# Cloudforce One # Scans # Results ## Get the Latest Scan Result `cloudforce_one.scans.results.get(strconfig_id, ResultGetParams**kwargs) -> ResultGetResponse` **get** `/accounts/{account_id}/cloudforce-one/scans/results/{config_id}` Get the Latest Scan Result ### Parameters - `account_id: str` Defines the Account ID. - `config_id: str` Defines the Config ID. ### Returns - `class ResultGetResponse: …` - `_1_1_1_1: List[ScanResult]` - `number: Optional[float]` - `proto: Optional[str]` - `status: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) result = client.cloudforce_one.scans.results.get( config_id="config_id", account_id="account_id", ) print(result._1._1._1._1) ``` #### Response ```json { "errors": [ "string" ], "messages": [ "string" ], "result": { "1.1.1.1": [ { "number": 8080, "proto": "tcp", "status": "open" } ] }, "success": true } ``` ## Domain Types ### Scan Result - `class ScanResult: …` - `number: Optional[float]` - `proto: Optional[str]` - `status: Optional[str]` ### Result Get Response - `class ResultGetResponse: …` - `_1_1_1_1: List[ScanResult]` - `number: Optional[float]` - `proto: Optional[str]` - `status: Optional[str]` # Config ## List Scan Configs `cloudforce_one.scans.config.list(ConfigListParams**kwargs) -> SyncSinglePage[ConfigListResponse]` **get** `/accounts/{account_id}/cloudforce-one/scans/config` List Scan Configs ### Parameters - `account_id: str` Defines the Account ID. ### Returns - `class ConfigListResponse: …` - `id: str` Defines the Config ID. - `account_id: str` - `frequency: float` Defines the number of days between each scan (0 = One-off scan). - `ips: List[str]` Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000. - `ports: List[str]` Defines a list of ports to scan. Valid values are:"default", "all", or a comma-separated list of ports or range of ports (e.g. ["1-80", "443"]). "default" scans the 100 most commonly open ports. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) page = client.cloudforce_one.scans.config.list( account_id="account_id", ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": [ { "id": "uuid", "account_id": "abcd1234abcd1234abcd1234abcd1234", "frequency": 7, "ips": [ "1.1.1.1", "2606:4700:4700::1111" ], "ports": [ "default" ] } ] } ``` ## Create a new Scan Config `cloudforce_one.scans.config.create(ConfigCreateParams**kwargs) -> ConfigCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/scans/config` Create a new Scan Config ### Parameters - `account_id: str` Defines the Account ID. - `ips: Sequence[str]` Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000. - `frequency: Optional[float]` Defines the number of days between each scan (0 = One-off scan). - `ports: Optional[Sequence[str]]` Defines a list of ports to scan. Valid values are:"default", "all", or a comma-separated list of ports or range of ports (e.g. ["1-80", "443"]). "default" scans the 100 most commonly open ports. ### Returns - `class ConfigCreateResponse: …` - `id: str` Defines the Config ID. - `account_id: str` - `frequency: float` Defines the number of days between each scan (0 = One-off scan). - `ips: List[str]` Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000. - `ports: List[str]` Defines a list of ports to scan. Valid values are:"default", "all", or a comma-separated list of ports or range of ports (e.g. ["1-80", "443"]). "default" scans the 100 most commonly open ports. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) config = client.cloudforce_one.scans.config.create( account_id="account_id", ips=["1.1.1.1", "2606:4700:4700::1111"], ) print(config.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": "uuid", "account_id": "abcd1234abcd1234abcd1234abcd1234", "frequency": 7, "ips": [ "1.1.1.1", "2606:4700:4700::1111" ], "ports": [ "default" ] } } ``` ## Update an existing Scan Config `cloudforce_one.scans.config.edit(strconfig_id, ConfigEditParams**kwargs) -> ConfigEditResponse` **patch** `/accounts/{account_id}/cloudforce-one/scans/config/{config_id}` Update an existing Scan Config ### Parameters - `account_id: str` Defines the Account ID. - `config_id: str` Defines the Config ID. - `frequency: Optional[float]` Defines the number of days between each scan (0 = One-off scan). - `ips: Optional[Sequence[str]]` Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000. - `ports: Optional[Sequence[str]]` Defines a list of ports to scan. Valid values are:"default", "all", or a comma-separated list of ports or range of ports (e.g. ["1-80", "443"]). "default" scans the 100 most commonly open ports. ### Returns - `class ConfigEditResponse: …` - `id: str` Defines the Config ID. - `account_id: str` - `frequency: float` Defines the number of days between each scan (0 = One-off scan). - `ips: List[str]` Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000. - `ports: List[str]` Defines a list of ports to scan. Valid values are:"default", "all", or a comma-separated list of ports or range of ports (e.g. ["1-80", "443"]). "default" scans the 100 most commonly open ports. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.scans.config.edit( config_id="config_id", account_id="account_id", ) print(response.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": "uuid", "account_id": "abcd1234abcd1234abcd1234abcd1234", "frequency": 7, "ips": [ "1.1.1.1", "2606:4700:4700::1111" ], "ports": [ "default" ] } } ``` ## Delete a Scan Config `cloudforce_one.scans.config.delete(strconfig_id, ConfigDeleteParams**kwargs) -> object` **delete** `/accounts/{account_id}/cloudforce-one/scans/config/{config_id}` Delete a Scan Config ### Parameters - `account_id: str` Defines the Account ID. - `config_id: str` Defines the Config ID. ### Returns - `object` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) config = client.cloudforce_one.scans.config.delete( config_id="config_id", account_id="account_id", ) print(config) ``` #### Response ```json { "errors": [ "string" ], "messages": [ "string" ], "result": {}, "success": true } ``` ## Domain Types ### Config List Response - `class ConfigListResponse: …` - `id: str` Defines the Config ID. - `account_id: str` - `frequency: float` Defines the number of days between each scan (0 = One-off scan). - `ips: List[str]` Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000. - `ports: List[str]` Defines a list of ports to scan. Valid values are:"default", "all", or a comma-separated list of ports or range of ports (e.g. ["1-80", "443"]). "default" scans the 100 most commonly open ports. ### Config Create Response - `class ConfigCreateResponse: …` - `id: str` Defines the Config ID. - `account_id: str` - `frequency: float` Defines the number of days between each scan (0 = One-off scan). - `ips: List[str]` Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000. - `ports: List[str]` Defines a list of ports to scan. Valid values are:"default", "all", or a comma-separated list of ports or range of ports (e.g. ["1-80", "443"]). "default" scans the 100 most commonly open ports. ### Config Edit Response - `class ConfigEditResponse: …` - `id: str` Defines the Config ID. - `account_id: str` - `frequency: float` Defines the number of days between each scan (0 = One-off scan). - `ips: List[str]` Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000. - `ports: List[str]` Defines a list of ports to scan. Valid values are:"default", "all", or a comma-separated list of ports or range of ports (e.g. ["1-80", "443"]). "default" scans the 100 most commonly open ports. # Binary Storage ## Retrieves a file from Binary Storage `cloudforce_one.binary_storage.get(strhash, BinaryStorageGetParams**kwargs)` **get** `/accounts/{account_id}/cloudforce-one/binary/{hash}` Retrieves a binary file from the Cloudforce One binary storage for analysis. ### Parameters - `account_id: str` Account ID. - `hash: str` hash of the binary ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) client.cloudforce_one.binary_storage.get( hash="hash", account_id="account_id", ) ``` ## Posts a file to Binary Storage `cloudforce_one.binary_storage.create(BinaryStorageCreateParams**kwargs) -> BinaryStorageCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/binary` Uploads a binary file to Cloudforce One's binary database for malware analysis and threat intelligence correlation. ### Parameters - `account_id: str` Account ID. - `file: FileTypes` The binary file content to upload. ### Returns - `class BinaryStorageCreateResponse: …` - `content_type: str` - `md5: str` - `sha1: str` - `sha256: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) binary_storage = client.cloudforce_one.binary_storage.create( account_id="account_id", file=b"Example data", ) print(binary_storage.content_type) ``` #### Response ```json { "content_type": "text/plain", "md5": "5d84ade76d2a8387c81175bb0cbe6492", "sha1": "9aff6879626d957eafadda044e4f879aae1e7278", "sha256": "0000a7f2692ef479e2e3d02661568882cadec451cc8a64d4e7faca29810cd626" } ``` ## Domain Types ### Binary Storage Create Response - `class BinaryStorageCreateResponse: …` - `content_type: str` - `md5: str` - `sha1: str` - `sha256: str` # Requests ## List Requests `cloudforce_one.requests.list(RequestListParams**kwargs) -> SyncSinglePage[ListItem]` **post** `/accounts/{account_id}/cloudforce-one/requests` Lists Cloudforce One intelligence requests with filtering and pagination. ### Parameters - `account_id: str` Identifier. - `page: int` Page number of results. - `per_page: int` Number of results per page. - `completed_after: Optional[Union[str, datetime]]` Retrieve requests completed after this time. - `completed_before: Optional[Union[str, datetime]]` Retrieve requests completed before this time. - `created_after: Optional[Union[str, datetime]]` Retrieve requests created after this time. - `created_before: Optional[Union[str, datetime]]` Retrieve requests created before this time. - `request_type: Optional[str]` Requested information from request. - `sort_by: Optional[str]` Field to sort results by. - `sort_order: Optional[Literal["asc", "desc"]]` Sort order (asc or desc). - `"asc"` - `"desc"` - `status: Optional[Literal["open", "accepted", "reported", 3 more]]` Request Status. - `"open"` - `"accepted"` - `"reported"` - `"approved"` - `"completed"` - `"declined"` ### Returns - `class ListItem: …` - `id: str` UUID. - `created: datetime` Request creation time. - `priority: Literal["routine", "high", "urgent"]` - `"routine"` - `"high"` - `"urgent"` - `request: str` Requested information from request. - `summary: str` Brief description of the request. - `tlp: Literal["clear", "amber", "amber-strict", 2 more]` The CISA defined Traffic Light Protocol (TLP). - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` - `updated: datetime` Request last updated time. - `completed: Optional[datetime]` Request completion time. - `message_tokens: Optional[int]` Tokens for the request messages. - `readable_id: Optional[str]` Readable Request ID. - `status: Optional[Literal["open", "accepted", "reported", 3 more]]` Request Status. - `"open"` - `"accepted"` - `"reported"` - `"approved"` - `"completed"` - `"declined"` - `tokens: Optional[int]` Tokens for the request. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) page = client.cloudforce_one.requests.list( account_id="023e105f4ecef8ad9ca31a8372d0c353", page=0, per_page=10, ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": [ { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "created": "2022-04-01T00:00:00Z", "priority": "routine", "request": "Victomology", "summary": "DoS attack", "tlp": "clear", "updated": "2022-04-01T00:00:00Z", "completed": "2024-01-01T00:00:00Z", "message_tokens": 16, "readable_id": "RFI-2022-000001", "status": "open", "tokens": 0 } ] } ``` ## Get a Request `cloudforce_one.requests.get(strrequest_id, RequestGetParams**kwargs) -> Item` **get** `/accounts/{account_id}/cloudforce-one/requests/{request_id}` Retrieves details for a specific Cloudforce One intelligence request. ### Parameters - `account_id: str` Identifier. - `request_id: str` UUID. ### Returns - `class Item: …` - `id: str` UUID. - `content: str` Request content. - `created: datetime` - `priority: datetime` - `request: str` Requested information from request. - `summary: str` Brief description of the request. - `tlp: Literal["clear", "amber", "amber-strict", 2 more]` The CISA defined Traffic Light Protocol (TLP). - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` - `updated: datetime` - `completed: Optional[datetime]` - `message_tokens: Optional[int]` Tokens for the request messages. - `readable_id: Optional[str]` Readable Request ID. - `status: Optional[Literal["open", "accepted", "reported", 3 more]]` Request Status. - `"open"` - `"accepted"` - `"reported"` - `"approved"` - `"completed"` - `"declined"` - `tokens: Optional[int]` Tokens for the request. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) item = client.cloudforce_one.requests.get( request_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(item.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "content": "What regions were most effected by the recent DoS?", "created": "2022-04-01T05:20:00Z", "priority": "2022-04-01T05:20:00Z", "request": "Victomology", "summary": "DoS attack", "tlp": "clear", "updated": "2022-04-01T05:20:00Z", "completed": "2022-04-01T05:20:00Z", "message_tokens": 1, "readable_id": "RFI-2022-000001", "status": "open", "tokens": 16 } } ``` ## Create a New Request. `cloudforce_one.requests.create(RequestCreateParams**kwargs) -> Item` **post** `/accounts/{account_id}/cloudforce-one/requests/new` Creating a request adds the request into the Cloudforce One queue for analysis. In addition to the content, a short title, type, priority, and releasability should be provided. If one is not provided, a default will be assigned. ### Parameters - `account_id: str` Identifier. - `content: Optional[str]` Request content. - `priority: Optional[str]` Priority for analyzing the request. - `request_type: Optional[str]` Requested information from request. - `summary: Optional[str]` Brief description of the request. - `tlp: Optional[Literal["clear", "amber", "amber-strict", 2 more]]` The CISA defined Traffic Light Protocol (TLP). - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` ### Returns - `class Item: …` - `id: str` UUID. - `content: str` Request content. - `created: datetime` - `priority: datetime` - `request: str` Requested information from request. - `summary: str` Brief description of the request. - `tlp: Literal["clear", "amber", "amber-strict", 2 more]` The CISA defined Traffic Light Protocol (TLP). - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` - `updated: datetime` - `completed: Optional[datetime]` - `message_tokens: Optional[int]` Tokens for the request messages. - `readable_id: Optional[str]` Readable Request ID. - `status: Optional[Literal["open", "accepted", "reported", 3 more]]` Request Status. - `"open"` - `"accepted"` - `"reported"` - `"approved"` - `"completed"` - `"declined"` - `tokens: Optional[int]` Tokens for the request. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) item = client.cloudforce_one.requests.create( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(item.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "content": "What regions were most effected by the recent DoS?", "created": "2022-04-01T05:20:00Z", "priority": "2022-04-01T05:20:00Z", "request": "Victomology", "summary": "DoS attack", "tlp": "clear", "updated": "2022-04-01T05:20:00Z", "completed": "2022-04-01T05:20:00Z", "message_tokens": 1, "readable_id": "RFI-2022-000001", "status": "open", "tokens": 16 } } ``` ## Update a Request `cloudforce_one.requests.update(strrequest_id, RequestUpdateParams**kwargs) -> Item` **put** `/accounts/{account_id}/cloudforce-one/requests/{request_id}` Updating a request alters the request in the Cloudforce One queue. This API may be used to update any attributes of the request after the initial submission. Only fields that you choose to update need to be add to the request body. ### Parameters - `account_id: str` Identifier. - `request_id: str` UUID. - `content: Optional[str]` Request content. - `priority: Optional[str]` Priority for analyzing the request. - `request_type: Optional[str]` Requested information from request. - `summary: Optional[str]` Brief description of the request. - `tlp: Optional[Literal["clear", "amber", "amber-strict", 2 more]]` The CISA defined Traffic Light Protocol (TLP). - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` ### Returns - `class Item: …` - `id: str` UUID. - `content: str` Request content. - `created: datetime` - `priority: datetime` - `request: str` Requested information from request. - `summary: str` Brief description of the request. - `tlp: Literal["clear", "amber", "amber-strict", 2 more]` The CISA defined Traffic Light Protocol (TLP). - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` - `updated: datetime` - `completed: Optional[datetime]` - `message_tokens: Optional[int]` Tokens for the request messages. - `readable_id: Optional[str]` Readable Request ID. - `status: Optional[Literal["open", "accepted", "reported", 3 more]]` Request Status. - `"open"` - `"accepted"` - `"reported"` - `"approved"` - `"completed"` - `"declined"` - `tokens: Optional[int]` Tokens for the request. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) item = client.cloudforce_one.requests.update( request_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(item.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "content": "What regions were most effected by the recent DoS?", "created": "2022-04-01T05:20:00Z", "priority": "2022-04-01T05:20:00Z", "request": "Victomology", "summary": "DoS attack", "tlp": "clear", "updated": "2022-04-01T05:20:00Z", "completed": "2022-04-01T05:20:00Z", "message_tokens": 1, "readable_id": "RFI-2022-000001", "status": "open", "tokens": 16 } } ``` ## Delete a Request `cloudforce_one.requests.delete(strrequest_id, RequestDeleteParams**kwargs) -> RequestDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/requests/{request_id}` Deletes a Cloudforce One intelligence request and all associated data. ### Parameters - `account_id: str` Identifier. - `request_id: str` UUID. ### Returns - `class RequestDeleteResponse: …` - `errors: List[Error]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[ErrorSource]` - `pointer: Optional[str]` - `messages: List[Message]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[MessageSource]` - `pointer: Optional[str]` - `success: Literal[true]` Whether the API call was successful. - `true` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) request = client.cloudforce_one.requests.delete( request_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(request.errors) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true } ``` ## Get Request Quota `cloudforce_one.requests.quota(RequestQuotaParams**kwargs) -> Quota` **get** `/accounts/{account_id}/cloudforce-one/requests/quota` Retrieves quota usage for Cloudforce One standard requests. ### Parameters - `account_id: str` Identifier. ### Returns - `class Quota: …` - `anniversary_date: Optional[datetime]` Anniversary date is when annual quota limit is refreshed. - `quarter_anniversary_date: Optional[datetime]` Quarter anniversary date is when quota limit is refreshed each quarter. - `quota: Optional[int]` Tokens for the quarter. - `remaining: Optional[int]` Tokens remaining for the quarter. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) quota = client.cloudforce_one.requests.quota( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(quota.anniversary_date) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "anniversary_date": "2022-04-01T00:00:00Z", "quarter_anniversary_date": "2022-04-01T00:00:00Z", "quota": 120, "remaining": 64 } } ``` ## Get Request Types `cloudforce_one.requests.types(RequestTypesParams**kwargs) -> SyncSinglePage[RequestTypesResponse]` **get** `/accounts/{account_id}/cloudforce-one/requests/types` Lists available request types for Cloudforce One intelligence requests. ### Parameters - `account_id: str` Identifier. ### Returns - `str` Request Types. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) page = client.cloudforce_one.requests.types( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) page = page.result[0] print(page) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": [ "Indicators of Compromise", "Victomology" ] } ``` ## Get Request Priority, Status, and TLP constants `cloudforce_one.requests.constants(RequestConstantsParams**kwargs) -> RequestConstants` **get** `/accounts/{account_id}/cloudforce-one/requests/constants` Retrieves constant values used in Cloudforce One requests, including valid statuses and types. ### Parameters - `account_id: str` Identifier. ### Returns - `class RequestConstants: …` - `priority: Optional[List[Literal["routine", "high", "urgent"]]]` - `"routine"` - `"high"` - `"urgent"` - `status: Optional[List[Literal["open", "accepted", "reported", 3 more]]]` - `"open"` - `"accepted"` - `"reported"` - `"approved"` - `"completed"` - `"declined"` - `tlp: Optional[List[Literal["clear", "amber", "amber-strict", 2 more]]]` - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) request_constants = client.cloudforce_one.requests.constants( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(request_constants.priority) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "priority": [ "routine", "high", "urgent" ], "status": [ "open", "accepted", "reported", "approved", "completed", "declined" ], "tlp": [ "clear", "green", "amber", "amber-strict", "red" ] } } ``` ## Domain Types ### Item - `class Item: …` - `id: str` UUID. - `content: str` Request content. - `created: datetime` - `priority: datetime` - `request: str` Requested information from request. - `summary: str` Brief description of the request. - `tlp: Literal["clear", "amber", "amber-strict", 2 more]` The CISA defined Traffic Light Protocol (TLP). - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` - `updated: datetime` - `completed: Optional[datetime]` - `message_tokens: Optional[int]` Tokens for the request messages. - `readable_id: Optional[str]` Readable Request ID. - `status: Optional[Literal["open", "accepted", "reported", 3 more]]` Request Status. - `"open"` - `"accepted"` - `"reported"` - `"approved"` - `"completed"` - `"declined"` - `tokens: Optional[int]` Tokens for the request. ### List Item - `class ListItem: …` - `id: str` UUID. - `created: datetime` Request creation time. - `priority: Literal["routine", "high", "urgent"]` - `"routine"` - `"high"` - `"urgent"` - `request: str` Requested information from request. - `summary: str` Brief description of the request. - `tlp: Literal["clear", "amber", "amber-strict", 2 more]` The CISA defined Traffic Light Protocol (TLP). - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` - `updated: datetime` Request last updated time. - `completed: Optional[datetime]` Request completion time. - `message_tokens: Optional[int]` Tokens for the request messages. - `readable_id: Optional[str]` Readable Request ID. - `status: Optional[Literal["open", "accepted", "reported", 3 more]]` Request Status. - `"open"` - `"accepted"` - `"reported"` - `"approved"` - `"completed"` - `"declined"` - `tokens: Optional[int]` Tokens for the request. ### Quota - `class Quota: …` - `anniversary_date: Optional[datetime]` Anniversary date is when annual quota limit is refreshed. - `quarter_anniversary_date: Optional[datetime]` Quarter anniversary date is when quota limit is refreshed each quarter. - `quota: Optional[int]` Tokens for the quarter. - `remaining: Optional[int]` Tokens remaining for the quarter. ### Request Constants - `class RequestConstants: …` - `priority: Optional[List[Literal["routine", "high", "urgent"]]]` - `"routine"` - `"high"` - `"urgent"` - `status: Optional[List[Literal["open", "accepted", "reported", 3 more]]]` - `"open"` - `"accepted"` - `"reported"` - `"approved"` - `"completed"` - `"declined"` - `tlp: Optional[List[Literal["clear", "amber", "amber-strict", 2 more]]]` - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` ### Request Types - `List[RequestTypesResponse]` ### Request Delete Response - `class RequestDeleteResponse: …` - `errors: List[Error]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[ErrorSource]` - `pointer: Optional[str]` - `messages: List[Message]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[MessageSource]` - `pointer: Optional[str]` - `success: Literal[true]` Whether the API call was successful. - `true` ### Request Types Response - `str` Request Types. # Message ## List Request Messages `cloudforce_one.requests.message.get(strrequest_id, MessageGetParams**kwargs) -> SyncSinglePage[Message]` **post** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/message` Lists messages in a Cloudforce One intelligence request conversation. ### Parameters - `account_id: str` Identifier. - `request_id: str` UUID. - `page: int` Page number of results. - `per_page: int` Number of results per page. - `after: Optional[Union[str, datetime]]` Retrieve mes ges created after this time. - `before: Optional[Union[str, datetime]]` Retrieve messages created before this time. - `sort_by: Optional[str]` Field to sort results by. - `sort_order: Optional[Literal["asc", "desc"]]` Sort order (asc or desc). - `"asc"` - `"desc"` ### Returns - `class Message: …` - `id: int` Message ID. - `author: str` Author of message. - `content: str` Content of message. - `is_follow_on_request: bool` Whether the message is a follow-on request. - `updated: datetime` Defines the message last updated time. - `created: Optional[datetime]` Defines the message creation time. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) page = client.cloudforce_one.requests.message.get( request_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", account_id="023e105f4ecef8ad9ca31a8372d0c353", page=0, per_page=10, ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": [ { "id": 0, "author": "user@domain.com", "content": "Can you elaborate on the type of DoS that occurred?", "is_follow_on_request": true, "updated": "2022-01-01T00:00:00Z", "created": "2022-01-01T00:00:00Z" } ] } ``` ## Create a New Request Message `cloudforce_one.requests.message.create(strrequest_id, MessageCreateParams**kwargs) -> Message` **post** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/new` Adds a message to a Cloudforce One intelligence request conversation. ### Parameters - `account_id: str` Identifier. - `request_id: str` UUID. - `content: Optional[str]` Content of message. ### Returns - `class Message: …` - `id: int` Message ID. - `author: str` Author of message. - `content: str` Content of message. - `is_follow_on_request: bool` Whether the message is a follow-on request. - `updated: datetime` Defines the message last updated time. - `created: Optional[datetime]` Defines the message creation time. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) message = client.cloudforce_one.requests.message.create( request_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(message.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": 0, "author": "user@domain.com", "content": "Can you elaborate on the type of DoS that occurred?", "is_follow_on_request": true, "updated": "2022-01-01T00:00:00Z", "created": "2022-01-01T00:00:00Z" } } ``` ## Update a Request Message `cloudforce_one.requests.message.update(intmessage_id, MessageUpdateParams**kwargs) -> Message` **put** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}` Updates a message in a Cloudforce One intelligence request thread. ### Parameters - `account_id: str` Identifier. - `request_id: str` UUID. - `message_id: int` - `content: Optional[str]` Content of message. ### Returns - `class Message: …` - `id: int` Message ID. - `author: str` Author of message. - `content: str` Content of message. - `is_follow_on_request: bool` Whether the message is a follow-on request. - `updated: datetime` Defines the message last updated time. - `created: Optional[datetime]` Defines the message creation time. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) message = client.cloudforce_one.requests.message.update( message_id=0, account_id="023e105f4ecef8ad9ca31a8372d0c353", request_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", ) print(message.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": 0, "author": "user@domain.com", "content": "Can you elaborate on the type of DoS that occurred?", "is_follow_on_request": true, "updated": "2022-01-01T00:00:00Z", "created": "2022-01-01T00:00:00Z" } } ``` ## Delete a Request Message `cloudforce_one.requests.message.delete(intmessage_id, MessageDeleteParams**kwargs) -> MessageDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}` Removes a message from a Cloudforce One intelligence request thread. ### Parameters - `account_id: str` Identifier. - `request_id: str` UUID. - `message_id: int` ### Returns - `class MessageDeleteResponse: …` - `errors: List[Error]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[ErrorSource]` - `pointer: Optional[str]` - `messages: List[Message]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[MessageSource]` - `pointer: Optional[str]` - `success: Literal[true]` Whether the API call was successful. - `true` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) message = client.cloudforce_one.requests.message.delete( message_id=0, account_id="023e105f4ecef8ad9ca31a8372d0c353", request_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", ) print(message.errors) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true } ``` ## Domain Types ### Message - `class Message: …` - `id: int` Message ID. - `author: str` Author of message. - `content: str` Content of message. - `is_follow_on_request: bool` Whether the message is a follow-on request. - `updated: datetime` Defines the message last updated time. - `created: Optional[datetime]` Defines the message creation time. ### Message Delete Response - `class MessageDeleteResponse: …` - `errors: List[Error]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[ErrorSource]` - `pointer: Optional[str]` - `messages: List[Message]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[MessageSource]` - `pointer: Optional[str]` - `success: Literal[true]` Whether the API call was successful. - `true` # Priority ## Get a Priority Intelligence Requirement `cloudforce_one.requests.priority.get(strpriority_id, PriorityGetParams**kwargs) -> Item` **get** `/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}` Retrieves a specific priority intelligence request from Cloudforce One. ### Parameters - `account_id: str` Identifier. - `priority_id: str` UUID. ### Returns - `class Item: …` - `id: str` UUID. - `content: str` Request content. - `created: datetime` - `priority: datetime` - `request: str` Requested information from request. - `summary: str` Brief description of the request. - `tlp: Literal["clear", "amber", "amber-strict", 2 more]` The CISA defined Traffic Light Protocol (TLP). - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` - `updated: datetime` - `completed: Optional[datetime]` - `message_tokens: Optional[int]` Tokens for the request messages. - `readable_id: Optional[str]` Readable Request ID. - `status: Optional[Literal["open", "accepted", "reported", 3 more]]` Request Status. - `"open"` - `"accepted"` - `"reported"` - `"approved"` - `"completed"` - `"declined"` - `tokens: Optional[int]` Tokens for the request. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) item = client.cloudforce_one.requests.priority.get( priority_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(item.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "content": "What regions were most effected by the recent DoS?", "created": "2022-04-01T05:20:00Z", "priority": "2022-04-01T05:20:00Z", "request": "Victomology", "summary": "DoS attack", "tlp": "clear", "updated": "2022-04-01T05:20:00Z", "completed": "2022-04-01T05:20:00Z", "message_tokens": 1, "readable_id": "RFI-2022-000001", "status": "open", "tokens": 16 } } ``` ## Create a New Priority Intelligence Requirement `cloudforce_one.requests.priority.create(PriorityCreateParams**kwargs) -> Priority` **post** `/accounts/{account_id}/cloudforce-one/requests/priority/new` Creates a new priority intelligence request in Cloudforce One. ### Parameters - `account_id: str` Identifier. - `labels: Sequence[Label]` List of labels. - `priority: int` Priority. - `requirement: str` Requirement. - `tlp: Literal["clear", "amber", "amber-strict", 2 more]` The CISA defined Traffic Light Protocol (TLP). - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` ### Returns - `class Priority: …` - `id: str` UUID. - `created: datetime` Priority creation time. - `labels: List[Label]` List of labels. - `priority: int` Priority. - `requirement: str` Requirement. - `tlp: Literal["clear", "amber", "amber-strict", 2 more]` The CISA defined Traffic Light Protocol (TLP). - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` - `updated: datetime` Priority last updated time. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) priority = client.cloudforce_one.requests.priority.create( account_id="023e105f4ecef8ad9ca31a8372d0c353", labels=["DoS", "CVE"], priority=1, requirement="DoS attacks carried out by CVEs", tlp="clear", ) print(priority.