Skip to content
Cloudflare API
Start here
API Reference
Cloudforce One

Threat Events

Filter and list events
cloudforce_one.threat_events.list(ThreatEventListParams**kwargs) -> ThreatEventListResponse
GET/accounts/{account_id}/cloudforce-one/events
Reads an event
Deprecated
cloudforce_one.threat_events.get(strevent_id, ThreatEventGetParams**kwargs) -> ThreatEventGetResponse
GET/accounts/{account_id}/cloudforce-one/events/{event_id}
Creates a new event
cloudforce_one.threat_events.create(ThreatEventCreateParams**kwargs) -> ThreatEventCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/create
Updates an event
cloudforce_one.threat_events.edit(strevent_id, ThreatEventEditParams**kwargs) -> ThreatEventEditResponse
PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}
Creates bulk events
cloudforce_one.threat_events.bulk_create(ThreatEventBulkCreateParams**kwargs) -> ThreatEventBulkCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/create/bulk
Creates bulk DOS event with relationships and indicators
Deprecated
cloudforce_one.threat_events.bulk_create_relationships(ThreatEventBulkCreateRelationshipsParams**kwargs) -> ThreatEventBulkCreateRelationshipsResponse
POST/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships
ModelsExpand Collapse
List[ThreatEventListResponseItem]
attacker: str
attacker_country: str
attacker_country_alpha3: str
category: str
dataset_id: str
date: str
event: str
has_children: bool
indicator: str
indicator_type: str
indicator_type_id: float
kill_chain: float
mitre_attack: List[str]
mitre_capec: List[str]
num_referenced: float
num_references: float
raw_id: str
referenced: List[str]
referenced_ids: List[float]
references: List[str]
references_ids: List[float]
tags: List[str]
target_country: str
target_country_alpha3: str
target_industry: str
tlp: str
uuid: str
insight: Optional[str]
releasability_id: Optional[str]
class ThreatEventGetResponse: …
attacker: str
attacker_country: str
attacker_country_alpha3: str
category: str
dataset_id: str
date: str
event: str
has_children: bool
indicator: str
indicator_type: str
indicator_type_id: float
kill_chain: float
mitre_attack: List[str]
mitre_capec: List[str]
num_referenced: float
num_references: float
raw_id: str
referenced: List[str]
referenced_ids: List[float]
references: List[str]
references_ids: List[float]
tags: List[str]
target_country: str
target_country_alpha3: str
target_industry: str
tlp: str
uuid: str
insight: Optional[str]
releasability_id: Optional[str]
class ThreatEventCreateResponse: …
attacker: str
attacker_country: str
attacker_country_alpha3: str
category: str
dataset_id: str
date: str
event: str
has_children: bool
indicator: str
indicator_type: str
indicator_type_id: float
kill_chain: float
mitre_attack: List[str]
mitre_capec: List[str]
num_referenced: float
num_references: float
raw_id: str
referenced: List[str]
referenced_ids: List[float]
references: List[str]
references_ids: List[float]
tags: List[str]
target_country: str
target_country_alpha3: str
target_industry: str
tlp: str
uuid: str
insight: Optional[str]
releasability_id: Optional[str]
class ThreatEventEditResponse: …
attacker: str
attacker_country: str
attacker_country_alpha3: str
category: str
dataset_id: str
date: str
event: str
has_children: bool
indicator: str
indicator_type: str
indicator_type_id: float
kill_chain: float
mitre_attack: List[str]
mitre_capec: List[str]
num_referenced: float
num_references: float
raw_id: str
referenced: List[str]
referenced_ids: List[float]
references: List[str]
references_ids: List[float]
tags: List[str]
target_country: str
target_country_alpha3: str
target_industry: str
tlp: str
uuid: str
insight: Optional[str]
releasability_id: Optional[str]
class ThreatEventBulkCreateResponse: …

