool` Whether alerts are enabled - `AlertRollupEnabled bool` Whether alert rollup is enabled - `CreatedAt string` Creation timestamp - `Name string` Name of the saved query - `QueryJson string` JSON string containing the query parameters - `RuleEnabled bool` Whether rule is enabled - `UpdatedAt string` Last update timestamp - `UserEmail string` Email of the user who created the query - `CustomThreatFeedID int64` Intel Indicator Feed ID (numeric) - `RuleListID string` WAF rules list ID for blocking - `RuleScope string` Scope for the rule ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) query, err := client.CloudforceOne.ThreatEvents.Queries.New(context.TODO(), cloudforce_one.ThreatEventQueryNewParams{ AccountID: cloudflare.F("account_id"), AlertEnabled: cloudflare.F(true), AlertRollupEnabled: cloudflare.F(true), Name: cloudflare.F("name"), QueryJson: cloudflare.F("query_json"), RuleEnabled: cloudflare.F(true), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", query.ID) } ``` #### Response ```json { "id": 0, "account_id": 0, "alert_enabled": true, "alert_rollup_enabled": true, "created_at": "created_at", "name": "name", "query_json": "query_json", "rule_enabled": true, "updated_at": "updated_at", "user_email": "user_email", "custom_threat_feed_id": 0, "rule_list_id": "rule_list_id", "rule_scope": "rule_scope" } ``` ## Read a saved event query `client.CloudforceOne.ThreatEvents.Queries.Get(ctx, queryID, query) (*ThreatEventQueryGetResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/queries/{query_id}` Retrieve a saved event query by its ID ### Parameters - `queryID int64` Event query ID - `query ThreatEventQueryGetParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventQueryGetResponse struct{…}` - `ID int64` Unique identifier for the saved query - `AccountID int64` Account ID - `AlertEnabled bool` Whether alerts are enabled - `AlertRollupEnabled bool` Whether alert rollup is enabled - `CreatedAt string` Creation timestamp - `Name string` Name of the saved query - `QueryJson string` JSON string containing the query parameters - `RuleEnabled bool` Whether rule is enabled - `UpdatedAt string` Last update timestamp - `UserEmail string` Email of the user who created the query - `CustomThreatFeedID int64` Intel Indicator Feed ID (numeric) - `RuleListID string` WAF rules list ID for blocking - `RuleScope string` Scope for the rule ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) query, err := client.CloudforceOne.ThreatEvents.Queries.Get( context.TODO(), int64(0), cloudforce_one.ThreatEventQueryGetParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", query.ID) } ``` #### Response ```json { "id": 0, "account_id": 0, "alert_enabled": true, "alert_rollup_enabled": true, "created_at": "created_at", "name": "name", "query_json": "query_json", "rule_enabled": true, "updated_at": "updated_at", "user_email": "user_email", "custom_threat_feed_id": 0, "rule_list_id": "rule_list_id", "rule_scope": "rule_scope" } ``` ## Update a saved event query `client.CloudforceOne.ThreatEvents.Queries.Edit(ctx, queryID, params) (*ThreatEventQueryEditResponse, error)` **patch** `/accounts/{account_id}/cloudforce-one/events/queries/{query_id}` Update an existing saved event query by its ID ### Parameters - `queryID int64` Event query ID - `params ThreatEventQueryEditParams` - `AccountID param.Field[string]` Path param: Account ID. - `AlertEnabled param.Field[bool]` Body param: Enable alerts for this query - `AlertRollupEnabled param.Field[bool]` Body param: Enable alert rollup for this query - `Name param.Field[string]` Body param: Unique name for the saved query - `QueryJson param.Field[string]` Body param: JSON string containing the query parameters - `RuleEnabled param.Field[bool]` Body param: Enable rule for this query - `RuleScope param.Field[string]` Body param: Scope for the rule ### Returns - `type ThreatEventQueryEditResponse struct{…}` - `ID int64` Unique identifier for the saved query - `AccountID int64` Account ID - `AlertEnabled bool` Whether alerts are enabled - `AlertRollupEnabled bool` Whether alert rollup is enabled - `CreatedAt string` Creation timestamp - `Name string` Name of the saved query - `QueryJson string` JSON string containing the query parameters - `RuleEnabled bool` Whether rule is enabled - `UpdatedAt string` Last update timestamp - `UserEmail string` Email of the user who created the query - `CustomThreatFeedID int64` Intel Indicator Feed ID (numeric) - `RuleListID string` WAF rules list ID for blocking - `RuleScope string` Scope for the rule ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.CloudforceOne.ThreatEvents.Queries.Edit( context.TODO(), int64(0), cloudforce_one.ThreatEventQueryEditParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.ID) } ``` #### Response ```json { "id": 0, "account_id": 0, "alert_enabled": true, "alert_rollup_enabled": true, "created_at": "created_at", "name": "name", "query_json": "query_json", "rule_enabled": true, "updated_at": "updated_at", "user_email": "user_email", "custom_threat_feed_id": 0, "rule_list_id": "rule_list_id", "rule_scope": "rule_scope" } ``` ## Delete a saved event query `client.CloudforceOne.ThreatEvents.Queries.Delete(ctx, queryID, body) error` **delete** `/accounts/{account_id}/cloudforce-one/events/queries/{query_id}` Delete a saved event query by its ID ### Parameters - `queryID int64` Event query ID - `body ThreatEventQueryDeleteParams` - `AccountID param.Field[string]` Account ID. ### Example ```go package main import ( "context" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) err := client.CloudforceOne.ThreatEvents.Queries.Delete( context.TODO(), int64(0), cloudforce_one.ThreatEventQueryDeleteParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } } ``` # Relationships ## Filter and list events related to specific event `client.CloudforceOne.ThreatEvents.Relationships.List(ctx, eventID, params) (*[]ThreatEventRelationshipListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships` The `event_id` must be defined (to list existing events (and their IDs), use the [`Filter and List Events`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/methods/list/) endpoint). Also, must provide query parameters. ### Parameters - `eventID string` Event UUID. - `params ThreatEventRelationshipListParams` - `AccountID param.Field[string]` Path param: Account ID. - `DatasetID param.Field[string]` Query param: The dataset ID to search within. - `Direction param.Field[ThreatEventRelationshipListParamsDirection]` Query param: The direction to traverse the graph. Defaults to 'both' to search all. - `const ThreatEventRelationshipListParamsDirectionAncestors ThreatEventRelationshipListParamsDirection = "ancestors"` - `const ThreatEventRelationshipListParamsDirectionDescendants ThreatEventRelationshipListParamsDirection = "descendants"` - `const ThreatEventRelationshipListParamsDirectionBoth ThreatEventRelationshipListParamsDirection = "both"` - `IncludeParent param.Field[bool]` Query param: Whether to include the starting event in the results. Defaults to true. - `IndicatorTypeIDs param.Field[[]string]` Query param: An optional array of indicator type IDs to filter the results by. - `MaxDepth param.Field[float64]` Query param: The maximum depth to traverse. Defaults to 5. - `Page param.Field[float64]` Query param - `PageSize param.Field[float64]` Query param - `RelationshipTypes param.Field[ThreatEventRelationshipListParamsRelationshipTypesUnion]` Query param: An optional array of relationship types to filter by. - `UnionString` - `type ThreatEventRelationshipListParamsRelationshipTypesArray []string` ### Returns - `type ThreatEventRelationshipListResponse []ThreatEventRelationshipListResponse` - `Attacker string` - `AttackerCountry string` - `AttackerCountryAlpha3 string` - `Category string` - `DatasetID string` - `Date string` - `Event string` - `HasChildren bool` - `Indicator string` - `IndicatorType string` - `IndicatorTypeID float64` - `KillChain float64` - `MitreAttack []string` - `MitreCapec []string` - `NumReferenced float64` - `NumReferences float64` - `RawID string` - `Referenced []string` - `ReferencedIDs []float64` - `References []string` - `ReferencesIDs []float64` - `Tags []string` - `TargetCountry string` - `TargetCountryAlpha3 string` - `TargetIndustry string` - `TLP string` - `UUID string` - `Insight string` - `ReleasabilityID string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) relationships, err := client.CloudforceOne.ThreatEvents.Relationships.List( context.TODO(), "event_id", cloudforce_one.ThreatEventRelationshipListParams{ AccountID: cloudflare.F("account_id"), DatasetID: cloudflare.F("datasetId"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", relationships) } ``` #### Response ```json [ { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ] ``` # Indicators ## Lists indicators across multiple datasets `client.CloudforceOne.ThreatEvents.Indicators.List(ctx, params) (*ThreatEventIndicatorListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/indicators` Retrieves a paginated list of indicators across specified datasets. Use datasetIds=all or datasetIds=* to query all datasets for the account. If no datasetIds provided, uses the default dataset. ### Parameters - `params ThreatEventIndicatorListParams` - `AccountID param.Field[string]` Path param: Account ID. - `CreatedAfter param.Field[Time]` Query param: Filter indicators created on or after this date. Must use ISO 8601 format (e.g., '2024-01-15T00:00:00Z'). - `CreatedBefore param.Field[Time]` Query param: Filter indicators created on or before this date. Must use ISO 8601 format (e.g., '2024-12-31T23:59:59Z'). - `DatasetIDs param.Field[[]string]` Query param: Dataset IDs to query indicators from (array of UUIDs), or special value 'all' or '*' to query all datasets. If not provided, uses the default dataset. - `Format param.Field[ThreatEventIndicatorListParamsFormat]` Query param: Output format for indicator data. 'json' returns the default format, 'stix2' returns STIX 2.1 Indicator SDOs, 'taxii' returns a TAXII 2.1 Envelope with Content-Type application/taxii+json;version=2.1. - `const ThreatEventIndicatorListParamsFormatJson ThreatEventIndicatorListParamsFormat = "json"` - `const ThreatEventIndicatorListParamsFormatStix2 ThreatEventIndicatorListParamsFormat = "stix2"` - `const ThreatEventIndicatorListParamsFormatTaxii ThreatEventIndicatorListParamsFormat = "taxii"` - `IncludeTags param.Field[bool]` Query param: Whether to include full tag details for each indicator. Defaults to true. - `IncludeTotalCount param.Field[bool]` Query param: Whether to compute accurate total count via COUNT(*). Defaults to false for performance. When false, total_count is an approximation. - `IndicatorType param.Field[string]` Query param - `Name param.Field[string]` Query param: Filter indicators by value using substring match (LIKE). Legacy alternative to structured search. - `Page param.Field[float64]` Query param - `PageSize param.Field[float64]` Query param - `RelatedEvents param.Field[[]string]` Query param: Filter by related event IDs - `RelatedEventsLimit param.Field[float64]` Query param: Limit the number of related events returned per indicator. Default: 2. Set to 0 for none, -1 for all events. - `Search param.Field[[]ThreatEventIndicatorListParamsSearch]` Query param: Structured search as a JSON array of {field, op, value} objects. Searchable fields: value, indicatorType. Supports operators: equals, not, contains, startsWith, endsWith, gt, lt, gte, lte, like, in, find. Use the 'in' operator with an array value to bulk-check up to 100 indicators in a single request, e.g. search=[{"field":"value","op":"in","value":["evil.com","bad.org"]}]. Multiple conditions are AND'd together. Max 10 conditions per request. - `Field ThreatEventIndicatorListParamsSearchField` The indicator field to search on. Allowed: value, indicatorType. - `const ThreatEventIndicatorListParamsSearchFieldValue ThreatEventIndicatorListParamsSearchField = "value"` - `const ThreatEventIndicatorListParamsSearchFieldIndicatorType ThreatEventIndicatorListParamsSearchField = "indicatorType"` - `Op ThreatEventIndicatorListParamsSearchOp` Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'value', op:'in', value:['evil.com','bad.org']}. - `const ThreatEventIndicatorListParamsSearchOpEquals ThreatEventIndicatorListParamsSearchOp = "equals"` - `const ThreatEventIndicatorListParamsSearchOpNot ThreatEventIndicatorListParamsSearchOp = "not"` - `const ThreatEventIndicatorListParamsSearchOpGt ThreatEventIndicatorListParamsSearchOp = "gt"` - `const ThreatEventIndicatorListParamsSearchOpGte ThreatEventIndicatorListParamsSearchOp = "gte"` - `const ThreatEventIndicatorListParamsSearchOpLt ThreatEventIndicatorListParamsSearchOp = "lt"` - `const ThreatEventIndicatorListParamsSearchOpLte ThreatEventIndicatorListParamsSearchOp = "lte"` - `const ThreatEventIndicatorListParamsSearchOpLike ThreatEventIndicatorListParamsSearchOp = "like"` - `const ThreatEventIndicatorListParamsSearchOpContains ThreatEventIndicatorListParamsSearchOp = "contains"` - `const ThreatEventIndicatorListParamsSearchOpStartsWith ThreatEventIndicatorListParamsSearchOp = "startsWith"` - `const ThreatEventIndicatorListParamsSearchOpEndsWith ThreatEventIndicatorListParamsSearchOp = "endsWith"` - `const ThreatEventIndicatorListParamsSearchOpIn ThreatEventIndicatorListParamsSearchOp = "in"` - `const ThreatEventIndicatorListParamsSearchOpFind ThreatEventIndicatorListParamsSearchOp = "find"` - `Value ThreatEventIndicatorListParamsSearchValueUnion` Search value. String for most operators. Array of strings for 'in' operator (max 100 items). - `UnionString` - `type ThreatEventIndicatorListParamsSearchValueArray []string` - `Source param.Field[ThreatEventIndicatorListParamsSource]` Query param: Read backend. 