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "created": "2022-04-01T05:20:00Z", "labels": [ "DoS", "CVE" ], "priority": 1, "requirement": "DoS attacks carried out by CVEs", "tlp": "clear", "updated": "2022-04-01T05:20:00Z" } } ``` ## Update a Priority Intelligence Requirement `cloudforce_one.requests.priority.update(strpriority_id, PriorityUpdateParams**kwargs) -> Item` **put** `/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}` Updates a priority intelligence request in Cloudforce One. ### Parameters - `account_id: str` Identifier. - `priority_id: str` UUID. - `labels: Sequence[Label]` List of labels. - `priority: int` Priority. - `requirement: str` Requirement. - `tlp: Literal["clear", "amber", "amber-strict", 2 more]` The CISA defined Traffic Light Protocol (TLP). - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` ### Returns - `class Item: …` - `id: str` UUID. - `content: str` Request content. - `created: datetime` - `priority: datetime` - `request: str` Requested information from request. - `summary: str` Brief description of the request. - `tlp: Literal["clear", "amber", "amber-strict", 2 more]` The CISA defined Traffic Light Protocol (TLP). - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` - `updated: datetime` - `completed: Optional[datetime]` - `message_tokens: Optional[int]` Tokens for the request messages. - `readable_id: Optional[str]` Readable Request ID. - `status: Optional[Literal["open", "accepted", "reported", 3 more]]` Request Status. - `"open"` - `"accepted"` - `"reported"` - `"approved"` - `"completed"` - `"declined"` - `tokens: Optional[int]` Tokens for the request. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) item = client.cloudforce_one.requests.priority.update( priority_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", account_id="023e105f4ecef8ad9ca31a8372d0c353", labels=["DoS", "CVE"], priority=1, requirement="DoS attacks carried out by CVEs", tlp="clear", ) print(item.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": "f174e90a-fafe-4643-bbbc-4a0ed4fc8415", "content": "What regions were most effected by the recent DoS?", "created": "2022-04-01T05:20:00Z", "priority": "2022-04-01T05:20:00Z", "request": "Victomology", "summary": "DoS attack", "tlp": "clear", "updated": "2022-04-01T05:20:00Z", "completed": "2022-04-01T05:20:00Z", "message_tokens": 1, "readable_id": "RFI-2022-000001", "status": "open", "tokens": 16 } } ``` ## Delete a Priority Intelligence Requirement `cloudforce_one.requests.priority.delete(strpriority_id, PriorityDeleteParams**kwargs) -> PriorityDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}` Deletes a priority intelligence request from Cloudforce One. ### Parameters - `account_id: str` Identifier. - `priority_id: str` UUID. ### Returns - `class PriorityDeleteResponse: …` - `errors: List[Error]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[ErrorSource]` - `pointer: Optional[str]` - `messages: List[Message]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[MessageSource]` - `pointer: Optional[str]` - `success: Literal[true]` Whether the API call was successful. - `true` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) priority = client.cloudforce_one.requests.priority.delete( priority_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(priority.errors) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true } ``` ## Get Priority Intelligence Requirement Quota `cloudforce_one.requests.priority.quota(PriorityQuotaParams**kwargs) -> Quota` **get** `/accounts/{account_id}/cloudforce-one/requests/priority/quota` Retrieves quota usage for Cloudforce One priority requests. ### Parameters - `account_id: str` Identifier. ### Returns - `class Quota: …` - `anniversary_date: Optional[datetime]` Anniversary date is when annual quota limit is refreshed. - `quarter_anniversary_date: Optional[datetime]` Quarter anniversary date is when quota limit is refreshed each quarter. - `quota: Optional[int]` Tokens for the quarter. - `remaining: Optional[int]` Tokens remaining for the quarter. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) quota = client.cloudforce_one.requests.priority.quota( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(quota.anniversary_date) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "anniversary_date": "2022-04-01T00:00:00Z", "quarter_anniversary_date": "2022-04-01T00:00:00Z", "quota": 120, "remaining": 64 } } ``` ## Domain Types ### Label - `str` ### Priority - `class Priority: …` - `id: str` UUID. - `created: datetime` Priority creation time. - `labels: List[Label]` List of labels. - `priority: int` Priority. - `requirement: str` Requirement. - `tlp: Literal["clear", "amber", "amber-strict", 2 more]` The CISA defined Traffic Light Protocol (TLP). - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` - `updated: datetime` Priority last updated time. ### Priority Edit - `class PriorityEdit: …` - `labels: List[Label]` List of labels. - `priority: int` Priority. - `requirement: str` Requirement. - `tlp: Literal["clear", "amber", "amber-strict", 2 more]` The CISA defined Traffic Light Protocol (TLP). - `"clear"` - `"amber"` - `"amber-strict"` - `"green"` - `"red"` ### Priority Delete Response - `class PriorityDeleteResponse: …` - `errors: List[Error]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[ErrorSource]` - `pointer: Optional[str]` - `messages: List[Message]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[MessageSource]` - `pointer: Optional[str]` - `success: Literal[true]` Whether the API call was successful. - `true` # Assets ## Get a Request Asset `cloudforce_one.requests.assets.get(strasset_id, AssetGetParams**kwargs) -> SyncSinglePage[AssetGetResponse]` **get** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}` Retrieves an asset attached to a Cloudforce One intelligence request. ### Parameters - `account_id: str` Identifier. - `request_id: str` UUID. - `asset_id: str` UUID. ### Returns - `class AssetGetResponse: …` - `id: int` Asset ID. - `name: str` Asset name. - `created: Optional[datetime]` Defines the asset creation time. - `description: Optional[str]` Asset description. - `file_type: Optional[str]` Asset file type. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) page = client.cloudforce_one.requests.assets.get( asset_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", account_id="023e105f4ecef8ad9ca31a8372d0c353", request_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": [ { "id": 0, "name": "example.docx", "created": "2022-01-01T00:00:00Z", "description": "example description", "file_type": "docx" } ] } ``` ## List Request Assets `cloudforce_one.requests.assets.create(strrequest_id, AssetCreateParams**kwargs) -> SyncSinglePage[AssetCreateResponse]` **post** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset` Lists assets attached to a Cloudforce One intelligence request. ### Parameters - `account_id: str` Identifier. - `request_id: str` UUID. - `page: int` Page number of results. - `per_page: int` Number of results per page. ### Returns - `class AssetCreateResponse: …` - `id: int` Asset ID. - `name: str` Asset name. - `created: Optional[datetime]` Defines the asset creation time. - `description: Optional[str]` Asset description. - `file_type: Optional[str]` Asset file type. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) page = client.cloudforce_one.requests.assets.create( request_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", account_id="023e105f4ecef8ad9ca31a8372d0c353", page=0, per_page=10, ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": [ { "id": 0, "name": "example.docx", "created": "2022-01-01T00:00:00Z", "description": "example description", "file_type": "docx" } ] } ``` ## Update a Request Asset `cloudforce_one.requests.assets.update(strasset_id, AssetUpdateParams**kwargs) -> AssetUpdateResponse` **put** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}` Updates an asset in a Cloudforce One intelligence request. ### Parameters - `account_id: str` Identifier. - `request_id: str` UUID. - `asset_id: str` UUID. - `source: Optional[str]` Asset file to upload. ### Returns - `class AssetUpdateResponse: …` - `id: int` Asset ID. - `name: str` Asset name. - `created: Optional[datetime]` Defines the asset creation time. - `description: Optional[str]` Asset description. - `file_type: Optional[str]` Asset file type. ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) asset = client.cloudforce_one.requests.assets.update( asset_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", account_id="023e105f4ecef8ad9ca31a8372d0c353", request_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", ) print(asset.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": 0, "name": "example.docx", "created": "2022-01-01T00:00:00Z", "description": "example description", "file_type": "docx" } } ``` ## Delete a Request Asset `cloudforce_one.requests.assets.delete(strasset_id, AssetDeleteParams**kwargs) -> AssetDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}` Removes an asset from a Cloudforce One intelligence request. ### Parameters - `account_id: str` Identifier. - `request_id: str` UUID. - `asset_id: str` UUID. ### Returns - `class AssetDeleteResponse: …` - `errors: List[Error]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[ErrorSource]` - `pointer: Optional[str]` - `messages: List[Message]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[MessageSource]` - `pointer: Optional[str]` - `success: Literal[true]` Whether the API call was successful. - `true` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) asset = client.cloudforce_one.requests.assets.delete( asset_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", account_id="023e105f4ecef8ad9ca31a8372d0c353", request_id="f174e90a-fafe-4643-bbbc-4a0ed4fc8415", ) print(asset.errors) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true } ``` ## Domain Types ### Asset Get Response - `class AssetGetResponse: …` - `id: int` Asset ID. - `name: str` Asset name. - `created: Optional[datetime]` Defines the asset creation time. - `description: Optional[str]` Asset description. - `file_type: Optional[str]` Asset file type. ### Asset Create Response - `class AssetCreateResponse: …` - `id: int` Asset ID. - `name: str` Asset name. - `created: Optional[datetime]` Defines the asset creation time. - `description: Optional[str]` Asset description. - `file_type: Optional[str]` Asset file type. ### Asset Update Response - `class AssetUpdateResponse: …` - `id: int` Asset ID. - `name: str` Asset name. - `created: Optional[datetime]` Defines the asset creation time. - `description: Optional[str]` Asset description. - `file_type: Optional[str]` Asset file type. ### Asset Delete Response - `class AssetDeleteResponse: …` - `errors: List[Error]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[ErrorSource]` - `pointer: Optional[str]` - `messages: List[Message]` - `code: int` - `message: str` - `documentation_url: Optional[str]` - `source: Optional[MessageSource]` - `pointer: Optional[str]` - `success: Literal[true]` Whether the API call was successful. - `true` # Threat Events ## Filter and list events `cloudforce_one.threat_events.list(ThreatEventListParams**kwargs) -> ThreatEventListResponse` **get** `/accounts/{account_id}/cloudforce-one/events` Use `datasetId=all` or `datasetId=*` to query all event datasets for the account (limited to 50). When `datasetId` is unspecified, events are listed from the default Cloudforce One Threat Events dataset. To list existing datasets, use the [`List Datasets`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint. ### Parameters - `account_id: str` Account ID. - `cursor: Optional[str]` Cursor for pagination. When provided, filters are embedded in the cursor so you only need to pass cursor and pageSize. Returned in the previous response's result_info.cursor field. Use cursor-based pagination for deep pagination (beyond 100,000 records) or for optimal performance. - `dataset_id: Optional[Sequence[str]]` Dataset IDs to query events from (array of UUIDs), or special value 'all' or '*' to query all event datasets for the account. If not provided, uses the default dataset. - `force_refresh: Optional[bool]` - `format: Optional[Literal["json", "stix2", "taxii"]]` - `"json"` - `"stix2"` - `"taxii"` - `order: Optional[Literal["asc", "desc"]]` - `"asc"` - `"desc"` - `order_by: Optional[str]` - `page: Optional[float]` Page number (1-indexed) for offset-based pagination. Limited to offset of 100,000 records. For deep pagination, use cursor-based pagination instead. - `page_size: Optional[float]` Number of results per page. Maximum 25,000. - `search: Optional[Iterable[Search]]` - `field: Optional[str]` Event field to search on. Allowed: attacker, attackerCountry, category, createdAt, date, event, indicator, indicatorType, killChain, mitreAttack, tags, targetCountry, targetIndustry, tlp, uuid. - `op: Optional[Literal["equals", "not", "gt", 9 more]]` Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'tags', op:'in', value:['malware','apt']}. - `"equals"` - `"not"` - `"gt"` - `"gte"` - `"lt"` - `"lte"` - `"like"` - `"contains"` - `"startsWith"` - `"endsWith"` - `"in"` - `"find"` - `value: Optional[Union[str, float, Sequence[Union[str, float]]]]` Search value. String or number for most operators. Array for 'in' operator (max 100 items). - `str` - `float` - `Sequence[Union[str, float]]` - `str` - `float` - `source: Optional[Literal["do", "r2catalog"]]` Read backend. 'do' (default) reads Durable Object storage. 'r2catalog' reads R2 Data Catalog (admin-only, experimental; supports a subset of search fields — no 'tags'). - `"do"` - `"r2catalog"` ### Returns - `List[ThreatEventListResponseItem]` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) threat_events = client.cloudforce_one.threat_events.list( account_id="account_id", ) print(threat_events) ``` #### Response ```json [ { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ] ``` ## Reads an event `cloudforce_one.threat_events.get(strevent_id, ThreatEventGetParams**kwargs) -> ThreatEventGetResponse` **get** `/accounts/{account_id}/cloudforce-one/events/{event_id}` This Method is deprecated. Please use /events/dataset/:dataset_id/events/:event_id instead. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. ### Returns - `class ThreatEventGetResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) threat_event = client.cloudforce_one.threat_events.get( event_id="event_id", account_id="account_id", ) print(threat_event.uuid) ``` #### Response ```json { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ``` ## Creates a new event `cloudforce_one.threat_events.create(ThreatEventCreateParams**kwargs) -> ThreatEventCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/create` To create a dataset, see the [`Create Dataset`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create/) endpoint. When `datasetId` parameter is unspecified, it will be created in a default dataset named `Cloudforce One Threat Events`. ### Parameters - `account_id: str` Account ID. - `category: str` - `date: Union[str, datetime]` - `event: str` - `raw: Raw` - `data: Optional[Dict[str, object]]` - `source: Optional[str]` - `tlp: Optional[str]` - `tlp: str` - `account_id: Optional[float]` - `attacker: Optional[str]` - `attacker_country: Optional[str]` - `dataset_id: Optional[str]` - `indicator: Optional[str]` - `indicators: Optional[Iterable[Indicator]]` Array of indicators for this event. Supports multiple indicators per event for complex scenarios. - `indicator_type: str` The type of indicator (e.g., DOMAIN, IP, JA3, HASH) - `value: str` The indicator value (e.g., domain name, IP address, hash) - `indicator_type: Optional[str]` - `insight: Optional[str]` - `tags: Optional[Sequence[str]]` - `target_country: Optional[str]` - `target_industry: Optional[str]` ### Returns - `class ThreatEventCreateResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Example ```python import os from datetime import datetime from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) threat_event = client.cloudforce_one.threat_events.create( path_account_id="account_id", category="Domain Resolution", date=datetime.fromisoformat("2022-04-01T00:00:00"), event="An attacker registered the domain domain.com", raw={ "data": { "foo": "bar" } }, tlp="amber", ) print(threat_event.uuid) ``` #### Response ```json { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ``` ## Updates an event `cloudforce_one.threat_events.edit(strevent_id, ThreatEventEditParams**kwargs) -> ThreatEventEditResponse` **patch** `/accounts/{account_id}/cloudforce-one/events/{event_id}` Update an existing event by its identifier. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. - `dataset_id: str` Dataset ID containing the event to update. - `attacker: Optional[str]` - `attacker_country: Optional[str]` - `category: Optional[str]` - `created_at: Optional[Union[str, datetime]]` - `date: Optional[Union[str, datetime]]` - `event: Optional[str]` - `indicator: Optional[str]` - `indicator_type: Optional[str]` - `insight: Optional[str]` - `raw: Optional[Raw]` - `data: Optional[Dict[str, object]]` - `source: Optional[str]` - `tlp: Optional[str]` - `target_country: Optional[str]` - `target_industry: Optional[str]` - `tlp: Optional[str]` ### Returns - `class ThreatEventEditResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.edit( event_id="event_id", account_id="account_id", dataset_id="9b769969-a211-466c-8ac3-cb91266a066a", ) print(response.uuid) ``` #### Response ```json { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ``` ## Creates bulk events `cloudforce_one.threat_events.bulk_create(ThreatEventBulkCreateParams**kwargs) -> ThreatEventBulkCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/create/bulk` The `datasetId` parameter must be defined. To list existing datasets (and their IDs) in your account, use the [`List Datasets`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint. ### Parameters - `account_id: str` Account ID. - `data: Iterable[Data]` - `category: str` - `date: Union[str, datetime]` - `event: str` - `raw: DataRaw` - `data: Optional[Dict[str, object]]` - `source: Optional[str]` - `tlp: Optional[str]` - `tlp: str` - `account_id: Optional[float]` - `attacker: Optional[str]` - `attacker_country: Optional[str]` - `dataset_id: Optional[str]` - `indicator: Optional[str]` - `indicators: Optional[Iterable[DataIndicator]]` Array of indicators for this event. Supports multiple indicators per event for complex scenarios. - `indicator_type: str` The type of indicator (e.g., DOMAIN, IP, JA3, HASH) - `value: str` The indicator value (e.g., domain name, IP address, hash) - `indicator_type: Optional[str]` - `insight: Optional[str]` - `tags: Optional[Sequence[str]]` - `target_country: Optional[str]` - `target_industry: Optional[str]` - `dataset_id: str` - `include_created_events: Optional[bool]` When true, response includes array of created event UUIDs and shard IDs. Useful for tracking which events were created and where. ### Returns - `class ThreatEventBulkCreateResponse: …` Detailed result of bulk event creation with auto-tag management - `created_events_count: float` Number of events created - `created_tags_count: float` Number of new tags created in SoT - `error_count: float` Number of errors encountered - `queued_indicators_count: float` Number of indicators queued for async processing - `create_bulk_events_request_id: Optional[str]` Correlation ID for async indicator processing - `created_events: Optional[List[CreatedEvent]]` Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true - `event_index: float` Original index in the input data array - `shard_id: str` Dataset ID of the shard where the event was created - `uuid: str` UUID of the created event - `errors: Optional[List[Error]]` Array of error details - `error: str` Error message - `event_index: float` Index of the event that caused the error ### Example ```python import os from datetime import datetime from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.bulk_create( account_id="account_id", data=[{ "category": "Domain Resolution", "date": datetime.fromisoformat("2022-04-01T00:00:00"), "event": "An attacker registered the domain domain.com", "raw": { "data": { "foo": "bar" } }, "tlp": "amber", }], dataset_id="durableObjectName", ) print(response.created_events_count) ``` #### Response ```json { "createdEventsCount": 0, "createdTagsCount": 0, "errorCount": 0, "queuedIndicatorsCount": 0, "createBulkEventsRequestId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "createdEvents": [ { "eventIndex": 0, "shardId": "shardId", "uuid": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" } ], "errors": [ { "error": "error", "eventIndex": 0 } ] } ``` ## Creates bulk DOS event with relationships and indicators `cloudforce_one.threat_events.bulk_create_relationships(ThreatEventBulkCreateRelationshipsParams**kwargs) -> ThreatEventBulkCreateRelationshipsResponse` **post** `/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships` This method is deprecated. Please use `event_create_bulk` instead ### Parameters - `account_id: str` Account ID. - `data: Iterable[Data]` - `category: str` - `date: Union[str, datetime]` - `event: str` - `raw: DataRaw` - `data: Optional[Dict[str, object]]` - `source: Optional[str]` - `tlp: Optional[str]` - `tlp: str` - `account_id: Optional[float]` - `attacker: Optional[str]` - `attacker_country: Optional[str]` - `dataset_id: Optional[str]` - `indicator: Optional[str]` - `indicators: Optional[Iterable[DataIndicator]]` Array of indicators for this event. Supports multiple indicators per event for complex scenarios. - `indicator_type: str` The type of indicator (e.g., DOMAIN, IP, JA3, HASH) - `value: str` The indicator value (e.g., domain name, IP address, hash) - `indicator_type: Optional[str]` - `insight: Optional[str]` - `tags: Optional[Sequence[str]]` - `target_country: Optional[str]` - `target_industry: Optional[str]` - `dataset_id: str` ### Returns - `class ThreatEventBulkCreateRelationshipsResponse: …` Result of bulk relationship creation operation - `created_events_count: float` Number of events created - `created_indicators_count: float` Number of indicators created - `created_relationships_count: float` Number of relationships created - `error_count: float` Number of errors encountered - `errors: Optional[List[Error]]` Array of error details - `error: str` Error message - `event_index: float` Index of the event that caused the error ### Example ```python import os from datetime import datetime from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.bulk_create_relationships( account_id="account_id", data=[{ "category": "Domain Resolution", "date": datetime.fromisoformat("2022-04-01T00:00:00"), "event": "An attacker registered the domain domain.com", "raw": { "data": { "foo": "bar" } }, "tlp": "amber", }], dataset_id="durableObjectName", ) print(response.created_events_count) ``` #### Response ```json { "createdEventsCount": 0, "createdIndicatorsCount": 0, "createdRelationshipsCount": 0, "errorCount": 0, "errors": [ { "error": "error", "eventIndex": 0 } ] } ``` ## Domain Types ### Threat Event List Response - `List[ThreatEventListResponseItem]` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Threat Event Get Response - `class ThreatEventGetResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Threat Event Create Response - `class ThreatEventCreateResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Threat Event Edit Response - `class ThreatEventEditResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Threat Event Bulk Create Response - `class ThreatEventBulkCreateResponse: …` Detailed result of bulk event creation with auto-tag management - `created_events_count: float` Number of events created - `created_tags_count: float` Number of new tags created in SoT - `error_count: float` Number of errors encountered - `queued_indicators_count: float` Number of indicators queued for async processing - `create_bulk_events_request_id: Optional[str]` Correlation ID for async indicator processing - `created_events: Optional[List[CreatedEvent]]` Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true - `event_index: float` Original index in the input data array - `shard_id: str` Dataset ID of the shard where the event was created - `uuid: str` UUID of the created event - `errors: Optional[List[Error]]` Array of error details - `error: str` Error message - `event_index: float` Index of the event that caused the error ### Threat Event Bulk Create Relationships Response - `class ThreatEventBulkCreateRelationshipsResponse: …` Result of bulk relationship creation operation - `created_events_count: float` Number of events created - `created_indicators_count: float` Number of indicators created - `created_relationships_count: float` Number of relationships created - `error_count: float` Number of errors encountered - `errors: Optional[List[Error]]` Array of error details - `error: str` Error message - `event_index: float` Index of the event that caused the error # Aggregate ## Aggregate events by single or multiple columns with optional date filtering `cloudforce_one.threat_events.aggregate.list(AggregateListParams**kwargs) -> AggregateListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/aggregate` Aggregate threat events by one or more columns (e.g., attacker, targetIndustry) with optional date filtering and daily grouping. Supports multi-dimensional aggregation for cross-analysis. ### Parameters - `account_id: str` Account ID. - `aggregate_by: str` Column(s) to aggregate by - single column or comma-separated list (e.g., 'attacker', 'targetIndustry', 'attacker,targetIndustry') - `dataset_id: Optional[Sequence[str]]` Dataset ID(s) to filter by. Can be a single dataset ID, comma-separated list, or array. If not provided, uses default dataset - `end_date: Optional[str]` End date for filtering (ISO 8601 format, e.g., '2024-12-31') - `group_by_date: Optional[bool]` Whether to group results by date (daily aggregation) - `limit: Optional[float]` Maximum number of results to return - `start_date: Optional[str]` Start date for filtering (ISO 8601 format, e.g., '2024-01-01') ### Returns - `class AggregateListResponse: …` - `aggregate_by: str` Column(s) that were aggregated by - `aggregations: List[Aggregation]` Array of aggregation results with dynamic fields based on aggregateBy columns - `count: float` Number of events for this aggregation - `date: Optional[str]` Date (if groupByDate is true) - `total: float` Total number of events in the aggregation - `date_range: Optional[DateRange]` Date range used for filtering - `end_date: Optional[str]` - `start_date: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) aggregates = client.cloudforce_one.threat_events.aggregate.list( account_id="account_id", aggregate_by="aggregateBy", ) print(aggregates.aggregate_by) ``` #### Response ```json { "aggregateBy": "aggregateBy", "aggregations": [ { "count": 0, "date": "date" } ], "total": 0, "dateRange": { "endDate": "endDate", "startDate": "startDate" } } ``` ## Domain Types ### Aggregate List Response - `class AggregateListResponse: …` - `aggregate_by: str` Column(s) that were aggregated by - `aggregations: List[Aggregation]` Array of aggregation results with dynamic fields based on aggregateBy columns - `count: float` Number of events for this aggregation - `date: Optional[str]` Date (if groupByDate is true) - `total: float` Total number of events in the aggregation - `date_range: Optional[DateRange]` Date range used for filtering - `end_date: Optional[str]` - `start_date: Optional[str]` # Graphql ## GraphQL endpoint for event aggregation `cloudforce_one.threat_events.graphql.create(GraphqlCreateParams**kwargs) -> GraphqlCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/graphql` Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation. ### Parameters - `account_id: str` Account ID. ### Returns - `class GraphqlCreateResponse: …` - `data: Optional[object]` - `errors: Optional[List[object]]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) graphql = client.cloudforce_one.threat_events.graphql.create( account_id="account_id", ) print(graphql.data) ``` #### Response ```json { "data": {}, "errors": [ {} ] } ``` ## Domain Types ### Graphql Create Response - `class GraphqlCreateResponse: …` - `data: Optional[object]` - `errors: Optional[List[object]]` # Graph ## Query graph neighborhood from R2 Data Catalog `cloudforce_one.threat_events.graph.list(GraphListParams**kwargs) -> GraphListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/graph` Expands the single-level relationship neighborhood of one or more seed nodes (event, indicator, or tag) from R2 Data Catalog. Seeds use compact id format (type:uuid), e.g. "event:550e8400-...". Multi-seed requests merge and deduplicate results server-side. Hydrates neighbor entities with summary data from Durable Objects. Supports filtering by relationship type and dataset scope. ### Parameters - `account_id: str` Account ID. - `cursor: Optional[str]` Opaque pagination token. Only valid when seeds has exactly 1 entry; 400 otherwise. - `dataset_ids: Optional[Sequence[str]]` Comma-separated dataset UUIDs to restrict neighbor scope. Intersected with ACL grants. - `direction: Optional[str]` Edge direction relative to each seed: out (seed→neighbors), in (neighbors→seed), both (default). - `expand: Optional[Sequence[str]]` Comma-separated list of response sections to expand (hydrate). Allowed: `nodes`. Omitting `expand` returns identifier-only nodes. - `hydration: Optional[str]` Hydration strategy for neighbor nodes when expand=nodes is set. r2_join (default): use R2 JOIN query + DO fallback. do_only: use plain R2 query + hydrate all neighbors via Durable Objects. - `limit: Optional[float]` Max neighbors per seed (default: 100, max: 1000). Values above 1000 return 400. - `max_nodes: Optional[float]` Total accumulated node cap across all seeds (default: 500, max: 1000). Values above 1000 return 400. - `relationship_types: Optional[Sequence[str]]` Comma-separated relationship types to filter by. Allowed: tagged_with, appears_in, related_to, caused_by, attributed_to. - `seeds: Optional[Sequence[str]]` Comma-separated compact seed ids (type:uuid). Example: seeds=event:550e8400-...,indicator:661fa920-... Provide 1–50 entries; omitting seeds returns 400. ### Returns - `class GraphListResponse: …` - `edges: List[Edge]` - `id: str` Deterministic composite edge id (source→target:relationshipType) - `relationship_type: str` - `source: str` Compact id of the source node (type:uuid) - `source_id: str` - `source_type: str` - `target: str` Compact id of the target node (type:uuid) - `target_id: str` - `target_type: str` - `node: Optional[Dict[str, object]]` Focal node object (legacy single-seed). Null when unavailable. - `nodes: List[Dict[str, object]]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) graphs = client.cloudforce_one.threat_events.graph.list( account_id="account_id", ) print(graphs.edges) ``` #### Response ```json { "errors": [], "messages": [], "result": { "edges": [ { "id": "event:550e8400-e29b-41d4-a716-446655440000→indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04:appears_in", "relationshipType": "appears_in", "source": "event:550e8400-e29b-41d4-a716-446655440000", "sourceId": "550e8400-e29b-41d4-a716-446655440000", "sourceType": "event", "target": "indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04", "targetId": "661fa920-bbf3-4e71-9c55-2a3d8e7f1b04", "targetType": "indicator" } ], "node": null, "nodes": [ { "attacker": "APT28", "category": "intrusion", "datasetId": "a1b2c3d4-0001-4000-8000-000000000001", "date": "2026-06-01", "event": "Attacker registered domain evil.example.com", "id": "event:550e8400-e29b-41d4-a716-446655440000", "role": "focal", "type": "event", "uuid": "550e8400-e29b-41d4-a716-446655440000" }, { "datasetId": "a1b2c3d4-0001-4000-8000-000000000001", "id": "indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04", "indicatorType": "domain", "role": "focal", "type": "indicator", "uuid": "661fa920-bbf3-4e71-9c55-2a3d8e7f1b04", "value": "evil.example.com" }, { "categoryId": "threat-actor", "id": "tag:772af1c8-dc4a-4a29-b3e6-4f8c9d2a6e71", "type": "tag", "uuid": "772af1c8-dc4a-4a29-b3e6-4f8c9d2a6e71", "value": "APT28" } ] }, "result_info": { "count": 3, "cursor": null, "depth_reached": 1, "edge_count": 1, "has_more": false, "query_time_ms": 890, "seeds": [ "event:550e8400-e29b-41d4-a716-446655440000", "indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04" ], "total_count": 3, "truncated": false }, "success": true } ``` ## Domain Types ### Graph List Response - `class GraphListResponse: …` - `edges: List[Edge]` - `id: str` Deterministic composite edge id (source→target:relationshipType) - `relationship_type: str` - `source: str` Compact id of the source node (type:uuid) - `source_id: str` - `source_type: str` - `target: str` Compact id of the target node (type:uuid) - `target_id: str` - `target_type: str` - `node: Optional[Dict[str, object]]` Focal node object (legacy single-seed). Null when unavailable. - `nodes: List[Dict[str, object]]` # Queries ## List all saved event queries `cloudforce_one.threat_events.queries.list(QueryListParams**kwargs) -> QueryListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/queries` Retrieve all saved event queries for the account ### Parameters - `account_id: str` Account ID. ### Returns - `List[QueryListResponseItem]` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) queries = client.cloudforce_one.threat_events.queries.list( account_id="account_id", ) print(queries) ``` #### Response ```json [ { "id": 0, "account_id": 0, "alert_enabled": true, "alert_rollup_enabled": true, "created_at": "created_at", "name": "name", "query_json": "query_json", "rule_enabled": true, "updated_at": "updated_at", "user_email": "user_email", "custom_threat_feed_id": 0, "rule_list_id": "rule_list_id", "rule_scope": "rule_scope" } ] ``` ## Create a saved event query `cloudforce_one.threat_events.queries.create(QueryCreateParams**kwargs) -> QueryCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/queries/create` Create a new saved event query for the account ### Parameters - `account_id: str` Account ID. - `alert_enabled: bool` Enable alerts for this query - `alert_rollup_enabled: bool` Enable alert rollup for this query - `name: str` Unique name for the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Enable