Skip to content
Cloudflare API
Start here
API Reference

Cloudforce One

Cloudforce OneScans

Cloudforce OneScansResults

Get the Latest Scan Result
client.cloudforceOne.scans.results.get(stringconfigID, ResultGetParams { account_id } params, RequestOptionsoptions?): ResultGetResponse { 1.1.1.1 }
GET/accounts/{account_id}/cloudforce-one/scans/results/{config_id}
ModelsExpand Collapse
ScanResult { number, proto, status }
number?: number
proto?: string
status?: string
ResultGetResponse { 1.1.1.1 }
"1.1.1.1": Array<ScanResult { number, proto, status } >
number?: number
proto?: string
status?: string

Cloudforce OneScansConfig

List Scan Configs
client.cloudforceOne.scans.config.list(ConfigListParams { account_id } params, RequestOptionsoptions?): SinglePage<ConfigListResponse { id, account_id, frequency, 2 more } >
GET/accounts/{account_id}/cloudforce-one/scans/config
Create a new Scan Config
client.cloudforceOne.scans.config.create(ConfigCreateParams { account_id, ips, frequency, ports } params, RequestOptionsoptions?): ConfigCreateResponse { id, account_id, frequency, 2 more }
POST/accounts/{account_id}/cloudforce-one/scans/config
Update an existing Scan Config
client.cloudforceOne.scans.config.edit(stringconfigID, ConfigEditParams { account_id, frequency, ips, ports } params, RequestOptionsoptions?): ConfigEditResponse { id, account_id, frequency, 2 more }
PATCH/accounts/{account_id}/cloudforce-one/scans/config/{config_id}
Delete a Scan Config
client.cloudforceOne.scans.config.delete(stringconfigID, ConfigDeleteParams { account_id } params, RequestOptionsoptions?): ConfigDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/scans/config/{config_id}
ModelsExpand Collapse
ConfigListResponse { id, account_id, frequency, 2 more }
id: string

Defines the Config ID.

account_id: string
frequency: number

Defines the number of days between each scan (0 = One-off scan).

ips: Array<string>

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: Array<string>

Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. [“1-80”, “443”]). “default” scans the 100 most commonly open ports.

ConfigCreateResponse { id, account_id, frequency, 2 more }
id: string

Defines the Config ID.

account_id: string
frequency: number

Defines the number of days between each scan (0 = One-off scan).

ips: Array<string>

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: Array<string>

Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. [“1-80”, “443”]). “default” scans the 100 most commonly open ports.

ConfigEditResponse { id, account_id, frequency, 2 more }
id: string

Defines the Config ID.

account_id: string
frequency: number

Defines the number of days between each scan (0 = One-off scan).

ips: Array<string>

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: Array<string>

Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. [“1-80”, “443”]). “default” scans the 100 most commonly open ports.

ConfigDeleteResponse = unknown

Cloudforce OneBinary Storage

Retrieves a file from Binary Storage
client.cloudforceOne.binaryStorage.get(stringhash, BinaryStorageGetParams { account_id } params, RequestOptionsoptions?): void
GET/accounts/{account_id}/cloudforce-one/binary/{hash}
Posts a file to Binary Storage
client.cloudforceOne.binaryStorage.create(BinaryStorageCreateParams { account_id, file } params, RequestOptionsoptions?): BinaryStorageCreateResponse { content_type, md5, sha1, sha256 }
POST/accounts/{account_id}/cloudforce-one/binary
ModelsExpand Collapse
BinaryStorageCreateResponse { content_type, md5, sha1, sha256 }
content_type: string
md5: string
sha1: string
sha256: string

Cloudforce OneRequests

List Requests
client.cloudforceOne.requests.list(RequestListParams { account_id, page, per_page, 8 more } params, RequestOptionsoptions?): SinglePage<ListItem { id, created, priority, 9 more } >
POST/accounts/{account_id}/cloudforce-one/requests
Get a Request
client.cloudforceOne.requests.get(stringrequestID, RequestGetParams { account_id } params, RequestOptionsoptions?): Item { id, content, created, 10 more }
GET/accounts/{account_id}/cloudforce-one/requests/{request_id}
Create a New Request.
client.cloudforceOne.requests.create(RequestCreateParams { account_id, content, priority, 3 more } params, RequestOptionsoptions?): Item { id, content, created, 10 more }
POST/accounts/{account_id}/cloudforce-one/requests/new
Update a Request
client.cloudforceOne.requests.update(stringrequestID, RequestUpdateParams { account_id, content, priority, 3 more } params, RequestOptionsoptions?): Item { id, content, created, 10 more }
PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}
Delete a Request
client.cloudforceOne.requests.delete(stringrequestID, RequestDeleteParams { account_id } params, RequestOptionsoptions?): RequestDeleteResponse { errors, messages, success }
DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}
Get Request Quota
client.cloudforceOne.requests.quota(RequestQuotaParams { account_id } params, RequestOptionsoptions?): Quota { anniversary_date, quarter_anniversary_date, quota, remaining }
GET/accounts/{account_id}/cloudforce-one/requests/quota
Get Request Types
client.cloudforceOne.requests.types(RequestTypesParams { account_id } params, RequestOptionsoptions?): SinglePage<RequestTypesResponse>
GET/accounts/{account_id}/cloudforce-one/requests/types
Get Request Priority, Status, and TLP constants
client.cloudforceOne.requests.constants(RequestConstantsParams { account_id } params, RequestOptionsoptions?): RequestConstants { priority, status, tlp }
GET/accounts/{account_id}/cloudforce-one/requests/constants
ModelsExpand Collapse
Item { id, content, created, 10 more }
id: string

UUID.

maxLength36
content: string

Request content.

created: string
formatdate-time
priority: string
formatdate-time
request: string

Requested information from request.

summary: string

Brief description of the request.

tlp: "clear" | "amber" | "amber-strict" | 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:
"clear"
"amber"
"amber-strict"
"green"
"red"
updated: string
formatdate-time
completed?: string
formatdate-time
message_tokens?: number

Tokens for the request messages.

readable_id?: string

Readable Request ID.

status?: "open" | "accepted" | "reported" | 3 more

Request Status.