'do' (default) reads Durable Object storage. 'r2catalog' reads R2 Data Catalog (admin-only, experimental; supports a subset of search fields). - `const ThreatEventIndicatorListParamsSourceDo ThreatEventIndicatorListParamsSource = "do"` - `const ThreatEventIndicatorListParamsSourceR2catalog ThreatEventIndicatorListParamsSource = "r2catalog"` - `Tags param.Field[[]string]` Query param: Filter by tag values or UUIDs. Indicators must have at least one of the specified tags (OR logic). Supports both tag UUID and tag value. - `TagSearch param.Field[[]ThreatEventIndicatorListParamsTagSearch]` Query param: Structured tag-metadata filter as a JSON array of {field, op, value} objects. Operates against the per-dataset IndicatorTag mirror so you can find indicators by tag attributes (origin country, motive, sophistication, priority, etc.) without a separate Tags lookup. Common dashboard usage: drill from a country into indicators, e.g. tagSearch=[{"field":"originCountryISO","op":"in","value":["IR","CN"]}]. Country values may be passed as alpha-2, alpha-3, name, or alias (e.g. "iran"). Operators: equals, not, gt/gte/lt/lte (numeric only), contains/like/find/startsWith/endsWith (string only), in. AND-joined across entries; combined with `tags`, a matching tag must satisfy both. Max 10 entries per request, max 100 values per 'in'. Performance notes: `originCountryISO` uses its B-tree index for equals/not/in. `priority` uses its B-tree index for numeric comparisons. Other string columns (`actorCategory`, `motive`, etc.) are case-insensitive and unindexed; current catalog size makes this a non-issue. `endsWith` and `aliasGroupNames` contains/like are leading-wildcard scans and slow on large result sets. `aliasGroupNames` matches on the JSON-encoded text, so substrings can cross alias boundaries ("apt28" also matches "apt280" when both appear in the same tag's alias list). - `Field ThreatEventIndicatorListParamsTagSearchField` Tag mirror field to filter on. Allowed: value, categoryId, actorCategory, aliasGroupNames, attributionConfidence, attributionOrganization, motive, opsecLevel, originCountryISO, sophisticationLevel, priority, analyticPriority. Filters operate against the per-dataset IndicatorTag mirror (which is kept in sync with the Tags SoT by the tag-propagation workflow). - `const ThreatEventIndicatorListParamsTagSearchFieldValue ThreatEventIndicatorListParamsTagSearchField = "value"` - `const ThreatEventIndicatorListParamsTagSearchFieldCategoryID ThreatEventIndicatorListParamsTagSearchField = "categoryId"` - `const ThreatEventIndicatorListParamsTagSearchFieldActorCategory ThreatEventIndicatorListParamsTagSearchField = "actorCategory"` - `const ThreatEventIndicatorListParamsTagSearchFieldAliasGroupNames ThreatEventIndicatorListParamsTagSearchField = "aliasGroupNames"` - `const ThreatEventIndicatorListParamsTagSearchFieldAttributionConfidence ThreatEventIndicatorListParamsTagSearchField = "attributionConfidence"` - `const ThreatEventIndicatorListParamsTagSearchFieldAttributionOrganization ThreatEventIndicatorListParamsTagSearchField = "attributionOrganization"` - `const ThreatEventIndicatorListParamsTagSearchFieldMotive ThreatEventIndicatorListParamsTagSearchField = "motive"` - `const ThreatEventIndicatorListParamsTagSearchFieldOpsecLevel ThreatEventIndicatorListParamsTagSearchField = "opsecLevel"` - `const ThreatEventIndicatorListParamsTagSearchFieldOriginCountryISO ThreatEventIndicatorListParamsTagSearchField = "originCountryISO"` - `const ThreatEventIndicatorListParamsTagSearchFieldSophisticationLevel ThreatEventIndicatorListParamsTagSearchField = "sophisticationLevel"` - `const ThreatEventIndicatorListParamsTagSearchFieldPriority ThreatEventIndicatorListParamsTagSearchField = "priority"` - `const ThreatEventIndicatorListParamsTagSearchFieldAnalyticPriority ThreatEventIndicatorListParamsTagSearchField = "analyticPriority"` - `Op ThreatEventIndicatorListParamsTagSearchOp` Search operator. Use 'in' for bulk OR within a single field, e.g. {field:"originCountryISO", op:"in", value:["IR","CN"]}. - `const ThreatEventIndicatorListParamsTagSearchOpEquals ThreatEventIndicatorListParamsTagSearchOp = "equals"` - `const ThreatEventIndicatorListParamsTagSearchOpNot ThreatEventIndicatorListParamsTagSearchOp = "not"` - `const ThreatEventIndicatorListParamsTagSearchOpGt ThreatEventIndicatorListParamsTagSearchOp = "gt"` - `const ThreatEventIndicatorListParamsTagSearchOpGte ThreatEventIndicatorListParamsTagSearchOp = "gte"` - `const ThreatEventIndicatorListParamsTagSearchOpLt ThreatEventIndicatorListParamsTagSearchOp = "lt"` - `const ThreatEventIndicatorListParamsTagSearchOpLte ThreatEventIndicatorListParamsTagSearchOp = "lte"` - `const ThreatEventIndicatorListParamsTagSearchOpLike ThreatEventIndicatorListParamsTagSearchOp = "like"` - `const ThreatEventIndicatorListParamsTagSearchOpContains ThreatEventIndicatorListParamsTagSearchOp = "contains"` - `const ThreatEventIndicatorListParamsTagSearchOpStartsWith ThreatEventIndicatorListParamsTagSearchOp = "startsWith"` - `const ThreatEventIndicatorListParamsTagSearchOpEndsWith ThreatEventIndicatorListParamsTagSearchOp = "endsWith"` - `const ThreatEventIndicatorListParamsTagSearchOpIn ThreatEventIndicatorListParamsTagSearchOp = "in"` - `const ThreatEventIndicatorListParamsTagSearchOpFind ThreatEventIndicatorListParamsTagSearchOp = "find"` - `Value ThreatEventIndicatorListParamsTagSearchValueUnion` Search value. String or number for most operators. Array for 'in' (max 100 items). Country values may be passed as alpha-2, alpha-3, name, or common alias (e.g. "iran", "IR", "IRN") and are normalized to alpha-2 server-side. - `UnionString` - `UnionFloat` - `type ThreatEventIndicatorListParamsTagSearchValueArray []ThreatEventIndicatorListParamsTagSearchValueArrayUnion` - `UnionString` - `UnionFloat` ### Returns - `type ThreatEventIndicatorListResponse struct{…}` - `Properties ThreatEventIndicatorListResponseProperties` - `Indicators ThreatEventIndicatorListResponsePropertiesIndicators` - `Items ThreatEventIndicatorListResponsePropertiesIndicatorsItems` - `CreatedAt Time` - `IndicatorType string` - `UpdatedAt Time` - `UUID string` - `Value string` - `DatasetID string` The dataset ID this indicator belongs to. Included in list responses. - `RelatedEvents []ThreatEventIndicatorListResponsePropertiesIndicatorsItemsRelatedEvent` - `DatasetID string` - `EventID string` - `Tags []ThreatEventIndicatorListResponsePropertiesIndicatorsItemsTag` - `CategoryName string` - `UUID string` - `Value string` - `Type string` - `Pagination ThreatEventIndicatorListResponsePropertiesPagination` - `Properties ThreatEventIndicatorListResponsePropertiesPaginationProperties` - `Count ThreatEventIndicatorListResponsePropertiesPaginationPropertiesCount` - `Type string` - `Page ThreatEventIndicatorListResponsePropertiesPaginationPropertiesPage` - `Type string` - `PerPage ThreatEventIndicatorListResponsePropertiesPaginationPropertiesPerPage` - `Type string` - `TotalCount ThreatEventIndicatorListResponsePropertiesPaginationPropertiesTotalCount` - `Type string` - `Type string` - `Type string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) indicators, err := client.CloudforceOne.ThreatEvents.Indicators.List(context.TODO(), cloudforce_one.ThreatEventIndicatorListParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", indicators.Properties) } ``` #### Response ```json { "properties": { "indicators": { "items": { "createdAt": "2022-04-01T00:00:00Z", "indicatorType": "domain", "updatedAt": "2022-04-01T00:00:00Z", "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "malicious-domain.com", "datasetId": "dataset-uuid-123", "relatedEvents": [ { "datasetId": "dataset-uuid-123", "eventId": "event-uuid-456" } ], "tags": [ { "categoryName": "categoryName", "uuid": "uuid", "value": "value" } ] }, "type": "array" }, "pagination": { "properties": { "count": { "type": "number" }, "page": { "type": "number" }, "per_page": { "type": "number" }, "total_count": { "type": "number" } }, "type": "object" } }, "type": "object" } ``` # Aggregate ## Aggregate indicators by column(s) `client.CloudforceOne.ThreatEvents.Indicators.Aggregate.List(ctx, params) (*ThreatEventIndicatorAggregateListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/indicators/aggregate` Aggregate threat indicators by one or more columns (e.g., indicatorType, value) across datasets. Returns top-N groups ordered by count. ### Parameters - `params ThreatEventIndicatorAggregateListParams` - `AccountID param.Field[string]` Path param: Account ID. - `AggregateBy param.Field[string]` Query param: Column(s) to aggregate by - single column or comma-separated list (e.g., 'indicatorType', 'value', 'indicatorType,value') - `CreatedAfter param.Field[string]` Query param: Filter indicators created after this date (ISO 8601 format, e.g., '2024-01-01') - `CreatedBefore param.Field[string]` Query param: Filter indicators created before this date (ISO 8601 format, e.g., '2024-12-31') - `DatasetIDs param.Field[[]string]` Query param: Dataset ID(s) to filter by. Can be a single dataset ID or comma-separated list. If not provided, aggregates across all accessible datasets - `EventDateAfter param.Field[string]` Query param: For measure=relationships: only count event links whose eventDate is on/after this date (ISO 8601). Use to bound 'top indicator' to recent activity. - `EventDateBefore param.Field[string]` Query param: For measure=relationships: only count event links whose eventDate is on/before this date (ISO 8601). - `Limit param.Field[float64]` Query param: Maximum number of aggregation results to return (1-100) - `Measure param.Field[ThreatEventIndicatorAggregateListParamsMeasure]` Query param: What to count per group: 'indicators' (catalog rows, default) or 'relationships' (linked events per indicator). Use 'relationships' for 'top indicator by event activity'. - `const ThreatEventIndicatorAggregateListParamsMeasureIndicators ThreatEventIndicatorAggregateListParamsMeasure = "indicators"` - `const ThreatEventIndicatorAggregateListParamsMeasureRelationships ThreatEventIndicatorAggregateListParamsMeasure = "relationships"` - `TagUUID param.Field[string]` Query param: Scope to indicators associated with this tag/actor UUID. Combine with measure=relationships for 'top indicator for an actor'. ### Returns - `type ThreatEventIndicatorAggregateListResponse struct{…}` - `AggregateBy string` Column(s) that were aggregated by - `Aggregations []ThreatEventIndicatorAggregateListResponseAggregation` Array of aggregation results with dynamic fields based on aggregateBy columns - `Count float64` Number of indicators for this aggregation - `FailedDatasets float64` Number of datasets whose aggregation failed and were excluded from the result - `Total