# Threat Events ## Filter and list events `cloudforce_one.threat_events.list(ThreatEventListParams**kwargs) -> ThreatEventListResponse` **get** `/accounts/{account_id}/cloudforce-one/events` Use `datasetId=all` or `datasetId=*` to query all event datasets for the account (limited to 50). When `datasetId` is unspecified, events are listed from the default Cloudforce One Threat Events dataset. To list existing datasets, use the [`List Datasets`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint. ### Parameters - `account_id: str` Account ID. - `cursor: Optional[str]` Cursor for pagination. When provided, filters are embedded in the cursor so you only need to pass cursor and pageSize. Returned in the previous response's result_info.cursor field. Use cursor-based pagination for deep pagination (beyond 100,000 records) or for optimal performance. - `dataset_id: Optional[Sequence[str]]` Dataset IDs to query events from (array of UUIDs), or special value 'all' or '*' to query all event datasets for the account. If not provided, uses the default dataset. - `force_refresh: Optional[bool]` - `format: Optional[Literal["json", "stix2", "taxii"]]` - `"json"` - `"stix2"` - `"taxii"` - `order: Optional[Literal["asc", "desc"]]` - `"asc"` - `"desc"` - `order_by: Optional[str]` - `page: Optional[float]` Page number (1-indexed) for offset-based pagination. Limited to offset of 100,000 records. For deep pagination, use cursor-based pagination instead. - `page_size: Optional[float]` Number of results per page. Maximum 25,000. - `search: Optional[Iterable[Search]]` - `field: Optional[str]` Event field to search on. Allowed: attacker, attackerCountry, category, createdAt, date, event, indicator, indicatorType, killChain, mitreAttack, tags, targetCountry, targetIndustry, tlp, uuid. - `op: Optional[Literal["equals", "not", "gt", 9 more]]` Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'tags', op:'in', value:['malware','apt']}. - `"equals"` - `"not"` - `"gt"` - `"gte"` - `"lt"` - `"lte"` - `"like"` - `"contains"` - `"startsWith"` - `"endsWith"` - `"in"` - `"find"` - `value: Optional[Union[str, float, Sequence[Union[str, float]]]]` Search value. String or number for most operators. Array for 'in' operator (max 100 items). - `str` - `float` - `Sequence[Union[str, float]]` - `str` - `float` - `source: Optional[Literal["do", "r2catalog"]]` Read backend. 'do' (default) reads Durable Object storage. 'r2catalog' reads R2 Data Catalog (admin-only, experimental; supports a subset of search fields — no 'tags'). - `"do"` - `"r2catalog"` ### Returns - `List[ThreatEventListResponseItem]` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) threat_events = client.cloudforce_one.threat_events.list( account_id="account_id", ) print(threat_events) ``` #### Response ```json [ { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ] ``` ## Reads an event `cloudforce_one.threat_events.get(strevent_id, ThreatEventGetParams**kwargs) -> ThreatEventGetResponse` **get** `/accounts/{account_id}/cloudforce-one/events/{event_id}` This Method is deprecated. Please use /events/dataset/:dataset_id/events/:event_id instead. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. ### Returns - `class ThreatEventGetResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) threat_event = client.cloudforce_one.threat_events.get( event_id="event_id", account_id="account_id", ) print(threat_event.uuid) ``` #### Response ```json { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ``` ## Creates a new event `cloudforce_one.threat_events.create(ThreatEventCreateParams**kwargs) -> ThreatEventCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/create` To create a dataset, see the [`Create Dataset`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create/) endpoint. When `datasetId` parameter is unspecified, it will be created in a default dataset named `Cloudforce One Threat Events`. ### Parameters - `account_id: str` Account ID. - `category: str` - `date: Union[str, datetime]` - `event: str` - `raw: Raw` - `data: Optional[Dict[str, object]]` - `source: Optional[str]` - `tlp: Optional[str]` - `tlp: str` - `account_id: Optional[float]` - `attacker: Optional[str]` - `attacker_country: Optional[str]` - `dataset_id: Optional[str]` - `indicator: Optional[str]` - `indicators: Optional[Iterable[Indicator]]` Array of indicators for this event. Supports multiple indicators per event for complex scenarios. - `indicator_type: str` The type of indicator (e.g., DOMAIN, IP, JA3, HASH) - `value: str` The indicator value (e.g., domain name, IP address, hash) - `indicator_type: Optional[str]` - `insight: Optional[str]` - `tags: Optional[Sequence[str]]` - `target_country: Optional[str]` - `target_industry: Optional[str]` ### Returns - `class ThreatEventCreateResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Example ```python import os from datetime import datetime from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) threat_event = client.cloudforce_one.threat_events.create( path_account_id="account_id", category="Domain Resolution", date=datetime.fromisoformat("2022-04-01T00:00:00"), event="An attacker registered the domain domain.com", raw={ "data": { "foo": "bar" } }, tlp="amber", ) print(threat_event.uuid) ``` #### Response ```json { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ``` ## Updates an event `cloudforce_one.threat_events.edit(strevent_id, ThreatEventEditParams**kwargs) -> ThreatEventEditResponse` **patch** `/accounts/{account_id}/cloudforce-one/events/{event_id}` Update an existing event by its identifier. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. - `dataset_id: str` Dataset ID containing the event to update. - `attacker: Optional[str]` - `attacker_country: Optional[str]` - `category: Optional[str]` - `created_at: Optional[Union[str, datetime]]` - `date: Optional[Union[str, datetime]]` - `event: Optional[str]` - `indicator: Optional[str]` - `indicator_type: Optional[str]` - `insight: Optional[str]` - `raw: Optional[Raw]` - `data: Optional[Dict[str, object]]` - `source: Optional[str]` - `tlp: Optional[str]` - `target_country: Optional[str]` - `target_industry: Optional[str]` - `tlp: Optional[str]` ### Returns - `class ThreatEventEditResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.edit( event_id="event_id", account_id="account_id", dataset_id="9b769969-a211-466c-8ac3-cb91266a066a", ) print(response.uuid) ``` #### Response ```json { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ``` ## Creates bulk events `cloudforce_one.threat_events.bulk_create(ThreatEventBulkCreateParams**kwargs) -> ThreatEventBulkCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/create/bulk` The `datasetId` parameter must be defined. To list existing datasets (and their IDs) in your account, use the [`List Datasets`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint. ### Parameters - `account_id: str` Account ID. - `data: Iterable[Data]` - `category: str` - `date: Union[str, datetime]` - `event: str` - `raw: DataRaw` - `data: Optional[Dict[str, object]]` - `source: Optional[str]` - `tlp: Optional[str]` - `tlp: str` - `account_id: Optional[float]` - `attacker: Optional[str]` - `attacker_country: Optional[str]` - `dataset_id: Optional[str]` - `indicator: Optional[str]` - `indicators: Optional[Iterable[DataIndicator]]` Array of indicators for this event. Supports multiple indicators per event for complex scenarios. - `indicator_type: str` The type of indicator (e.g., DOMAIN, IP, JA3, HASH) - `value: str` The indicator value (e.g., domain name, IP address, hash) - `indicator_type: Optional[str]` - `insight: Optional[str]` - `tags: Optional[Sequence[str]]` - `target_country: Optional[str]` - `target_industry: Optional[str]` - `dataset_id: str` - `include_created_events: Optional[bool]` When true, response includes array of created event UUIDs and shard IDs. Useful for tracking which events were created and where. ### Returns - `class ThreatEventBulkCreateResponse: …` Detailed result of bulk event creation with auto-tag management - `created_events_count: float` Number of events created - `created_tags_count: float` Number of new tags created in SoT - `error_count: float` Number of errors encountered - `queued_indicators_count: float` Number of indicators queued for async processing - `create_bulk_events_request_id: Optional[str]` Correlation ID for async indicator processing - `created_events: Optional[List[CreatedEvent]]` Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true - `event_index: float` Original index in the input data array - `shard_id: str` Dataset ID of the shard where the event was created - `uuid: str` UUID of the created event - `errors: Optional[List[Error]]` Array of error details - `error: str` Error message - `event_index: float` Index of the event that caused the error ### Example ```python import os from datetime import datetime from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.bulk_create( account_id="account_id", data=[{ "category": "Domain Resolution", "date": datetime.fromisoformat("2022-04-01T00:00:00"), "event": "An attacker registered the domain domain.com", "raw": { "data": { "foo": "bar" } }, "tlp": "amber", }], dataset_id="durableObjectName", ) print(response.created_events_count) ``` #### Response ```json { "createdEventsCount": 0, "createdTagsCount": 0, "errorCount": 0, "queuedIndicatorsCount": 0, "createBulkEventsRequestId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", "createdEvents": [ { "eventIndex": 0, "shardId": "shardId", "uuid": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e" } ], "errors": [ { "error": "error", "eventIndex": 0 } ] } ``` ## Creates bulk DOS event with relationships and indicators `cloudforce_one.threat_events.bulk_create_relationships(ThreatEventBulkCreateRelationshipsParams**kwargs) -> ThreatEventBulkCreateRelationshipsResponse` **post** `/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships` This method is deprecated. Please use `event_create_bulk` instead ### Parameters - `account_id: str` Account ID. - `data: Iterable[Data]` - `category: str` - `date: Union[str, datetime]` - `event: str` - `raw: DataRaw` - `data: Optional[Dict[str, object]]` - `source: Optional[str]` - `tlp: Optional[str]` - `tlp: str` - `account_id: Optional[float]` - `attacker: Optional[str]` - `attacker_country: Optional[str]` - `dataset_id: Optional[str]` - `indicator: Optional[str]` - `indicators: Optional[Iterable[DataIndicator]]` Array of indicators for this event. Supports multiple indicators per event for complex scenarios. - `indicator_type: str` The type of indicator (e.g., DOMAIN, IP, JA3, HASH) - `value: str` The indicator value (e.g., domain name, IP address, hash) - `indicator_type: Optional[str]` - `insight: Optional[str]` - `tags: Optional[Sequence[str]]` - `target_country: Optional[str]` - `target_industry: Optional[str]` - `dataset_id: str` ### Returns - `class ThreatEventBulkCreateRelationshipsResponse: …` Result of bulk relationship creation operation - `created_events_count: float` Number of events created - `created_indicators_count: float` Number of indicators created - `created_relationships_count: float` Number of relationships created - `error_count: float` Number of errors encountered - `errors: Optional[List[Error]]` Array of error details - `error: str` Error message - `event_index: float` Index of the event that caused the error ### Example ```python import os from datetime import datetime from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.bulk_create_relationships( account_id="account_id", data=[{ "category": "Domain Resolution", "date": datetime.fromisoformat("2022-04-01T00:00:00"), "event": "An attacker registered the domain domain.com", "raw": { "data": { "foo": "bar" } }, "tlp": "amber", }], dataset_id="durableObjectName", ) print(response.created_events_count) ``` #### Response ```json { "createdEventsCount": 0, "createdIndicatorsCount": 0, "createdRelationshipsCount": 0, "errorCount": 0, "errors": [ { "error": "error", "eventIndex": 0 } ] } ``` ## Domain Types ### Threat Event List Response - `List[ThreatEventListResponseItem]` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Threat Event Get Response - `class ThreatEventGetResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Threat Event Create Response - `class ThreatEventCreateResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Threat Event Edit Response - `class ThreatEventEditResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Threat Event Bulk Create Response - `class ThreatEventBulkCreateResponse: …` Detailed result of bulk event creation with auto-tag management - `created_events_count: float` Number of events created - `created_tags_count: float` Number of new tags created in SoT - `error_count: float` Number of errors encountered - `queued_indicators_count: float` Number of indicators queued for async processing - `create_bulk_events_request_id: Optional[str]` Correlation ID for async indicator processing - `created_events: Optional[List[CreatedEvent]]` Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true - `event_index: float` Original index in the input data array - `shard_id: str` Dataset ID of the shard where the event was created - `uuid: str` UUID of the created event - `errors: Optional[List[Error]]` Array of error details - `error: str` Error message - `event_index: float` Index of the event that caused the error ### Threat Event Bulk Create Relationships Response - `class ThreatEventBulkCreateRelationshipsResponse: …` Result of bulk relationship creation operation - `created_events_count: float` Number of events created - `created_indicators_count: float` Number of indicators created - `created_relationships_count: float` Number of relationships created - `error_count: float` Number of errors encountered - `errors: Optional[List[Error]]` Array of error details - `error: str` Error message - `event_index: float` Index of the event that caused the error # Aggregate ## Aggregate events by single or multiple columns with optional date filtering `cloudforce_one.threat_events.aggregate.list(AggregateListParams**kwargs) -> AggregateListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/aggregate` Aggregate threat events by one or more columns (e.g., attacker, targetIndustry) with optional date filtering and daily grouping. Supports multi-dimensional aggregation for cross-analysis. ### Parameters - `account_id: str` Account ID. - `aggregate_by: str` Column(s) to aggregate by - single column or comma-separated list (e.g., 'attacker', 'targetIndustry', 'attacker,targetIndustry') - `dataset_id: Optional[Sequence[str]]` Dataset ID(s) to filter by. Can be a single dataset ID, comma-separated list, or array. If not provided, uses default dataset - `end_date: Optional[str]` End date for filtering (ISO 8601 format, e.g., '2024-12-31') - `group_by_date: Optional[bool]` Whether to group results by date (daily aggregation) - `limit: Optional[float]` Maximum number of results to return - `start_date: Optional[str]` Start date for filtering (ISO 8601 format, e.g., '2024-01-01') ### Returns - `class AggregateListResponse: …` - `aggregate_by: str` Column(s) that were aggregated by - `aggregations: List[Aggregation]` Array of aggregation results with dynamic fields based on aggregateBy columns - `count: float` Number of events for this aggregation - `date: Optional[str]` Date (if groupByDate is true) - `total: float` Total number of events in the aggregation - `date_range: Optional[DateRange]` Date range used for filtering - `end_date: Optional[str]` - `start_date: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) aggregates = client.cloudforce_one.threat_events.aggregate.list( account_id="account_id", aggregate_by="aggregateBy", ) print(aggregates.aggregate_by) ``` #### Response ```json { "aggregateBy": "aggregateBy", "aggregations": [ { "count": 0, "date": "date" } ], "total": 0, "dateRange": { "endDate": "endDate", "startDate": "startDate" } } ``` ## Domain Types ### Aggregate List Response - `class AggregateListResponse: …` - `aggregate_by: str` Column(s) that were aggregated by - `aggregations: List[Aggregation]` Array of aggregation results with dynamic fields based on aggregateBy columns - `count: float` Number of events for this aggregation - `date: Optional[str]` Date (if groupByDate is true) - `total: float` Total number of events in the aggregation - `date_range: Optional[DateRange]` Date range used for filtering - `end_date: Optional[str]` - `start_date: Optional[str]` # Graphql ## GraphQL endpoint for event aggregation `cloudforce_one.threat_events.graphql.create(GraphqlCreateParams**kwargs) -> GraphqlCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/graphql` Execute GraphQL aggregations over threat events. Supports multi-dimensional group-bys, optional date range filtering, and multi-dataset aggregation. ### Parameters - `account_id: str` Account ID. ### Returns - `class GraphqlCreateResponse: …` - `data: Optional[object]` - `errors: Optional[List[object]]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) graphql = client.cloudforce_one.threat_events.graphql.create( account_id="account_id", ) print(graphql.data) ``` #### Response ```json { "data": {}, "errors": [ {} ] } ``` ## Domain Types ### Graphql Create Response - `class GraphqlCreateResponse: …` - `data: Optional[object]` - `errors: Optional[List[object]]` # Graph ## Query graph neighborhood from R2 Data Catalog `cloudforce_one.threat_events.graph.list(GraphListParams**kwargs) -> GraphListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/graph` Expands the single-level relationship neighborhood of one or more seed nodes (event, indicator, or tag) from R2 Data Catalog. Seeds use compact id format (type:uuid), e.g. "event:550e8400-...". Multi-seed requests merge and deduplicate results server-side. Hydrates neighbor entities with summary data from Durable Objects. Supports filtering by relationship type and dataset scope. ### Parameters - `account_id: str` Account ID. - `cursor: Optional[str]` Opaque pagination token. Only valid when seeds has exactly 1 entry; 400 otherwise. - `dataset_ids: Optional[Sequence[str]]` Comma-separated dataset UUIDs to restrict neighbor scope. Intersected with ACL grants. - `direction: Optional[str]` Edge direction relative to each seed: out (seed→neighbors), in (neighbors→seed), both (default). - `expand: Optional[Sequence[str]]` Comma-separated list of response sections to expand (hydrate). Allowed: `nodes`. Omitting `expand` returns identifier-only nodes. - `hydration: Optional[str]` Hydration strategy for neighbor nodes when expand=nodes is set. r2_join (default): use R2 JOIN query + DO fallback. do_only: use plain R2 query + hydrate all neighbors via Durable Objects. - `limit: Optional[float]` Max neighbors per seed (default: 100, max: 1000). Values above 1000 return 400. - `max_nodes: Optional[float]` Total accumulated node cap across all seeds (default: 500, max: 1000). Values above 1000 return 400. - `relationship_types: Optional[Sequence[str]]` Comma-separated relationship types to filter by. Allowed: tagged_with, appears_in, related_to, caused_by, attributed_to. - `seeds: Optional[Sequence[str]]` Comma-separated compact seed ids (type:uuid). Example: seeds=event:550e8400-...,indicator:661fa920-... Provide 1–50 entries; omitting seeds returns 400. ### Returns - `class GraphListResponse: …` - `edges: List[Edge]` - `id: str` Deterministic composite edge id (source→target:relationshipType) - `relationship_type: str` - `source: str` Compact id of the source node (type:uuid) - `source_id: str` - `source_type: str` - `target: str` Compact id of the target node (type:uuid) - `target_id: str` - `target_type: str` - `node: Optional[Dict[str, object]]` Focal node object (legacy single-seed). Null when unavailable. - `nodes: List[Dict[str, object]]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) graphs = client.cloudforce_one.threat_events.graph.list( account_id="account_id", ) print(graphs.edges) ``` #### Response ```json { "errors": [], "messages": [], "result": { "edges": [ { "id": "event:550e8400-e29b-41d4-a716-446655440000→indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04:appears_in", "relationshipType": "appears_in", "source": "event:550e8400-e29b-41d4-a716-446655440000", "sourceId": "550e8400-e29b-41d4-a716-446655440000", "sourceType": "event", "target": "indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04", "targetId": "661fa920-bbf3-4e71-9c55-2a3d8e7f1b04", "targetType": "indicator" } ], "node": null, "nodes": [ { "attacker": "APT28", "category": "intrusion", "datasetId": "a1b2c3d4-0001-4000-8000-000000000001", "date": "2026-06-01", "event": "Attacker registered domain evil.example.com", "id": "event:550e8400-e29b-41d4-a716-446655440000", "role": "focal", "type": "event", "uuid": "550e8400-e29b-41d4-a716-446655440000" }, { "datasetId": "a1b2c3d4-0001-4000-8000-000000000001", "id": "indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04", "indicatorType": "domain", "role": "focal", "type": "indicator", "uuid": "661fa920-bbf3-4e71-9c55-2a3d8e7f1b04", "value": "evil.example.com" }, { "categoryId": "threat-actor", "id": "tag:772af1c8-dc4a-4a29-b3e6-4f8c9d2a6e71", "type": "tag", "uuid": "772af1c8-dc4a-4a29-b3e6-4f8c9d2a6e71", "value": "APT28" } ] }, "result_info": { "count": 3, "cursor": null, "depth_reached": 1, "edge_count": 1, "has_more": false, "query_time_ms": 890, "seeds": [ "event:550e8400-e29b-41d4-a716-446655440000", "indicator:661fa920-bbf3-4e71-9c55-2a3d8e7f1b04" ], "total_count": 3, "truncated": false }, "success": true } ``` ## Domain Types ### Graph List Response - `class GraphListResponse: …` - `edges: List[Edge]` - `id: str` Deterministic composite edge id (source→target:relationshipType) - `relationship_type: str` - `source: str` Compact id of the source node (type:uuid) - `source_id: str` - `source_type: str` - `target: str` Compact id of the target node (type:uuid) - `target_id: str` - `target_type: str` - `node: Optional[Dict[str, object]]` Focal node object (legacy single-seed). Null when unavailable. - `nodes: List[Dict[str, object]]` # Queries ## List all saved event queries `cloudforce_one.threat_events.queries.list(QueryListParams**kwargs) -> QueryListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/queries` Retrieve all saved event queries for the account ### Parameters - `account_id: str` Account ID. ### Returns - `List[QueryListResponseItem]` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) queries = client.cloudforce_one.threat_events.queries.list( account_id="account_id", ) print(queries) ``` #### Response ```json [ { "id": 0, "account_id": 0, "alert_enabled": true, "alert_rollup_enabled": true, "created_at": "created_at", "name": "name", "query_json": "query_json", "rule_enabled": true, "updated_at": "updated_at", "user_email": "user_email", "custom_threat_feed_id": 0, "rule_list_id": "rule_list_id", "rule_scope": "rule_scope" } ] ``` ## Create a saved event query `cloudforce_one.threat_events.queries.create(QueryCreateParams**kwargs) -> QueryCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/queries/create` Create a new saved event query for the account ### Parameters - `account_id: str` Account ID. - `alert_enabled: bool` Enable alerts for this query - `alert_rollup_enabled: bool` Enable alert rollup for this query - `name: str` Unique name for the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Enable rule for this query - `rule_scope: Optional[str]` Scope for the rule ### Returns - `class QueryCreateResponse: …` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) query = client.cloudforce_one.threat_events.queries.create( account_id="account_id", alert_enabled=True, alert_rollup_enabled=True, name="name", query_json="query_json", rule_enabled=True, ) print(query.id) ``` #### Response ```json { "id": 0, "account_id": 0, "alert_enabled": true, "alert_rollup_enabled": true, "created_at": "created_at", "name": "name", "query_json": "query_json", "rule_enabled": true, "updated_at": "updated_at", "user_email": "user_email", "custom_threat_feed_id": 0, "rule_list_id": "rule_list_id", "rule_scope": "rule_scope" } ``` ## Read a saved event query `cloudforce_one.threat_events.queries.get(intquery_id, QueryGetParams**kwargs) -> QueryGetResponse` **get** `/accounts/{account_id}/cloudforce-one/events/queries/{query_id}` Retrieve a saved event query by its ID ### Parameters - `account_id: str` Account ID. - `query_id: int` Event query ID ### Returns - `class QueryGetResponse: …` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) query = client.cloudforce_one.threat_events.queries.get( query_id=0, account_id="account_id", ) print(query.id) ``` #### Response ```json { "id": 0, "account_id": 0, "alert_enabled": true, "alert_rollup_enabled": true, "created_at": "created_at", "name": "name", "query_json": "query_json", "rule_enabled": true, "updated_at": "updated_at", "user_email": "user_email", "custom_threat_feed_id": 0, "rule_list_id": "rule_list_id", "rule_scope": "rule_scope" } ``` ## Update a saved event query `cloudforce_one.threat_events.queries.edit(intquery_id, QueryEditParams**kwargs) -> QueryEditResponse` **patch** `/accounts/{account_id}/cloudforce-one/events/queries/{query_id}` Update an existing saved event query by its ID ### Parameters - `account_id: str` Account ID. - `query_id: int` Event query ID - `alert_enabled: Optional[bool]` Enable alerts for this query - `alert_rollup_enabled: Optional[bool]` Enable alert rollup for this query - `name: Optional[str]` Unique name for the saved query - `query_json: Optional[str]` JSON string containing the query parameters - `rule_enabled: Optional[bool]` Enable rule for this query - `rule_scope: Optional[str]` Scope for the rule ### Returns - `class QueryEditResponse: …` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.queries.edit( query_id=0, account_id="account_id", ) print(response.id) ``` #### Response ```json { "id": 0, "account_id": 0, "alert_enabled": true, "alert_rollup_enabled": true, "created_at": "created_at", "name": "name", "query_json": "query_json", "rule_enabled": true, "updated_at": "updated_at", "user_email": "user_email", "custom_threat_feed_id": 0, "rule_list_id": "rule_list_id", "rule_scope": "rule_scope" } ``` ## Delete a saved event query `cloudforce_one.threat_events.queries.delete(intquery_id, QueryDeleteParams**kwargs)` **delete** `/accounts/{account_id}/cloudforce-one/events/queries/{query_id}` Delete a saved event query by its ID ### Parameters - `account_id: str` Account ID. - `query_id: int` Event query ID ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) client.cloudforce_one.threat_events.queries.delete( query_id=0, account_id="account_id", ) ``` ## Domain Types ### Query List Response - `List[QueryListResponseItem]` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule ### Query Create Response - `class QueryCreateResponse: …` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule ### Query Get Response - `class QueryGetResponse: …` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule ### Query Edit Response - `class QueryEditResponse: …` - `id: int` Unique identifier for the saved query - `account_id: int` Account ID - `alert_enabled: bool` Whether alerts are enabled - `alert_rollup_enabled: bool` Whether alert rollup is enabled - `created_at: str` Creation timestamp - `name: str` Name of the saved query - `query_json: str` JSON string containing the query parameters - `rule_enabled: bool` Whether rule is enabled - `updated_at: str` Last update timestamp - `user_email: str` Email of the user who created the query - `custom_threat_feed_id: Optional[int]` Intel Indicator Feed ID (numeric) - `rule_list_id: Optional[str]` WAF rules list ID for blocking - `rule_scope: Optional[str]` Scope for the rule # Relationships ## Filter and list events related to specific event `cloudforce_one.threat_events.relationships.list(strevent_id, RelationshipListParams**kwargs) -> RelationshipListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships` The `event_id` must be defined (to list existing events (and their IDs), use the [`Filter and List Events`](https://edgetunnel-b2h.pages.dev/api/resources/cloudforce_one/subresources/threat_events/methods/list/) endpoint). Also, must provide query parameters. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. - `dataset_id: str` The dataset ID to search within. - `direction: Optional[Literal["ancestors", "descendants", "both"]]` The direction to traverse the graph. Defaults to 'both' to search all. - `"ancestors"` - `"descendants"` - `"both"` - `include_parent: Optional[bool]` Whether to include the starting event in the results. Defaults to true. - `indicator_type_ids: Optional[Sequence[str]]` An optional array of indicator type IDs to filter the results by. - `max_depth: Optional[float]` The maximum depth to traverse. Defaults to 5. - `page: Optional[float]` - `page_size: Optional[float]` - `relationship_types: Optional[Union[str, Sequence[str]]]` An optional array of relationship types to filter by. - `str` - `Sequence[str]` ### Returns - `List[RelationshipListResponseItem]` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) relationships = client.cloudforce_one.threat_events.relationships.list( event_id="event_id", account_id="account_id", dataset_id="datasetId", ) print(relationships) ``` #### Response ```json [ { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ] ``` ## Domain Types ### Relationship List Response - `List[RelationshipListResponseItem]` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` # Indicators ## Lists indicators across multiple datasets `cloudforce_one.threat_events.indicators.list(IndicatorListParams**kwargs) -> IndicatorListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/indicators` Retrieves a paginated list of indicators across specified datasets. Use datasetIds=all or datasetIds=* to query all datasets for the account. If no datasetIds provided, uses the default dataset. ### Parameters - `account_id: str` Account ID. - `created_after: Optional[Union[str, datetime]]` Filter indicators created on or after this date. Must use ISO 8601 format (e.g., '2024-01-15T00:00:00Z'). - `created_before: Optional[Union[str, datetime]]` Filter indicators created on or before this date. Must use ISO 8601 format (e.g., '2024-12-31T23:59:59Z'). - `dataset_ids: Optional[Sequence[str]]` Dataset IDs to query indicators from (array of UUIDs), or special value 'all' or '*' to query all datasets. If not provided, uses the default dataset. - `format: Optional[Literal["json", "stix2", "taxii"]]` Output format for indicator data. 'json' returns the default format, 'stix2' returns STIX 2.1 Indicator SDOs, 'taxii' returns a TAXII 2.1 Envelope with Content-Type application/taxii+json;version=2.1. - `"json"` - `"stix2"` - `"taxii"` - `include_tags: Optional[bool]` Whether to include full tag details for each indicator. Defaults to true. - `include_total_count: Optional[bool]` Whether to compute accurate total count via COUNT(*). Defaults to false for performance. When false, total_count is an approximation. - `indicator_type: Optional[str]` - `name: Optional[str]` Filter indicators by value using substring match (LIKE). Legacy alternative to structured search. - `page: Optional[float]` - `page_size: Optional[float]` - `related_events: Optional[Sequence[str]]` Filter by related event IDs - `related_events_limit: Optional[float]` Limit the number of related events returned per indicator. Default: 2. Set to 0 for none, -1 for all events. - `search: Optional[Iterable[Search]]` Structured search as a JSON array of {field, op, value} objects. Searchable fields: value, indicatorType. Supports operators: equals, not, contains, startsWith, endsWith, gt, lt, gte, lte, like, in, find. Use the 'in' operator with an array value to bulk-check up to 100 indicators in a single request, e.g. search=[{"field":"value","op":"in","value":["evil.com","bad.org"]}]. Multiple conditions are AND'd together. Max 10 conditions per request. - `field: Literal["value", "indicatorType"]` The indicator field to search on. Allowed: value, indicatorType. - `"value"` - `"indicatorType"` - `op: Literal["equals", "not", "gt", 9 more]` Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'value', op:'in', value:['evil.com','bad.org']}. - `"equals"` - `"not"` - `"gt"` - `"gte"` - `"lt"` - `"lte"` - `"like"` - `"contains"` - `"startsWith"` - `"endsWith"` - `"in"` - `"find"` - `value: Union[str, Sequence[str]]` Search value. String for most operators. Array of strings for 'in' operator (max 100 items). - `str` - `Sequence[str]` - `source: Optional[Literal["do", "r2catalog"]]` Read backend. 'do' (default) reads Durable Object storage. 'r2catalog' reads R2 Data Catalog (admin-only, experimental; supports a subset of search fields). - `"do"` - `"r2catalog"` - `tags: Optional[Sequence[str]]` Filter by tag values or UUIDs. Indicators must have at least one of the specified tags (OR logic). Supports both tag UUID and tag value. - `tag_search: Optional[Iterable[TagSearch]]` Structured tag-metadata filter as a JSON array of {field, op, value} objects. Operates against the per-dataset IndicatorTag mirror so you can find indicators by tag attributes (origin country, motive, sophistication, priority, etc.) without a separate Tags lookup. Common dashboard usage: drill from a country into indicators, e.g. tagSearch=[{"field":"originCountryISO","op":"in","value":["IR","CN"]}]. Country values may be passed as alpha-2, alpha-3, name, or alias (e.g. "iran"). Operators: equals, not, gt/gte/lt/lte (numeric only), contains/like/find/startsWith/endsWith (string only), in. AND-joined across entries; combined with `tags`, a matching tag must satisfy both. Max 10 entries per request, max 100 values per 'in'. Performance notes: `originCountryISO` uses its B-tree index for equals/not/in. `priority` uses its B-tree index for numeric comparisons. Other string columns (`actorCategory`, `motive`, etc.) are case-insensitive and unindexed; current catalog size makes this a non-issue. `endsWith` and `aliasGroupNames` contains/like are leading-wildcard scans and slow on large result sets. `aliasGroupNames` matches on the JSON-encoded text, so substrings can cross alias boundaries ("apt28" also matches "apt280" when both appear in the same tag's alias list). - `field: Literal["value", "categoryId", "actorCategory", 9 more]` Tag mirror field to filter on. Allowed: value, categoryId, actorCategory, aliasGroupNames, attributionConfidence, attributionOrganization, motive, opsecLevel, originCountryISO, sophisticationLevel, priority, analyticPriority. Filters operate against the per-dataset IndicatorTag mirror (which is kept in sync with the Tags SoT by the tag-propagation workflow). - `"value"` - `"categoryId"` - `"actorCategory"` - `"aliasGroupNames"` - `"attributionConfidence"` - `"attributionOrganization"` - `"motive"` - `"opsecLevel"` - `"originCountryISO"` - `"sophisticationLevel"` - `"priority"` - `"analyticPriority"` - `op: Literal["equals", "not", "gt", 9 more]` Search operator. Use 'in' for bulk OR within a single field, e.g. {field:"originCountryISO", op:"in", value:["IR","CN"]}. - `"equals"` - `"not"` - `"gt"` - `"gte"` - `"lt"` - `"lte"` - `"like"` - `"contains"` - `"startsWith"` - `"endsWith"` - `"in"` - `"find"` - `value: Optional[Union[str, float, Sequence[Union[str, float]]]]` Search value. String or number for most operators. Array for 'in' (max 100 items). Country values may be passed as alpha-2, alpha-3, name, or common alias (e.g. "iran", "IR", "IRN") and are normalized to alpha-2 server-side. - `str` - `float` - `Sequence[Union[str, float]]` - `str` - `float` ### Returns - `class IndicatorListResponse: …` - `properties: Properties` - `indicators: PropertiesIndicators` - `items: PropertiesIndicatorsItems` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[PropertiesIndicatorsItemsRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[PropertiesIndicatorsItemsTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `type: str` - `pagination: PropertiesPagination` - `properties: PropertiesPaginationProperties` - `count: PropertiesPaginationPropertiesCount` - `type: str` - `page: PropertiesPaginationPropertiesPage` - `type: str` - `per_page: PropertiesPaginationPropertiesPerPage` - `type: str` - `total_count: PropertiesPaginationPropertiesTotalCount` - `type: str` - `type: str` - `type: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) indicators = client.cloudforce_one.threat_events.indicators.list( account_id="account_id", ) print(indicators.properties) ``` #### Response ```json { "properties": { "indicators": { "items": { "createdAt": "2022-04-01T00:00:00Z", "indicatorType": "domain", "updatedAt": "2022-04-01T00:00:00Z", "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "malicious-domain.com", "datasetId": "dataset-uuid-123", "relatedEvents": [ { "datasetId": "dataset-uuid-123", "eventId": "event-uuid-456" } ], "tags": [ { "categoryName": "categoryName", "uuid": "uuid", "value": "value" } ] }, "type": "array" }, "pagination": { "properties": { "count": { "type": "number" }, "page": { "type": "number" }, "per_page": { "type": "number" }, "total_count": { "type": "number" } }, "type": "object" } }, "type": "object" } ``` ## Domain Types ### Indicator List Response - `class IndicatorListResponse: …` - `properties: Properties` - `indicators: PropertiesIndicators` - `items: PropertiesIndicatorsItems` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[PropertiesIndicatorsItemsRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[PropertiesIndicatorsItemsTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `type: str` - `pagination: PropertiesPagination` - `properties: PropertiesPaginationProperties` - `count: PropertiesPaginationPropertiesCount` - `type: str` - `page: PropertiesPaginationPropertiesPage` - `type: str` - `per_page: PropertiesPaginationPropertiesPerPage` - `type: str` - `total_count: PropertiesPaginationPropertiesTotalCount` - `type: str` - `type: str` - `type: str` # Aggregate ## Aggregate indicators by column(s) `cloudforce_one.threat_events.indicators.aggregate.list(AggregateListParams**kwargs) -> AggregateListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/indicators/aggregate` Aggregate threat indicators by one or more columns (e.g., indicatorType, value) across datasets. Returns top-N groups ordered by count. ### Parameters - `account_id: str` Account ID. - `aggregate_by: str` Column(s) to aggregate by - single column or comma-separated list (e.g., 'indicatorType', 'value', 'indicatorType,value') - `created_after: Optional[str]` Filter indicators created after this date (ISO 8601 format, e.g., '2024-01-01') - `created_before: Optional[str]` Filter indicators created before this date (ISO 8601 format, e.g., '2024-12-31') - `dataset_ids: Optional[Sequence[str]]` Dataset ID(s) to filter by. Can be a single dataset ID or comma-separated list. If not provided, aggregates across all accessible datasets - `event_date_after: Optional[str]` For measure=relationships: only count event links whose eventDate is on/after this date (ISO 8601). Use to bound 'top indicator' to recent activity. - `event_date_before: Optional[str]` For measure=relationships: only count event links whose eventDate is on/before this date (ISO 8601). - `limit: Optional[float]` Maximum number of aggregation results to return (1-100) - `measure: Optional[Literal["indicators", "relationships"]]` What to count per group: 'indicators' (catalog rows, default) or 'relationships' (linked events per indicator). Use 'relationships' for 'top indicator by event activity'. - `"indicators"` - `"relationships"` - `tag_uuid: Optional[str]` Scope to indicators associated with this tag/actor UUID. Combine with measure=relationships for 'top indicator for an actor'. ### Returns - `class AggregateListResponse: …` - `aggregate_by: str` Column(s) that were aggregated by - `aggregations: List[Aggregation]` Array of aggregation results with dynamic fields based on aggregateBy columns - `count: float` Number of indicators for this aggregation - `failed_datasets: float` Number of datasets whose aggregation failed and were excluded from the result - `total: float` Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) aggregates = client.cloudforce_one.threat_events.indicators.aggregate.list( account_id="account_id", aggregate_by="aggregateBy", ) print(aggregates.aggregate_by) ``` #### Response ```json { "aggregateBy": "aggregateBy", "aggregations": [ { "count": 0 } ], "failedDatasets": 0, "total": 0 } ``` ## Domain Types ### Aggregate List Response - `class AggregateListResponse: …` - `aggregate_by: str` Column(s) that were aggregated by - `aggregations: List[Aggregation]` Array of aggregation results with dynamic fields based on aggregateBy columns - `count: float` Number of indicators for this aggregation - `failed_datasets: float` Number of datasets whose aggregation failed and were excluded from the result - `total: float` Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships # Types ## Lists indicator types across multiple datasets `cloudforce_one.threat_events.indicators.types.list(TypeListParams**kwargs) -> TypeListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/indicator-types` List indicator types across one or more datasets for the account. ### Parameters - `account_id: str` Account ID. - `dataset_ids: Optional[Sequence[str]]` Array of dataset IDs to query indicator types from. If not provided, queries all datasets for the account. ### Returns - `class TypeListResponse: …` - `items: Items` - `type: str` - `type: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) types = client.cloudforce_one.threat_events.indicators.types.list( account_id="account_id", ) print(types.items) ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` ## Domain Types ### Type List Response - `class TypeListResponse: …` - `items: Items` - `type: str` - `type: str` # By Dataset ## Lists indicators `cloudforce_one.threat_events.indicators.by_dataset.list(strdataset_id, ByDatasetListParams**kwargs) -> ByDatasetListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators` This method is deprecated. Please use /events/indicators to retrieve a paginated list of indicators. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset UUID. - `indicator_type: Optional[str]` - `name: Optional[str]` Filter by indicator value (substring match) - `page: Optional[float]` - `page_size: Optional[float]` - `related_event: Optional[Sequence[str]]` Filter indicators by related event UUID(s). Multiple UUIDs can be provided by repeating the parameter. ### Returns - `class ByDatasetListResponse: …` - `indicators: List[Indicator]` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[IndicatorRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[IndicatorTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) by_datasets = client.cloudforce_one.threat_events.indicators.by_dataset.list( dataset_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="account_id", ) print(by_datasets.indicators) ``` #### Response ```json { "indicators": [ { "createdAt": "2022-04-01T00:00:00Z", "indicatorType": "domain", "updatedAt": "2022-04-01T00:00:00Z", "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "malicious-domain.com", "datasetId": "dataset-uuid-123", "relatedEvents": [ { "datasetId": "dataset-uuid-123", "eventId": "event-uuid-456" } ], "tags": [ { "categoryName": "categoryName", "uuid": "uuid", "value": "value" } ] } ], "pagination": { "page": 0, "pageSize": 0, "totalCount": 0, "totalPages": 0 } } ``` ## Reads an indicator `cloudforce_one.threat_events.indicators.by_dataset.get(strindicator_id, ByDatasetGetParams**kwargs) -> ByDatasetGetResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}` Retrieves a specific indicator by its UUID. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset ID. - `indicator_id: str` Indicator UUID. ### Returns - `class ByDatasetGetResponse: …` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[RelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[Tag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) by_dataset = client.cloudforce_one.threat_events.indicators.by_dataset.get( indicator_id="indicator_id", account_id="account_id", dataset_id="dataset_id", ) print(by_dataset.uuid) ``` #### Response ```json { "createdAt": "2022-04-01T00:00:00Z", "indicatorType": "domain", "updatedAt": "2022-04-01T00:00:00Z", "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "malicious-domain.com", "datasetId": "dataset-uuid-123", "relatedEvents": [ { "datasetId": "dataset-uuid-123", "eventId": "event-uuid-456" } ], "tags": [ { "categoryName": "categoryName", "uuid": "uuid", "value": "value" } ] } ``` ## Domain Types ### By Dataset List Response - `class ByDatasetListResponse: …` - `indicators: List[Indicator]` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[IndicatorRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[IndicatorTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` ### By Dataset Get Response - `class ByDatasetGetResponse: …` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[RelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[Tag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` # Tags ## List mirrored tags for an indicator dataset `cloudforce_one.threat_events.indicators.by_dataset.tags.list(strdataset_id, TagListParams**kwargs) -> TagListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags` Returns all mirrored tags from the indicator dataset (DO mirror table). No pagination. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset ID. ### Returns - `List[object]` Array of mirror tag rows ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) tags = client.cloudforce_one.threat_events.indicators.by_dataset.tags.list( dataset_id="dataset_id", account_id="account_id", ) print(tags) ``` #### Response ```json [ {} ] ``` ## Domain Types ### Tag List Response - `List[object]` Array of mirror tag rows # Attackers ## Lists attackers across multiple datasets `cloudforce_one.threat_events.attackers.list(AttackerListParams**kwargs) -> AttackerListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/attackers` List attacker names referenced in events across one or more datasets. ### Parameters - `account_id: str` Account ID. - `dataset_ids: Optional[Sequence[str]]` Array of dataset IDs to query attackers from. If not provided, uses the default dataset. ### Returns - `class AttackerListResponse: …` - `items: Items` - `type: str` - `type: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) attackers = client.cloudforce_one.threat_events.attackers.list( account_id="account_id", ) print(attackers.items) ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` ## Domain Types ### Attacker List Response - `class AttackerListResponse: …` - `items: Items` - `type: str` - `type: str` # Categories ## Lists categories across multiple datasets `cloudforce_one.threat_events.categories.list(CategoryListParams**kwargs) -> CategoryListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/categories` List categories across one or more datasets for the account. ### Parameters - `account_id: str` Account ID. - `dataset_ids: Optional[Sequence[str]]` Array of dataset IDs to query categories from. If not provided, uses the default dataset. ### Returns - `List[CategoryListResponseItem]` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) categories = client.cloudforce_one.threat_events.categories.list( account_id="account_id", ) print(categories) ``` #### Response ```json [ { "killChain": 0, "name": "name", "uuid": "12345678-1234-1234-1234-1234567890ab", "mitreAttack": [ "T1234" ], "mitreCapec": [ "123" ], "shortname": "shortname" } ] ``` ## Reads a category `cloudforce_one.threat_events.categories.get(strcategory_id, CategoryGetParams**kwargs) -> CategoryGetResponse` **get** `/accounts/{account_id}/cloudforce-one/events/categories/{category_id}` Retrieve a single category by its identifier. ### Parameters - `account_id: str` Account ID. - `category_id: str` Category UUID. ### Returns - `class CategoryGetResponse: …` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) category = client.cloudforce_one.threat_events.categories.get( category_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="account_id", ) print(category.uuid) ``` #### Response ```json { "killChain": 0, "name": "name", "uuid": "12345678-1234-1234-1234-1234567890ab", "mitreAttack": [ "T1234" ], "mitreCapec": [ "123" ], "shortname": "shortname" } ``` ## Creates a new category `cloudforce_one.threat_events.categories.create(CategoryCreateParams**kwargs) -> CategoryCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/categories/create` Create a new event category for the account. ### Parameters - `account_id: str` Account ID. - `kill_chain: float` - `name: str` - `mitre_attack: Optional[Sequence[str]]` - `mitre_capec: Optional[Sequence[str]]` - `shortname: Optional[str]` ### Returns - `class CategoryCreateResponse: …` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) category = client.cloudforce_one.threat_events.categories.create( account_id="account_id", kill_chain=0, name="name", ) print(category.uuid) ``` #### Response ```json { "killChain": 0, "name": "name", "uuid": "12345678-1234-1234-1234-1234567890ab", "mitreAttack": [ "T1234" ], "mitreCapec": [ "123" ], "shortname": "shortname" } ``` ## Updates a category `cloudforce_one.threat_events.categories.edit(strcategory_id, CategoryEditParams**kwargs) -> CategoryEditResponse` **patch** `/accounts/{account_id}/cloudforce-one/events/categories/{category_id}` Update an existing category by its identifier. ### Parameters - `account_id: str` Account ID. - `category_id: str` Category UUID. - `kill_chain: Optional[float]` - `mitre_attack: Optional[Sequence[str]]` - `mitre_capec: Optional[Sequence[str]]` - `name: Optional[str]` - `shortname: Optional[str]` ### Returns - `class CategoryEditResponse: …` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.categories.edit( category_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="account_id", ) print(response.uuid) ``` #### Response ```json { "killChain": 0, "name": "name", "uuid": "12345678-1234-1234-1234-1234567890ab", "mitreAttack": [ "T1234" ], "mitreCapec": [ "123" ], "shortname": "shortname" } ``` ## Deletes a category `cloudforce_one.threat_events.categories.delete(strcategory_id, CategoryDeleteParams**kwargs) -> CategoryDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/events/categories/{category_id}` Delete a category by its identifier. ### Parameters - `account_id: str` Account ID. - `category_id: str` Category UUID. ### Returns - `class CategoryDeleteResponse: …` - `uuid: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) category = client.cloudforce_one.threat_events.categories.delete( category_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="account_id", ) print(category.uuid) ``` #### Response ```json { "uuid": "12345678-1234-1234-1234-1234567890ab" } ``` ## Domain Types ### Category List Response - `List[CategoryListResponseItem]` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Category Get Response - `class CategoryGetResponse: …` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Category Create Response - `class CategoryCreateResponse: …` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Category Edit Response - `class CategoryEditResponse: …` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Category Delete Response - `class CategoryDeleteResponse: …` - `uuid: str` # Catalog ## Lists categories `cloudforce_one.threat_events.categories.catalog.list(CatalogListParams**kwargs) -> CatalogListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/categories/catalog` List all categories stored in the account catalog. ### Parameters - `account_id: str` Account ID. ### Returns - `List[CatalogListResponseItem]` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) catalogs = client.cloudforce_one.threat_events.categories.catalog.list( account_id="account_id", ) print(catalogs) ``` #### Response ```json [ { "killChain": 0, "name": "name", "uuid": "12345678-1234-1234-1234-1234567890ab", "mitreAttack": [ "T1234" ], "mitreCapec": [ "123" ], "shortname": "shortname" } ] ``` ## Domain Types ### Catalog List Response - `List[CatalogListResponseItem]` - `kill_chain: float` - `name: str` - `uuid: str` - `mitre_attack: Optional[List[str]]` - `mitre_capec: Optional[List[str]]` - `shortname: Optional[str]` # Countries ## Retrieves countries information for all countries `cloudforce_one.threat_events.countries.list(CountryListParams**kwargs) -> CountryListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/countries` Retrieve country code information for all supported countries. ### Parameters - `account_id: str` Account ID. ### Returns - `List[CountryListResponseItem]` - `result: List[CountryListResponseItemResult]` - `alpha2: str` - `alpha3: str` - `name: str` - `success: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) countries = client.cloudforce_one.threat_events.countries.list( account_id="account_id", ) print(countries) ``` #### Response ```json [ { "result": [ { "alpha2": "AF", "alpha3": "AF", "name": "Afghanistan" } ], "success": "true" } ] ``` ## Domain Types ### Country List Response - `List[CountryListResponseItem]` - `result: List[CountryListResponseItemResult]` - `alpha2: str` - `alpha3: str` - `name: str` - `success: str` # Crons # Datasets ## Lists all datasets in an account `cloudforce_one.threat_events.datasets.list(DatasetListParams**kwargs) -> DatasetListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset` List all datasets accessible to the account. ### Parameters - `account_id: str` Account ID. - `include_deleted: Optional[bool]` When true, include soft-deleted datasets in the response. Each item includes a `deletedAt` field (ISO 8601 or null). Default: false. ### Returns - `List[DatasetListResponseItem]` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) datasets = client.cloudforce_one.threat_events.datasets.list( account_id="account_id", ) print(datasets) ``` #### Response ```json [ { "isPublic": true, "name": "friendly dataset name", "uuid": "12345678-1234-1234-1234-1234567890ab", "deletedAt": "deletedAt" } ] ``` ## Reads a dataset `cloudforce_one.threat_events.datasets.get(strdataset_id, DatasetGetParams**kwargs) -> DatasetGetResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}` Retrieve metadata for a specific dataset. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset ID. ### Returns - `class DatasetGetResponse: …` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) dataset = client.cloudforce_one.threat_events.datasets.get( dataset_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="account_id", ) print(dataset.uuid) ``` #### Response ```json { "isPublic": true, "name": "friendly dataset name", "uuid": "12345678-1234-1234-1234-1234567890ab", "deletedAt": "deletedAt" } ``` ## Creates a dataset `cloudforce_one.threat_events.datasets.create(DatasetCreateParams**kwargs) -> DatasetCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/dataset/create` Create a new dataset in the account. ### Parameters - `account_id: str` Account ID. - `is_public: bool` If true, then anyone can search the dataset. If false, then its limited to the account. - `name: str` Used to describe the dataset within the account context. ### Returns - `class DatasetCreateResponse: …` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) dataset = client.cloudforce_one.threat_events.datasets.create( account_id="account_id", is_public=True, name="x", ) print(dataset.uuid) ``` #### Response ```json { "isPublic": true, "name": "friendly dataset name", "uuid": "12345678-1234-1234-1234-1234567890ab", "deletedAt": "deletedAt" } ``` ## Updates an existing dataset `cloudforce_one.threat_events.datasets.edit(strdataset_id, DatasetEditParams**kwargs) -> DatasetEditResponse` **patch** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}` Update an existing dataset by its identifier. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset ID. - `is_public: bool` If true, then anyone can search the dataset. If false, then its limited to the account. - `name: str` Used to describe the dataset within the account context. ### Returns - `class DatasetEditResponse: …` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.datasets.edit( dataset_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="account_id", is_public=True, name="x", ) print(response.uuid) ``` #### Response ```json { "isPublic": true, "name": "friendly dataset name", "uuid": "12345678-1234-1234-1234-1234567890ab", "deletedAt": "deletedAt" } ``` ## Delete a dataset `cloudforce_one.threat_events.datasets.delete(strdataset_id, DatasetDeleteParams**kwargs) -> DatasetDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}` Soft-deletes a dataset given a datasetId. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset ID to delete ### Returns - `class DatasetDeleteResponse: …` - `name: str` - `uuid: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) dataset = client.cloudforce_one.threat_events.datasets.delete( dataset_id="dataset_id", account_id="account_id", ) print(dataset.uuid) ``` #### Response ```json { "name": "friendly dataset name", "uuid": "12345678-1234-1234-1234-1234567890ab" } ``` ## Reads raw data for an event by UUID `cloudforce_one.threat_events.datasets.raw(strevent_id, DatasetRawParams**kwargs) -> DatasetRawResponse` **get** `/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}` Retrieves the raw data associated with an event. Searches across all shards in the dataset. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset ID. - `event_id: str` Event ID. ### Returns - `class DatasetRawResponse: …` - `id: float` - `account_id: float` - `created: str` - `data: str` - `source: str` - `tlp: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.datasets.raw( event_id="event_id", account_id="account_id", dataset_id="dataset_id", ) print(response.id) ``` #### Response ```json { "id": 1, "accountId": 1234, "created": "1970-01-01T00:00:00.000Z", "data": "{\"foo\": \"bar\"}", "source": "https://example.com", "tlp": "amber" } ``` ## Domain Types ### Dataset List Response - `List[DatasetListResponseItem]` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Dataset Get Response - `class DatasetGetResponse: …` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Dataset Create Response - `class DatasetCreateResponse: …` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Dataset Edit Response - `class DatasetEditResponse: …` - `is_public: bool` - `name: str` - `uuid: str` - `deleted_at: Optional[str]` ### Dataset Delete Response - `class DatasetDeleteResponse: …` - `name: str` - `uuid: str` ### Dataset Raw Response - `class DatasetRawResponse: …` - `id: float` - `account_id: float` - `created: str` - `data: str` - `source: str` - `tlp: str` # Health # Events ## Reads an event `cloudforce_one.threat_events.datasets.events.get(strevent_id, EventGetParams**kwargs) -> EventGetResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}` Retrieves a specific event by its UUID. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset ID. - `event_id: str` Event UUID. ### Returns - `class EventGetResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) event = client.cloudforce_one.threat_events.datasets.events.get( event_id="event_id", account_id="account_id", dataset_id="dataset_id", ) print(event.uuid) ``` #### Response ```json { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ``` ## Domain Types ### Event Get Response - `class EventGetResponse: …` - `attacker: str` - `attacker_country: str` - `attacker_country_alpha3: str` - `category: str` - `dataset_id: str` - `date: str` - `event: str` - `has_children: bool` - `indicator: str` - `indicator_type: str` - `indicator_type_id: float` - `kill_chain: float` - `mitre_attack: List[str]` - `mitre_capec: List[str]` - `num_referenced: float` - `num_references: float` - `raw_id: str` - `referenced: List[str]` - `referenced_ids: List[float]` - `references: List[str]` - `references_ids: List[float]` - `tags: List[str]` - `target_country: str` - `target_country_alpha3: str` - `target_industry: str` - `tlp: str` - `uuid: str` - `insight: Optional[str]` - `releasability_id: Optional[str]` # Indicator Types ## Lists all indicator types `cloudforce_one.threat_events.indicator_types.list(IndicatorTypeListParams**kwargs) -> IndicatorTypeListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/indicatorTypes` This Method is deprecated. Please use /events/dataset/:dataset_id/indicatorTypes instead. ### Parameters - `account_id: str` Account ID. ### Returns - `class IndicatorTypeListResponse: …` - `items: Items` - `type: str` - `type: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) indicator_types = client.cloudforce_one.threat_events.indicator_types.list( account_id="account_id", ) print(indicator_types.items) ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` ## Domain Types ### Indicator Type List Response - `class IndicatorTypeListResponse: …` - `items: Items` - `type: str` - `type: str` # Raw ## Reads data for a raw event `cloudforce_one.threat_events.raw.get(strraw_id, RawGetParams**kwargs) -> RawGetResponse` **get** `/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}` Retrieve raw data for a specific event. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. - `raw_id: str` Raw Event UUID. ### Returns - `class RawGetResponse: …` - `id: str` - `account_id: float` - `created: str` - `data: object` - `source: str` - `tlp: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) raw = client.cloudforce_one.threat_events.raw.get( raw_id="raw_id", account_id="account_id", event_id="event_id", ) print(raw.id) ``` #### Response ```json { "id": "1234", "accountId": 1234, "created": "1970-01-01", "data": {}, "source": "https://example.com", "tlp": "amber" } ``` ## Updates a raw event `cloudforce_one.threat_events.raw.edit(strraw_id, RawEditParams**kwargs) -> RawEditResponse` **patch** `/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}` Update raw data for a specific event. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. - `raw_id: str` Raw Event UUID. - `data: Optional[object]` - `source: Optional[str]` - `tlp: Optional[str]` ### Returns - `class RawEditResponse: …` - `id: str` - `data: object` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.raw.edit( raw_id="raw_id", account_id="account_id", event_id="event_id", ) print(response.id) ``` #### Response ```json { "id": "1234", "data": {} } ``` ## Domain Types ### Raw Get Response - `class RawGetResponse: …` - `id: str` - `account_id: float` - `created: str` - `data: object` - `source: str` - `tlp: str` ### Raw Edit Response - `class RawEditResponse: …` - `id: str` - `data: object` # Relate ## Removes an event reference `cloudforce_one.threat_events.relate.delete(strevent_id, RelateDeleteParams**kwargs) -> RelateDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/events/relate/{event_id}` Remove one or more references from an event. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. ### Returns - `class RelateDeleteResponse: …` - `success: bool` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) relate = client.cloudforce_one.threat_events.relate.delete( event_id="event_id", account_id="account_id", ) print(relate.success) ``` #### Response ```json { "result": { "success": true }, "success": true } ``` ## Domain Types ### Relate Delete Response - `class RelateDeleteResponse: …` - `success: bool` # Tags ## Lists all tags (SoT) `cloudforce_one.threat_events.tags.list(TagListParams**kwargs) -> TagListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/tags` Returns all Source-of-Truth tags for an account. Supports legacy free-text `search` on tag value and `categoryUuid` exact match, plus a structured `filters` JSON array for filtering by metadata fields (originCountryISO, actorCategory, motive, priority, etc.). Country values may be passed as alpha-2, alpha-3, name, or common alias. ### Parameters - `account_id: str` Account ID. - `category_uuid: Optional[str]` - `filters: Optional[Iterable[Filter]]` Structured filters as a JSON array of {field, op, value} objects. Searchable fields: uuid, value, actorCategory, actorCategoryConfidence, aliasGroupNames, attributionConfidence, attributionConfidenceScore, attributionOrganization, categoryName, motive, motiveConfidence, opsecLevel, originCountryISO, originCountryConfidence, sophisticationLevel, priority, analyticPriority. Operators: equals, not, contains, startsWith, endsWith, gt, lt, gte, lte, like, in, find. Use 'in' for bulk OR within a single field, e.g. filters=[{"field":"originCountryISO","op":"in","value":["IR","CN"]}]. Multiple entries are AND-joined. Max 10 entries per request, max 100 values per 'in'. Per-field notes: `uuid` accepts only 'equals' and 'in' (other operators throw ValidationError) — matched against the canonical lowercase storage but callers may pass either case (the server lowercases before comparison); index-backed by the column's UNIQUE constraint and intended for batched UUID → tag resolution. `originCountryISO` uses its B-tree index for equals/not/in. `priority` uses its B-tree index for numeric comparisons. Other string columns (`actorCategory`, `motive`, etc.) are case-insensitive and unindexed; current catalog size makes this a non-issue. `endsWith` and `aliasGroupNames` contains/like are leading-wildcard scans and slow on large result sets. `aliasGroupNames` matches on the JSON-encoded text, so substrings can cross alias boundaries (a search for "apt28" will also match "apt280" if both appear in the same tag's alias list). - `field: Literal["uuid", "value", "actorCategory", 14 more]` Tag field to search on. Allowed: uuid, value, actorCategory, actorCategoryConfidence, aliasGroupNames, attributionConfidence, attributionConfidenceScore, attributionOrganization, categoryName, motive, motiveConfidence, opsecLevel, originCountryISO, originCountryConfidence, sophisticationLevel, priority, analyticPriority. - `"uuid"` - `"value"` - `"actorCategory"` - `"actorCategoryConfidence"` - `"aliasGroupNames"` - `"attributionConfidence"` - `"attributionConfidenceScore"` - `"attributionOrganization"` - `"categoryName"` - `"motive"` - `"motiveConfidence"` - `"opsecLevel"` - `"originCountryISO"` - `"originCountryConfidence"` - `"sophisticationLevel"` - `"priority"` - `"analyticPriority"` - `op: Literal["equals", "not", "gt", 9 more]` Search operator. Use 'in' for bulk OR within a single field, e.g. {field:"originCountryISO", op:"in", value:["IR","CN"]}. - `"equals"` - `"not"` - `"gt"` - `"gte"` - `"lt"` - `"lte"` - `"like"` - `"contains"` - `"startsWith"` - `"endsWith"` - `"in"` - `"find"` - `value: Optional[Union[str, float, Sequence[Union[str, float]]]]` Search value. String or number for most operators. Array for 'in' (max 100 items). Country values may be passed as alpha-2, alpha-3, name, or common alias (e.g. 'iran', 'IR', 'IRN') and are normalized to alpha-2 server-side. - `str` - `float` - `Sequence[Union[str, float]]` - `str` - `float` - `page: Optional[float]` - `page_size: Optional[float]` - `search: Optional[str]` Legacy free-text substring match on tag value. ### Returns - `class TagListResponse: …` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` - `tags: List[Tag]` - `uuid: str` - `value: str` - `active_duration: Optional[str]` - `actor_category: Optional[str]` - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[List[TagAlias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[List[str]]` - `alias_group_names_internal: Optional[List[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_name: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` - `external_reference_links: Optional[List[str]]` - `external_references: Optional[List[TagExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[List[TagInternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_iso_alpha3: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) tags = client.cloudforce_one.threat_events.tags.list( account_id="account_id", ) print(tags.pagination) ``` #### Response ```json { "pagination": { "page": 0, "pageSize": 0, "totalCount": 0, "totalPages": 0 }, "tags": [ { "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "APT28", "activeDuration": "activeDuration", "actorCategory": "actorCategory", "actorCategoryConfidence": 7, "aliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "aliasGroupNames": [ "string" ], "aliasGroupNamesInternal": [ "string" ], "analyticPriority": 0, "attributionConfidence": "attributionConfidence", "attributionConfidenceScore": 7, "attributionOrganization": "attributionOrganization", "categoryName": "Nation State", "categoryUuid": "12345678-1234-1234-1234-1234567890ab", "dateOfDiscovery": "2024-01-15", "externalReferenceLinks": [ "string" ], "externalReferences": [ { "url": "https://example.com/report", "description": "Vendor threat report" } ], "internalAliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "internalDescription": "internalDescription", "motive": "motive", "motiveConfidence": 7, "opsecLevel": "opsecLevel", "originCountryConfidence": 7, "originCountryISO": "originCountryISO", "originCountryISOAlpha3": "IRN", "originCountryTlp": "amber", "priority": 0, "sophisticationLevel": "sophisticationLevel" } ] } ``` ## Creates a new tag `cloudforce_one.threat_events.tags.create(TagCreateParams**kwargs) -> TagCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/tags/create` Creates a new tag to be used accross threat events. ### Parameters - `account_id: str` Account ID. - `value: str` - `active_duration: Optional[str]` - `actor_category: Optional[str]` Actor variety. Allowed values: Activist, Competitor, Customer, Crime Syndicate, Former Employee, Nation State, Organized Crime, Nation State Affiliated, Terrorist, Unaffiliated. - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[Iterable[Alias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[Sequence[str]]` - `alias_group_names_internal: Optional[Sequence[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` Date the actor was discovered (ISO YYYY-MM-DD). - `external_reference_links: Optional[Sequence[str]]` - `external_references: Optional[Iterable[ExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[Iterable[InternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` Actor motive. Allowed values: Convenience, Fear, Fun, Financial, Grudge, Ideology, Espionage. - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` ### Returns - `class TagCreateResponse: …` - `uuid: str` - `value: str` - `active_duration: Optional[str]` - `actor_category: Optional[str]` - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[List[Alias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[List[str]]` - `alias_group_names_internal: Optional[List[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_name: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` - `external_reference_links: Optional[List[str]]` - `external_references: Optional[List[ExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[List[InternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_iso_alpha3: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) tag = client.cloudforce_one.threat_events.tags.create( account_id="account_id", value="APT28", ) print(tag.uuid) ``` #### Response ```json { "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "APT28", "activeDuration": "activeDuration", "actorCategory": "actorCategory", "actorCategoryConfidence": 7, "aliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "aliasGroupNames": [ "string" ], "aliasGroupNamesInternal": [ "string" ], "analyticPriority": 0, "attributionConfidence": "attributionConfidence", "attributionConfidenceScore": 7, "attributionOrganization": "attributionOrganization", "categoryName": "Nation State", "categoryUuid": "12345678-1234-1234-1234-1234567890ab", "dateOfDiscovery": "2024-01-15", "externalReferenceLinks": [ "string" ], "externalReferences": [ { "url": "https://example.com/report", "description": "Vendor threat report" } ], "internalAliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "internalDescription": "internalDescription", "motive": "motive", "motiveConfidence": 7, "opsecLevel": "opsecLevel", "originCountryConfidence": 7, "originCountryISO": "originCountryISO", "originCountryISOAlpha3": "IRN", "originCountryTlp": "amber", "priority": 0, "sophisticationLevel": "sophisticationLevel" } ``` ## Updates a tag (SoT) `cloudforce_one.threat_events.tags.edit(strtag_uuid, TagEditParams**kwargs) -> TagEditResponse` **patch** `/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}` Updates a Source-of-Truth tag by UUID. ### Parameters - `account_id: str` Account ID. - `tag_uuid: str` Tag UUID. - `active_duration: Optional[str]` - `actor_category: Optional[str]` Actor variety. Allowed values: Activist, Competitor, Customer, Crime Syndicate, Former Employee, Nation State, Organized Crime, Nation State Affiliated, Terrorist, Unaffiliated. - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[Iterable[Alias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[Sequence[str]]` - `alias_group_names_internal: Optional[Sequence[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` Date the actor was discovered (ISO YYYY-MM-DD). - `external_reference_links: Optional[Sequence[str]]` - `external_references: Optional[Iterable[ExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[Iterable[InternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` Actor motive. Allowed values: Convenience, Fear, Fun, Financial, Grudge, Ideology, Espionage. - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` - `value: Optional[str]` ### Returns - `class TagEditResponse: …` - `uuid: str` - `value: str` - `active_duration: Optional[str]` - `actor_category: Optional[str]` - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[List[Alias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[List[str]]` - `alias_group_names_internal: Optional[List[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_name: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` - `external_reference_links: Optional[List[str]]` - `external_references: Optional[List[ExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[List[InternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_iso_alpha3: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.tags.edit( tag_uuid="tag_uuid", account_id="account_id", ) print(response.uuid) ``` #### Response ```json { "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "APT28", "activeDuration": "activeDuration", "actorCategory": "actorCategory", "actorCategoryConfidence": 7, "aliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "aliasGroupNames": [ "string" ], "aliasGroupNamesInternal": [ "string" ], "analyticPriority": 0, "attributionConfidence": "attributionConfidence", "attributionConfidenceScore": 7, "attributionOrganization": "attributionOrganization", "categoryName": "Nation State", "categoryUuid": "12345678-1234-1234-1234-1234567890ab", "dateOfDiscovery": "2024-01-15", "externalReferenceLinks": [ "string" ], "externalReferences": [ { "url": "https://example.com/report", "description": "Vendor threat report" } ], "internalAliases": [ { "value": "Fancy Bear", "confidence": 8, "tlp": "amber" } ], "internalDescription": "internalDescription", "motive": "motive", "motiveConfidence": 7, "opsecLevel": "opsecLevel", "originCountryConfidence": 7, "originCountryISO": "originCountryISO", "originCountryISOAlpha3": "IRN", "originCountryTlp": "amber", "priority": 0, "sophisticationLevel": "sophisticationLevel" } ``` ## Deletes a tag (SoT) `cloudforce_one.threat_events.tags.delete(strtag_uuid, TagDeleteParams**kwargs) -> TagDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}` Deletes a Source-of-Truth tag by UUID. ### Parameters - `account_id: str` Account ID. - `tag_uuid: str` Tag UUID. ### Returns - `class TagDeleteResponse: …` - `uuid: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) tag = client.cloudforce_one.threat_events.tags.delete( tag_uuid="tag_uuid", account_id="account_id", ) print(tag.uuid) ``` #### Response ```json { "uuid": "12345678-1234-1234-1234-1234567890ab" } ``` ## Domain Types ### Tag List Response - `class TagListResponse: …` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` - `tags: List[Tag]` - `uuid: str` - `value: str` - `active_duration: Optional[str]` - `actor_category: Optional[str]` - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[List[TagAlias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[List[str]]` - `alias_group_names_internal: Optional[List[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_name: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` - `external_reference_links: Optional[List[str]]` - `external_references: Optional[List[TagExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[List[TagInternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_iso_alpha3: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` ### Tag Create Response - `class TagCreateResponse: …` - `uuid: str` - `value: str` - `active_duration: Optional[str]` - `actor_category: Optional[str]` - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[List[Alias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[List[str]]` - `alias_group_names_internal: Optional[List[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_name: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` - `external_reference_links: Optional[List[str]]` - `external_references: Optional[List[ExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[List[InternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_iso_alpha3: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` ### Tag Edit Response - `class TagEditResponse: …` - `uuid: str` - `value: str` - `active_duration: Optional[str]` - `actor_category: Optional[str]` - `actor_category_confidence: Optional[int]` Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts. - `aliases: Optional[List[Alias]]` Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `alias_group_names: Optional[List[str]]` - `alias_group_names_internal: Optional[List[str]]` - `analytic_priority: Optional[float]` - `attribution_confidence: Optional[str]` - `attribution_confidence_score: Optional[int]` - `attribution_organization: Optional[str]` - `category_name: Optional[str]` - `category_uuid: Optional[str]` - `date_of_discovery: Optional[str]` - `external_reference_links: Optional[List[str]]` - `external_references: Optional[List[ExternalReference]]` Structured external references ({ url, description }). Public: returned to all accounts. - `url: str` - `description: Optional[str]` - `internal_aliases: Optional[List[InternalAlias]]` Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts. - `value: str` - `confidence: Optional[int]` - `tlp: Optional[Literal["red", "amber", "green", "white"]]` - `"red"` - `"amber"` - `"green"` - `"white"` - `internal_description: Optional[str]` - `motive: Optional[str]` - `motive_confidence: Optional[int]` Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts. - `opsec_level: Optional[str]` - `origin_country_confidence: Optional[int]` Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `origin_country_iso: Optional[str]` - `origin_country_iso_alpha3: Optional[str]` - `origin_country_tlp: Optional[Literal["red", "amber", "green", "white"]]` TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts. - `"red"` - `"amber"` - `"green"` - `"white"` - `priority: Optional[float]` - `sophistication_level: Optional[str]` ### Tag Delete Response - `class TagDeleteResponse: …` - `uuid: str` # Categories ## Lists all tag categories (SoT) `cloudforce_one.threat_events.tags.categories.list(CategoryListParams**kwargs) -> CategoryListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/tags/categories` Returns all Source-of-Truth tag categories for an account. ### Parameters - `account_id: str` Account ID. - `search: Optional[str]` ### Returns - `class CategoryListResponse: …` - `categories: List[Category]` - `name: str` - `uuid: str` - `created_at: Optional[str]` - `description: Optional[str]` - `updated_at: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) categories = client.cloudforce_one.threat_events.tags.categories.list( account_id="account_id", ) print(categories.categories) ``` #### Response ```json { "categories": [ { "name": "Actor", "uuid": "12345678-1234-1234-1234-1234567890ab", "createdAt": "createdAt", "description": "description", "updatedAt": "updatedAt" } ] } ``` ## Creates a new tag category (SoT) `cloudforce_one.threat_events.tags.categories.create(CategoryCreateParams**kwargs) -> CategoryCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/tags/categories/create` Creates a new Source-of-Truth tag category for an account. ### Parameters - `account_id: str` Account ID. - `name: str` - `description: Optional[str]` ### Returns - `class CategoryCreateResponse: …` - `name: str` - `uuid: str` - `created_at: Optional[str]` - `description: Optional[str]` - `updated_at: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) category = client.cloudforce_one.threat_events.tags.categories.create( account_id="account_id", name="Actor", ) print(category.uuid) ``` #### Response ```json { "name": "Actor", "uuid": "12345678-1234-1234-1234-1234567890ab", "createdAt": "createdAt", "description": "description", "updatedAt": "updatedAt" } ``` ## Updates a tag category (SoT) `cloudforce_one.threat_events.tags.categories.edit(strcategory_uuid, CategoryEditParams**kwargs) -> CategoryEditResponse` **patch** `/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}` Updates a Source-of-Truth tag category by UUID. ### Parameters - `account_id: str` Account ID. - `category_uuid: str` Tag Category UUID. - `description: Optional[str]` - `name: Optional[str]` ### Returns - `class CategoryEditResponse: …` - `name: str` - `uuid: str` - `created_at: Optional[str]` - `description: Optional[str]` - `updated_at: Optional[str]` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) response = client.cloudforce_one.threat_events.tags.categories.edit( category_uuid="category_uuid", account_id="account_id", ) print(response.uuid) ``` #### Response ```json { "name": "Actor", "uuid": "12345678-1234-1234-1234-1234567890ab", "createdAt": "createdAt", "description": "description", "updatedAt": "updatedAt" } ``` ## Deletes a tag category (SoT) `cloudforce_one.threat_events.tags.categories.delete(strcategory_uuid, CategoryDeleteParams**kwargs) -> CategoryDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}` Deletes a Source-of-Truth tag category by UUID. ### Parameters - `account_id: str` Account ID. - `category_uuid: str` Tag Category UUID. ### Returns - `class CategoryDeleteResponse: …` - `uuid: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) category = client.cloudforce_one.threat_events.tags.categories.delete( category_uuid="category_uuid", account_id="account_id", ) print(category.uuid) ``` #### Response ```json { "uuid": "12345678-1234-1234-1234-1234567890ab" } ``` ## Domain Types ### Category List Response - `class CategoryListResponse: …` - `categories: List[Category]` - `name: str` - `uuid: str` - `created_at: Optional[str]` - `description: Optional[str]` - `updated_at: Optional[str]` ### Category Create Response - `class CategoryCreateResponse: …` - `name: str` - `uuid: str` - `created_at: Optional[str]` - `description: Optional[str]` - `updated_at: Optional[str]` ### Category Edit Response - `class CategoryEditResponse: …` - `name: str` - `uuid: str` - `created_at: Optional[str]` - `description: Optional[str]` - `updated_at: Optional[str]` ### Category Delete Response - `class CategoryDeleteResponse: …` - `uuid: str` # Indicators ## List indicators related to a tag `cloudforce_one.threat_events.tags.indicators.list(strtag_uuid, IndicatorListParams**kwargs) -> IndicatorListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators` Returns indicators associated with the provided tag UUID, with pagination. By default fans out across every indicator dataset the account can read; pass datasetIds to scope to specific datasets. ### Parameters - `account_id: str` Account ID. - `tag_uuid: str` Tag UUID. - `dataset_ids: Optional[Sequence[str]]` Dataset UUIDs to scope to (repeat the param for multiple), or 'all' / '*' for every readable indicator dataset. Omit to search all readable datasets. - `indicator_type: Optional[str]` - `page: Optional[float]` - `page_size: Optional[float]` - `related_event: Optional[Sequence[str]]` Filter indicators by related event UUID(s). Multiple UUIDs can be provided by repeating the parameter. - `search: Optional[Iterable[Search]]` Structured search as a JSON array of {field, op, value} objects. Searchable fields: value, indicatorType. Multiple conditions are AND'd together. Max 10 conditions per request. - `field: Literal["value", "indicatorType"]` The indicator field to search on. Allowed: value, indicatorType. - `"value"` - `"indicatorType"` - `op: Literal["equals", "not", "gt", 9 more]` Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'value', op:'in', value:['evil.com','bad.org']}. - `"equals"` - `"not"` - `"gt"` - `"gte"` - `"lt"` - `"lte"` - `"like"` - `"contains"` - `"startsWith"` - `"endsWith"` - `"in"` - `"find"` - `value: Union[str, Sequence[str]]` Search value. String for most operators. Array of strings for 'in' operator (max 100 items). - `str` - `Sequence[str]` ### Returns - `class IndicatorListResponse: …` - `indicators: List[Indicator]` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[IndicatorRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[IndicatorTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) indicators = client.cloudforce_one.threat_events.tags.indicators.list( tag_uuid="tag_uuid", account_id="account_id", ) print(indicators.indicators) ``` #### Response ```json { "indicators": [ { "createdAt": "2022-04-01T00:00:00Z", "indicatorType": "domain", "updatedAt": "2022-04-01T00:00:00Z", "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "malicious-domain.com", "datasetId": "dataset-uuid-123", "relatedEvents": [ { "datasetId": "dataset-uuid-123", "eventId": "event-uuid-456" } ], "tags": [ { "categoryName": "categoryName", "uuid": "uuid", "value": "value" } ] } ], "pagination": { "page": 0, "pageSize": 0, "totalCount": 0, "totalPages": 0 } } ``` ## Domain Types ### Indicator List Response - `class IndicatorListResponse: …` - `indicators: List[Indicator]` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[IndicatorRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[IndicatorTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` # By Dataset ## List indicators related to a tag within a dataset (deprecated) `cloudforce_one.threat_events.tags.indicators.by_dataset.list(strtag_uuid, ByDatasetListParams**kwargs) -> ByDatasetListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators` This endpoint is deprecated. Use GET /:account_id/events/tags/:tag_uuid/indicators with the optional datasetIds query parameter instead. Returns indicators associated with the provided tag UUID within a single dataset's indicator shards, with pagination. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset UUID. - `tag_uuid: str` Tag UUID. - `indicator_type: Optional[str]` - `page: Optional[float]` - `page_size: Optional[float]` - `related_event: Optional[Sequence[str]]` Filter indicators by related event UUID(s). Multiple UUIDs can be provided by repeating the parameter. - `search: Optional[Iterable[Search]]` Structured search as a JSON array of {field, op, value} objects. Searchable fields: value, indicatorType. Multiple conditions are AND'd together. Max 10 conditions per request. - `field: Literal["value", "indicatorType"]` The indicator field to search on. Allowed: value, indicatorType. - `"value"` - `"indicatorType"` - `op: Literal["equals", "not", "gt", 9 more]` Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'value', op:'in', value:['evil.com','bad.org']}. - `"equals"` - `"not"` - `"gt"` - `"gte"` - `"lt"` - `"lte"` - `"like"` - `"contains"` - `"startsWith"` - `"endsWith"` - `"in"` - `"find"` - `value: Union[str, Sequence[str]]` Search value. String for most operators. Array of strings for 'in' operator (max 100 items). - `str` - `Sequence[str]` ### Returns - `class ByDatasetListResponse: …` - `indicators: List[Indicator]` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[IndicatorRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[IndicatorTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) by_datasets = client.cloudforce_one.threat_events.tags.indicators.by_dataset.list( tag_uuid="tag_uuid", account_id="account_id", dataset_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", ) print(by_datasets.indicators) ``` #### Response ```json { "indicators": [ { "createdAt": "2022-04-01T00:00:00Z", "indicatorType": "domain", "updatedAt": "2022-04-01T00:00:00Z", "uuid": "12345678-1234-1234-1234-1234567890ab", "value": "malicious-domain.com", "datasetId": "dataset-uuid-123", "relatedEvents": [ { "datasetId": "dataset-uuid-123", "eventId": "event-uuid-456" } ], "tags": [ { "categoryName": "categoryName", "uuid": "uuid", "value": "value" } ] } ], "pagination": { "page": 0, "pageSize": 0, "totalCount": 0, "totalPages": 0 } } ``` ## Domain Types ### By Dataset List Response - `class ByDatasetListResponse: …` - `indicators: List[Indicator]` - `created_at: datetime` - `indicator_type: str` - `updated_at: datetime` - `uuid: str` - `value: str` - `dataset_id: Optional[str]` The dataset ID this indicator belongs to. Included in list responses. - `related_events: Optional[List[IndicatorRelatedEvent]]` - `dataset_id: str` - `event_id: str` - `tags: Optional[List[IndicatorTag]]` - `category_name: Optional[str]` - `uuid: Optional[str]` - `value: Optional[str]` - `pagination: Pagination` - `page: float` - `page_size: float` - `total_count: float` - `total_pages: float` # Event Tags ## Adds a tag to an event `cloudforce_one.threat_events.event_tags.create(strevent_id, EventTagCreateParams**kwargs) -> EventTagCreateResponse` **post** `/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create` Add one or more tags to an event. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. - `tags: Sequence[str]` ### Returns - `class EventTagCreateResponse: …` - `success: bool` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) event_tag = client.cloudforce_one.threat_events.event_tags.create( event_id="event_id", account_id="account_id", tags=["botnet"], ) print(event_tag.success) ``` #### Response ```json { "result": { "success": true }, "success": true } ``` ## Removes a tag from an event `cloudforce_one.threat_events.event_tags.delete(strevent_id, EventTagDeleteParams**kwargs) -> EventTagDeleteResponse` **delete** `/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}` Remove one or more tags from an event. ### Parameters - `account_id: str` Account ID. - `event_id: str` Event UUID. ### Returns - `class EventTagDeleteResponse: …` - `success: bool` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) event_tag = client.cloudforce_one.threat_events.event_tags.delete( event_id="event_id", account_id="account_id", ) print(event_tag.success) ``` #### Response ```json { "result": { "success": true }, "success": true } ``` ## Domain Types ### Event Tag Create Response - `class EventTagCreateResponse: …` - `success: bool` ### Event Tag Delete Response - `class EventTagDeleteResponse: …` - `success: bool` # Target Industries ## Lists target industries across multiple datasets `cloudforce_one.threat_events.target_industries.list(TargetIndustryListParams**kwargs) -> TargetIndustryListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/targetIndustries` List target industries referenced in events across one or more datasets. ### Parameters - `account_id: str` Account ID. - `dataset_ids: Optional[Sequence[str]]` Array of dataset IDs to query target industries from. If not provided, uses the default dataset. ### Returns - `class TargetIndustryListResponse: …` - `items: Items` - `type: str` - `type: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) target_industries = client.cloudforce_one.threat_events.target_industries.list( account_id="account_id", ) print(target_industries.items) ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` ## Domain Types ### Target Industry List Response - `class TargetIndustryListResponse: …` - `items: Items` - `type: str` - `type: str` # By Dataset ## Lists all target industries for a specific dataset `cloudforce_one.threat_events.target_industries.by_dataset.list(strdataset_id, ByDatasetListParams**kwargs) -> ByDatasetListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries` List all target industries referenced in events for a specific dataset. ### Parameters - `account_id: str` Account ID. - `dataset_id: str` Dataset UUID. ### Returns - `class ByDatasetListResponse: …` - `items: Items` - `type: str` - `type: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) by_datasets = client.cloudforce_one.threat_events.target_industries.by_dataset.list( dataset_id="182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e", account_id="account_id", ) print(by_datasets.items) ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` ## Domain Types ### By Dataset List Response - `class ByDatasetListResponse: …` - `items: Items` - `type: str` - `type: str` # Catalog ## Lists all target industries from industry map catalog `cloudforce_one.threat_events.target_industries.catalog.list(CatalogListParams**kwargs) -> CatalogListResponse` **get** `/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog` List all predefined target industries from the industry map catalog. ### Parameters - `account_id: str` Account ID. ### Returns - `class CatalogListResponse: …` - `items: Items` - `type: str` - `type: str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) catalogs = client.cloudforce_one.threat_events.target_industries.catalog.list( account_id="account_id", ) print(catalogs.items) ``` #### Response ```json { "items": { "type": "string" }, "type": "array" } ``` ## Domain Types ### Catalog List Response - `class CatalogListResponse: …` - `items: Items` - `type: str` - `type: str` # Insights