One of the following:
"open"
"accepted"
"reported"
"approved"
"completed"
"declined"
tokens?: number

Tokens for the request.

ListItem { id, created, priority, 9 more }
id: string

UUID.

maxLength36
created: string

Request creation time.

formatdate-time
priority: "routine" | "high" | "urgent"
One of the following:
"routine"
"high"
"urgent"
request: string

Requested information from request.

summary: string

Brief description of the request.

tlp: "clear" | "amber" | "amber-strict" | 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:
"clear"
"amber"
"amber-strict"
"green"
"red"
updated: string

Request last updated time.

formatdate-time
completed?: string

Request completion time.

formatdate-time
message_tokens?: number

Tokens for the request messages.

readable_id?: string

Readable Request ID.

status?: "open" | "accepted" | "reported" | 3 more

Request Status.

One of the following:
"open"
"accepted"
"reported"
"approved"
"completed"
"declined"
tokens?: number

Tokens for the request.

Quota { anniversary_date, quarter_anniversary_date, quota, remaining }
anniversary_date?: string

Anniversary date is when annual quota limit is refreshed.

formatdate-time
quarter_anniversary_date?: string

Quarter anniversary date is when quota limit is refreshed each quarter.

formatdate-time
quota?: number

Tokens for the quarter.

remaining?: number

Tokens remaining for the quarter.

RequestConstants { priority, status, tlp }
priority?: Array<"routine" | "high" | "urgent">
One of the following:
"routine"
"high"
"urgent"
status?: Array<"open" | "accepted" | "reported" | 3 more>
One of the following:
"open"
"accepted"
"reported"
"approved"
"completed"
"declined"
tlp?: Array<"clear" | "amber" | "amber-strict" | 2 more>
One of the following:
"clear"
"amber"
"amber-strict"
"green"
"red"
RequestTypes = Array<RequestTypesResponse>
RequestDeleteResponse { errors, messages, success }
errors: Array<Error>
code: number
minimum1000
message: string
documentation_url?: string
source?: Source { pointer }
pointer?: string
messages: Array<Message>
code: number
minimum1000
message: string
documentation_url?: string
source?: Source { pointer }
pointer?: string
success: true

Whether the API call was successful.

RequestTypesResponse = string

Request Types.

Cloudforce OneRequestsMessage

List Request Messages
client.cloudforceOne.requests.message.get(stringrequestID, MessageGetParams { account_id, page, per_page, 4 more } params, RequestOptionsoptions?): SinglePage<Message { id, author, content, 3 more } >
POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/message
Create a New Request Message
client.cloudforceOne.requests.message.create(stringrequestID, MessageCreateParams { account_id, content } params, RequestOptionsoptions?): Message { id, author, content, 3 more }
POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/new
Update a Request Message
client.cloudforceOne.requests.message.update(numbermessageID, MessageUpdateParams { account_id, request_id, content } params, RequestOptionsoptions?): Message { id, author, content, 3 more }
PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}
Delete a Request Message
client.cloudforceOne.requests.message.delete(numbermessageID, MessageDeleteParams { account_id, request_id } params, RequestOptionsoptions?): MessageDeleteResponse { errors, messages, success }
DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}
ModelsExpand Collapse
Message { id, author, content, 3 more }
id: number

Message ID.

author: string

Author of message.

content: string

Content of message.

is_follow_on_request: boolean

Whether the message is a follow-on request.

updated: string

Defines the message last updated time.

formatdate-time
created?: string

Defines the message creation time.

formatdate-time
MessageDeleteResponse { errors, messages, success }
errors: Array<Error>
code: number
minimum1000
message: string
documentation_url?: string
source?: Source { pointer }
pointer?: string
messages: Array<Message>
code: number
minimum1000
message: string
documentation_url?: string
source?: Source { pointer }
pointer?: string
success: true

Whether the API call was successful.

Cloudforce OneRequestsPriority

Get a Priority Intelligence Requirement
client.cloudforceOne.requests.priority.get(stringpriorityID, PriorityGetParams { account_id } params, RequestOptionsoptions?): Item { id, content, created, 10 more }
GET/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}
Create a New Priority Intelligence Requirement
client.cloudforceOne.requests.priority.create(PriorityCreateParams { account_id, labels, priority, 2 more } params, RequestOptionsoptions?): Priority { id, created, labels, 4 more }
POST/accounts/{account_id}/cloudforce-one/requests/priority/new
Update a Priority Intelligence Requirement
client.cloudforceOne.requests.priority.update(stringpriorityID, PriorityUpdateParams { account_id, labels, priority, 2 more } params, RequestOptionsoptions?): Item { id, content, created, 10 more }
PUT/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}
Delete a Priority Intelligence Requirement
client.cloudforceOne.requests.priority.delete(stringpriorityID, PriorityDeleteParams { account_id } params, RequestOptionsoptions?): PriorityDeleteResponse { errors, messages, success }
DELETE/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}
Get Priority Intelligence Requirement Quota
client.cloudforceOne.requests.priority.quota(PriorityQuotaParams { account_id } params, RequestOptionsoptions?): Quota { anniversary_date, quarter_anniversary_date, quota, remaining }
GET/accounts/{account_id}/cloudforce-one/requests/priority/quota
ModelsExpand Collapse
Label = string
Priority { id, created, labels, 4 more }
id: string