float64` Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) aggregates, err := client.CloudforceOne.ThreatEvents.Indicators.Aggregate.List(context.TODO(), cloudforce_one.ThreatEventIndicatorAggregateListParams{ AccountID: cloudflare.F("account_id"), AggregateBy: cloudflare.F("aggregateBy"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", aggregates.AggregateBy) } ``` #### Response ```json { "aggregateBy": "aggregateBy", "aggregations": [ { "count": 0 } ], "failedDatasets": 0, "total": 0 } ``` # Types ## Lists indicator types across multiple datasets `client.CloudforceOne.ThreatEvents.Indicators.Types.List(ctx, params) (*ThreatEventIndicatorTypeListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/indicator-types` List indicator types across one or more datasets for the account. ### Parameters - `params ThreatEventIndicatorTypeListParams` - `AccountID param.Field[string]` Path param: Account ID. - `DatasetIDs param.Field[[]string]` Query param: Array of dataset IDs to query indicator types from. If not provided, queries all datasets for the account. ### Returns - `type ThreatEventIndicatorTypeListResponse struct{…}` - `Items ThreatEventIndicatorTypeListResponseItems` - `Type string` - `Type string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) types, err := client.CloudforceOne.ThreatEvents.Indicators.Types.List(context.TODO(), cloudforce_one.ThreatEventIndicatorTypeListParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", types.Items) } ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` # By Dataset ## Lists indicators `client.CloudforceOne.ThreatEvents.Indicators.ByDataset.List(ctx, datasetID, params) (*ThreatEventIndicatorByDatasetListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators` This method is deprecated. Please use /events/indicators to retrieve a paginated list of indicators. ### Parameters - `datasetID string` Dataset UUID. - `params ThreatEventIndicatorByDatasetListParams` - `AccountID param.Field[string]` Path param: Account ID. - `IndicatorType param.Field[string]` Query param - `Name param.Field[string]` Query param: Filter by indicator value (substring match) - `Page param.Field[float64]` Query param - `PageSize param.Field[float64]` Query param - `RelatedEvent param.Field[[]string]` Query param: Filter indicators by related event UUID(s). Multiple UUIDs can be provided by repeating the parameter. ### Returns - `type ThreatEventIndicatorByDatasetListResponse struct{…}` - `Indicators []ThreatEventIndicatorByDatasetListResponseIndicator` - `CreatedAt Time` - `IndicatorType string` - `UpdatedAt Time` - `UUID string` - `Value string` - `DatasetID string` The dataset ID this indicator belongs to. Included in list responses. - `RelatedEvents []ThreatEventIndicatorByDatasetListResponseIndicatorsRelatedEvent` - `DatasetID string` - `EventID string` - `Tags []ThreatEventIndicatorByDatasetListResponseIndicatorsTag` - `CategoryName string` - `UUID string` - `Value string` - `Pagination ThreatEventIndicatorByDatasetListResponsePagination` - `Page float64` - `PageSize float64` - `TotalCount float64` - `TotalPages float64` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) byDatasets, err := client.CloudforceOne.ThreatEvents.Indicators.ByDataset.List( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", cloudforce_one.ThreatEventIndicatorByDatasetListParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", byDatasets.Indicators) } ``` #### Response ```json { "indicators": [ { "createdAt": "2022-04-01T00:00:00Z", "indicatorType": "domain", "updatedAt": "2022-04-01T00:00:00Z", "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "malicious-domain.com", "datasetId": "dataset-uuid-123", "relatedEvents": [ { "datasetId": "dataset-uuid-123", "eventId": "event-uuid-456" } ], "tags": [ { "categoryName": "categoryName", "uuid": "uuid", "value": "value" } ] } ], "pagination": { "page": 0, "pageSize": 0, "totalCount": 0, "totalPages": 0 } } ``` ## Reads an indicator `client.CloudforceOne.ThreatEvents.Indicators.ByDataset.Get(ctx, datasetID, indicatorID, query) (*ThreatEventIndicatorByDatasetGetResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}` Retrieves a specific indicator by its UUID. ### Parameters - `datasetID string` Dataset ID. - `indicatorID string` Indicator UUID. - `query ThreatEventIndicatorByDatasetGetParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventIndicatorByDatasetGetResponse struct{…}` - `CreatedAt Time` - `IndicatorType string` - `UpdatedAt Time` - `UUID string` - `Value string` - `DatasetID string` The dataset ID this indicator belongs to. Included in list responses. - `RelatedEvents []ThreatEventIndicatorByDatasetGetResponseRelatedEvent` - `DatasetID string` - `EventID string` - `Tags []ThreatEventIndicatorByDatasetGetResponseTag` - `CategoryName string` - `UUID string` - `Value string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) byDataset, err := client.CloudforceOne.ThreatEvents.Indicators.ByDataset.Get( context.TODO(), "dataset_id", "indicator_id", cloudforce_one.ThreatEventIndicatorByDatasetGetParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", byDataset.UUID) } ``` #### Response ```json { "createdAt": "2022-04-01T00:00:00Z", "indicatorType": "domain", "updatedAt": "2022-04-01T00:00:00Z", "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "malicious-domain.com", "datasetId": "dataset-uuid-123", "relatedEvents": [ { "datasetId": "dataset-uuid-123", "eventId": "event-uuid-456" } ], "tags": [ { "categoryName": "categoryName", "uuid": "uuid", "value": "value" } ] } ``` # Tags ## List mirrored tags for an indicator dataset `client.CloudforceOne.ThreatEvents.Indicators.ByDataset.Tags.List(ctx, datasetID, query) (*[]ThreatEventIndicatorByDatasetTagListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags` Returns all mirrored tags from the indicator dataset (DO mirror table). No pagination. ### Parameters - `datasetID string` Dataset ID. - `query ThreatEventIndicatorByDatasetTagListParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventIndicatorByDatasetTagListResponse []ThreatEventIndicatorByDatasetTagListResponse` Array of mirror tag rows ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) tags, err := client.CloudforceOne.ThreatEvents.Indicators.ByDataset.Tags.List( context.TODO(), "dataset_id", cloudforce_one.ThreatEventIndicatorByDatasetTagListParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", tags) } ``` #### Response ```json [ {} ] ``` # Attackers ## Lists attackers across multiple datasets `client.CloudforceOne.ThreatEvents.Attackers.List(ctx, params) (*ThreatEventAttackerListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/attackers` List attacker names referenced in events across one or more datasets. ### Parameters - `params ThreatEventAttackerListParams` - `AccountID param.Field[string]` Path param: Account ID. - `DatasetIDs param.Field[[]string]` Query param: Array of dataset IDs to query attackers from. If not provided, uses the default dataset. ### Returns - `type ThreatEventAttackerListResponse struct{…}` - `Items ThreatEventAttackerListResponseItems` - `Type string` - `Type string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) attackers, err := client.CloudforceOne.ThreatEvents.Attackers.List(context.TODO(), cloudforce_one.ThreatEventAttackerListParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", attackers.Items) } ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` # Categories ## Lists categories across multiple datasets `client.CloudforceOne.ThreatEvents.Categories.List(ctx, params) (*[]ThreatEventCategoryListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/categories` List categories across one or more datasets for the account. ### Parameters - `params ThreatEventCategoryListParams` - `AccountID param.Field[string]` Path param: Account ID. - `DatasetIDs param.Field[[]string]` Query param: Array of dataset IDs to query categories from. If not provided, uses the default dataset. ### Returns - `type ThreatEventCategoryListResponse []ThreatEventCategoryListResponse` - `KillChain float64` - `Name string` - `UUID string` - `MitreAttack []string` - `MitreCapec []string` - `Shortname string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) categories, err := client.CloudforceOne.ThreatEvents.Categories.List(context.TODO(), cloudforce_one.ThreatEventCategoryListParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", categories) } ``` #### Response ```json [ { "killChain": 0, "name": "name", "uuid": "12345678-1234-1234-1234-1234567890ab", "mitreAttack": [ "T1234" ], "mitreCapec": [ "123" ], "shortname": "shortname" } ] ``` ## Reads a category `client.CloudforceOne.ThreatEvents.Categories.Get(ctx, categoryID, query) (*ThreatEventCategoryGetResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/categories/{category_id}` Retrieve a single category by its identifier. ### Parameters - `categoryID string` Category UUID. - `query ThreatEventCategoryGetParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventCategoryGetResponse struct{…}` - `KillChain float64` - `Name string` - `UUID string` - `MitreAttack []string` - `MitreCapec []string` - `Shortname string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) category, err := client.CloudforceOne.ThreatEvents.Categories.Get( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", cloudforce_one.ThreatEventCategoryGetParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", category.UUID) } ``` #### Response ```json { "killChain": 0, "name": "name", "uuid": "12345678-1234-1234-1234-1234567890ab", "mitreAttack": [ "T1234" ], "mitreCapec": [ "123" ], "shortname": "shortname" } ``` ## Creates a new category `client.CloudforceOne.ThreatEvents.Categories.New(ctx, params) (*ThreatEventCategoryNewResponse, error)` **post** `/accounts/{account_id}/cloudforce-one/events/categories/create` Create a new event category for the account. ### Parameters - `params ThreatEventCategoryNewParams` - `AccountID param.Field[string]` Path param: Account ID. - `KillChain param.Field[float64]` Body param - `Name param.Field[string]` Body param - `MitreAttack param.Field[[]string]` Body param - `MitreCapec param.Field[[]string]` Body param - `Shortname param.Field[string]` Body param ### Returns - `type ThreatEventCategoryNewResponse struct{…}` - `KillChain float64` - `Name string` - `UUID string` - `MitreAttack []string` - `MitreCapec []string` - `Shortname string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) category, err := client.CloudforceOne.ThreatEvents.Categories.New(context.TODO(), cloudforce_one.ThreatEventCategoryNewParams{ AccountID: cloudflare.F("account_id"), KillChain: cloudflare.F(0.000000), Name: cloudflare.F("name"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", category.UUID) } ``` #### Response ```json { "killChain": 0, "name": "name", "uuid": "12345678-1234-1234-1234-1234567890ab", "mitreAttack": [ "T1234" ], "mitreCapec": [ "123" ], "shortname": "shortname" } ``` ## Updates a category `client.CloudforceOne.ThreatEvents.Categories.Edit(ctx, categoryID, params) (*ThreatEventCategoryEditResponse, error)` **patch** `/accounts/{account_id}/cloudforce-one/events/categories/{category_id}` Update an existing category by its identifier. ### Parameters - `categoryID string` Category UUID. - `params ThreatEventCategoryEditParams` - `AccountID param.Field[string]` Path param: Account ID. - `KillChain param.Field[float64]` Body param - `MitreAttack param.Field[[]string]` Body param - `MitreCapec param.Field[[]string]` Body param - `Name param.Field[string]` Body param - `Shortname param.Field[string]` Body param ### Returns - `type ThreatEventCategoryEditResponse struct{…}` - `KillChain float64` - `Name string` - `UUID string` - `MitreAttack []string` - `MitreCapec []string` - `Shortname string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.CloudforceOne.ThreatEvents.Categories.Edit( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", cloudforce_one.ThreatEventCategoryEditParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.UUID) } ``` #### Response ```json { "killChain": 0, "name": "name", "uuid": "12345678-1234-1234-1234-1234567890ab", "mitreAttack": [ "T1234" ], "mitreCapec": [ "123" ], "shortname": "shortname" } ``` ## Deletes a category `client.CloudforceOne.ThreatEvents.Categories.Delete(ctx, categoryID, body) (*ThreatEventCategoryDeleteResponse, error)` **delete** `/accounts/{account_id}/cloudforce-one/events/categories/{category_id}` Delete a category by its identifier. ### Parameters - `categoryID string` Category UUID. - `body ThreatEventCategoryDeleteParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventCategoryDeleteResponse struct{…}` - `UUID string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) category, err := client.CloudforceOne.ThreatEvents.Categories.Delete( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", cloudforce_one.ThreatEventCategoryDeleteParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", category.UUID) } ``` #### Response ```json { "uuid": "12345678-1234-1234-1234-1234567890ab" } ``` # Catalog ## Lists categories `client.CloudforceOne.ThreatEvents.Categories.Catalog.List(ctx, query) (*[]ThreatEventCategoryCatalogListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/categories/catalog` List all categories stored in the account catalog. ### Parameters - `query ThreatEventCategoryCatalogListParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventCategoryCatalogListResponse []ThreatEventCategoryCatalogListResponse` - `KillChain float64` - `Name string` - `UUID string` - `MitreAttack []string` - `MitreCapec []string` - `Shortname string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) catalogs, err := client.CloudforceOne.ThreatEvents.Categories.Catalog.List(context.TODO(), cloudforce_one.ThreatEventCategoryCatalogListParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", catalogs) } ``` #### Response ```json [ { "killChain": 0, "name": "name", "uuid": "12345678-1234-1234-1234-1234567890ab", "mitreAttack": [ "T1234" ], "mitreCapec": [ "123" ], "shortname": "shortname" } ] ``` # Countries ## Retrieves countries information for all countries `client.CloudforceOne.ThreatEvents.Countries.List(ctx, query) (*[]ThreatEventCountryListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/countries` Retrieve country code information for all supported countries. ### Parameters - `query ThreatEventCountryListParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventCountryListResponse []ThreatEventCountryListResponse` - `Result []ThreatEventCountryListResponseResult` - `Alpha2 string` - `Alpha3 string` - `Name string` - `Success string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) countries, err := client.CloudforceOne.ThreatEvents.Countries.List(context.TODO(), cloudforce_one.ThreatEventCountryListParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", countries) } ``` #### Response ```json [ { "result": [ { "alpha2": "AF", "alpha3": "AF", "name": "Afghanistan" } ], "success": "true" } ] ``` # Crons # Datasets ## Lists all datasets in an account `client.CloudforceOne.ThreatEvents.Datasets.List(ctx, params) (*[]ThreatEventDatasetListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/dataset` List all datasets accessible to the account. ### Parameters - `params ThreatEventDatasetListParams` - `AccountID param.Field[string]` Path param: Account ID. - `IncludeDeleted param.Field[bool]` Query param: When true, include soft-deleted datasets in the response. Each item includes a `deletedAt` field (ISO 8601 or null). Default: false. ### Returns - `type ThreatEventDatasetListResponse []ThreatEventDatasetListResponse` - `IsPublic bool` - `Name string` - `UUID string` - `DeletedAt string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) datasets, err := client.CloudforceOne.ThreatEvents.Datasets.List(context.TODO(), cloudforce_one.ThreatEventDatasetListParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", datasets) } ``` #### Response ```json [ { "isPublic": true, "name": "friendly dataset name", "uuid": "12345678-1234-1234-1234-1234567890ab", "deletedAt": "deletedAt" } ] ``` ## Reads a dataset `client.CloudforceOne.ThreatEvents.Datasets.Get(ctx, datasetID, query) (*ThreatEventDatasetGetResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}` Retrieve metadata for a specific dataset. ### Parameters - `datasetID string` Dataset ID. - `query ThreatEventDatasetGetParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventDatasetGetResponse struct{…}` - `IsPublic bool` - `Name string` - `UUID string` - `DeletedAt string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) dataset, err := client.CloudforceOne.ThreatEvents.Datasets.Get( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", cloudforce_one.ThreatEventDatasetGetParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", dataset.UUID) } ``` #### Response ```json { "isPublic": true, "name": "friendly dataset name", "uuid": "12345678-1234-1234-1234-1234567890ab", "deletedAt": "deletedAt" } ``` ## Creates a dataset `client.CloudforceOne.ThreatEvents.Datasets.New(ctx, params) (*ThreatEventDatasetNewResponse, error)` **post** `/accounts/{account_id}/cloudforce-one/events/dataset/create` Create a new dataset in the account. ### Parameters - `params ThreatEventDatasetNewParams` - `AccountID param.Field[string]` Path param: Account ID. - `IsPublic param.Field[bool]` Body param: If true, then anyone can search the dataset. If false, then its limited to the account. - `Name param.Field[string]` Body param: Used to describe the dataset within the account context. ### Returns - `type ThreatEventDatasetNewResponse struct{…}` - `IsPublic bool` - `Name string` - `UUID string` - `DeletedAt string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) dataset, err := client.CloudforceOne.ThreatEvents.Datasets.New(context.TODO(), cloudforce_one.ThreatEventDatasetNewParams{ AccountID: cloudflare.F("account_id"), IsPublic: cloudflare.F(true), Name: cloudflare.F("x"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", dataset.UUID) } ``` #### Response ```json { "isPublic": true, "name": "friendly dataset name", "uuid": "12345678-1234-1234-1234-1234567890ab", "deletedAt": "deletedAt" } ``` ## Updates an existing dataset `client.CloudforceOne.ThreatEvents.Datasets.Edit(ctx, datasetID, params) (*ThreatEventDatasetEditResponse, error)` **patch** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}` Update an existing dataset by its identifier. ### Parameters - `datasetID string` Dataset ID. - `params ThreatEventDatasetEditParams` - `AccountID param.Field[string]` Path param: Account ID. - `IsPublic param.Field[bool]` Body param: If true, then anyone can search the dataset. If false, then its limited to the account. - `Name param.Field[string]` Body param: Used to describe the dataset within the account context. ### Returns - `type ThreatEventDatasetEditResponse struct{…}` - `IsPublic bool` - `Name string` - `UUID string` - `DeletedAt string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.CloudforceOne.ThreatEvents.Datasets.Edit( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", cloudforce_one.ThreatEventDatasetEditParams{ AccountID: cloudflare.F("account_id"), IsPublic: cloudflare.F(true), Name: cloudflare.F("x"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.UUID) } ``` #### Response ```json { "isPublic": true, "name": "friendly dataset name", "uuid": "12345678-1234-1234-1234-1234567890ab", "deletedAt": "deletedAt" } ``` ## Delete a dataset `client.CloudforceOne.ThreatEvents.Datasets.Delete(ctx, datasetID, body) (*ThreatEventDatasetDeleteResponse, error)` **delete** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}` Soft-deletes a dataset given a datasetId. ### Parameters - `datasetID string` Dataset ID to delete - `body ThreatEventDatasetDeleteParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventDatasetDeleteResponse struct{…}` - `Name string` - `UUID string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) dataset, err := client.CloudforceOne.ThreatEvents.Datasets.Delete( context.TODO(), "dataset_id", cloudforce_one.ThreatEventDatasetDeleteParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", dataset.UUID) } ``` #### Response ```json { "name": "friendly dataset name", "uuid": "12345678-1234-1234-1234-1234567890ab" } ``` ## Reads raw data for an event by UUID `client.CloudforceOne.ThreatEvents.Datasets.Raw(ctx, datasetID, eventID, query) (*ThreatEventDatasetRawResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}` Retrieves the raw data associated with an event. Searches across all shards in the dataset. ### Parameters - `datasetID string` Dataset ID. - `eventID string` Event ID. - `query ThreatEventDatasetRawParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventDatasetRawResponse struct{…}` - `ID float64` - `AccountID float64` - `Created string` - `Data string` - `Source string` - `TLP string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.CloudforceOne.ThreatEvents.Datasets.Raw( context.TODO(), "dataset_id", "event_id", cloudforce_one.ThreatEventDatasetRawParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.ID) } ``` #### Response ```json { "id": 1, "accountId": 1234, "created": "1970-01-01T00:00:00.000Z", "data": "{\"foo\": \"bar\"}", "source": "https://example.com", "tlp": "amber" } ``` # Health # Events ## Reads an event `client.CloudforceOne.ThreatEvents.Datasets.Events.Get(ctx, datasetID, eventID, query) (*ThreatEventDatasetEventGetResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}` Retrieves a specific event by its UUID. ### Parameters - `datasetID string` Dataset ID. - `eventID string` Event UUID. - `query ThreatEventDatasetEventGetParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventDatasetEventGetResponse struct{…}` - `Attacker string` - `AttackerCountry string` - `AttackerCountryAlpha3 string` - `Category string` - `DatasetID string` - `Date string` - `Event string` - `HasChildren bool` - `Indicator string` - `IndicatorType string` - `IndicatorTypeID float64` - `KillChain float64` - `MitreAttack []string` - `MitreCapec []string` - `NumReferenced float64` - `NumReferences float64` - `RawID string` - `Referenced []string` - `ReferencedIDs []float64` - `References []string` - `ReferencesIDs []float64` - `Tags []string` - `TargetCountry string` - `TargetCountryAlpha3 string` - `TargetIndustry string` - `TLP string` - `UUID string` - `Insight string` - `ReleasabilityID string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) event, err := client.CloudforceOne.ThreatEvents.Datasets.Events.Get( context.TODO(), "dataset_id", "event_id", cloudforce_one.ThreatEventDatasetEventGetParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", event.UUID) } ``` #### Response ```json { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ``` # Indicator Types ## Lists all indicator types `client.CloudforceOne.ThreatEvents.IndicatorTypes.List(ctx, query) (*ThreatEventIndicatorTypeListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/indicatorTypes` This Method is deprecated. Please use /events/dataset/:dataset_id/indicatorTypes instead. ### Parameters - `query ThreatEventIndicatorTypeListParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventIndicatorTypeListResponse struct{…}` - `Items ThreatEventIndicatorTypeListResponseItems` - `Type string` - `Type string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) indicatorTypes, err := client.CloudforceOne.ThreatEvents.IndicatorTypes.List(context.TODO(), cloudforce_one.ThreatEventIndicatorTypeListParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", indicatorTypes.Items) } ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` # Raw ## Reads data for a raw event `client.CloudforceOne.ThreatEvents.Raw.Get(ctx, eventID, rawID, query) (*ThreatEventRawGetResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}` Retrieve raw data for a specific event. ### Parameters - `eventID string` Event UUID. - `rawID string` Raw Event UUID. - `query ThreatEventRawGetParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventRawGetResponse struct{…}` - `ID string` - `AccountID float64` - `Created string` - `Data unknown` - `Source string` - `TLP string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) raw, err := client.CloudforceOne.ThreatEvents.Raw.Get( context.TODO(), "event_id", "raw_id", cloudforce_one.ThreatEventRawGetParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", raw.ID) } ``` #### Response ```json { "id": "1234", "accountId": 1234, "created": "1970-01-01", "data": {}, "source": "https://example.com", "tlp": "amber" } ``` ## Updates