Detailed result of bulk event creation with auto-tag management

created_events_count: float

Number of events created

created_tags_count: float

Number of new tags created in SoT

error_count: float

Number of errors encountered

queued_indicators_count: float

Number of indicators queued for async processing

create_bulk_events_request_id: Optional[str]

Correlation ID for async indicator processing

formatuuid
created_events: Optional[List[CreatedEvent]]

Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true

event_index: float

Original index in the input data array

shard_id: str

Dataset ID of the shard where the event was created

uuid: str

UUID of the created event

formatuuid
errors: Optional[List[Error]]

Array of error details

error: str

Error message

event_index: float

Index of the event that caused the error

class ThreatEventBulkCreateRelationshipsResponse: …

Result of bulk relationship creation operation

created_events_count: float

Number of events created

created_indicators_count: float

Number of indicators created

created_relationships_count: float

Number of relationships created

error_count: float

Number of errors encountered

errors: Optional[List[Error]]

Array of error details

error: str

Error message

event_index: float

Index of the event that caused the error

Threat EventsAggregate

Aggregate events by single or multiple columns with optional date filtering
cloudforce_one.threat_events.aggregate.list(AggregateListParams**kwargs) -> AggregateListResponse
GET/accounts/{account_id}/cloudforce-one/events/aggregate
ModelsExpand Collapse
class AggregateListResponse: …
aggregate_by: str

Column(s) that were aggregated by

aggregations: List[Aggregation]

Array of aggregation results with dynamic fields based on aggregateBy columns

count: float

Number of events for this aggregation

date: Optional[str]

Date (if groupByDate is true)

total: float

Total number of events in the aggregation

date_range: Optional[DateRange]

Date range used for filtering

end_date: Optional[str]
start_date: Optional[str]

Threat EventsGraphql

GraphQL endpoint for event aggregation
cloudforce_one.threat_events.graphql.create(GraphqlCreateParams**kwargs) -> GraphqlCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/graphql
ModelsExpand Collapse
class GraphqlCreateResponse: …
data: Optional[object]
errors: Optional[List[object]]

Threat EventsGraph

Query graph neighborhood from R2 Data Catalog
cloudforce_one.threat_events.graph.list(GraphListParams**kwargs) -> GraphListResponse
GET/accounts/{account_id}/cloudforce-one/events/graph
ModelsExpand Collapse
class GraphListResponse: …
edges: List[Edge]
id: str

Deterministic composite edge id (source→target:relationshipType)

relationship_type: str
source: str

Compact id of the source node (type:uuid)

source_id: str
source_type: str
target: str

Compact id of the target node (type:uuid)

target_id: str
target_type: str
node: Optional[Dict[str, object]]

Focal node object (legacy single-seed). Null when unavailable.

nodes: List[Dict[str, object]]

Threat EventsQueries

List all saved event queries
cloudforce_one.threat_events.queries.list(QueryListParams**kwargs) -> QueryListResponse
GET/accounts/{account_id}/cloudforce-one/events/queries
Create a saved event query
cloudforce_one.threat_events.queries.create(QueryCreateParams**kwargs) -> QueryCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/queries/create
Read a saved event query
cloudforce_one.threat_events.queries.get(intquery_id, QueryGetParams**kwargs) -> QueryGetResponse
GET/accounts/{account_id}/cloudforce-one/events/queries/{query_id}
Update a saved event query
cloudforce_one.threat_events.queries.edit(intquery_id, QueryEditParams**kwargs) -> QueryEditResponse
PATCH/accounts/{account_id}/cloudforce-one/events/queries/{query_id}
Delete a saved event query
cloudforce_one.threat_events.queries.delete(intquery_id, QueryDeleteParams**kwargs)
DELETE/accounts/{account_id}/cloudforce-one/events/queries/{query_id}
ModelsExpand Collapse
List[QueryListResponseItem]
id: int