UUID.

maxLength36
created: string

Priority creation time.

formatdate-time
labels: Array<Label>

List of labels.

priority: number

Priority.

requirement: string

Requirement.

tlp: "clear" | "amber" | "amber-strict" | 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:
"clear"
"amber"
"amber-strict"
"green"
"red"
updated: string

Priority last updated time.

formatdate-time
PriorityEdit { labels, priority, requirement, tlp }
labels: Array<Label>

List of labels.

priority: number

Priority.

requirement: string

Requirement.

tlp: "clear" | "amber" | "amber-strict" | 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:
"clear"
"amber"
"amber-strict"
"green"
"red"
PriorityDeleteResponse { errors, messages, success }
errors: Array<Error>
code: number
minimum1000
message: string
documentation_url?: string
source?: Source { pointer }
pointer?: string
messages: Array<Message>
code: number
minimum1000
message: string
documentation_url?: string
source?: Source { pointer }
pointer?: string
success: true

Whether the API call was successful.

Cloudforce OneRequestsAssets

Get a Request Asset
client.cloudforceOne.requests.assets.get(stringassetID, AssetGetParams { account_id, request_id } params, RequestOptionsoptions?): SinglePage<AssetGetResponse { id, name, created, 2 more } >
GET/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}
List Request Assets
client.cloudforceOne.requests.assets.create(stringrequestID, AssetCreateParams { account_id, page, per_page } params, RequestOptionsoptions?): SinglePage<AssetCreateResponse { id, name, created, 2 more } >
POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset
Update a Request Asset
client.cloudforceOne.requests.assets.update(stringassetID, AssetUpdateParams { account_id, request_id, source } params, RequestOptionsoptions?): AssetUpdateResponse { id, name, created, 2 more }
PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}
Delete a Request Asset
client.cloudforceOne.requests.assets.delete(stringassetID, AssetDeleteParams { account_id, request_id } params, RequestOptionsoptions?): AssetDeleteResponse { errors, messages, success }
DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}
ModelsExpand Collapse
AssetGetResponse { id, name, created, 2 more }
id: number

Asset ID.

name: string

Asset name.

created?: string

Defines the asset creation time.

formatdate-time
description?: string

Asset description.

file_type?: string

Asset file type.

AssetCreateResponse { id, name, created, 2 more }
id: number

Asset ID.

name: string

Asset name.

created?: string

Defines the asset creation time.

formatdate-time
description?: string

Asset description.

file_type?: string

Asset file type.

AssetUpdateResponse { id, name, created, 2 more }
id: number

Asset ID.

name: string

Asset name.

created?: string

Defines the asset creation time.

formatdate-time
description?: string

Asset description.

file_type?: string

Asset file type.

AssetDeleteResponse { errors, messages, success }
errors: Array<Error>
code: number
minimum1000
message: string
documentation_url?: string
source?: Source { pointer }
pointer?: string
messages: Array<Message>
code: number
minimum1000
message: string
documentation_url?: string
source?: Source { pointer }
pointer?: string
success: true

Whether the API call was successful.