a raw event `client.CloudforceOne.ThreatEvents.Raw.Edit(ctx, eventID, rawID, params) (*ThreatEventRawEditResponse, error)` **patch** `/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}` Update raw data for a specific event. ### Parameters - `eventID string` Event UUID. - `rawID string` Raw Event UUID. - `params ThreatEventRawEditParams` - `AccountID param.Field[string]` Path param: Account ID. - `Data param.Field[unknown]` Body param - `Source param.Field[string]` Body param - `TLP param.Field[string]` Body param ### Returns - `type ThreatEventRawEditResponse struct{…}` - `ID string` - `Data unknown` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.CloudforceOne.ThreatEvents.Raw.Edit( context.TODO(), "event_id", "raw_id", cloudforce_one.ThreatEventRawEditParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.ID) } ``` #### Response ```json { "id": "1234", "data": {} } ``` # Relate ## Removes an event reference `client.CloudforceOne.ThreatEvents.Relate.Delete(ctx, eventID, body) (*ThreatEventRelateDeleteResponse, error)` **delete** `/accounts/{account_id}/cloudforce-one/events/relate/{event_id}` Remove one or more references from an event. ### Parameters - `eventID string` Event UUID. - `body ThreatEventRelateDeleteParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventRelateDeleteResponse struct{…}` - `Success bool` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) relate, err := client.CloudforceOne.ThreatEvents.Relate.Delete( context.TODO(), "event_id", cloudforce_one.ThreatEventRelateDeleteParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", relate.Success) } ``` #### Response ```json { "result": { "success": true }, "success": true } ``` # Tags ## Lists all tags (SoT) `client.CloudforceOne.ThreatEvents.Tags.List(ctx, params) (*ThreatEventTagListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/tags` Returns all Source-of-Truth tags for an account. Supports legacy free-text `search` on tag value and `categoryUuid` exact match, plus a structured `filters` JSON array for filtering by metadata fields (originCountryISO, actorCategory, motive, priority, etc.). Country values may be passed as alpha-2, alpha-3, name, or common alias. ### Parameters - `params ThreatEventTagListParams` - `AccountID param.Field[string]` Path param: Account ID. - `CategoryUUID param.Field[string]` Query param - `Filters param.Field[[]ThreatEventTagListParamsFilter]` Query param: Structured filters as a JSON array of {field, op, value} objects. Searchable fields: uuid, value, actorCategory, actorCategoryConfidence, aliasGroupNames, attributionConfidence, attributionConfidenceScore, attributionOrganization, categoryName, motive, motiveConfidence, opsecLevel, originCountryISO, originCountryConfidence, sophisticationLevel, priority, analyticPriority. Operators: equals, not, contains, startsWith, endsWith, gt, lt, gte, lte, like, in, find. Use 'in' for bulk OR within a single field, e.g. filters=[{"field":"originCountryISO","op":"in","value":["IR","CN"]}]. Multiple entries are AND-joined. Max 10 entries per request, max 100 values per 'in'. Per-field notes: `uuid` accepts only 'equals' and 'in' (other operators throw ValidationError) — matched against the canonical lowercase storage but callers may pass either case (the server lowercases before comparison); index-backed by the column's UNIQUE constraint and intended for batched UUID → tag resolution. `originCountryISO` uses its B-tree index for equals/not/in. `priority` uses its B-tree index for numeric comparisons. Other string columns (`actorCategory`, `motive`, etc.) are case-insensitive and unindexed; current catalog size makes this a non-issue. `endsWith` and `aliasGroupNames` contains/like are leading-wildcard scans and slow on large result sets. `aliasGroupNames` matches on the JSON-encoded text, so substrings can cross alias boundaries (a search for "apt28" will also match "apt280" if both appear in the same tag's alias list). - `Field ThreatEventTagListParamsFiltersField` Tag field to search on. Allowed: uuid, value, actorCategory, actorCategoryConfidence, aliasGroupNames, attributionConfidence, attributionConfidenceScore, attributionOrganization, categoryName, motive, motiveConfidence, opsecLevel, originCountryISO, originCountryConfidence, sophisticationLevel, priority, analyticPriority. - `const ThreatEventTagListParamsFiltersFieldUUID ThreatEventTagListParamsFiltersField = "uuid"` - `const ThreatEventTagListParamsFiltersFieldValue ThreatEventTagListParamsFiltersField = "value"` - `const ThreatEventTagListParamsFiltersFieldActorCategory ThreatEventTagListParamsFiltersField = "actorCategory"` - `const ThreatEventTagListParamsFiltersFieldActorCategoryConfidence ThreatEventTagListParamsFiltersField = "actorCategoryConfidence"` - `const ThreatEventTagListParamsFiltersFieldAliasGroupNames ThreatEventTagListParamsFiltersField = "aliasGroupNames"` - `const ThreatEventTagListParamsFiltersFieldAttributionConfidence ThreatEventTagListParamsFiltersField = "attributionConfidence"` - `const ThreatEventTagListParamsFiltersFieldAttributionConfidenceScore ThreatEventTagListParamsFiltersField = "attributionConfidenceScore"` - `const ThreatEventTagListParamsFiltersFieldAttributionOrganization ThreatEventTagListParamsFiltersField = "attributionOrganization"` - `const ThreatEventTagListParamsFiltersFieldCategoryName ThreatEventTagListParamsFiltersField = "categoryName"` - `const ThreatEventTagListParamsFiltersFieldMotive ThreatEventTagListParamsFiltersField = "motive"` - `const ThreatEventTagListParamsFiltersFieldMotiveConfidence ThreatEventTagListParamsFiltersField = "motiveConfidence"` - `const ThreatEventTagListParamsFiltersFieldOpsecLevel ThreatEventTagListParamsFiltersField = "opsecLevel"` - `const ThreatEventTagListParamsFiltersFieldOriginCountryISO ThreatEventTagListParamsFiltersField = "originCountryISO"` - `const ThreatEventTagListParamsFiltersFieldOriginCountryConfidence ThreatEventTagListParamsFiltersField = "originCountryConfidence"` - `const ThreatEventTagListParamsFiltersFieldSophisticationLevel ThreatEventTagListParamsFiltersField = "sophisticationLevel"` - `const ThreatEventTagListParamsFiltersFieldPriority ThreatEventTagListParamsFiltersField = "priority"` - `const ThreatEventTagListParamsFiltersFieldAnalyticPriority ThreatEventTagListParamsFiltersField = "analyticPriority"` - `Op ThreatEventTagListParamsFiltersOp` Search operator. Use 'in' for bulk OR within a single field, e.g. {field:"originCountryISO", op:"in", value:["IR","CN"]}. - `const ThreatEventTagListParamsFiltersOpEquals ThreatEventTagListParamsFiltersOp = "equals"` - `const ThreatEventTagListParamsFiltersOpNot ThreatEventTagListParamsFiltersOp = "not"` - `const ThreatEventTagListParamsFiltersOpGt ThreatEventTagListParamsFiltersOp = "gt"` - `const ThreatEventTagListParamsFiltersOpGte ThreatEventTagListParamsFiltersOp = "gte"` - `const ThreatEventTagListParamsFiltersOpLt ThreatEventTagListParamsFiltersOp = "lt"` - `const ThreatEventTagListParamsFiltersOpLte ThreatEventTagListParamsFiltersOp = "lte"` - `const ThreatEventTagListParamsFiltersOpLike ThreatEventTagListParamsFiltersOp = "like"` - `const ThreatEventTagListParamsFiltersOpContains ThreatEventTagListParamsFiltersOp = "contains"` - `const ThreatEventTagListParamsFiltersOpStartsWith ThreatEventTagListParamsFiltersOp = "startsWith"` - `const ThreatEventTagListParamsFiltersOpEndsWith ThreatEventTagListParamsFiltersOp = "endsWith"` - `const ThreatEventTagListParamsFiltersOpIn ThreatEventTagListParamsFiltersOp = "in"` - `const ThreatEventTagListParamsFiltersOpFind ThreatEventTagListParamsFiltersOp = "find"` - `Value ThreatEventTagListParamsFiltersValueUnion` Search value. String or number for most operators. Array for 'in' (max 100 items). Country values may be passed as alpha-2, alpha-3, name, or common alias (e.g. 'iran', 'IR', 'IRN') and are normalized to alpha-2 server-side. - `UnionString` - `UnionFloat` - `type ThreatEventTagListParamsFiltersValueArray []ThreatEventTagListParamsFiltersValueArrayUnion` - `UnionString` - `UnionFloat` - `Page param.Field[float64]` Query param - `PageSize param.Field[float64]` Query param - `Search param.Field[string]` Query param: Legacy free-text substring match on tag value. ### Returns - `type ThreatEventTagListResponse struct{…}` - `Pagination ThreatEventTagListResponsePagination` - `Page float64` - `PageSize float64` - `TotalCount float64` - `TotalPages float64` - `Tags []ThreatEventTagListResponseTag` - `UUID string` - `Value string` - `ActiveDuration string` - `ActorCategory string` - `ActorCategoryConfidence int64` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `Aliases []ThreatEventTagListResponseTagsAlias` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `Value string` - `Confidence int64` - `TLP ThreatEventTagListResponseTagsAliasesTLP` - `const ThreatEventTagListResponseTagsAliasesTLPRed ThreatEventTagListResponseTagsAliasesTLP = "red"` - `const ThreatEventTagListResponseTagsAliasesTLPAmber ThreatEventTagListResponseTagsAliasesTLP = "amber"` - `const ThreatEventTagListResponseTagsAliasesTLPGreen ThreatEventTagListResponseTagsAliasesTLP = "green"` - `const ThreatEventTagListResponseTagsAliasesTLPWhite ThreatEventTagListResponseTagsAliasesTLP = "white"` - `AliasGroupNames []string` - `AliasGroupNamesInternal []string` - `AnalyticPriority float64` - `AttributionConfidence string` - `AttributionConfidenceScore int64` - `AttributionOrganization string` - `CategoryName string` - `CategoryUUID string` - `DateOfDiscovery string` - `ExternalReferenceLinks []string` - `ExternalReferences []ThreatEventTagListResponseTagsExternalReference` Structured external references ({ url, description }). Public: returned to all accounts. - `URL string` - `Description string` - `InternalAliases []ThreatEventTagListResponseTagsInternalAlias` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `Value string` - `Confidence int64` - `TLP ThreatEventTagListResponseTagsInternalAliasesTLP` - `const ThreatEventTagListResponseTagsInternalAliasesTLPRed ThreatEventTagListResponseTagsInternalAliasesTLP = "red"` - `const ThreatEventTagListResponseTagsInternalAliasesTLPAmber ThreatEventTagListResponseTagsInternalAliasesTLP = "amber"` - `const ThreatEventTagListResponseTagsInternalAliasesTLPGreen ThreatEventTagListResponseTagsInternalAliasesTLP = "green"` - `const ThreatEventTagListResponseTagsInternalAliasesTLPWhite ThreatEventTagListResponseTagsInternalAliasesTLP = "white"` - `InternalDescription string` - `Motive string` - `MotiveConfidence int64` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `OpsecLevel string` - `OriginCountryConfidence int64` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `OriginCountryISO string` - `OriginCountryISOAlpha3 string` - `OriginCountryTLP ThreatEventTagListResponseTagsOriginCountryTLP` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `const ThreatEventTagListResponseTagsOriginCountryTLPRed ThreatEventTagListResponseTagsOriginCountryTLP = "red"` - `const ThreatEventTagListResponseTagsOriginCountryTLPAmber ThreatEventTagListResponseTagsOriginCountryTLP = "amber"` - `const ThreatEventTagListResponseTagsOriginCountryTLPGreen ThreatEventTagListResponseTagsOriginCountryTLP = "green"` - `const ThreatEventTagListResponseTagsOriginCountryTLPWhite ThreatEventTagListResponseTagsOriginCountryTLP = "white"` - `Priority float64` - `SophisticationLevel string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) tags, err := client.CloudforceOne.ThreatEvents.Tags.List(context.TODO(), cloudforce_one.ThreatEventTagListParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", tags.Pagination) } ``` #### Response ```json { "pagination": { "page": 0, "pageSize": 0, "totalCount": 0, "totalPages": 0 }, "tags": [ { "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "APT28", "activeDuration": "activeDuration", "actorCategory": "actorCategory", "actorCategoryConfidence": 7, "aliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "aliasGroupNames": [ "string" ], "aliasGroupNamesInternal": [ "string" ], "analyticPriority": 0, "attributionConfidence": "attributionConfidence", "attributionConfidenceScore": 7, "attributionOrganization": "attributionOrganization", "categoryName": "Nation