rule for this query - `rule_scope: Optional[str]` Scope for the rule ### Returns - `class QueryCreateResponse: …` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) query = client.cloudforce_one.threat_events.queries.create( account_id="account_id", alert_enabled=True, alert_rollup_enabled=True, name="name", query_json="query_json", rule_enabled=True, ) print(query.id) ``` #### Response ```json { "id": 0, "account_id": 0, "alert_enabled": true, "alert_rollup_enabled": true, "created_at": "created_at", "name": "name", "query_json": "query_json", "rule_enabled": true, "updated_at": "updated_at", "user_email": "user_email", "custom_threat_feed_id": 0, "rule_list_id": "rule_list_id", "rule_scope": "rule_scope" } ``` ## Read a saved event query `cloudforce_one.threat_events.queries.get(intquery_id, QueryGetParams**kwargs) -> QueryGetResponse` **get** `/accounts/{account_id}/cloudforce-one/events/queries/{query_id}` Retrieve a saved event query by its ID ### Parameters - `account_id: str` Account ID. - `query_id: int` Event query ID ### Returns - `class QueryGetResponse: …` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) query = client.cloudforce_one.threat_events.queries.get( query_id=0, account_id="account_id", ) print(query.id) ``` #### Response ```json { "id": 0, "account_id": 0, "alert_enabled": true, "alert_rollup_enabled": true, "created_at": "created_at", "name": "name", "query_json": "query_json", "rule_enabled": true, "updated_at": "updated_at", "user_email": "user_email", "custom_threat_feed_id": 0, "rule_list_id": "rule_list_id", "rule_scope": "rule_scope" } ``` ## Update a saved event query `cloudforce_one.threat_events.queries.edit(intquery_id, QueryEditParams**kwargs) -> QueryEditResponse` **patch** `/accounts/{account_id}/cloudforce-one/events/queries/{query_id}` Update an existing saved event query by its ID ### Parameters - `account_id: str` Account ID. - `query_id: int` Event query ID - `alert_enabled: Optional[bool]` Enable alerts for this query - `alert_rollup_enabled: Optional[bool]` Enable alert rollup for this query - `name: Optional[str]` Unique name for the saved query - `query_json: Optional[str]` JSON string containing the query parameters - `rule_enabled: Optional[bool]` Enable rule for this query - `rule_scope: Optional[str]` Scope for the rule ### Returns - `class QueryEditResponse: …` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.queries.edit( query_id=0, account_id="account_id", ) print(response.id) ``` #### Response ```json { "id": 0, "account_id": 0, "alert_enabled": true, "alert_rollup_enabled": true, "created_at": "created_at", "name": "name", "query_json": "query_json", "rule_enabled": true, "updated_at": "updated_at", "user_email": "user_email", "custom_threat_feed_id": 0, "rule_list_id": "rule_list_id", "rule_scope": "rule_scope" } ``` ## Delete a saved event query `cloudforce_one.threat_events.queries.delete(intquery_id, QueryDeleteParams**kwargs)` **delete** `/accounts/{account_id}/cloudforce-one/events/queries/{query_id}` Delete a saved event query by its ID ### Parameters - `account_id: str` Account ID. - `query_id: int` Event query ID ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) client.cloudforce_one.threat_events.queries.delete( query_id=0, account_id="account_id", ) ``` ## Domain Types ### Query List Response - `List[QueryListResponseItem]` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule ### Query Create Response - `class QueryCreateResponse: …` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule ### Query Get Response - `class QueryGetResponse: …` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule ### Query Edit Response - `class QueryEditResponse: …` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule # Relationships ## Filter and list events related to specific event `cloudforce_one.threat_events.relationships.list(strevent_id, RelationshipListParams**kwargs) -> RelationshipListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships` The `event_id` must be defined (to list existing events (and their IDs), use the [`Filter and List Events`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/methods/list/) endpoint). Also, must provide query parameters. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. - `dataset_id: str` The dataset ID to search within. - `direction: Optional[Literal["ancestors", "descendants", "both"]]` The direction to traverse the graph. Defaults to 'both' to search all. - `"ancestors"` - `"descendants"` - `"both"` - `include_parent: Optional[bool]` Whether to include the starting event in the results. Defaults to true. - `indicator_type_ids: Optional[Sequence[str]]` An optional array of indicator type IDs to filter the results by. - `max_depth: Optional[float]` The maximum depth to traverse. Defaults to 5. - `page: Optional[float]` - `page_size: Optional[float]` - `relationship_types: Optional[Union[str, Sequence[str]]]` An optional array of relationship types to filter by. - `str` - `Sequence[str]` ### Returns - `List[RelationshipListResponseItem]` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) relationships = client.cloudforce_one.threat_events.relationships.list( event_id="event_id", account_id="account_id", dataset_id="datasetId", ) print(relationships) ``` #### Response ```json [ { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ] ``` ## Domain Types ### Relationship List Response - `List[RelationshipListResponseItem]` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` # Indicators ## Lists indicators across multiple datasets `cloudforce_one.threat_events.indicators.list(IndicatorListParams**kwargs) -> IndicatorListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/indicators` Retrieves a paginated list of indicators across specified datasets. Use datasetIds=all or datasetIds=* to query all datasets for the account. If no datasetIds provided, uses the default dataset. ### Parameters - `account_id: str` Account ID. - `created_after: Optional[Union[str, datetime]]` Filter indicators created on or after this date. Must use ISO 8601 format (e.g., '2024-01-15T00:00:00Z'). - `created_before: Optional[Union[str, datetime]]` Filter indicators created on or before this date. Must use ISO 8601 format (e.g., '2024-12-31T23:59:59Z'). - `dataset_ids: Optional[Sequence[str]]` Dataset IDs to query indicators from (array of UUIDs), or special value 'all' or '*' to query all datasets. If not provided, uses the default dataset. - `format: Optional[Literal["json", "stix2", "taxii"]]` Output format for indicator data. 'json' returns the default format, 'stix2' returns STIX 2.1 Indicator SDOs, 'taxii' returns a TAXII 2.1 Envelope with Content-Type application/taxii+json;version=2.1. - `"json"` - `"stix2"` - `"taxii"` - `include_tags: Optional[bool]` Whether to include full tag details for each indicator. Defaults to true. - `include_total_count: Optional[bool]` Whether to compute accurate total count via COUNT(*). Defaults to false for performance. When false, total_count is an approximation. - `indicator_type: Optional[str]` - `name: Optional[str]` Filter indicators by value using substring match (LIKE). Legacy alternative to structured search. - `page: Optional[float]` - `page_size: Optional[float]` - `related_events: Optional[Sequence[str]]` Filter by related event IDs - `related_events_limit: Optional[float]` Limit the number of related events returned per indicator. Default: 2. Set to 0 for none, -1 for all events. - `search: Optional[Iterable[Search]]` Structured search as a JSON array of {field, op, value} objects. Searchable fields: value, indicatorType. Supports operators: equals, not, contains, startsWith, endsWith, gt, lt, gte, lte, like, in, find. Use the 'in' operator with an array value to bulk-check up to 100 indicators in a single request, e.g. search=[{"field":"value","op":"in","value":["evil.com","bad.org"]}]. Multiple conditions are AND'd together. Max 10 conditions per request. - `field: Literal["value", "indicatorType"]` The indicator field to search on. Allowed: value, indicatorType. - `"value"` - `"indicatorType"` - `op: Literal["equals", "not", "gt", 9 more]` Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'value', op:'in', value:['evil.com','bad.org']}. - `"equals"` - `"not"` - `"gt"` - `"gte"` - `"lt"` - `"lte"` - `"like"` - `"contains"` - `"startsWith"` - `"endsWith"` - `"in"` - `"find"` - `value: Union[str, Sequence[str]]` Search value. String for most operators. Array of strings for 'in' operator (max 100 items). - `str` - `Sequence[str]` - `source: Optional[Literal["do", "r2catalog"]]` Read backend. 'do' (default) reads Durable Object storage. 'r2catalog' reads R2 Data Catalog (admin-only, experimental; supports a subset of search fields). - `"do"` - `"r2catalog"` - `tags: Optional[Sequence[str]]` Filter by tag values or UUIDs. Indicators must have at least one of the specified tags (OR logic). Supports both tag UUID and tag value. - `tag_search: Optional[Iterable[TagSearch]]` Structured tag-metadata filter as a JSON array of {field, op, value} objects. Operates against the per-dataset IndicatorTag mirror so you can find indicators by tag attributes (origin country, motive, sophistication, priority, etc.) without a separate Tags lookup. Common dashboard usage: drill from a country into indicators, e.g. tagSearch=[{"field":"originCountryISO","op":"in","value":["IR","CN"]}]. Country values may be passed as alpha-2, alpha-3, name, or alias (e.g. "iran"). Operators: equals, not, gt/gte/lt/lte (numeric only), contains/like/find/startsWith/endsWith (string only), in. AND-joined across entries; combined with `tags`, a matching tag must satisfy both. Max 10 entries per request, max 100 values per 'in'. Performance notes: `originCountryISO` uses its B-tree index for equals/not/in. `priority` uses its B-tree index for numeric comparisons. Other string columns (`actorCategory`, `motive`, etc.) are case-insensitive and unindexed; current catalog size makes this a non-issue. `endsWith` and `aliasGroupNames` contains/like are leading-wildcard scans and slow on large result sets. `aliasGroupNames` matches on the JSON-encoded text, so substrings can cross alias boundaries ("apt28" also matches "apt280" when both appear in the same tag's alias list). - `field: Literal["value", "categoryId", "actorCategory", 9 more]` Tag mirror field to filter on. Allowed: value, categoryId, actorCategory, aliasGroupNames, attributionConfidence, attributionOrganization, motive, opsecLevel, originCountryISO, sophisticationLevel, priority, analyticPriority. Filters operate against the per-dataset IndicatorTag mirror (which is kept in sync with the Tags SoT by the tag-propagation workflow). - `"value"` - `"categoryId"` - `"actorCategory"` - `"aliasGroupNames"` - `"attributionConfidence"` - `"attributionOrganization"` - `"motive"` - `"opsecLevel"` - `"originCountryISO"` - `"sophisticationLevel"` - `"priority"` - `"analyticPriority"` - `op: Literal["equals", "not", "gt", 9 more]` Search operator. Use 'in' for bulk OR within a single field, e.g. {field:"originCountryISO", op:"in", value:["IR","CN"]}. - `"equals"` - `"not"` - `"gt"` - `"gte"` - `"lt"` - `"lte"` - `"like"` - `"contains"` - `"startsWith"` - `"endsWith"` - `"in"` - `"find"` - `value: Optional[Union[str, float, Sequence[Union[str, float]]]]` Search value. String or number for most operators. Array for 'in' (max 100 items). Country values may be passed as alpha-2, alpha-3, name, or common alias (e.g. "iran", "IR", "IRN") and are normalized to alpha-2 server-side. - `str` - `float` - `Sequence[Union[str, float]]` - `str` - `float` ### Returns - `class IndicatorListResponse: …` - `properties: Properties` - `indicators: PropertiesIndicators` - `items: PropertiesIndicatorsItems` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[PropertiesIndicatorsItemsRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[PropertiesIndicatorsItemsTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `type: str` - `pagination: PropertiesPagination` - `properties: PropertiesPaginationProperties` - `count: PropertiesPaginationPropertiesCount` - `type: str` - `page: PropertiesPaginationPropertiesPage` - `type: str` - `per_page: PropertiesPaginationPropertiesPerPage` - `type: str` - `total_count: PropertiesPaginationPropertiesTotalCount` - `type: str` - `type: str` - `type: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) indicators = client.cloudforce_one.threat_events.indicators.list( account_id="account_id", ) print(indicators.properties) ``` #### Response ```json { "properties": { "indicators": { "items": { "createdAt": "2022-04-01T00:00:00Z", "indicatorType": "domain", "updatedAt": "2022-04-01T00:00:00Z", "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "malicious-domain.com", "datasetId": "dataset-uuid-123", "relatedEvents": [ { "datasetId": "dataset-uuid-123", "eventId": "event-uuid-456" } ], "tags": [ { "categoryName": "categoryName", "uuid": "uuid", "value": "value" } ] }, "type": "array" }, "pagination": { "properties": { "count": { "type": "number" }, "page": { "type": "number" }, "per_page": { "type": "number" }, "total_count": { "type": "number" } }, "type": "object" } }, "type": "object" } ``` ## Domain Types ### Indicator List Response - `class IndicatorListResponse: …` - `properties: Properties` - `indicators: PropertiesIndicators` - `items: PropertiesIndicatorsItems` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[PropertiesIndicatorsItemsRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[PropertiesIndicatorsItemsTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `type: str` - `pagination: PropertiesPagination` - `properties: PropertiesPaginationProperties` - `count: PropertiesPaginationPropertiesCount` - `type: str` - `page: PropertiesPaginationPropertiesPage` - `type: str` - `per_page: PropertiesPaginationPropertiesPerPage` - `type: str` - `total_count: PropertiesPaginationPropertiesTotalCount` - `type: str` - `type: str` - `type: str` # Aggregate ## Aggregate indicators by column(s) `cloudforce_one.threat_events.indicators.aggregate.list(AggregateListParams**kwargs) -> AggregateListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/indicators/aggregate` Aggregate threat indicators by one or more columns (e.g., indicatorType, value) across datasets. Returns top-N groups ordered by count. ### Parameters - `account_id: str` Account ID. - `aggregate_by: str` Column(s) to aggregate by - single column or comma-separated list (e.g., 'indicatorType', 'value', 'indicatorType,value') - `created_after: Optional[str]` Filter indicators created after this date (ISO 8601 format, e.g., '2024-01-01') - `created_before: Optional[str]` Filter indicators created before this date (ISO 8601 format, e.g., '2024-12-31') - `dataset_ids: Optional[Sequence[str]]` Dataset ID(s) to filter by. Can be a single dataset ID or comma-separated list. If not provided, aggregates across all accessible datasets - `event_date_after: Optional[str]` For measure=relationships: only count event links whose eventDate is on/after this date (ISO 8601). Use to bound 'top indicator' to recent activity. - `event_date_before: Optional[str]` For measure=relationships: only count event links whose eventDate is on/before this date (ISO 8601). - `limit: Optional[float]` Maximum number of aggregation results to return (1-100) - `measure: Optional[Literal["indicators", "relationships"]]` What to count per group: 'indicators' (catalog rows, default) or 'relationships' (linked events per indicator). Use 'relationships' for 'top indicator by event activity'. - `"indicators"` - `"relationships"` - `tag_uuid: Optional[str]` Scope to indicators associated with this tag/actor UUID. Combine with measure=relationships for 'top indicator for an actor'. ### Returns - `class AggregateListResponse: …` - `aggregate_by: str` Column(s) that were aggregated by - `aggregations: List[Aggregation]` Array of aggregation results with dynamic fields based on aggregateBy columns - `count: float` Number of indicators for this aggregation - `failed_datasets: float` Number of datasets whose aggregation failed and were excluded from the result - `total: float` Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) aggregates = client.cloudforce_one.threat_events.indicators.aggregate.list( account_id="account_id", aggregate_by="aggregateBy", ) print(aggregates.aggregate_by) ``` #### Response ```json { "aggregateBy": "aggregateBy", "aggregations": [ { "count": 0 } ], "failedDatasets": 0, "total": 0 } ``` ## Domain Types ### Aggregate List Response - `class AggregateListResponse: …` - `aggregate_by: str` Column(s) that were aggregated by - `aggregations: List[Aggregation]` Array of aggregation results with dynamic fields based on aggregateBy columns - `count: float` Number of indicators for this aggregation - `failed_datasets: float` Number of datasets whose aggregation failed and were excluded from the result - `total: float` Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships # Types ## Lists indicator types across multiple datasets `cloudforce_one.threat_events.indicators.types.list(TypeListParams**kwargs) -> TypeListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/indicator-types` List indicator types across one or more datasets for the account. ### Parameters - `account_id: str` Account ID. - `dataset_ids: Optional[Sequence[str]]` Array of dataset IDs to query indicator types from. If not provided, queries all datasets for the account. ### Returns - `class TypeListResponse: …` - `items: Items` - `type: str` - `type: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) types = client.cloudforce_one.threat_events.indicators.types.list( account_id="account_id", ) print(types.items) ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` ## Domain Types ### Type List Response - `class TypeListResponse: …` - `items: Items` - `type: str` - `type: str` # By Dataset ## Lists indicators `cloudforce_one.threat_events.indicators.by_dataset.list(strdataset_id, ByDatasetListParams**kwargs) -> ByDatasetListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators` This method is deprecated. Please use /events/indicators to retrieve a paginated list of indicators. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset UUID. - `indicator_type: Optional[str]` - `name: Optional[str]` Filter by indicator value (substring match) - `page: Optional[float]` - `page_size: Optional[float]` - `related_event: Optional[Sequence[str]]` Filter indicators by related event UUID(s). Multiple UUIDs can be provided by repeating the parameter. ### Returns - `class ByDatasetListResponse: …` - `indicators: List[Indicator]` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[IndicatorRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[IndicatorTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) by_datasets = client.cloudforce_one.threat_events.indicators.by_dataset.list( dataset_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="account_id", ) print(by_datasets.indicators) ``` #### Response ```json { "indicators": [ { "createdAt": "2022-04-01T00:00:00Z", "indicatorType": "domain", "updatedAt": "2022-04-01T00:00:00Z", "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "malicious-domain.com", "datasetId": "dataset-uuid-123", "relatedEvents": [ { "datasetId": "dataset-uuid-123", "eventId": "event-uuid-456" } ], "tags": [ { "categoryName": "categoryName", "uuid": "uuid", "value": "value" } ] } ], "pagination": { "page": 0, "pageSize": 0, "totalCount": 0, "totalPages": 0 } } ``` ## Reads an indicator `cloudforce_one.threat_events.indicators.by_dataset.get(strindicator_id, ByDatasetGetParams**kwargs) -> ByDatasetGetResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}` Retrieves a specific indicator by its UUID. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset ID. - `indicator_id: str` Indicator UUID. ### Returns - `class ByDatasetGetResponse: …` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[RelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[Tag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) by_dataset = client.cloudforce_one.threat_events.indicators.by_dataset.get( indicator_id="indicator_id", account_id="account_id", dataset_id="dataset_id", ) print(by_dataset.uuid) ``` #### Response ```json { "createdAt": "2022-04-01T00:00:00Z", "indicatorType": "domain", "updatedAt": "2022-04-01T00:00:00Z", "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "malicious-domain.com", "datasetId": "dataset-uuid-123", "relatedEvents": [ { "datasetId": "dataset-uuid-123", "eventId": "event-uuid-456" } ], "tags": [ { "categoryName": "categoryName", "uuid": "uuid", "value": "value" } ] } ``` ## Domain Types ### By Dataset List Response - `class ByDatasetListResponse: …` - `indicators: List[Indicator]` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[IndicatorRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[IndicatorTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` ### By Dataset Get Response - `class ByDatasetGetResponse: …` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[RelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[Tag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` # Tags ## List mirrored tags for an indicator dataset `cloudforce_one.threat_events.indicators.by_dataset.tags.list(strdataset_id, TagListParams**kwargs) -> TagListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags` Returns all mirrored tags from the indicator dataset (DO mirror table). No pagination. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset ID. ### Returns - `List[object]` Array of mirror tag rows ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) tags = client.cloudforce_one.threat_events.indicators.by_dataset.tags.list( dataset_id="dataset_id", account_id="account_id", ) print(tags) ``` #### Response ```json [ {} ] ``` ## Domain Types ### Tag List Response - `List[object]` Array of mirror tag rows # Attackers ## Lists attackers across multiple datasets `cloudforce_one.threat_events.attackers.list(AttackerListParams**kwargs) -> AttackerListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/attackers` List attacker names referenced in events across one or more datasets. ### Parameters - `account_id: str` Account ID. - `dataset_ids: Optional[Sequence[str]]` Array of dataset IDs to query attackers from. If not provided, uses the default dataset. ### Returns - `class AttackerListResponse: …` - `items: Items` - `type: str` - `type: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) attackers = client.cloudforce_one.threat_events.attackers.list( account_id="account_id", ) print(attackers.items) ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` ## Domain Types ### Attacker List Response - `class AttackerListResponse: …` - `items: Items` - `type: str` - `type: str` # Categories ## Lists categories across multiple datasets `cloudforce_one.threat_events.categories.list(CategoryListParams**kwargs) -> CategoryListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/categories` List categories across one or more datasets for the account. ### Parameters - `account_id: str` Account ID. - `dataset_ids: Optional[Sequence[str]]` Array of dataset IDs to query categories from. If not provided, uses the default dataset. ### Returns - `List[CategoryListResponseItem]` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) categories = client.cloudforce_one.threat_events.categories.list( account_id="account_id", ) print(categories) ``` #### Response ```json [ { "killChain": 0, "name": "name", "uuid": "12345678-1234-1234-1234-1234567890ab", "mitreAttack": [ "T1234" ], "mitreCapec": [ "123" ], "shortname": "shortname" } ] ``` ## Reads a category `cloudforce_one.threat_events.categories.get(strcategory_id, CategoryGetParams**kwargs) -> CategoryGetResponse` **get** `/accounts/{account_id}/cloudforce-one/events/categories/{category_id}` Retrieve a single category by its identifier. ### Parameters - `account_id: str` Account ID. - `category_id: str` Category UUID. ### Returns - `class CategoryGetResponse: …` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) category = client.cloudforce_one.threat_events.categories.get( category_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="account_id", ) print(category.uuid) ``` #### Response ```json { "killChain": 0, "name": "name", "uuid": "12345678-1234-1234-1234-1234567890ab", "mitreAttack": [ "T1234" ], "mitreCapec": [ "123" ], "shortname": "shortname" } ``` ## Creates a new category `cloudforce_one.threat_events.categories.create(CategoryCreateParams**kwargs) -> CategoryCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/categories/create` Create a new event category for the account. ### Parameters - `account_id: str` Account ID. - `kill_chain: float` - `name: str` - `mitre_attack: Optional[Sequence[str]]` - `mitre_capec: Optional[Sequence[str]]` - `shortname: Optional[str]` ### Returns - `class CategoryCreateResponse: …` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) category = client.cloudforce_one.threat_events.categories.create( account_id="account_id", kill_chain=0, name="name", ) print(category.uuid) ``` #### Response ```json { "killChain": 0, "name": "name", "uuid": "12345678-1234-1234-1234-1234567890ab", "mitreAttack": [ "T1234" ], "mitreCapec": [ "123" ], "shortname": "shortname" } ``` ## Updates a category `cloudforce_one.threat_events.categories.edit(strcategory_id, CategoryEditParams**kwargs) -> CategoryEditResponse` **patch** `/accounts/{account_id}/cloudforce-one/events/categories/{category_id}` Update an existing category by its identifier. ### Parameters - `account_id: str` Account ID. - `category_id: str` Category UUID. - `kill_chain: Optional[float]` - `mitre_attack: Optional[Sequence[str]]` - `mitre_capec: Optional[Sequence[str]]` - `name: Optional[str]` - `shortname: Optional[str]` ### Returns - `class CategoryEditResponse: …` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.categories.edit( category_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="account_id", ) print(response.uuid) ``` #### Response ```json { "killChain": 0, "name": "name", "uuid": "12345678-1234-1234-1234-1234567890ab", "mitreAttack": [ "T1234" ], "mitreCapec": [ "123" ], "shortname": "shortname" } ``` ## Deletes a category `cloudforce_one.threat_events.categories.delete(strcategory_id, CategoryDeleteParams**kwargs) -> CategoryDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/events/categories/{category_id}` Delete a category by its identifier. ### Parameters - `account_id: str` Account ID. - `category_id: str` Category UUID. ### Returns - `class CategoryDeleteResponse: …` - `uuid: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) category = client.cloudforce_one.threat_events.categories.delete( category_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="account_id", ) print(category.uuid) ``` #### Response ```json { "uuid": "12345678-1234-1234-1234-1234567890ab" } ``` ## Domain Types ### Category List Response - `List[CategoryListResponseItem]` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Category Get Response - `class CategoryGetResponse: …` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Category Create Response - `class CategoryCreateResponse: …` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Category Edit Response - `class CategoryEditResponse: …` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Category Delete Response - `class CategoryDeleteResponse: …` - `uuid: str` # Catalog ## Lists categories `cloudforce_one.threat_events.categories.catalog.list(CatalogListParams**kwargs) -> CatalogListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/categories/catalog` List all categories stored in the account catalog. ### Parameters - `account_id: str` Account ID. ### Returns - `List[CatalogListResponseItem]` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) catalogs = client.cloudforce_one.threat_events.categories.catalog.list( account_id="account_id", ) print(catalogs) ``` #### Response ```json [ { "killChain": 0, "name": "name", "uuid": "12345678-1234-1234-1234-1234567890ab", "mitreAttack": [ "T1234" ], "mitreCapec": [ "123" ], "shortname": "shortname" } ] ``` ## Domain Types ### Catalog List Response - `List[CatalogListResponseItem]` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` # Countries ## Retrieves countries information for all countries `cloudforce_one.threat_events.countries.list(CountryListParams**kwargs) -> CountryListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/countries` Retrieve country code information for all supported countries. ### Parameters - `account_id: str` Account ID. ### Returns - `List[CountryListResponseItem]` - `result: List[CountryListResponseItemResult]` - `alpha2: str` - `alpha3: str` - `name: str` - `success: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) countries = client.cloudforce_one.threat_events.countries.list( account_id="account_id", ) print(countries) ``` #### Response ```json [ { "result": [ { "alpha2": "AF", "alpha3": "AF", "name": "Afghanistan" } ], "success": "true" } ] ``` ## Domain Types ### Country List Response - `List[CountryListResponseItem]` - `result: List[CountryListResponseItemResult]` - `alpha2: str` - `alpha3: str` - `name: str` - `success: str` # Crons # Datasets ## Lists all datasets in an account `cloudforce_one.threat_events.datasets.list(DatasetListParams**kwargs) -> DatasetListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset` List all datasets accessible to the account. ### Parameters - `account_id: str` Account ID. - `include_deleted: Optional[bool]` When true, include soft-deleted datasets in the response. Each item includes a `deletedAt` field (ISO 8601 or null). Default: false. ### Returns - `List[DatasetListResponseItem]` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) datasets = client.cloudforce_one.threat_events.datasets.list( account_id="account_id", ) print(datasets) ``` #### Response ```json [ { "isPublic": true, "name": "friendly dataset name", "uuid": "12345678-1234-1234-1234-1234567890ab", "deletedAt": "deletedAt" } ] ``` ## Reads a dataset `cloudforce_one.threat_events.datasets.get(strdataset_id, DatasetGetParams**kwargs) -> DatasetGetResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}` Retrieve metadata for a specific dataset. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset ID. ### Returns - `class DatasetGetResponse: …` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) dataset = client.cloudforce_one.threat_events.datasets.get( dataset_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="account_id", ) print(dataset.uuid) ``` #### Response ```json { "isPublic": true, "name": "friendly dataset name", "uuid": "12345678-1234-1234-1234-1234567890ab", "deletedAt": "deletedAt" } ``` ## Creates a dataset `cloudforce_one.threat_events.datasets.create(DatasetCreateParams**kwargs) -> DatasetCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/dataset/create` Create a new dataset in the account. ### Parameters - `account_id: str` Account ID. - `is_public: bool` If true, then anyone can search the dataset. If false, then its limited to the account. - `name: str` Used to describe the dataset within the account context. ### Returns - `class DatasetCreateResponse: …` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) dataset = client.cloudforce_one.threat_events.datasets.create( account_id="account_id", is_public=True, name="x", ) print(dataset.uuid) ``` #### Response ```json { "isPublic": true, "name": "friendly dataset name", "uuid": "12345678-1234-1234-1234-1234567890ab", "deletedAt": "deletedAt" } ``` ## Updates an existing dataset `cloudforce_one.threat_events.datasets.edit(strdataset_id, DatasetEditParams**kwargs) -> DatasetEditResponse` **patch** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}` Update an existing dataset by its identifier. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset ID. - `is_public: bool` If true, then anyone can search the dataset. If false, then its limited to the account. - `name: str` Used to describe the dataset within the account context. ### Returns - `class DatasetEditResponse: …` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.datasets.edit( dataset_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="account_id", is_public=True, name="x", ) print(response.uuid) ``` #### Response ```json { "isPublic": true, "name": "friendly dataset name", "uuid": "12345678-1234-1234-1234-1234567890ab", "deletedAt": "deletedAt" } ``` ## Delete a dataset `cloudforce_one.threat_events.datasets.delete(strdataset_id, DatasetDeleteParams**kwargs) -> DatasetDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}` Soft-deletes a dataset given a datasetId. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset ID to delete ### Returns - `class DatasetDeleteResponse: …` - `name: str` - `uuid: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) dataset = client.cloudforce_one.threat_events.datasets.delete( dataset_id="dataset_id", account_id="account_id", ) print(dataset.uuid) ``` #### Response ```json { "name": "friendly dataset name", "uuid": "12345678-1234-1234-1234-1234567890ab" } ``` ## Reads raw data for an event by UUID `cloudforce_one.threat_events.datasets.raw(strevent_id, DatasetRawParams**kwargs) -> DatasetRawResponse` **get** `/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}` Retrieves the raw data associated with an event. Searches across all shards in the dataset. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset ID. - `event_id: str` Event ID. ### Returns - `class DatasetRawResponse: …` - `id: float` - `account_id: float` - `created: str` - `data: str` - `source: str` - `tlp: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.datasets.raw( event_id="event_id", account_id="account_id", dataset_id="dataset_id", ) print(response.id) ``` #### Response ```json { "id": 1, "accountId": 1234, "created": "1970-01-01T00:00:00.000Z", "data": "{\"foo\": \"bar\"}", "source": "https://example.com", "tlp": "amber" } ``` ## Domain Types ### Dataset List Response - `List[DatasetListResponseItem]` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Dataset Get Response - `class DatasetGetResponse: …` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Dataset Create Response - `class DatasetCreateResponse: …` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Dataset Edit Response - `class DatasetEditResponse: …` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Dataset Delete Response - `class DatasetDeleteResponse: …` - `name: str` - `uuid: str` ### Dataset Raw Response - `class DatasetRawResponse: …` - `id: float` - `account_id: float` - `created: str` - `data: str` - `source: str` - `tlp: str` # Health # Events ## Reads an event `cloudforce_one.threat_events.datasets.events.get(strevent_id, EventGetParams**kwargs) -> EventGetResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}` Retrieves a specific event by its UUID. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset ID. - `event_id: str` Event UUID. ### Returns - `class EventGetResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) event = client.cloudforce_one.threat_events.datasets.events.get( event_id="event_id", account_id="account_id", dataset_id="dataset_id", ) print(event.uuid) ``` #### Response ```json { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ``` ## Domain Types ### Event Get Response - `class EventGetResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` # Indicator Types ## Lists all indicator types `cloudforce_one.threat_events.indicator_types.list(IndicatorTypeListParams**kwargs) -> IndicatorTypeListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/indicatorTypes` This Method is deprecated. Please use /events/dataset/:dataset_id/indicatorTypes instead. ### Parameters - `account_id: str` Account ID. ### Returns - `class IndicatorTypeListResponse: …` - `items: Items` - `type: str` - `type: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) indicator_types = client.cloudforce_one.threat_events.indicator_types.list( account_id="account_id", ) print(indicator_types.items) ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` ## Domain Types ### Indicator Type List Response - `class IndicatorTypeListResponse: …` - `items: Items` - `type: str` - `type: str` # Raw ## Reads data for a raw event `cloudforce_one.threat_events.raw.get(strraw_id, RawGetParams**kwargs) -> RawGetResponse` **get** `/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}` Retrieve raw data for a specific event. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. - `raw_id: str` Raw Event UUID. ### Returns - `class RawGetResponse: …` - `id: str` - `account_id: float` - `created: str` - `data: object` - `source: str` - `tlp: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) raw = client.cloudforce_one.threat_events.raw.get( raw_id="raw_id", account_id="account_id", event_id="event_id", ) print(raw.id) ``` #### Response ```json { "id": "1234", "accountId": 1234, "created": "1970-01-01", "data": {}, "source": "https://example.com", "tlp": "amber" } ``` ## Updates a raw event `cloudforce_one.threat_events.raw.edit(strraw_id, RawEditParams**kwargs) -> RawEditResponse` **patch** `/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}` Update raw data for a specific event. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. - `raw_id: str` Raw Event UUID. - `data: Optional[object]` - `source: Optional[str]` - `tlp: Optional[str]` ### Returns - `class RawEditResponse: …` - `id: str` - `data: object` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.raw.edit( raw_id="raw_id", account_id="account_id", event_id="event_id", ) print(response.id) ``` #### Response ```json { "id": "1234", "data": {} } ``` ## Domain Types ### Raw Get Response - `class RawGetResponse: …` - `id: str` - `account_id: float` - `created: str` - `data: object` - `source: str` - `tlp: str` ### Raw Edit Response - `class RawEditResponse: …` - `id: str` - `data: object` # Relate ## Removes an event reference `cloudforce_one.threat_events.relate.delete(strevent_id, RelateDeleteParams**kwargs) -> RelateDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/events/relate/{event_id}` Remove one or more references from an event. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. ### Returns - `class RelateDeleteResponse: …` - `success: bool` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) relate = client.cloudforce_one.threat_events.relate.delete( event_id="event_id", account_id="account_id", ) print(relate.success) ``` #### Response ```json { "result": { "success": true }, "success": true } ``` ## Domain Types ### Relate Delete Response - `class RelateDeleteResponse: …` - `success: bool` # Tags ## Lists all tags (SoT) `cloudforce_one.threat_events.tags.list(TagListParams**kwargs) -> TagListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/tags` Returns all Source-of-Truth tags for an account. Supports legacy free-text `search` on tag value and `categoryUuid` exact match, plus a structured `filters` JSON array for filtering by metadata fields (originCountryISO, actorCategory, motive, priority, etc.). Country values may be passed as alpha-2, alpha-3, name, or common alias. ### Parameters - `account_id: str` Account ID. - `category_uuid: Optional[str]` - `filters: Optional[Iterable[Filter]]` Structured filters as a JSON array of {field, op, value} objects. Searchable fields: uuid, value, actorCategory, actorCategoryConfidence, aliasGroupNames, attributionConfidence, attributionConfidenceScore, attributionOrganization, categoryName, motive, motiveConfidence, opsecLevel, originCountryISO, originCountryConfidence, sophisticationLevel, priority, analyticPriority. Operators: equals, not, contains, startsWith, endsWith, gt, lt, gte, lte, like, in, find. Use 'in' for bulk OR within a single field, e.g. filters=[{"field":"originCountryISO","op":"in","value":["IR","CN"]}]. Multiple entries are AND-joined. Max 10 entries per request, max 100 values per 'in'. Per-field notes: `uuid` accepts only 'equals' and 'in' (other operators throw ValidationError) — matched against the canonical lowercase storage but callers may pass either case (the server lowercases before comparison); index-backed by the column's UNIQUE constraint and intended for batched UUID → tag resolution. `originCountryISO` uses its B-tree index for equals/not/in. `priority` uses its B-tree index for numeric comparisons. Other string columns (`actorCategory`, `motive`, etc.) are case-insensitive and unindexed; current catalog size makes this a non-issue. `endsWith` and `aliasGroupNames` contains/like are leading-wildcard scans and slow on large result sets. `aliasGroupNames` matches on the JSON-encoded text, so substrings can cross alias boundaries (a search for "apt28" will also match "apt280" if both appear in the same tag's alias list). - `field: Literal["uuid", "value", "actorCategory", 14 more]` Tag field to search on. Allowed: uuid, value, actorCategory, actorCategoryConfidence, aliasGroupNames, attributionConfidence, attributionConfidenceScore, attributionOrganization, categoryName, motive, motiveConfidence, opsecLevel, originCountryISO, originCountryConfidence, sophisticationLevel, priority, analyticPriority. - `"uuid"` - `"value"` - `"actorCategory"` - `"actorCategoryConfidence"` - `"aliasGroupNames"` - `"attributionConfidence"` - `"attributionConfidenceScore"` - `"attributionOrganization"` - `"categoryName"` - `"motive"` - `"motiveConfidence"` - `"opsecLevel"` - `"originCountryISO"` - `"originCountryConfidence"` - `"sophisticationLevel"` - `"priority"` - `"analyticPriority"` - `op: Literal["equals", "not", "gt", 9 more]` Search operator. Use 'in' for bulk OR within a single field, e.g. {field:"originCountryISO", op:"in", value:["IR","CN"]}. - `"equals"` - `"not"` - `"gt"` - `"gte"` - `"lt"` - `"lte"` - `"like"` - `"contains"` - `"startsWith"` - `"endsWith"` - `"in"` - `"find"` - `value: Optional[Union[str, float, Sequence[Union[str, float]]]]` Search value. String or number for most operators. Array for 'in' (max 100 items). Country values may be passed as alpha-2, alpha-3, name, or common alias (e.g. 'iran', 'IR', 'IRN') and are normalized to alpha-2 server-side. - `str` - `float` - `Sequence[Union[str, float]]` - `str` - `float` - `page: Optional[float]` - `page_size: Optional[float]` - `search: Optional[str]` Legacy free-text substring match on tag value. ### Returns - `class TagListResponse: …` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` - `tags: List[Tag]` - `uuid: str` - `value: str` - `active_duration: Optional[str]` - `actor_category: Optional[str]` - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[List[TagAlias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[List[str]]` - `alias_group_names_internal: Optional[List[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_name: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` - `external_reference_links: Optional[List[str]]` - `external_references: Optional[List[TagExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[List[TagInternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_iso_alpha3: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) tags = client.cloudforce_one.threat_events.tags.list( account_id="account_id", ) print(tags.pagination) ``` #### Response ```json { "pagination": { "page": 0, "pageSize": 0, "totalCount": 0, "totalPages": 0 }, "tags": [ { "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "APT28", "activeDuration": "activeDuration", "actorCategory": "actorCategory", "actorCategoryConfidence": 7, "aliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "aliasGroupNames": [ "string" ], "aliasGroupNamesInternal": [ "string" ], "analyticPriority": 0, "attributionConfidence": "attributionConfidence", "attributionConfidenceScore": 7, "attributionOrganization": "attributionOrganization", "categoryName": "Nation State", "categoryUuid": "12345678-1234-1234-1234-1234567890ab", "dateOfDiscovery": "2024-01-15", "externalReferenceLinks": [ "string" ], "externalReferences": [ { "url": "https://example.com/report", "description": "Vendor threat report" } ], "internalAliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "internalDescription": "internalDescription", "motive": "motive", "motiveConfidence": 7, "opsecLevel": "opsecLevel", "originCountryConfidence": 7, "originCountryISO": "originCountryISO", "originCountryISOAlpha3": "IRN", "originCountryTlp": "amber", "priority": 0, "sophisticationLevel": "sophisticationLevel" } ] } ``` ## Creates a new tag `cloudforce_one.threat_events.tags.create(TagCreateParams**kwargs) -> TagCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/tags/create` Creates a new tag to be used accross threat events. ### Parameters - `account_id: str` Account ID. - `value: str` - `active_duration: Optional[str]` - `actor_category: Optional[str]` Actor variety. Allowed values: Activist, Competitor, Customer, Crime Syndicate, Former Employee, Nation State, Organized Crime, Nation State Affiliated, Terrorist, Unaffiliated. - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[Iterable[Alias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[Sequence[str]]` - `alias_group_names_internal: Optional[Sequence[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` Date the actor was discovered (ISO YYYY-MM-DD). - `external_reference_links: Optional[Sequence[str]]` - `external_references: Optional[Iterable[ExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[Iterable[InternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` Actor motive. Allowed values: Convenience, Fear, Fun, Financial, Grudge, Ideology, Espionage. - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` ### Returns - `class TagCreateResponse: …` - `uuid: str` - `value: str` - `active_duration: Optional[str]` - `actor_category: Optional[str]` - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[List[Alias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[List[str]]` - `alias_group_names_internal: Optional[List[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_name: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` - `external_reference_links: Optional[List[str]]` - `external_references: Optional[List[ExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[List[InternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_iso_alpha3: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) tag = client.cloudforce_one.threat_events.tags.create( account_id="account_id", value="APT28", ) print(tag.uuid) ``` #### Response ```json { "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "APT28", "activeDuration": "activeDuration", "actorCategory": "actorCategory", "actorCategoryConfidence": 7, "aliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "aliasGroupNames": [ "string" ], "aliasGroupNamesInternal": [ "string" ], "analyticPriority": 0, "attributionConfidence": "attributionConfidence", "attributionConfidenceScore": 7, "attributionOrganization": "attributionOrganization", "categoryName": "Nation State", "categoryUuid": "12345678-1234-1234-1234-1234567890ab", "dateOfDiscovery": "2024-01-15", "externalReferenceLinks": [ "string" ], "externalReferences": [ { "url": "https://example.com/report", "description": "Vendor threat report" } ], "internalAliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "internalDescription": "internalDescription", "motive": "motive", "motiveConfidence": 7, "opsecLevel": "opsecLevel", "originCountryConfidence": 7, "originCountryISO": "originCountryISO", "originCountryISOAlpha3": "IRN", "originCountryTlp": "amber", "priority": 0, "sophisticationLevel": "sophisticationLevel" } ``` ## Updates a tag (SoT) `cloudforce_one.threat_events.tags.edit(strtag_uuid, TagEditParams**kwargs) -> TagEditResponse` **patch** `/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}` Updates a Source-of-Truth tag by UUID. ### Parameters - `account_id: str` Account ID. - `tag_uuid: str` Tag UUID. - `active_duration: Optional[str]` - `actor_category: Optional[str]` Actor variety. Allowed values: Activist, Competitor, Customer, Crime Syndicate, Former Employee, Nation State, Organized Crime, Nation State Affiliated, Terrorist, Unaffiliated. - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[Iterable[Alias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[Sequence[str]]` - `alias_group_names_internal: Optional[Sequence[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` Date the actor was discovered (ISO YYYY-MM-DD). - `external_reference_links: Optional[Sequence[str]]` - `external_references: Optional[Iterable[ExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[Iterable[InternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` Actor motive. Allowed values: Convenience, Fear, Fun, Financial, Grudge, Ideology, Espionage. - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` - `value: Optional[str]` ### Returns - `class TagEditResponse: …` - `uuid: str` - `value: str` - `active_duration: Optional[str]` - `actor_category: Optional[str]` - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[List[Alias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[List[str]]` - `alias_group_names_internal: Optional[List[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_name: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` - `external_reference_links: Optional[List[str]]` - `external_references: Optional[List[ExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[List[InternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_iso_alpha3: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.tags.edit( tag_uuid="tag_uuid", account_id="account_id", ) print(response.uuid) ``` #### Response ```json { "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "APT28", "activeDuration": "activeDuration", "actorCategory": "actorCategory", "actorCategoryConfidence": 7, "aliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "aliasGroupNames": [ "string" ], "aliasGroupNamesInternal": [ "string" ], "analyticPriority": 0, "attributionConfidence": "attributionConfidence", "attributionConfidenceScore": 7, "attributionOrganization": "attributionOrganization", "categoryName": "Nation State", "categoryUuid": "12345678-1234-1234-1234-1234567890ab", "dateOfDiscovery": "2024-01-15", "externalReferenceLinks": [ "string" ], "externalReferences": [ { "url": "https://example.com/report", "description": "Vendor threat report" } ], "internalAliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "internalDescription": "internalDescription", "motive": "motive", "motiveConfidence": 7, "opsecLevel": "opsecLevel", "originCountryConfidence": 7, "originCountryISO": "originCountryISO", "originCountryISOAlpha3": "IRN", "originCountryTlp": "amber", "priority": 0, "sophisticationLevel": "sophisticationLevel" } ``` ## Deletes