Unique identifier for the saved query

account_id: int

Account ID

alert_enabled: bool

Whether alerts are enabled

alert_rollup_enabled: bool

Whether alert rollup is enabled

created_at: str

Creation timestamp

name: str

Name of the saved query

query_json: str

JSON string containing the query parameters

rule_enabled: bool

Whether rule is enabled

updated_at: str

Last update timestamp

user_email: str

Email of the user who created the query

custom_threat_feed_id: Optional[int]

Intel Indicator Feed ID (numeric)

rule_list_id: Optional[str]

WAF rules list ID for blocking

rule_scope: Optional[str]

Scope for the rule

class QueryCreateResponse: …
id: int

Unique identifier for the saved query

account_id: int

Account ID

alert_enabled: bool

Whether alerts are enabled

alert_rollup_enabled: bool

Whether alert rollup is enabled

created_at: str

Creation timestamp

name: str

Name of the saved query

query_json: str

JSON string containing the query parameters

rule_enabled: bool

Whether rule is enabled

updated_at: str

Last update timestamp

user_email: str

Email of the user who created the query

custom_threat_feed_id: Optional[int]

Intel Indicator Feed ID (numeric)

rule_list_id: Optional[str]

WAF rules list ID for blocking

rule_scope: Optional[str]

Scope for the rule

class QueryGetResponse: …
id: int

Unique identifier for the saved query

account_id: int

Account ID

alert_enabled: bool

Whether alerts are enabled

alert_rollup_enabled: bool

Whether alert rollup is enabled

created_at: str

Creation timestamp

name: str

Name of the saved query

query_json: str

JSON string containing the query parameters

rule_enabled: bool

Whether rule is enabled

updated_at: str

Last update timestamp

user_email: str

Email of the user who created the query

custom_threat_feed_id: Optional[int]

Intel Indicator Feed ID (numeric)

rule_list_id: Optional[str]

WAF rules list ID for blocking

rule_scope: Optional[str]

Scope for the rule

class QueryEditResponse: …
id: int

Unique identifier for the saved query

account_id: int

Account ID

alert_enabled: bool

Whether alerts are enabled

alert_rollup_enabled: bool

Whether alert rollup is enabled

created_at: str

Creation timestamp

name: str

Name of the saved query

query_json: str

JSON string containing the query parameters

rule_enabled: bool

Whether rule is enabled

updated_at: str

Last update timestamp

user_email: str

Email of the user who created the query

custom_threat_feed_id: Optional[int]

Intel Indicator Feed ID (numeric)

rule_list_id: Optional[str]

WAF rules list ID for blocking

rule_scope: Optional[str]

Scope for the rule

Threat EventsRelationships

Filter and list events related to specific event
cloudforce_one.threat_events.relationships.list(strevent_id, RelationshipListParams**kwargs) -> RelationshipListResponse
GET/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships
ModelsExpand Collapse
List[RelationshipListResponseItem]
attacker: str
attacker_country: str
attacker_country_alpha3: str
category: str
dataset_id: str
date: str
event: str
has_children: bool
indicator: str
indicator_type: str
indicator_type_id: float
kill_chain: float
mitre_attack: List[str]
mitre_capec: List[str]
num_referenced: float
num_references: float
raw_id: str
referenced: List[str]
referenced_ids: List[float]
references: List[str]
references_ids: List[float]
tags: List[str]
target_country: str
target_country_alpha3: str
target_industry: str
tlp: str
uuid: str
insight: Optional[str]
releasability_id: Optional[str]

Threat EventsIndicators

Lists indicators across multiple datasets
cloudforce_one.threat_events.indicators.list(IndicatorListParams**kwargs) -> IndicatorListResponse
GET/accounts/{account_id}/cloudforce-one/events/indicators
ModelsExpand Collapse
class IndicatorListResponse: …
properties: Properties
indicators: PropertiesIndicators
items: PropertiesIndicatorsItems
created_at: datetime
formatdate-time
indicator_type: str
updated_at: datetime
formatdate-time
uuid: str
value: str
dataset_id: Optional[str]