State", "categoryUuid": "12345678-1234-1234-1234-1234567890ab", "dateOfDiscovery": "2024-01-15", "externalReferenceLinks": [ "string" ], "externalReferences": [ { "url": "https://example.com/report", "description": "Vendor threat report" } ], "internalAliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "internalDescription": "internalDescription", "motive": "motive", "motiveConfidence": 7, "opsecLevel": "opsecLevel", "originCountryConfidence": 7, "originCountryISO": "originCountryISO", "originCountryISOAlpha3": "IRN", "originCountryTlp": "amber", "priority": 0, "sophisticationLevel": "sophisticationLevel" } ] } ``` ## Creates a new tag `client.CloudforceOne.ThreatEvents.Tags.New(ctx, params) (*ThreatEventTagNewResponse, error)` **post** `/accounts/{account_id}/cloudforce-one/events/tags/create` Creates a new tag to be used accross threat events. ### Parameters - `params ThreatEventTagNewParams` - `AccountID param.Field[string]` Path param: Account ID. - `Value param.Field[string]` Body param - `ActiveDuration param.Field[string]` Body param - `ActorCategory param.Field[string]` Body param: Actor variety. Allowed values: Activist, Competitor, Customer, Crime Syndicate, Former Employee, Nation State, Organized Crime, Nation State Affiliated, Terrorist, Unaffiliated. - `ActorCategoryConfidence param.Field[int64]` Body param: Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `Aliases param.Field[[]ThreatEventTagNewParamsAlias]` Body param: Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `Value string` - `Confidence int64` - `TLP ThreatEventTagNewParamsAliasesTLP` - `const ThreatEventTagNewParamsAliasesTLPRed ThreatEventTagNewParamsAliasesTLP = "red"` - `const ThreatEventTagNewParamsAliasesTLPAmber ThreatEventTagNewParamsAliasesTLP = "amber"` - `const ThreatEventTagNewParamsAliasesTLPGreen ThreatEventTagNewParamsAliasesTLP = "green"` - `const ThreatEventTagNewParamsAliasesTLPWhite ThreatEventTagNewParamsAliasesTLP = "white"` - `AliasGroupNames param.Field[[]string]` Body param - `AliasGroupNamesInternal param.Field[[]string]` Body param - `AnalyticPriority param.Field[float64]` Body param - `AttributionConfidence param.Field[string]` Body param - `AttributionConfidenceScore param.Field[int64]` Body param - `AttributionOrganization param.Field[string]` Body param - `CategoryUUID param.Field[string]` Body param - `DateOfDiscovery param.Field[string]` Body param: Date the actor was discovered (ISO YYYY-MM-DD). - `ExternalReferenceLinks param.Field[[]string]` Body param - `ExternalReferences param.Field[[]ThreatEventTagNewParamsExternalReference]` Body param: Structured external references ({ url, description }). Public: returned to all accounts. - `URL string` - `Description string` - `InternalAliases param.Field[[]ThreatEventTagNewParamsInternalAlias]` Body param: Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `Value string` - `Confidence int64` - `TLP ThreatEventTagNewParamsInternalAliasesTLP` - `const ThreatEventTagNewParamsInternalAliasesTLPRed ThreatEventTagNewParamsInternalAliasesTLP = "red"` - `const ThreatEventTagNewParamsInternalAliasesTLPAmber ThreatEventTagNewParamsInternalAliasesTLP = "amber"` - `const ThreatEventTagNewParamsInternalAliasesTLPGreen ThreatEventTagNewParamsInternalAliasesTLP = "green"` - `const ThreatEventTagNewParamsInternalAliasesTLPWhite ThreatEventTagNewParamsInternalAliasesTLP = "white"` - `InternalDescription param.Field[string]` Body param - `Motive param.Field[string]` Body param: Actor motive. Allowed values: Convenience, Fear, Fun, Financial, Grudge, Ideology, Espionage. - `MotiveConfidence param.Field[int64]` Body param: Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `OpsecLevel param.Field[string]` Body param - `OriginCountryConfidence param.Field[int64]` Body param: Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `OriginCountryISO param.Field[string]` Body param - `OriginCountryTLP param.Field[ThreatEventTagNewParamsOriginCountryTLP]` Body param: TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `const ThreatEventTagNewParamsOriginCountryTLPRed ThreatEventTagNewParamsOriginCountryTLP = "red"` - `const ThreatEventTagNewParamsOriginCountryTLPAmber ThreatEventTagNewParamsOriginCountryTLP = "amber"` - `const ThreatEventTagNewParamsOriginCountryTLPGreen ThreatEventTagNewParamsOriginCountryTLP = "green"` - `const ThreatEventTagNewParamsOriginCountryTLPWhite ThreatEventTagNewParamsOriginCountryTLP = "white"` - `Priority param.Field[float64]` Body param - `SophisticationLevel param.Field[string]` Body param ### Returns - `type ThreatEventTagNewResponse struct{…}` - `UUID string` - `Value string` - `ActiveDuration string` - `ActorCategory string` - `ActorCategoryConfidence int64` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `Aliases []ThreatEventTagNewResponseAlias` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `Value string` - `Confidence int64` - `TLP ThreatEventTagNewResponseAliasesTLP` - `const ThreatEventTagNewResponseAliasesTLPRed ThreatEventTagNewResponseAliasesTLP = "red"` - `const ThreatEventTagNewResponseAliasesTLPAmber ThreatEventTagNewResponseAliasesTLP = "amber"` - `const ThreatEventTagNewResponseAliasesTLPGreen ThreatEventTagNewResponseAliasesTLP = "green"` - `const ThreatEventTagNewResponseAliasesTLPWhite ThreatEventTagNewResponseAliasesTLP = "white"` - `AliasGroupNames []string` - `AliasGroupNamesInternal []string` - `AnalyticPriority float64` - `AttributionConfidence string` - `AttributionConfidenceScore int64` - `AttributionOrganization string` - `CategoryName string` - `CategoryUUID string` - `DateOfDiscovery string` - `ExternalReferenceLinks []string` - `ExternalReferences []ThreatEventTagNewResponseExternalReference` Structured external references ({ url, description }). Public: returned to all accounts. - `URL string` - `Description string` - `InternalAliases []ThreatEventTagNewResponseInternalAlias` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `Value string` - `Confidence int64` - `TLP ThreatEventTagNewResponseInternalAliasesTLP` - `const ThreatEventTagNewResponseInternalAliasesTLPRed ThreatEventTagNewResponseInternalAliasesTLP = "red"` - `const ThreatEventTagNewResponseInternalAliasesTLPAmber ThreatEventTagNewResponseInternalAliasesTLP = "amber"` - `const ThreatEventTagNewResponseInternalAliasesTLPGreen ThreatEventTagNewResponseInternalAliasesTLP = "green"` - `const ThreatEventTagNewResponseInternalAliasesTLPWhite ThreatEventTagNewResponseInternalAliasesTLP = "white"` - `InternalDescription string` - `Motive string` - `MotiveConfidence int64` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `OpsecLevel string` - `OriginCountryConfidence int64` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `OriginCountryISO string` - `OriginCountryISOAlpha3 string` - `OriginCountryTLP ThreatEventTagNewResponseOriginCountryTLP` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `const ThreatEventTagNewResponseOriginCountryTLPRed ThreatEventTagNewResponseOriginCountryTLP = "red"` - `const ThreatEventTagNewResponseOriginCountryTLPAmber ThreatEventTagNewResponseOriginCountryTLP = "amber"` - `const ThreatEventTagNewResponseOriginCountryTLPGreen ThreatEventTagNewResponseOriginCountryTLP = "green"` - `const ThreatEventTagNewResponseOriginCountryTLPWhite ThreatEventTagNewResponseOriginCountryTLP = "white"` - `Priority float64` - `SophisticationLevel string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) tag, err := client.CloudforceOne.ThreatEvents.Tags.New(context.TODO(), cloudforce_one.ThreatEventTagNewParams{ AccountID: cloudflare.F("account_id"), Value: cloudflare.F("APT28"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", tag.UUID) } ``` #### Response ```json { "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "APT28", "activeDuration": "activeDuration", "actorCategory": "actorCategory", "actorCategoryConfidence": 7, "aliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "aliasGroupNames": [ "string" ], "aliasGroupNamesInternal": [ "string" ], "analyticPriority": 0, "attributionConfidence": "attributionConfidence", "attributionConfidenceScore": 7, "attributionOrganization": "attributionOrganization", "categoryName": "Nation State", "categoryUuid": "12345678-1234-1234-1234-1234567890ab", "dateOfDiscovery": "2024-01-15", "externalReferenceLinks": [ "string" ], "externalReferences": [ { "url": "https://example.com/report", "description": "Vendor threat report" } ], "internalAliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "internalDescription": "internalDescription", "motive": "motive", "motiveConfidence": 7, "opsecLevel": "opsecLevel", "originCountryConfidence": 7, "originCountryISO": "originCountryISO", "originCountryISOAlpha3": "IRN", "originCountryTlp": "amber", "priority": 0, "sophisticationLevel": "sophisticationLevel" } ``` ## Updates a tag (SoT) `client.CloudforceOne.ThreatEvents.Tags.Edit(ctx, tagUUID, params) (*ThreatEventTagEditResponse, error)` **patch** `/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}` Updates a Source-of-Truth tag by UUID. ### Parameters - `tagUUID string` Tag UUID. - `params ThreatEventTagEditParams` - `AccountID param.Field[string]` Path param: Account ID. - `ActiveDuration param.Field[string]` Body param - `ActorCategory param.Field[string]` Body param: Actor variety. Allowed values: Activist, Competitor, Customer, Crime Syndicate, Former Employee, Nation State, Organized Crime, Nation State Affiliated, Terrorist, Unaffiliated. - `ActorCategoryConfidence param.Field[int64]` Body param: Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `Aliases param.Field[[]ThreatEventTagEditParamsAlias]` Body param: Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `Value string` - `Confidence int64` - `TLP ThreatEventTagEditParamsAliasesTLP` - `const ThreatEventTagEditParamsAliasesTLPRed ThreatEventTagEditParamsAliasesTLP = "red"` - `const ThreatEventTagEditParamsAliasesTLPAmber ThreatEventTagEditParamsAliasesTLP = "amber"` - `const ThreatEventTagEditParamsAliasesTLPGreen ThreatEventTagEditParamsAliasesTLP = "green"` - `const ThreatEventTagEditParamsAliasesTLPWhite ThreatEventTagEditParamsAliasesTLP = "white"` - `AliasGroupNames param.Field[[]string]` Body param - `AliasGroupNamesInternal param.Field[[]string]` Body param - `AnalyticPriority param.Field[float64]` Body param - `AttributionConfidence param.Field[string]` Body param - `AttributionConfidenceScore param.Field[int64]` Body param - `AttributionOrganization param.Field[string]` Body param - `CategoryUUID param.Field[string]` Body param - `DateOfDiscovery param.Field[string]` Body param: Date the actor was discovered (ISO YYYY-MM-DD). - `ExternalReferenceLinks param.Field[[]string]` Body param - `ExternalReferences param.Field[[]ThreatEventTagEditParamsExternalReference]` Body param: Structured external references ({ url, description }). Public: returned to all accounts. - `URL string` - `Description string` - `InternalAliases param.Field[[]ThreatEventTagEditParamsInternalAlias]` Body param: Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `Value string` - `Confidence int64` - `TLP ThreatEventTagEditParamsInternalAliasesTLP` - `const ThreatEventTagEditParamsInternalAliasesTLPRed ThreatEventTagEditParamsInternalAliasesTLP = "red"` - `const ThreatEventTagEditParamsInternalAliasesTLPAmber ThreatEventTagEditParamsInternalAliasesTLP = "amber"` - `const ThreatEventTagEditParamsInternalAliasesTLPGreen ThreatEventTagEditParamsInternalAliasesTLP = "green"` - `const ThreatEventTagEditParamsInternalAliasesTLPWhite ThreatEventTagEditParamsInternalAliasesTLP = "white"` - `InternalDescription param.Field[string]` Body param - `Motive param.Field[string]` Body param: Actor motive. Allowed values: Convenience, Fear, Fun, Financial, Grudge, Ideology, Espionage. - `MotiveConfidence param.Field[int64]` Body param: Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `OpsecLevel param.Field[string]` Body param - `OriginCountryConfidence param.Field[int64]` Body param: Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `OriginCountryISO param.Field[string]` Body param - `OriginCountryTLP param.Field[ThreatEventTagEditParamsOriginCountryTLP]` Body param: TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `const ThreatEventTagEditParamsOriginCountryTLPRed ThreatEventTagEditParamsOriginCountryTLP = "red"` - `const ThreatEventTagEditParamsOriginCountryTLPAmber