Cloudforce OneThreat Events

Filter and list events
client.cloudforceOne.threatEvents.list(ThreatEventListParams { account_id, cursor, datasetId, 8 more } params, RequestOptionsoptions?): ThreatEventListResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }
GET/accounts/{account_id}/cloudforce-one/events
Reads an event
Deprecated
client.cloudforceOne.threatEvents.get(stringeventID, ThreatEventGetParams { account_id } params, RequestOptionsoptions?): ThreatEventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }
GET/accounts/{account_id}/cloudforce-one/events/{event_id}
Creates a new event
client.cloudforceOne.threatEvents.create(ThreatEventCreateParams { account_id, category, date, 14 more } params, RequestOptionsoptions?): ThreatEventCreateResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }
POST/accounts/{account_id}/cloudforce-one/events/create
Updates an event
client.cloudforceOne.threatEvents.edit(stringeventID, ThreatEventEditParams { account_id, datasetId, attacker, 12 more } params, RequestOptionsoptions?): ThreatEventEditResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }
PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}
Creates bulk events
client.cloudforceOne.threatEvents.bulkCreate(ThreatEventBulkCreateParams { account_id, data, datasetId, includeCreatedEvents } params, RequestOptionsoptions?): ThreatEventBulkCreateResponse { createdEventsCount, createdTagsCount, errorCount, 4 more }
POST/accounts/{account_id}/cloudforce-one/events/create/bulk
Creates bulk DOS event with relationships and indicators
Deprecated
client.cloudforceOne.threatEvents.bulkCreateRelationships(ThreatEventBulkCreateRelationshipsParams { account_id, data, datasetId } params, RequestOptionsoptions?): ThreatEventBulkCreateRelationshipsResponse { createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more }
POST/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships
ModelsExpand Collapse
ThreatEventListResponse = Array<ThreatEventListResponseItem>
attacker: string
attackerCountry: string
attackerCountryAlpha3: string
category: string
datasetId: string
date: string
event: string
hasChildren: boolean
indicator: string
indicatorType: string
indicatorTypeId: number
killChain: number
mitreAttack: Array<string>
mitreCapec: Array<string>
numReferenced: number
numReferences: number
rawId: string
referenced: Array<string>
referencedIds: Array<number>
references: Array<string>
referencesIds: Array<number>
tags: Array<string>
targetCountry: string
targetCountryAlpha3: string
targetIndustry: string
tlp: string
uuid: string
insight?: string
releasabilityId?: string
ThreatEventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }
attacker: string
attackerCountry: string
attackerCountryAlpha3: string
category: string
datasetId: string
date: string
event: string
hasChildren: boolean
indicator: string
indicatorType: string
indicatorTypeId: number
killChain: number
mitreAttack: Array<string>
mitreCapec: Array<string>
numReferenced: number
numReferences: number
rawId: string
referenced: Array<string>
referencedIds: Array<number>
references: Array<string>
referencesIds: Array<number>
tags: Array<string>
targetCountry: string
targetCountryAlpha3: string
targetIndustry: string
tlp: string
uuid: string
insight?: string
releasabilityId?: string
ThreatEventCreateResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }
attacker: string
attackerCountry: string
attackerCountryAlpha3: string
category: string
datasetId: string
date: string
event: string
hasChildren: boolean
indicator: string
indicatorType: string
indicatorTypeId: number
killChain: number
mitreAttack: Array<string>
mitreCapec: Array<string>
numReferenced: number
numReferences: number
rawId: string
referenced: Array<string>
referencedIds: Array<number>
references: Array<string>
referencesIds: Array<number>
tags: Array<string>
targetCountry: string
targetCountryAlpha3: string
targetIndustry: string
tlp: string
uuid: string
insight?: string
releasabilityId?: string
ThreatEventEditResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }
attacker: string
attackerCountry: string
attackerCountryAlpha3: string
category: string
datasetId: string
date: string
event: string
hasChildren: boolean
indicator: string
indicatorType: string
indicatorTypeId: number
killChain: number
mitreAttack: Array<string>
mitreCapec: Array<string>
numReferenced: number
numReferences: number
rawId: string
referenced: Array<string>
referencedIds: Array<number>
references: Array<string>
referencesIds: Array<number>
tags: Array<string>
targetCountry: string
targetCountryAlpha3: string
targetIndustry: string
tlp: string
uuid: string
insight?: string
releasabilityId?: string
ThreatEventBulkCreateResponse { createdEventsCount, createdTagsCount, errorCount, 4 more }

Detailed result of bulk event creation with auto-tag management

createdEventsCount: number

Number of events created

createdTagsCount: number

Number of new tags created in SoT

errorCount: number

Number of errors encountered

queuedIndicatorsCount: number

Number of indicators queued for async processing

createBulkEventsRequestId?: string

Correlation ID for async indicator processing

formatuuid
createdEvents?: Array<CreatedEvent>

Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true

eventIndex: number

Original index in the input data array

shardId: string

Dataset ID of the shard where the event was created

uuid: string

UUID of the created event

formatuuid
errors?: Array<Error>

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

ThreatEventBulkCreateRelationshipsResponse { createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more }

Result of bulk relationship creation operation

createdEventsCount: number

Number of events created

createdIndicatorsCount: number

Number of indicators created

createdRelationshipsCount: number

Number of relationships created

errorCount: number

Number of errors encountered

errors?: Array<Error>

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

Cloudforce OneThreat EventsAggregate

Aggregate events by single or multiple columns with optional date filtering
client.cloudforceOne.threatEvents.aggregate.list(AggregateListParams { account_id, aggregateBy, datasetId, 4 more } params, RequestOptionsoptions?): AggregateListResponse { aggregateBy, aggregations, total, dateRange }
GET/accounts/{account_id}/cloudforce-one/events/aggregate
ModelsExpand Collapse
AggregateListResponse { aggregateBy, aggregations, total, dateRange }
aggregateBy: string

Column(s) that were aggregated by

aggregations: Array<Aggregation>

Array of aggregation results with dynamic fields based on aggregateBy columns

count: number

Number of events for this aggregation

date?: string

Date (if groupByDate is true)

total: number

Total number of events in the aggregation

dateRange?: DateRange { endDate, startDate }

Date range used for filtering

endDate?: string
startDate?: string

Cloudforce OneThreat EventsGraphql

GraphQL endpoint for event aggregation
client.cloudforceOne.threatEvents.graphql.create(GraphqlCreateParams { account_id } params, RequestOptionsoptions?): GraphqlCreateResponse { data, errors }
POST/accounts/{account_id}/cloudforce-one/events/graphql
ModelsExpand Collapse
GraphqlCreateResponse { data, errors }
data?: unknown
errors?: Array<unknown> | null

Cloudforce OneThreat EventsGraph

Query graph neighborhood from R2 Data Catalog
client.cloudforceOne.threatEvents.graph.list(GraphListParams { account_id, cursor, datasetIds, 7 more } params, RequestOptionsoptions?): GraphListResponse { edges, node, nodes }
GET/accounts/{account_id}/cloudforce-one/events/graph
ModelsExpand Collapse
GraphListResponse { edges, node, nodes }
edges: Array<Edge>
id: string

Deterministic composite edge id (source→target:relationshipType)

relationshipType: string
source: string

Compact id of the source node (type:uuid)

sourceId: string
sourceType: string
target: string

Compact id of the target node (type:uuid)

targetId: string
targetType: string
node: Record<string, unknown> | null

Focal node object (legacy single-seed). Null when unavailable.