The dataset ID this indicator belongs to. Included in list responses.

related_events: Optional[List[PropertiesIndicatorsItemsRelatedEvent]]
dataset_id: str
event_id: str
tags: Optional[List[PropertiesIndicatorsItemsTag]]
category_name: Optional[str]
uuid: Optional[str]
value: Optional[str]
type: str
type: str

Threat EventsIndicatorsAggregate

Aggregate indicators by column(s)
cloudforce_one.threat_events.indicators.aggregate.list(AggregateListParams**kwargs) -> AggregateListResponse
GET/accounts/{account_id}/cloudforce-one/events/indicators/aggregate
ModelsExpand Collapse
class AggregateListResponse: …
aggregate_by: str

Column(s) that were aggregated by

aggregations: List[Aggregation]

Array of aggregation results with dynamic fields based on aggregateBy columns

count: float

Number of indicators for this aggregation

failed_datasets: float

Number of datasets whose aggregation failed and were excluded from the result

total: float

Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships

Threat EventsIndicatorsTypes

Lists indicator types across multiple datasets
cloudforce_one.threat_events.indicators.types.list(TypeListParams**kwargs) -> TypeListResponse
GET/accounts/{account_id}/cloudforce-one/events/indicator-types
ModelsExpand Collapse
class TypeListResponse: …
items: Items
type: str
type: str

Threat EventsIndicatorsBy Dataset

Lists indicators
Deprecated
cloudforce_one.threat_events.indicators.by_dataset.list(strdataset_id, ByDatasetListParams**kwargs) -> ByDatasetListResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators
Reads an indicator
cloudforce_one.threat_events.indicators.by_dataset.get(strindicator_id, ByDatasetGetParams**kwargs) -> ByDatasetGetResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}
ModelsExpand Collapse
class ByDatasetListResponse: …
indicators: List[Indicator]
created_at: datetime
formatdate-time
indicator_type: str
updated_at: datetime
formatdate-time
uuid: str
value: str
dataset_id: Optional[str]

The dataset ID this indicator belongs to. Included in list responses.

related_events: Optional[List[IndicatorRelatedEvent]]
dataset_id: str
event_id: str
tags: Optional[List[IndicatorTag]]
category_name: Optional[str]
uuid: Optional[str]
value: Optional[str]
class ByDatasetGetResponse: …
created_at: datetime
formatdate-time
indicator_type: str
updated_at: datetime
formatdate-time
uuid: str
value: str
dataset_id: Optional[str]

The dataset ID this indicator belongs to. Included in list responses.

related_events: Optional[List[RelatedEvent]]
dataset_id: str
event_id: str
tags: Optional[List[Tag]]
category_name: Optional[str]
uuid: Optional[str]
value: Optional[str]

Threat EventsIndicatorsBy DatasetTags

List mirrored tags for an indicator dataset
cloudforce_one.threat_events.indicators.by_dataset.tags.list(strdataset_id, TagListParams**kwargs) -> TagListResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags
ModelsExpand Collapse
List[object]

Array of mirror tag rows

Threat EventsAttackers

Lists attackers across multiple datasets
cloudforce_one.threat_events.attackers.list(AttackerListParams**kwargs) -> AttackerListResponse
GET/accounts/{account_id}/cloudforce-one/events/attackers
ModelsExpand Collapse
class AttackerListResponse: …
items: Items
type: str
type: str