ThreatEventTagEditParamsOriginCountryTLP = "amber"` - `const ThreatEventTagEditParamsOriginCountryTLPGreen ThreatEventTagEditParamsOriginCountryTLP = "green"` - `const ThreatEventTagEditParamsOriginCountryTLPWhite ThreatEventTagEditParamsOriginCountryTLP = "white"` - `Priority param.Field[float64]` Body param - `SophisticationLevel param.Field[string]` Body param - `Value param.Field[string]` Body param ### Returns - `type ThreatEventTagEditResponse struct{…}` - `UUID string` - `Value string` - `ActiveDuration string` - `ActorCategory string` - `ActorCategoryConfidence int64` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `Aliases []ThreatEventTagEditResponseAlias` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `Value string` - `Confidence int64` - `TLP ThreatEventTagEditResponseAliasesTLP` - `const ThreatEventTagEditResponseAliasesTLPRed ThreatEventTagEditResponseAliasesTLP = "red"` - `const ThreatEventTagEditResponseAliasesTLPAmber ThreatEventTagEditResponseAliasesTLP = "amber"` - `const ThreatEventTagEditResponseAliasesTLPGreen ThreatEventTagEditResponseAliasesTLP = "green"` - `const ThreatEventTagEditResponseAliasesTLPWhite ThreatEventTagEditResponseAliasesTLP = "white"` - `AliasGroupNames []string` - `AliasGroupNamesInternal []string` - `AnalyticPriority float64` - `AttributionConfidence string` - `AttributionConfidenceScore int64` - `AttributionOrganization string` - `CategoryName string` - `CategoryUUID string` - `DateOfDiscovery string` - `ExternalReferenceLinks []string` - `ExternalReferences []ThreatEventTagEditResponseExternalReference` Structured external references ({ url, description }). Public: returned to all accounts. - `URL string` - `Description string` - `InternalAliases []ThreatEventTagEditResponseInternalAlias` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `Value string` - `Confidence int64` - `TLP ThreatEventTagEditResponseInternalAliasesTLP` - `const ThreatEventTagEditResponseInternalAliasesTLPRed ThreatEventTagEditResponseInternalAliasesTLP = "red"` - `const ThreatEventTagEditResponseInternalAliasesTLPAmber ThreatEventTagEditResponseInternalAliasesTLP = "amber"` - `const ThreatEventTagEditResponseInternalAliasesTLPGreen ThreatEventTagEditResponseInternalAliasesTLP = "green"` - `const ThreatEventTagEditResponseInternalAliasesTLPWhite ThreatEventTagEditResponseInternalAliasesTLP = "white"` - `InternalDescription string` - `Motive string` - `MotiveConfidence int64` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `OpsecLevel string` - `OriginCountryConfidence int64` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `OriginCountryISO string` - `OriginCountryISOAlpha3 string` - `OriginCountryTLP ThreatEventTagEditResponseOriginCountryTLP` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `const ThreatEventTagEditResponseOriginCountryTLPRed ThreatEventTagEditResponseOriginCountryTLP = "red"` - `const ThreatEventTagEditResponseOriginCountryTLPAmber ThreatEventTagEditResponseOriginCountryTLP = "amber"` - `const ThreatEventTagEditResponseOriginCountryTLPGreen ThreatEventTagEditResponseOriginCountryTLP = "green"` - `const ThreatEventTagEditResponseOriginCountryTLPWhite ThreatEventTagEditResponseOriginCountryTLP = "white"` - `Priority float64` - `SophisticationLevel string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.CloudforceOne.ThreatEvents.Tags.Edit( context.TODO(), "tag_uuid", cloudforce_one.ThreatEventTagEditParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.UUID) } ``` #### Response ```json { "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "APT28", "activeDuration": "activeDuration", "actorCategory": "actorCategory", "actorCategoryConfidence": 7, "aliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "aliasGroupNames": [ "string" ], "aliasGroupNamesInternal": [ "string" ], "analyticPriority": 0, "attributionConfidence": "attributionConfidence", "attributionConfidenceScore": 7, "attributionOrganization": "attributionOrganization", "categoryName": "Nation State", "categoryUuid": "12345678-1234-1234-1234-1234567890ab", "dateOfDiscovery": "2024-01-15", "externalReferenceLinks": [ "string" ], "externalReferences": [ { "url": "https://example.com/report", "description": "Vendor threat report" } ], "internalAliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "internalDescription": "internalDescription", "motive": "motive", "motiveConfidence": 7, "opsecLevel": "opsecLevel", "originCountryConfidence": 7, "originCountryISO": "originCountryISO", "originCountryISOAlpha3": "IRN", "originCountryTlp": "amber", "priority": 0, "sophisticationLevel": "sophisticationLevel" } ``` ## Deletes a tag (SoT) `client.CloudforceOne.ThreatEvents.Tags.Delete(ctx, tagUUID, body) (*ThreatEventTagDeleteResponse, error)` **delete** `/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}` Deletes a Source-of-Truth tag by UUID. ### Parameters - `tagUUID string` Tag UUID. - `body ThreatEventTagDeleteParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventTagDeleteResponse struct{…}` - `UUID string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) tag, err := client.CloudforceOne.ThreatEvents.Tags.Delete( context.TODO(), "tag_uuid", cloudforce_one.ThreatEventTagDeleteParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", tag.UUID) } ``` #### Response ```json { "uuid": "12345678-1234-1234-1234-1234567890ab" } ``` # Categories ## Lists all tag categories (SoT) `client.CloudforceOne.ThreatEvents.Tags.Categories.List(ctx, params) (*ThreatEventTagCategoryListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/tags/categories` Returns all Source-of-Truth tag categories for an account. ### Parameters - `params ThreatEventTagCategoryListParams` - `AccountID param.Field[string]` Path param: Account ID. - `Search param.Field[string]` Query param ### Returns - `type ThreatEventTagCategoryListResponse struct{…}` - `Categories []ThreatEventTagCategoryListResponseCategory` - `Name string` - `UUID string` - `CreatedAt string` - `Description string` - `UpdatedAt string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) categories, err := client.CloudforceOne.ThreatEvents.Tags.Categories.List(context.TODO(), cloudforce_one.ThreatEventTagCategoryListParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", categories.Categories) } ``` #### Response ```json { "categories": [ { "name": "Actor", "uuid": "12345678-1234-1234-1234-1234567890ab", "createdAt": "createdAt", "description": "description", "updatedAt": "updatedAt" } ] } ``` ## Creates a new tag category (SoT) `client.CloudforceOne.ThreatEvents.Tags.Categories.New(ctx, params) (*ThreatEventTagCategoryNewResponse, error)` **post** `/accounts/{account_id}/cloudforce-one/events/tags/categories/create` Creates a new Source-of-Truth tag category for an account. ### Parameters - `params ThreatEventTagCategoryNewParams` - `AccountID param.Field[string]` Path param: Account ID. - `Name param.Field[string]` Body param - `Description param.Field[string]` Body param ### Returns - `type ThreatEventTagCategoryNewResponse struct{…}` - `Name string` - `UUID string` - `CreatedAt string` - `Description string` - `UpdatedAt string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) category, err := client.CloudforceOne.ThreatEvents.Tags.Categories.New(context.TODO(), cloudforce_one.ThreatEventTagCategoryNewParams{ AccountID: cloudflare.F("account_id"), Name: cloudflare.F("Actor"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", category.UUID) } ``` #### Response ```json { "name": "Actor", "uuid": "12345678-1234-1234-1234-1234567890ab", "createdAt": "createdAt", "description": "description", "updatedAt": "updatedAt" } ``` ## Updates a tag category (SoT) `client.CloudforceOne.ThreatEvents.Tags.Categories.Edit(ctx, categoryUUID, params) (*ThreatEventTagCategoryEditResponse, error)` **patch** `/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}` Updates a Source-of-Truth tag category by UUID. ### Parameters - `categoryUUID string` Tag Category UUID. - `params ThreatEventTagCategoryEditParams` - `AccountID param.Field[string]` Path param: Account ID. - `Description param.Field[string]` Body param - `Name param.Field[string]` Body param ### Returns - `type ThreatEventTagCategoryEditResponse struct{…}` - `Name string` - `UUID string` - `CreatedAt string` - `Description string` - `UpdatedAt string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) response, err := client.CloudforceOne.ThreatEvents.Tags.Categories.Edit( context.TODO(), "category_uuid", cloudforce_one.ThreatEventTagCategoryEditParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", response.UUID) } ``` #### Response ```json { "name": "Actor", "uuid": "12345678-1234-1234-1234-1234567890ab", "createdAt": "createdAt", "description": "description", "updatedAt": "updatedAt" } ``` ## Deletes a tag category (SoT) `client.CloudforceOne.ThreatEvents.Tags.Categories.Delete(ctx, categoryUUID, body) (*ThreatEventTagCategoryDeleteResponse, error)` **delete** `/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}` Deletes a Source-of-Truth tag category by UUID. ### Parameters - `categoryUUID string` Tag Category UUID. - `body ThreatEventTagCategoryDeleteParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventTagCategoryDeleteResponse struct{…}` - `UUID string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) category, err := client.CloudforceOne.ThreatEvents.Tags.Categories.Delete( context.TODO(), "category_uuid", cloudforce_one.ThreatEventTagCategoryDeleteParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", category.UUID) } ``` #### Response ```json { "uuid": "12345678-1234-1234-1234-1234567890ab" } ``` # Indicators ## List indicators related to a tag `client.CloudforceOne.ThreatEvents.Tags.Indicators.List(ctx, tagUUID, params) (*ThreatEventTagIndicatorListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators` Returns indicators associated with the provided tag UUID, with pagination. By default fans out across every indicator dataset the account can read; pass datasetIds to scope to specific datasets. ### Parameters - `tagUUID string` Tag UUID. - `params ThreatEventTagIndicatorListParams` - `AccountID param.Field[string]` Path param: Account ID. - `DatasetIDs param.Field[[]string]` Query param: Dataset UUIDs to scope to (repeat the param for multiple), or 'all' / '*' for every readable indicator dataset. Omit to search all readable datasets. - `IndicatorType param.Field[string]` Query param - `Page param.Field[float64]` Query param - `PageSize param.Field[float64]` Query param - `RelatedEvent param.Field[[]string]` Query param: Filter indicators by related event UUID(s). Multiple UUIDs can be provided by repeating the parameter. - `Search param.Field[[]ThreatEventTagIndicatorListParamsSearch]` Query param: Structured search as a JSON array of {field, op, value} objects. Searchable fields: value, indicatorType. Multiple conditions are AND'd together. Max 10 conditions per request. - `Field ThreatEventTagIndicatorListParamsSearchField` The indicator field to search on. Allowed: value, indicatorType. - `const ThreatEventTagIndicatorListParamsSearchFieldValue ThreatEventTagIndicatorListParamsSearchField = "value"` - `const ThreatEventTagIndicatorListParamsSearchFieldIndicatorType ThreatEventTagIndicatorListParamsSearchField = "indicatorType"` - `Op ThreatEventTagIndicatorListParamsSearchOp` Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'value', op:'in', value:['evil.com','bad.org']}. - `const ThreatEventTagIndicatorListParamsSearchOpEquals ThreatEventTagIndicatorListParamsSearchOp = "equals"` - `const ThreatEventTagIndicatorListParamsSearchOpNot ThreatEventTagIndicatorListParamsSearchOp = "not"` - `const ThreatEventTagIndicatorListParamsSearchOpGt ThreatEventTagIndicatorListParamsSearchOp = "gt"` - `const ThreatEventTagIndicatorListParamsSearchOpGte ThreatEventTagIndicatorListParamsSearchOp = "gte"` - `const ThreatEventTagIndicatorListParamsSearchOpLt ThreatEventTagIndicatorListParamsSearchOp = "lt"` - `const ThreatEventTagIndicatorListParamsSearchOpLte ThreatEventTagIndicatorListParamsSearchOp = "lte"` - `const ThreatEventTagIndicatorListParamsSearchOpLike ThreatEventTagIndicatorListParamsSearchOp = "like"` - `const ThreatEventTagIndicatorListParamsSearchOpContains ThreatEventTagIndicatorListParamsSearchOp = "contains"` - `const ThreatEventTagIndicatorListParamsSearchOpStartsWith ThreatEventTagIndicatorListParamsSearchOp = "startsWith"` - `const ThreatEventTagIndicatorListParamsSearchOpEndsWith ThreatEventTagIndicatorListParamsSearchOp = "endsWith"` - `const ThreatEventTagIndicatorListParamsSearchOpIn ThreatEventTagIndicatorListParamsSearchOp = "in"` - `const ThreatEventTagIndicatorListParamsSearchOpFind ThreatEventTagIndicatorListParamsSearchOp = "find"` - `Value ThreatEventTagIndicatorListParamsSearchValueUnion` Search value. String for most operators. Array of strings for 'in' operator (max 100 items). - `UnionString` - `type ThreatEventTagIndicatorListParamsSearchValueArray []string` ### Returns - `type ThreatEventTagIndicatorListResponse struct{…}` - `Indicators []ThreatEventTagIndicatorListResponseIndicator` - `CreatedAt Time` - `IndicatorType string` - `UpdatedAt Time` - `UUID string` - `Value string` - `DatasetID string` The dataset ID this indicator belongs to. Included in list responses. - `RelatedEvents []ThreatEventTagIndicatorListResponseIndicatorsRelatedEvent` - `DatasetID string` - `EventID string` - `Tags []ThreatEventTagIndicatorListResponseIndicatorsTag` - `CategoryName string` - `UUID string` - `Value string` - `Pagination ThreatEventTagIndicatorListResponsePagination` - `Page float64` - `PageSize float64` - `TotalCount float64` - `TotalPages float64` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) indicators, err := client.CloudforceOne.ThreatEvents.Tags.Indicators.List( context.TODO(), "tag_uuid", cloudforce_one.ThreatEventTagIndicatorListParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", indicators.Indicators) } ``` #### Response ```json { "indicators": [ { "createdAt": "2022-04-01T00:00:00Z", "indicatorType": "domain", "updatedAt": "2022-04-01T00:00:00Z", "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "malicious-domain.com", "datasetId": "dataset-uuid-123", "relatedEvents": [ { "datasetId": "dataset-uuid-123", "eventId": "event-uuid-456" } ], "tags": [ { "categoryName": "categoryName", "uuid": "uuid", "value": "value" } ] } ], "pagination": { "page": 0, "pageSize": 0, "totalCount": 0, "totalPages": 0 } } ``` # By Dataset ## List indicators related to a tag within a dataset (deprecated) `client.CloudforceOne.ThreatEvents.Tags.Indicators.ByDataset.List(ctx, datasetID, tagUUID, params) (*ThreatEventTagIndicatorByDatasetListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators` This endpoint is deprecated. Use GET /:account_id/events/tags/:tag_uuid/indicators with the optional datasetIds query parameter instead. Returns indicators associated with the provided tag UUID within a single dataset's indicator shards, with pagination. ### Parameters - `datasetID string` Dataset UUID. - `tagUUID string` Tag UUID. - `params ThreatEventTagIndicatorByDatasetListParams` - `AccountID param.Field[string]` Path param: Account ID. - `IndicatorType param.Field[string]` Query param - `Page param.Field[float64]` Query param - `PageSize param.Field[float64]` Query param - `RelatedEvent param.Field[[]string]` Query param: Filter indicators by related event UUID(s). Multiple UUIDs can be provided by repeating the parameter. - `Search param.Field[[]ThreatEventTagIndicatorByDatasetListParamsSearch]` Query param: Structured search as a JSON array of {field, op, value} objects. Searchable fields: value, indicatorType. Multiple conditions are AND'd together. Max 10 conditions per request. - `Field ThreatEventTagIndicatorByDatasetListParamsSearchField` The indicator field to search on. Allowed: value, indicatorType. - `const ThreatEventTagIndicatorByDatasetListParamsSearchFieldValue ThreatEventTagIndicatorByDatasetListParamsSearchField = "value"` - `const ThreatEventTagIndicatorByDatasetListParamsSearchFieldIndicatorType ThreatEventTagIndicatorByDatasetListParamsSearchField = "indicatorType"` - `Op ThreatEventTagIndicatorByDatasetListParamsSearchOp` Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'value', op:'in', value:['evil.com','bad.org']}. - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpEquals ThreatEventTagIndicatorByDatasetListParamsSearchOp = "equals"` - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpNot ThreatEventTagIndicatorByDatasetListParamsSearchOp = "not"` - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpGt ThreatEventTagIndicatorByDatasetListParamsSearchOp = "gt"` - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpGte ThreatEventTagIndicatorByDatasetListParamsSearchOp = "gte"` - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpLt ThreatEventTagIndicatorByDatasetListParamsSearchOp = "lt"` - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpLte ThreatEventTagIndicatorByDatasetListParamsSearchOp = "lte"` - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpLike ThreatEventTagIndicatorByDatasetListParamsSearchOp = "like"` - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpContains ThreatEventTagIndicatorByDatasetListParamsSearchOp = "contains"` - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpStartsWith ThreatEventTagIndicatorByDatasetListParamsSearchOp = "startsWith"` - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpEndsWith ThreatEventTagIndicatorByDatasetListParamsSearchOp = "endsWith"` - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpIn ThreatEventTagIndicatorByDatasetListParamsSearchOp = "in"` - `const ThreatEventTagIndicatorByDatasetListParamsSearchOpFind ThreatEventTagIndicatorByDatasetListParamsSearchOp = "find"` - `Value ThreatEventTagIndicatorByDatasetListParamsSearchValueUnion` Search value. String for most operators. Array of strings for 'in' operator (max 100 items). - `UnionString` - `type ThreatEventTagIndicatorByDatasetListParamsSearchValueArray []string` ### Returns - `type ThreatEventTagIndicatorByDatasetListResponse struct{…}` - `Indicators []ThreatEventTagIndicatorByDatasetListResponseIndicator` - `CreatedAt Time` - `IndicatorType string` - `UpdatedAt Time` - `UUID string` - `Value string` - `DatasetID string` The dataset ID this indicator belongs to. Included in list responses. - `RelatedEvents []ThreatEventTagIndicatorByDatasetListResponseIndicatorsRelatedEvent` - `DatasetID string` - `EventID string` - `Tags []ThreatEventTagIndicatorByDatasetListResponseIndicatorsTag` - `CategoryName string` - `UUID string` - `Value string` - `Pagination ThreatEventTagIndicatorByDatasetListResponsePagination` - `Page float64` - `PageSize float64` - `TotalCount float64` - `TotalPages float64` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) byDatasets, err := client.CloudforceOne.ThreatEvents.Tags.Indicators.ByDataset.List( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "tag_uuid", cloudforce_one.ThreatEventTagIndicatorByDatasetListParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", byDatasets.Indicators) } ``` #### Response ```json { "indicators": [ { "createdAt": "2022-04-01T00:00:00Z", "indicatorType": "domain", "updatedAt": "2022-04-01T00:00:00Z", "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "malicious-domain.com", "datasetId": "dataset-uuid-123", "relatedEvents": [ { "datasetId": "dataset-uuid-123", "eventId": "event-uuid-456" } ], "tags": [ { "categoryName": "categoryName", "uuid": "uuid", "value": "value" } ] } ], "pagination": { "page": 0, "pageSize": 0, "totalCount": 0, "totalPages": 0 } } ``` # Event Tags ## Adds a tag to an event `client.CloudforceOne.ThreatEvents.EventTags.New(ctx, eventID, params) (*ThreatEventEventTagNewResponse, error)` **post** `/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create` Add one or more tags to an event. ### Parameters - `eventID string` Event UUID. - `params ThreatEventEventTagNewParams` - `AccountID param.Field[string]` Path param: Account ID. - `Tags param.Field[[]string]` Body param ### Returns - `type ThreatEventEventTagNewResponse struct{…}` - `Success bool` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) eventTag, err := client.CloudforceOne.ThreatEvents.EventTags.New( context.TODO(), "event_id", cloudforce_one.ThreatEventEventTagNewParams{ AccountID: cloudflare.F("account_id"), Tags: cloudflare.F([]string{"botnet"}), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", eventTag.Success) } ``` #### Response ```json { "result": { "success": true }, "success": true } ``` ## Removes a tag from an event `client.CloudforceOne.ThreatEvents.EventTags.Delete(ctx, eventID, body) (*ThreatEventEventTagDeleteResponse, error)` **delete** `/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}` Remove one or more tags from an event. ### Parameters - `eventID string` Event UUID. - `body ThreatEventEventTagDeleteParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventEventTagDeleteResponse struct{…}` - `Success bool` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) eventTag, err := client.CloudforceOne.ThreatEvents.EventTags.Delete( context.TODO(), "event_id", cloudforce_one.ThreatEventEventTagDeleteParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", eventTag.Success) } ``` #### Response ```json { "result": { "success": true }, "success": true } ``` # Target Industries ## Lists target industries across multiple datasets `client.CloudforceOne.ThreatEvents.TargetIndustries.List(ctx, params) (*ThreatEventTargetIndustryListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/targetIndustries` List target industries referenced in events across one or more datasets. ### Parameters - `params ThreatEventTargetIndustryListParams` - `AccountID param.Field[string]` Path param: Account ID. - `DatasetIDs param.Field[[]string]` Query param: Array of dataset IDs to query target industries from. If not provided, uses the default dataset. ### Returns - `type ThreatEventTargetIndustryListResponse struct{…}` - `Items ThreatEventTargetIndustryListResponseItems` - `Type string` - `Type string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) targetIndustries, err := client.CloudforceOne.ThreatEvents.TargetIndustries.List(context.TODO(), cloudforce_one.ThreatEventTargetIndustryListParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", targetIndustries.Items) } ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` # By Dataset ## Lists all target industries for a specific dataset `client.CloudforceOne.ThreatEvents.TargetIndustries.ByDataset.List(ctx, datasetID, query) (*ThreatEventTargetIndustryByDatasetListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries` List all target industries referenced in events for a specific dataset. ### Parameters - `datasetID string` Dataset UUID. - `query ThreatEventTargetIndustryByDatasetListParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventTargetIndustryByDatasetListResponse struct{…}` - `Items ThreatEventTargetIndustryByDatasetListResponseItems` - `Type string` - `Type string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) byDatasets, err := client.CloudforceOne.ThreatEvents.TargetIndustries.ByDataset.List( context.TODO(), "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", cloudforce_one.ThreatEventTargetIndustryByDatasetListParams{ AccountID: cloudflare.F("account_id"), }, ) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", byDatasets.Items) } ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` # Catalog ## Lists all target industries from industry map catalog `client.CloudforceOne.ThreatEvents.TargetIndustries.Catalog.List(ctx, query) (*ThreatEventTargetIndustryCatalogListResponse, error)` **get** `/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog` List all predefined target industries from the industry map catalog. ### Parameters - `query ThreatEventTargetIndustryCatalogListParams` - `AccountID param.Field[string]` Account ID. ### Returns - `type ThreatEventTargetIndustryCatalogListResponse struct{…}` - `Items ThreatEventTargetIndustryCatalogListResponseItems` - `Type string` - `Type string` ### Example ```go package main import ( "context" "fmt" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) catalogs, err := client.CloudforceOne.ThreatEvents.TargetIndustries.Catalog.List(context.TODO(), cloudforce_one.ThreatEventTargetIndustryCatalogListParams{ AccountID: cloudflare.F("account_id"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", catalogs.Items) } ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` # Insights