nodes: Array<Record<string, unknown>>

Cloudforce OneThreat EventsQueries

List all saved event queries
client.cloudforceOne.threatEvents.queries.list(QueryListParams { account_id } params, RequestOptionsoptions?): QueryListResponse { id, account_id, alert_enabled, 10 more }
GET/accounts/{account_id}/cloudforce-one/events/queries
Create a saved event query
client.cloudforceOne.threatEvents.queries.create(QueryCreateParams { account_id, alert_enabled, alert_rollup_enabled, 4 more } params, RequestOptionsoptions?): QueryCreateResponse { id, account_id, alert_enabled, 10 more }
POST/accounts/{account_id}/cloudforce-one/events/queries/create
Read a saved event query
client.cloudforceOne.threatEvents.queries.get(numberqueryID, QueryGetParams { account_id } params, RequestOptionsoptions?): QueryGetResponse { id, account_id, alert_enabled, 10 more }
GET/accounts/{account_id}/cloudforce-one/events/queries/{query_id}
Update a saved event query
client.cloudforceOne.threatEvents.queries.edit(numberqueryID, QueryEditParams { account_id, alert_enabled, alert_rollup_enabled, 4 more } params, RequestOptionsoptions?): QueryEditResponse { id, account_id, alert_enabled, 10 more }
PATCH/accounts/{account_id}/cloudforce-one/events/queries/{query_id}
Delete a saved event query
client.cloudforceOne.threatEvents.queries.delete(numberqueryID, QueryDeleteParams { account_id } params, RequestOptionsoptions?): void
DELETE/accounts/{account_id}/cloudforce-one/events/queries/{query_id}
ModelsExpand Collapse
QueryListResponse = Array<QueryListResponseItem>
id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

QueryCreateResponse { id, account_id, alert_enabled, 10 more }
id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

QueryGetResponse { id, account_id, alert_enabled, 10 more }
id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

QueryEditResponse { id, account_id, alert_enabled, 10 more }
id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

Cloudforce OneThreat EventsRelationships

Filter and list events related to specific event
client.cloudforceOne.threatEvents.relationships.list(stringeventID, RelationshipListParams { account_id, datasetId, direction, 6 more } params, RequestOptionsoptions?): RelationshipListResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }
GET/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships
ModelsExpand Collapse
RelationshipListResponse = Array<RelationshipListResponseItem>
attacker: string
attackerCountry: string
attackerCountryAlpha3: string
category: string
datasetId: string
date: string
event: string
hasChildren: boolean
indicator: string
indicatorType: string
indicatorTypeId: number
killChain: number
mitreAttack: Array<string>
mitreCapec: Array<string>
numReferenced: number
numReferences: number
rawId: string
referenced: Array<string>
referencedIds: Array<number>
references: Array<string>
referencesIds: Array<number>
tags: Array<string>
targetCountry: string
targetCountryAlpha3: string
targetIndustry: string
tlp: string
uuid: string
insight?: string
releasabilityId?: string

Cloudforce OneThreat EventsIndicators

Lists indicators across multiple datasets
client.cloudforceOne.threatEvents.indicators.list(IndicatorListParams { account_id, createdAfter, createdBefore, 14 more } params, RequestOptionsoptions?): IndicatorListResponse { properties, type }
GET/accounts/{account_id}/cloudforce-one/events/indicators
ModelsExpand Collapse
IndicatorListResponse { properties, type }
properties: Properties { indicators, pagination }
indicators: Indicators { items, type }
items: Items { createdAt, indicatorType, updatedAt, 5 more }
createdAt: string
formatdate-time
indicatorType: string
updatedAt: string
formatdate-time
uuid: string
value: string
datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>
datasetId: string
eventId: string
tags?: Array<Tag>
categoryName?: string
uuid?: string
value?: string
type: string
type: string

Cloudforce OneThreat EventsIndicatorsAggregate

Aggregate indicators by column(s)
client.cloudforceOne.threatEvents.indicators.aggregate.list(AggregateListParams { account_id, aggregateBy, createdAfter, 7 more } params, RequestOptionsoptions?): AggregateListResponse { aggregateBy, aggregations, failedDatasets, total }
GET/accounts/{account_id}/cloudforce-one/events/indicators/aggregate
ModelsExpand Collapse
AggregateListResponse { aggregateBy, aggregations, failedDatasets, total }
aggregateBy: string

Column(s) that were aggregated by

aggregations: Array<Aggregation>

Array of aggregation results with dynamic fields based on aggregateBy columns

count: number

Number of indicators for this aggregation

failedDatasets: number

Number of datasets whose aggregation failed and were excluded from the result

total: number

Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships

Cloudforce OneThreat EventsIndicatorsTypes

Lists indicator types across multiple datasets
client.cloudforceOne.threatEvents.indicators.types.list(TypeListParams { account_id, datasetIds } params, RequestOptionsoptions?): TypeListResponse { items, type }
GET/accounts/{account_id}/cloudforce-one/events/indicator-types
ModelsExpand Collapse
TypeListResponse { items, type }
items: Items { type }
type: string
type: string