Threat EventsCategories

Lists categories across multiple datasets
cloudforce_one.threat_events.categories.list(CategoryListParams**kwargs) -> CategoryListResponse
GET/accounts/{account_id}/cloudforce-one/events/categories
Reads a category
cloudforce_one.threat_events.categories.get(strcategory_id, CategoryGetParams**kwargs) -> CategoryGetResponse
GET/accounts/{account_id}/cloudforce-one/events/categories/{category_id}
Creates a new category
cloudforce_one.threat_events.categories.create(CategoryCreateParams**kwargs) -> CategoryCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/categories/create
Updates a category
cloudforce_one.threat_events.categories.edit(strcategory_id, CategoryEditParams**kwargs) -> CategoryEditResponse
PATCH/accounts/{account_id}/cloudforce-one/events/categories/{category_id}
Deletes a category
cloudforce_one.threat_events.categories.delete(strcategory_id, CategoryDeleteParams**kwargs) -> CategoryDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/events/categories/{category_id}
ModelsExpand Collapse
List[CategoryListResponseItem]
kill_chain: float
name: str
uuid: str
mitre_attack: Optional[List[str]]
mitre_capec: Optional[List[str]]
shortname: Optional[str]
class CategoryGetResponse: …
kill_chain: float
name: str
uuid: str
mitre_attack: Optional[List[str]]
mitre_capec: Optional[List[str]]
shortname: Optional[str]
class CategoryCreateResponse: …
kill_chain: float
name: str
uuid: str
mitre_attack: Optional[List[str]]
mitre_capec: Optional[List[str]]
shortname: Optional[str]
class CategoryEditResponse: …
kill_chain: float
name: str
uuid: str
mitre_attack: Optional[List[str]]
mitre_capec: Optional[List[str]]
shortname: Optional[str]
class CategoryDeleteResponse: …
uuid: str

Threat EventsCategoriesCatalog

Lists categories
cloudforce_one.threat_events.categories.catalog.list(CatalogListParams**kwargs) -> CatalogListResponse
GET/accounts/{account_id}/cloudforce-one/events/categories/catalog
ModelsExpand Collapse
List[CatalogListResponseItem]
kill_chain: float
name: str
uuid: str
mitre_attack: Optional[List[str]]
mitre_capec: Optional[List[str]]
shortname: Optional[str]

Threat EventsCountries

Retrieves countries information for all countries
cloudforce_one.threat_events.countries.list(CountryListParams**kwargs) -> CountryListResponse
GET/accounts/{account_id}/cloudforce-one/events/countries
ModelsExpand Collapse
List[CountryListResponseItem]
result: List[CountryListResponseItemResult]
alpha2: str
alpha3: str
name: str
success: str

Threat EventsCrons

Threat EventsDatasets

Lists all datasets in an account
cloudforce_one.threat_events.datasets.list(DatasetListParams**kwargs) -> DatasetListResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset
Reads a dataset
cloudforce_one.threat_events.datasets.get(strdataset_id, DatasetGetParams**kwargs) -> DatasetGetResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}
Creates a dataset
cloudforce_one.threat_events.datasets.create(DatasetCreateParams**kwargs) -> DatasetCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/dataset/create
Updates an existing dataset
cloudforce_one.threat_events.datasets.edit(strdataset_id, DatasetEditParams**kwargs) -> DatasetEditResponse
PATCH/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}
Delete a dataset
cloudforce_one.threat_events.datasets.delete(strdataset_id, DatasetDeleteParams**kwargs) -> DatasetDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}
Reads raw data for an event by UUID
cloudforce_one.threat_events.datasets.raw(strevent_id, DatasetRawParams**kwargs) -> DatasetRawResponse
GET/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}
ModelsExpand Collapse
List[DatasetListResponseItem]
is_public: bool
name: str
uuid: str
deleted_at: Optional[str]
class DatasetGetResponse: …
is_public: bool
name: str
uuid: str
deleted_at: Optional[str]
class DatasetCreateResponse: …
is_public: bool
name: str
uuid: str
deleted_at: Optional[str]
class DatasetEditResponse: …
is_public: bool
name: str
uuid: str
deleted_at: Optional[str]
class DatasetDeleteResponse: …
name: str
uuid: str
class DatasetRawResponse: …
id: float
account_id: float
created: str
data: str
source: str
tlp: str