a tag (SoT) `cloudforce_one.threat_events.tags.delete(strtag_uuid, TagDeleteParams**kwargs) -> TagDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}` Deletes a Source-of-Truth tag by UUID. ### Parameters - `account_id: str` Account ID. - `tag_uuid: str` Tag UUID. ### Returns - `class TagDeleteResponse: …` - `uuid: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) tag = client.cloudforce_one.threat_events.tags.delete( tag_uuid="tag_uuid", account_id="account_id", ) print(tag.uuid) ``` #### Response ```json { "uuid": "12345678-1234-1234-1234-1234567890ab" } ``` ## Domain Types ### Tag List Response - `class TagListResponse: …` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` - `tags: List[Tag]` - `uuid: str` - `value: str` - `active_duration: Optional[str]` - `actor_category: Optional[str]` - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[List[TagAlias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[List[str]]` - `alias_group_names_internal: Optional[List[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_name: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` - `external_reference_links: Optional[List[str]]` - `external_references: Optional[List[TagExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[List[TagInternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_iso_alpha3: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` ### Tag Create Response - `class TagCreateResponse: …` - `uuid: str` - `value: str` - `active_duration: Optional[str]` - `actor_category: Optional[str]` - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[List[Alias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[List[str]]` - `alias_group_names_internal: Optional[List[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_name: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` - `external_reference_links: Optional[List[str]]` - `external_references: Optional[List[ExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[List[InternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_iso_alpha3: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` ### Tag Edit Response - `class TagEditResponse: …` - `uuid: str` - `value: str` - `active_duration: Optional[str]` - `actor_category: Optional[str]` - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[List[Alias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[List[str]]` - `alias_group_names_internal: Optional[List[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_name: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` - `external_reference_links: Optional[List[str]]` - `external_references: Optional[List[ExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[List[InternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_iso_alpha3: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` ### Tag Delete Response - `class TagDeleteResponse: …` - `uuid: str` # Categories ## Lists all tag categories (SoT) `cloudforce_one.threat_events.tags.categories.list(CategoryListParams**kwargs) -> CategoryListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/tags/categories` Returns all Source-of-Truth tag categories for an account. ### Parameters - `account_id: str` Account ID. - `search: Optional[str]` ### Returns - `class CategoryListResponse: …` - `categories: List[Category]` - `name: str` - `uuid: str` - `created_at: Optional[str]` - `description: Optional[str]` - `updated_at: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) categories = client.cloudforce_one.threat_events.tags.categories.list( account_id="account_id", ) print(categories.categories) ``` #### Response ```json { "categories": [ { "name": "Actor", "uuid": "12345678-1234-1234-1234-1234567890ab", "createdAt": "createdAt", "description": "description", "updatedAt": "updatedAt" } ] } ``` ## Creates a new tag category (SoT) `cloudforce_one.threat_events.tags.categories.create(CategoryCreateParams**kwargs) -> CategoryCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/tags/categories/create` Creates a new Source-of-Truth tag category for an account. ### Parameters - `account_id: str` Account ID. - `name: str` - `description: Optional[str]` ### Returns - `class CategoryCreateResponse: …` - `name: str` - `uuid: str` - `created_at: Optional[str]` - `description: Optional[str]` - `updated_at: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) category = client.cloudforce_one.threat_events.tags.categories.create( account_id="account_id", name="Actor", ) print(category.uuid) ``` #### Response ```json { "name": "Actor", "uuid": "12345678-1234-1234-1234-1234567890ab", "createdAt": "createdAt", "description": "description", "updatedAt": "updatedAt" } ``` ## Updates a tag category (SoT) `cloudforce_one.threat_events.tags.categories.edit(strcategory_uuid, CategoryEditParams**kwargs) -> CategoryEditResponse` **patch** `/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}` Updates a Source-of-Truth tag category by UUID. ### Parameters - `account_id: str` Account ID. - `category_uuid: str` Tag Category UUID. - `description: Optional[str]` - `name: Optional[str]` ### Returns - `class CategoryEditResponse: …` - `name: str` - `uuid: str` - `created_at: Optional[str]` - `description: Optional[str]` - `updated_at: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.tags.categories.edit( category_uuid="category_uuid", account_id="account_id", ) print(response.uuid) ``` #### Response ```json { "name": "Actor", "uuid": "12345678-1234-1234-1234-1234567890ab", "createdAt": "createdAt", "description": "description", "updatedAt": "updatedAt" } ``` ## Deletes a tag category (SoT) `cloudforce_one.threat_events.tags.categories.delete(strcategory_uuid, CategoryDeleteParams**kwargs) -> CategoryDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}` Deletes a Source-of-Truth tag category by UUID. ### Parameters - `account_id: str` Account ID. - `category_uuid: str` Tag Category UUID. ### Returns - `class CategoryDeleteResponse: …` - `uuid: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) category = client.cloudforce_one.threat_events.tags.categories.delete( category_uuid="category_uuid", account_id="account_id", ) print(category.uuid) ``` #### Response ```json { "uuid": "12345678-1234-1234-1234-1234567890ab" } ``` ## Domain Types ### Category List Response - `class CategoryListResponse: …` - `categories: List[Category]` - `name: str` - `uuid: str` - `created_at: Optional[str]` - `description: Optional[str]` - `updated_at: Optional[str]` ### Category Create Response - `class CategoryCreateResponse: …` - `name: str` - `uuid: str` - `created_at: Optional[str]` - `description: Optional[str]` - `updated_at: Optional[str]` ### Category Edit Response - `class CategoryEditResponse: …` - `name: str` - `uuid: str` - `created_at: Optional[str]` - `description: Optional[str]` - `updated_at: Optional[str]` ### Category Delete Response - `class CategoryDeleteResponse: …` - `uuid: str` # Indicators ## List indicators related to a tag `cloudforce_one.threat_events.tags.indicators.list(strtag_uuid, IndicatorListParams**kwargs) -> IndicatorListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators` Returns indicators associated with the provided tag UUID, with pagination. By default fans out across every indicator dataset the account can read; pass datasetIds to scope to specific datasets. ### Parameters - `account_id: str` Account ID. - `tag_uuid: str` Tag UUID. - `dataset_ids: Optional[Sequence[str]]` Dataset UUIDs to scope to (repeat the param for multiple), or 'all' / '*' for every readable indicator dataset. Omit to search all readable datasets. - `indicator_type: Optional[str]` - `page: Optional[float]` - `page_size: Optional[float]` - `related_event: Optional[Sequence[str]]` Filter indicators by related event UUID(s). Multiple UUIDs can be provided by repeating the parameter. - `search: Optional[Iterable[Search]]` Structured search as a JSON array of {field, op, value} objects. Searchable fields: value, indicatorType. Multiple conditions are AND'd together. Max 10 conditions per request. - `field: Literal["value", "indicatorType"]` The indicator field to search on. Allowed: value, indicatorType. - `"value"` - `"indicatorType"` - `op: Literal["equals", "not", "gt", 9 more]` Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'value', op:'in', value:['evil.com','bad.org']}. - `"equals"` - `"not"` - `"gt"` - `"gte"` - `"lt"` - `"lte"` - `"like"` - `"contains"` - `"startsWith"` - `"endsWith"` - `"in"` - `"find"` - `value: Union[str, Sequence[str]]` Search value. String for most operators. Array of strings for 'in' operator (max 100 items). - `str` - `Sequence[str]` ### Returns - `class IndicatorListResponse: …` - `indicators: List[Indicator]` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[IndicatorRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[IndicatorTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) indicators = client.cloudforce_one.threat_events.tags.indicators.list( tag_uuid="tag_uuid", account_id="account_id", ) print(indicators.indicators) ``` #### Response ```json { "indicators": [ { "createdAt": "2022-04-01T00:00:00Z", "indicatorType": "domain", "updatedAt": "2022-04-01T00:00:00Z", "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "malicious-domain.com", "datasetId": "dataset-uuid-123", "relatedEvents": [ { "datasetId": "dataset-uuid-123", "eventId": "event-uuid-456" } ], "tags": [ { "categoryName": "categoryName", "uuid": "uuid", "value": "value" } ] } ], "pagination": { "page": 0, "pageSize": 0, "totalCount": 0, "totalPages": 0 } } ``` ## Domain Types ### Indicator List Response - `class IndicatorListResponse: …` - `indicators: List[Indicator]` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[IndicatorRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[IndicatorTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` # By Dataset ## List indicators related to a tag within a dataset (deprecated) `cloudforce_one.threat_events.tags.indicators.by_dataset.list(strtag_uuid, ByDatasetListParams**kwargs) -> ByDatasetListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators` This endpoint is deprecated. Use GET /:account_id/events/tags/:tag_uuid/indicators with the optional datasetIds query parameter instead. Returns indicators associated with the provided tag UUID within a single dataset's indicator shards, with pagination. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset UUID. - `tag_uuid: str` Tag UUID. - `indicator_type: Optional[str]` - `page: Optional[float]` - `page_size: Optional[float]` - `related_event: Optional[Sequence[str]]` Filter indicators by related event UUID(s). Multiple UUIDs can be provided by repeating the parameter. - `search: Optional[Iterable[Search]]` Structured search as a JSON array of {field, op, value} objects. Searchable fields: value, indicatorType. Multiple conditions are AND'd together. Max 10 conditions per request. - `field: Literal["value", "indicatorType"]` The indicator field to search on. Allowed: value, indicatorType. - `"value"` - `"indicatorType"` - `op: Literal["equals", "not", "gt", 9 more]` Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'value', op:'in', value:['evil.com','bad.org']}. - `"equals"` - `"not"` - `"gt"` - `"gte"` - `"lt"` - `"lte"` - `"like"` - `"contains"` - `"startsWith"` - `"endsWith"` - `"in"` - `"find"` - `value: Union[str, Sequence[str]]` Search value. String for most operators. Array of strings for 'in' operator (max 100 items). - `str` - `Sequence[str]` ### Returns - `class ByDatasetListResponse: …` - `indicators: List[Indicator]` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[IndicatorRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[IndicatorTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) by_datasets = client.cloudforce_one.threat_events.tags.indicators.by_dataset.list( tag_uuid="tag_uuid", account_id="account_id", dataset_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", ) print(by_datasets.indicators) ``` #### Response ```json { "indicators": [ { "createdAt": "2022-04-01T00:00:00Z", "indicatorType": "domain", "updatedAt": "2022-04-01T00:00:00Z", "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "malicious-domain.com", "datasetId": "dataset-uuid-123", "relatedEvents": [ { "datasetId": "dataset-uuid-123", "eventId": "event-uuid-456" } ], "tags": [ { "categoryName": "categoryName", "uuid": "uuid", "value": "value" } ] } ], "pagination": { "page": 0, "pageSize": 0, "totalCount": 0, "totalPages": 0 } } ``` ## Domain Types ### By Dataset List Response - `class ByDatasetListResponse: …` - `indicators: List[Indicator]` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[IndicatorRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[IndicatorTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` # Event Tags ## Adds a tag to an event `cloudforce_one.threat_events.event_tags.create(strevent_id, EventTagCreateParams**kwargs) -> EventTagCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create` Add one or more tags to an event. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. - `tags: Sequence[str]` ### Returns - `class EventTagCreateResponse: …` - `success: bool` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) event_tag = client.cloudforce_one.threat_events.event_tags.create( event_id="event_id", account_id="account_id", tags=["botnet"], ) print(event_tag.success) ``` #### Response ```json { "result": { "success": true }, "success": true } ``` ## Removes a tag from an event `cloudforce_one.threat_events.event_tags.delete(strevent_id, EventTagDeleteParams**kwargs) -> EventTagDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}` Remove one or more tags from an event. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. ### Returns - `class EventTagDeleteResponse: …` - `success: bool` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) event_tag = client.cloudforce_one.threat_events.event_tags.delete( event_id="event_id", account_id="account_id", ) print(event_tag.success) ``` #### Response ```json { "result": { "success": true }, "success": true } ``` ## Domain Types ### Event Tag Create Response - `class EventTagCreateResponse: …` - `success: bool` ### Event Tag Delete Response - `class EventTagDeleteResponse: …` - `success: bool` # Target Industries ## Lists target industries across multiple datasets `cloudforce_one.threat_events.target_industries.list(TargetIndustryListParams**kwargs) -> TargetIndustryListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/targetIndustries` List target industries referenced in events across one or more datasets. ### Parameters - `account_id: str` Account ID. - `dataset_ids: Optional[Sequence[str]]` Array of dataset IDs to query target industries from. If not provided, uses the default dataset. ### Returns - `class TargetIndustryListResponse: …` - `items: Items` - `type: str` - `type: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) target_industries = client.cloudforce_one.threat_events.target_industries.list( account_id="account_id", ) print(target_industries.items) ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` ## Domain Types ### Target Industry List Response - `class TargetIndustryListResponse: …` - `items: Items` - `type: str` - `type: str` # By Dataset ## Lists all target industries for a specific dataset `cloudforce_one.threat_events.target_industries.by_dataset.list(strdataset_id, ByDatasetListParams**kwargs) -> ByDatasetListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries` List all target industries referenced in events for a specific dataset. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset UUID. ### Returns - `class ByDatasetListResponse: …` - `items: Items` - `type: str` - `type: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) by_datasets = client.cloudforce_one.threat_events.target_industries.by_dataset.list( dataset_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="account_id", ) print(by_datasets.items) ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` ## Domain Types ### By Dataset List Response - `class ByDatasetListResponse: …` - `items: Items` - `type: str` - `type: str` # Catalog ## Lists all target industries from industry map catalog `cloudforce_one.threat_events.target_industries.catalog.list(CatalogListParams**kwargs) -> CatalogListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog` List all predefined target industries from the industry map catalog. ### Parameters - `account_id: str` Account ID. ### Returns - `class CatalogListResponse: …` - `items: Items` - `type: str` - `type: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) catalogs = client.cloudforce_one.threat_events.target_industries.catalog.list( account_id="account_id", ) print(catalogs.items) ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` ## Domain Types ### Catalog List Response - `class CatalogListResponse: …` - `items: Items` - `type: str` - `type: str` # Insights