Cloudforce OneThreat EventsIndicatorsBy Dataset

Lists indicators
Deprecated
client.cloudforceOne.threatEvents.indicators.byDataset.list(stringdatasetID, ByDatasetListParams { account_id, indicatorType, name, 3 more } params, RequestOptionsoptions?): ByDatasetListResponse { indicators, pagination }
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators
Reads an indicator
client.cloudforceOne.threatEvents.indicators.byDataset.get(stringindicatorID, ByDatasetGetParams { account_id, dataset_id } params, RequestOptionsoptions?): ByDatasetGetResponse { createdAt, indicatorType, updatedAt, 5 more }
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}
ModelsExpand Collapse
ByDatasetListResponse { indicators, pagination }
indicators: Array<Indicator>
createdAt: string
formatdate-time
indicatorType: string
updatedAt: string
formatdate-time
uuid: string
value: string
datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>
datasetId: string
eventId: string
tags?: Array<Tag>
categoryName?: string
uuid?: string
value?: string
ByDatasetGetResponse { createdAt, indicatorType, updatedAt, 5 more }
createdAt: string
formatdate-time
indicatorType: string
updatedAt: string
formatdate-time
uuid: string
value: string
datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>
datasetId: string
eventId: string
tags?: Array<Tag>
categoryName?: string
uuid?: string
value?: string

Cloudforce OneThreat EventsIndicatorsBy DatasetTags

List mirrored tags for an indicator dataset
client.cloudforceOne.threatEvents.indicators.byDataset.tags.list(stringdatasetID, TagListParams { account_id } params, RequestOptionsoptions?): TagListResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags
ModelsExpand Collapse
TagListResponse = Array<unknown>

Array of mirror tag rows

Cloudforce OneThreat EventsAttackers

Lists attackers across multiple datasets
client.cloudforceOne.threatEvents.attackers.list(AttackerListParams { account_id, datasetIds } params, RequestOptionsoptions?): AttackerListResponse { items, type }
GET/accounts/{account_id}/cloudforce-one/events/attackers
ModelsExpand Collapse
AttackerListResponse { items, type }
items: Items { type }
type: string
type: string

Cloudforce OneThreat EventsCategories

Lists categories across multiple datasets
client.cloudforceOne.threatEvents.categories.list(CategoryListParams { account_id, datasetIds } params, RequestOptionsoptions?): CategoryListResponse { killChain, name, uuid, 3 more }
GET/accounts/{account_id}/cloudforce-one/events/categories
Reads a category
client.cloudforceOne.threatEvents.categories.get(stringcategoryID, CategoryGetParams { account_id } params, RequestOptionsoptions?): CategoryGetResponse { killChain, name, uuid, 3 more }
GET/accounts/{account_id}/cloudforce-one/events/categories/{category_id}
Creates a new category
client.cloudforceOne.threatEvents.categories.create(CategoryCreateParams { account_id, killChain, name, 3 more } params, RequestOptionsoptions?): CategoryCreateResponse { killChain, name, uuid, 3 more }
POST/accounts/{account_id}/cloudforce-one/events/categories/create
Updates a category
client.cloudforceOne.threatEvents.categories.edit(stringcategoryID, CategoryEditParams { account_id, killChain, mitreAttack, 3 more } params, RequestOptionsoptions?): CategoryEditResponse { killChain, name, uuid, 3 more }
PATCH/accounts/{account_id}/cloudforce-one/events/categories/{category_id}
Deletes a category
client.cloudforceOne.threatEvents.categories.delete(stringcategoryID, CategoryDeleteParams { account_id } params, RequestOptionsoptions?): CategoryDeleteResponse { uuid }
DELETE/accounts/{account_id}/cloudforce-one/events/categories/{category_id}
ModelsExpand Collapse
CategoryListResponse = Array<CategoryListResponseItem>
killChain: number
name: string
uuid: string
mitreAttack?: Array<string>
mitreCapec?: Array<string>
shortname?: string
CategoryGetResponse { killChain, name, uuid, 3 more }
killChain: number
name: string
uuid: string
mitreAttack?: Array<string>
mitreCapec?: Array<string>
shortname?: string
CategoryCreateResponse { killChain, name, uuid, 3 more }
killChain: number
name: string
uuid: string
mitreAttack?: Array<string>
mitreCapec?: Array<string>
shortname?: string
CategoryEditResponse { killChain, name, uuid, 3 more }
killChain: number
name: string
uuid: string
mitreAttack?: Array<string>
mitreCapec?: Array<string>
shortname?: string
CategoryDeleteResponse { uuid }
uuid: string

Cloudforce OneThreat EventsCategoriesCatalog

Lists categories
client.cloudforceOne.threatEvents.categories.catalog.list(CatalogListParams { account_id } params, RequestOptionsoptions?): CatalogListResponse { killChain, name, uuid, 3 more }
GET/accounts/{account_id}/cloudforce-one/events/categories/catalog
ModelsExpand Collapse
CatalogListResponse = Array<CatalogListResponseItem>
killChain: number
name: string
uuid: string
mitreAttack?: Array<string>
mitreCapec?: Array<string>
shortname?: string

Cloudforce OneThreat EventsCountries

Retrieves countries information for all countries
client.cloudforceOne.threatEvents.countries.list(CountryListParams { account_id } params, RequestOptionsoptions?): CountryListResponse { result, success }
GET/accounts/{account_id}/cloudforce-one/events/countries
ModelsExpand Collapse
CountryListResponse = Array<CountryListResponseItem>
result: Array<Result>
alpha2: string
alpha3: string
name: string
success: string