Threat EventsDatasetsHealth

Threat EventsDatasetsEvents

Reads an event
cloudforce_one.threat_events.datasets.events.get(strevent_id, EventGetParams**kwargs) -> EventGetResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}
ModelsExpand Collapse
class EventGetResponse: …
attacker: str
attacker_country: str
attacker_country_alpha3: str
category: str
dataset_id: str
date: str
event: str
has_children: bool
indicator: str
indicator_type: str
indicator_type_id: float
kill_chain: float
mitre_attack: List[str]
mitre_capec: List[str]
num_referenced: float
num_references: float
raw_id: str
referenced: List[str]
referenced_ids: List[float]
references: List[str]
references_ids: List[float]
tags: List[str]
target_country: str
target_country_alpha3: str
target_industry: str
tlp: str
uuid: str
insight: Optional[str]
releasability_id: Optional[str]

Threat EventsIndicator Types

Lists all indicator types
Deprecated
cloudforce_one.threat_events.indicator_types.list(IndicatorTypeListParams**kwargs) -> IndicatorTypeListResponse
GET/accounts/{account_id}/cloudforce-one/events/indicatorTypes
ModelsExpand Collapse
class IndicatorTypeListResponse: …
items: Items
type: str
type: str

Threat EventsRaw

Reads data for a raw event
cloudforce_one.threat_events.raw.get(strraw_id, RawGetParams**kwargs) -> RawGetResponse
GET/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}
Updates a raw event
cloudforce_one.threat_events.raw.edit(strraw_id, RawEditParams**kwargs) -> RawEditResponse
PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}
ModelsExpand Collapse
class RawGetResponse: …
id: str
account_id: float
created: str
data: object
source: str
tlp: str
class RawEditResponse: …
id: str
data: object

Threat EventsRelate

Removes an event reference
cloudforce_one.threat_events.relate.delete(strevent_id, RelateDeleteParams**kwargs) -> RelateDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/events/relate/{event_id}
ModelsExpand Collapse
class RelateDeleteResponse: …
success: bool

Threat EventsTags

Lists all tags (SoT)
cloudforce_one.threat_events.tags.list(TagListParams**kwargs) -> TagListResponse
GET/accounts/{account_id}/cloudforce-one/events/tags
Creates a new tag
cloudforce_one.threat_events.tags.create(TagCreateParams**kwargs) -> TagCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/tags/create
Updates a tag (SoT)
cloudforce_one.threat_events.tags.edit(strtag_uuid, TagEditParams**kwargs) -> TagEditResponse
PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}
Deletes a tag (SoT)
cloudforce_one.threat_events.tags.delete(strtag_uuid, TagDeleteParams**kwargs) -> TagDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}
ModelsExpand Collapse
class TagListResponse: …
tags: List[Tag]
uuid: str
value: str
active_duration: Optional[str]
actor_category: Optional[str]
actor_category_confidence: Optional[int]

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
aliases: Optional[List[TagAlias]]

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: str
confidence: Optional[int]
maximum10
minimum1
tlp: Optional[Literal["red", "amber", "green", "white"]]
One of the following:
"red"
"amber"
"green"
"white"
alias_group_names: Optional[List[str]]
alias_group_names_internal: Optional[List[str]]
analytic_priority: Optional[float]
attribution_confidence: Optional[str]
attribution_confidence_score: Optional[int]
maximum10
minimum1
attribution_organization: Optional[str]
category_name: Optional[str]
category_uuid: Optional[str]
date_of_discovery: Optional[str]
external_references: Optional[List[TagExternalReference]]

Structured external references ({ url, description }). Public: returned to all accounts.

url: str
description: Optional[str]
internal_aliases: Optional[List[TagInternalAlias]]

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: str
confidence: Optional[int]
maximum10
minimum1
tlp: Optional[Literal["red", "amber", "green", "white"]]
One of the following:
"red"
"amber"
"green"
"white"
internal_description: Optional[str]
motive: Optional[str]
motive_confidence: Optional[int]

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
opsec_level: Optional[str]
origin_country_confidence: Optional[int]

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
origin_country_iso: Optional[str]
origin_country_iso_alpha3: Optional[str]
origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:
"red"
"amber"
"green"
"white"
priority: Optional[float]
sophistication_level: Optional[str]
class TagCreateResponse: …
uuid: str
value: str
active_duration: Optional[str]
actor_category: Optional[str]
actor_category_confidence: Optional[int]

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
aliases: Optional[List[Alias]]

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: str
confidence: Optional[int]
maximum10
minimum1
tlp: Optional[Literal["red", "amber", "green", "white"]]
One of the following:
"red"
"amber"
"green"
"white"
alias_group_names: Optional[List[str]]
alias_group_names_internal: Optional[List[str]]
analytic_priority: Optional[float]
attribution_confidence: Optional[str]
attribution_confidence_score: Optional[int]
maximum10
minimum1
attribution_organization: Optional[str]
category_name: Optional[str]
category_uuid: Optional[str]
date_of_discovery: Optional[str]
external_references: Optional[List[ExternalReference]]

Structured external references ({ url, description }). Public: returned to all accounts.

url: str
description: Optional[str]
internal_aliases: Optional[List[InternalAlias]]

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: str
confidence: Optional[int]
maximum10
minimum1
tlp: Optional[Literal["red", "amber", "green", "white"]]
One of the following:
"red"
"amber"
"green"
"white"
internal_description: Optional[str]
motive: Optional[str]
motive_confidence: Optional[int]

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
opsec_level: Optional[str]
origin_country_confidence: Optional[int]

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
origin_country_iso: Optional[str]
origin_country_iso_alpha3: Optional[str]
origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:
"red"
"amber"
"green"
"white"
priority: Optional[float]
sophistication_level: Optional[str]
class TagEditResponse: …
uuid: str
value: str
active_duration: Optional[str]
actor_category: Optional[str]
actor_category_confidence: Optional[int]

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
aliases: Optional[List[Alias]]

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: str
confidence: Optional[int]
maximum10
minimum1
tlp: Optional[Literal["red", "amber", "green", "white"]]
One of the following:
"red"
"amber"
"green"
"white"
alias_group_names: Optional[List[str]]
alias_group_names_internal: Optional[List[str]]
analytic_priority: Optional[float]
attribution_confidence: Optional[str]
attribution_confidence_score: Optional[int]
maximum10
minimum1
attribution_organization: Optional[str]
category_name: Optional[str]
category_uuid: Optional[str]
date_of_discovery: Optional[str]
external_references: Optional[List[ExternalReference]]

Structured external references ({ url, description }). Public: returned to all accounts.

url: str
description: Optional[str]
internal_aliases: Optional[List[InternalAlias]]

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: str
confidence: Optional[int]
maximum10
minimum1
tlp: Optional[Literal["red", "amber", "green", "white"]]
One of the following:
"red"
"amber"
"green"
"white"
internal_description: Optional[str]
motive: Optional[str]
motive_confidence: Optional[int]

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
opsec_level: Optional[str]
origin_country_confidence: Optional[int]

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
origin_country_iso: Optional[str]
origin_country_iso_alpha3: Optional[str]
origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:
"red"
"amber"
"green"
"white"
priority: Optional[float]
sophistication_level: Optional[str]
class TagDeleteResponse: …
uuid: str