Cloudforce OneThreat EventsCrons

Cloudforce OneThreat EventsDatasets

Lists all datasets in an account
client.cloudforceOne.threatEvents.datasets.list(DatasetListParams { account_id, includeDeleted } params, RequestOptionsoptions?): DatasetListResponse { isPublic, name, uuid, deletedAt }
GET/accounts/{account_id}/cloudforce-one/events/dataset
Reads a dataset
client.cloudforceOne.threatEvents.datasets.get(stringdatasetID, DatasetGetParams { account_id } params, RequestOptionsoptions?): DatasetGetResponse { isPublic, name, uuid, deletedAt }
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}
Creates a dataset
client.cloudforceOne.threatEvents.datasets.create(DatasetCreateParams { account_id, isPublic, name } params, RequestOptionsoptions?): DatasetCreateResponse { isPublic, name, uuid, deletedAt }
POST/accounts/{account_id}/cloudforce-one/events/dataset/create
Updates an existing dataset
client.cloudforceOne.threatEvents.datasets.edit(stringdatasetID, DatasetEditParams { account_id, isPublic, name } params, RequestOptionsoptions?): DatasetEditResponse { isPublic, name, uuid, deletedAt }
PATCH/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}
Delete a dataset
client.cloudforceOne.threatEvents.datasets.delete(stringdatasetID, DatasetDeleteParams { account_id } params, RequestOptionsoptions?): DatasetDeleteResponse { name, uuid }
DELETE/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}
Reads raw data for an event by UUID
client.cloudforceOne.threatEvents.datasets.raw(stringeventID, DatasetRawParams { account_id, dataset_id } params, RequestOptionsoptions?): DatasetRawResponse { id, accountId, created, 3 more }
GET/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}
ModelsExpand Collapse
DatasetListResponse = Array<DatasetListResponseItem>
isPublic: boolean
name: string
uuid: string
deletedAt?: string
DatasetGetResponse { isPublic, name, uuid, deletedAt }
isPublic: boolean
name: string
uuid: string
deletedAt?: string
DatasetCreateResponse { isPublic, name, uuid, deletedAt }
isPublic: boolean
name: string
uuid: string
deletedAt?: string
DatasetEditResponse { isPublic, name, uuid, deletedAt }
isPublic: boolean
name: string
uuid: string
deletedAt?: string
DatasetDeleteResponse { name, uuid }
name: string
uuid: string
DatasetRawResponse { id, accountId, created, 3 more }
id: number
accountId: number
created: string
data: string
source: string
tlp: string

Cloudforce OneThreat EventsDatasetsHealth

Cloudforce OneThreat EventsDatasetsEvents

Reads an event
client.cloudforceOne.threatEvents.datasets.events.get(stringeventID, EventGetParams { account_id, dataset_id } params, RequestOptionsoptions?): EventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}
ModelsExpand Collapse
EventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }
attacker: string
attackerCountry: string
attackerCountryAlpha3: string
category: string
datasetId: string
date: string
event: string
hasChildren: boolean
indicator: string
indicatorType: string
indicatorTypeId: number
killChain: number
mitreAttack: Array<string>
mitreCapec: Array<string>
numReferenced: number
numReferences: number
rawId: string
referenced: Array<string>
referencedIds: Array<number>
references: Array<string>
referencesIds: Array<number>
tags: Array<string>
targetCountry: string
targetCountryAlpha3: string
targetIndustry: string
tlp: string
uuid: string
insight?: string
releasabilityId?: string

Cloudforce OneThreat EventsIndicator Types

Lists all indicator types
Deprecated
client.cloudforceOne.threatEvents.indicatorTypes.list(IndicatorTypeListParams { account_id } params, RequestOptionsoptions?): IndicatorTypeListResponse { items, type }
GET/accounts/{account_id}/cloudforce-one/events/indicatorTypes
ModelsExpand Collapse
IndicatorTypeListResponse { items, type }
items: Items { type }
type: string
type: string

Cloudforce OneThreat EventsRaw

Reads data for a raw event
client.cloudforceOne.threatEvents.raw.get(stringrawID, RawGetParams { account_id, event_id } params, RequestOptionsoptions?): RawGetResponse { id, accountId, created, 3 more }
GET/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}
Updates a raw event
client.cloudforceOne.threatEvents.raw.edit(stringrawID, RawEditParams { account_id, event_id, data, 2 more } params, RequestOptionsoptions?): RawEditResponse { id, data }
PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}
ModelsExpand Collapse
RawGetResponse { id, accountId, created, 3 more }
id: string
accountId: number
created: string
data: unknown
source: string
tlp: string
RawEditResponse { id, data }
id: string
data: unknown

Cloudforce OneThreat EventsRelate

Removes an event reference
client.cloudforceOne.threatEvents.relate.delete(stringeventID, RelateDeleteParams { account_id } params, RequestOptionsoptions?): RelateDeleteResponse { success }
DELETE/accounts/{account_id}/cloudforce-one/events/relate/{event_id}
ModelsExpand Collapse
RelateDeleteResponse { success }
success: boolean