Threat EventsTagsCategories

Lists all tag categories (SoT)
cloudforce_one.threat_events.tags.categories.list(CategoryListParams**kwargs) -> CategoryListResponse
GET/accounts/{account_id}/cloudforce-one/events/tags/categories
Creates a new tag category (SoT)
cloudforce_one.threat_events.tags.categories.create(CategoryCreateParams**kwargs) -> CategoryCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/tags/categories/create
Updates a tag category (SoT)
cloudforce_one.threat_events.tags.categories.edit(strcategory_uuid, CategoryEditParams**kwargs) -> CategoryEditResponse
PATCH/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}
Deletes a tag category (SoT)
cloudforce_one.threat_events.tags.categories.delete(strcategory_uuid, CategoryDeleteParams**kwargs) -> CategoryDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}
ModelsExpand Collapse
class CategoryListResponse: …
categories: List[Category]
name: str
uuid: str
created_at: Optional[str]
description: Optional[str]
updated_at: Optional[str]
class CategoryCreateResponse: …
name: str
uuid: str
created_at: Optional[str]
description: Optional[str]
updated_at: Optional[str]
class CategoryEditResponse: …
name: str
uuid: str
created_at: Optional[str]
description: Optional[str]
updated_at: Optional[str]
class CategoryDeleteResponse: …
uuid: str

Threat EventsTagsIndicators

List indicators related to a tag
cloudforce_one.threat_events.tags.indicators.list(strtag_uuid, IndicatorListParams**kwargs) -> IndicatorListResponse
GET/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators
ModelsExpand Collapse
class IndicatorListResponse: …
indicators: List[Indicator]
created_at: datetime
formatdate-time
indicator_type: str
updated_at: datetime
formatdate-time
uuid: str
value: str
dataset_id: Optional[str]

The dataset ID this indicator belongs to. Included in list responses.

related_events: Optional[List[IndicatorRelatedEvent]]
dataset_id: str
event_id: str
tags: Optional[List[IndicatorTag]]
category_name: Optional[str]
uuid: Optional[str]
value: Optional[str]

Threat EventsTagsIndicatorsBy Dataset

List indicators related to a tag within a dataset (deprecated)
Deprecated
cloudforce_one.threat_events.tags.indicators.by_dataset.list(strtag_uuid, ByDatasetListParams**kwargs) -> ByDatasetListResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators
ModelsExpand Collapse
class ByDatasetListResponse: …
indicators: List[Indicator]
created_at: datetime
formatdate-time
indicator_type: str
updated_at: datetime
formatdate-time
uuid: str
value: str
dataset_id: Optional[str]

The dataset ID this indicator belongs to. Included in list responses.

related_events: Optional[List[IndicatorRelatedEvent]]
dataset_id: str
event_id: str
tags: Optional[List[IndicatorTag]]
category_name: Optional[str]
uuid: Optional[str]
value: Optional[str]

Threat EventsEvent Tags

Adds a tag to an event
cloudforce_one.threat_events.event_tags.create(strevent_id, EventTagCreateParams**kwargs) -> EventTagCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create
Removes a tag from an event
cloudforce_one.threat_events.event_tags.delete(strevent_id, EventTagDeleteParams**kwargs) -> EventTagDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}
ModelsExpand Collapse
class EventTagCreateResponse: …
success: bool
class EventTagDeleteResponse: …
success: bool

Threat EventsTarget Industries

Lists target industries across multiple datasets
cloudforce_one.threat_events.target_industries.list(TargetIndustryListParams**kwargs) -> TargetIndustryListResponse
GET/accounts/{account_id}/cloudforce-one/events/targetIndustries
ModelsExpand Collapse
class TargetIndustryListResponse: …
items: Items
type: str
type: str

Threat EventsTarget IndustriesBy Dataset

Lists all target industries for a specific dataset
cloudforce_one.threat_events.target_industries.by_dataset.list(strdataset_id, ByDatasetListParams**kwargs) -> ByDatasetListResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries
ModelsExpand Collapse
class ByDatasetListResponse: …
items: Items
type: str
type: str

Threat EventsTarget IndustriesCatalog

Lists all target industries from industry map catalog
cloudforce_one.threat_events.target_industries.catalog.list(CatalogListParams**kwargs) -> CatalogListResponse
GET/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog
ModelsExpand Collapse
class CatalogListResponse: …
items: Items
type: str
type: str

Threat EventsInsights