Cloudforce OneThreat EventsTags

Lists all tags (SoT)
client.cloudforceOne.threatEvents.tags.list(TagListParams { account_id, categoryUuid, filters, 3 more } params, RequestOptionsoptions?): TagListResponse { pagination, tags }
GET/accounts/{account_id}/cloudforce-one/events/tags
Creates a new tag
client.cloudforceOne.threatEvents.tags.create(TagCreateParams { account_id, value, activeDuration, 23 more } params, RequestOptionsoptions?): TagCreateResponse { uuid, value, activeDuration, 25 more }
POST/accounts/{account_id}/cloudforce-one/events/tags/create
Updates a tag (SoT)
client.cloudforceOne.threatEvents.tags.edit(stringtagUUID, TagEditParams { account_id, activeDuration, actorCategory, 23 more } params, RequestOptionsoptions?): TagEditResponse { uuid, value, activeDuration, 25 more }
PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}
Deletes a tag (SoT)
client.cloudforceOne.threatEvents.tags.delete(stringtagUUID, TagDeleteParams { account_id } params, RequestOptionsoptions?): TagDeleteResponse { uuid }
DELETE/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}
ModelsExpand Collapse
TagListResponse { pagination, tags }
tags: Array<Tag>
uuid: string
value: string
activeDuration?: string
actorCategory?: string
actorCategoryConfidence?: number

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "green" | "white" | null
One of the following:
"red"
"amber"
"green"
"white"
aliasGroupNames?: Array<string>
aliasGroupNamesInternal?: Array<string>
analyticPriority?: number
attributionConfidence?: string
attributionConfidenceScore?: number
maximum10
minimum1
attributionOrganization?: string
categoryName?: string
categoryUuid?: string
dateOfDiscovery?: string
externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string
description?: string | null
internalAliases?: Array<InternalAlias>

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "green" | "white" | null
One of the following:
"red"
"amber"
"green"
"white"
internalDescription?: string
motive?: string
motiveConfidence?: number

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
opsecLevel?: string
originCountryConfidence?: number

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
originCountryISO?: string
originCountryISOAlpha3?: string
originCountryTlp?: "red" | "amber" | "green" | "white"

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:
"red"
"amber"
"green"
"white"
priority?: number
sophisticationLevel?: string
TagCreateResponse { uuid, value, activeDuration, 25 more }
uuid: string
value: string
activeDuration?: string
actorCategory?: string
actorCategoryConfidence?: number

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "green" | "white" | null
One of the following:
"red"
"amber"
"green"
"white"
aliasGroupNames?: Array<string>
aliasGroupNamesInternal?: Array<string>
analyticPriority?: number
attributionConfidence?: string
attributionConfidenceScore?: number
maximum10
minimum1
attributionOrganization?: string
categoryName?: string
categoryUuid?: string
dateOfDiscovery?: string
externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string
description?: string | null
internalAliases?: Array<InternalAlias>

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "green" | "white" | null
One of the following:
"red"
"amber"
"green"
"white"
internalDescription?: string
motive?: string
motiveConfidence?: number

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
opsecLevel?: string
originCountryConfidence?: number

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
originCountryISO?: string
originCountryISOAlpha3?: string
originCountryTlp?: "red" | "amber" | "green" | "white"

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:
"red"
"amber"
"green"
"white"
priority?: number
sophisticationLevel?: string
TagEditResponse { uuid, value, activeDuration, 25 more }
uuid: string
value: string
activeDuration?: string
actorCategory?: string
actorCategoryConfidence?: number

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "green" | "white" | null
One of the following:
"red"
"amber"
"green"
"white"
aliasGroupNames?: Array<string>
aliasGroupNamesInternal?: Array<string>
analyticPriority?: number
attributionConfidence?: string
attributionConfidenceScore?: number
maximum10
minimum1
attributionOrganization?: string
categoryName?: string
categoryUuid?: string
dateOfDiscovery?: string
externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string
description?: string | null
internalAliases?: Array<InternalAlias>

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "green" | "white" | null
One of the following:
"red"
"amber"
"green"
"white"
internalDescription?: string
motive?: string
motiveConfidence?: number

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
opsecLevel?: string
originCountryConfidence?: number

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10
minimum1
originCountryISO?: string
originCountryISOAlpha3?: string
originCountryTlp?: "red" | "amber" | "green" | "white"

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:
"red"
"amber"
"green"
"white"
priority?: number
sophisticationLevel?: string
TagDeleteResponse { uuid }
uuid: string

Cloudforce OneThreat EventsTagsCategories

Lists all tag categories (SoT)
client.cloudforceOne.threatEvents.tags.categories.list(CategoryListParams { account_id, search } params, RequestOptionsoptions?): CategoryListResponse { categories }
GET/accounts/{account_id}/cloudforce-one/events/tags/categories
Creates a new tag category (SoT)
client.cloudforceOne.threatEvents.tags.categories.create(CategoryCreateParams { account_id, name, description } params, RequestOptionsoptions?): CategoryCreateResponse { name, uuid, createdAt, 2 more }
POST/accounts/{account_id}/cloudforce-one/events/tags/categories/create
Updates a tag category (SoT)
client.cloudforceOne.threatEvents.tags.categories.edit(stringcategoryUUID, CategoryEditParams { account_id, description, name } params, RequestOptionsoptions?): CategoryEditResponse { name, uuid, createdAt, 2 more }
PATCH/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}
Deletes a tag category (SoT)
client.cloudforceOne.threatEvents.tags.categories.delete(stringcategoryUUID, CategoryDeleteParams { account_id } params, RequestOptionsoptions?): CategoryDeleteResponse { uuid }
DELETE/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}
ModelsExpand Collapse
CategoryListResponse { categories }
categories: Array<Category>
name: string
uuid: string
createdAt?: string
description?: string
updatedAt?: string
CategoryCreateResponse { name, uuid, createdAt, 2 more }
name: string
uuid: string
createdAt?: string
description?: string
updatedAt?: string
CategoryEditResponse { name, uuid, createdAt, 2 more }
name: string
uuid: string
createdAt?: string
description?: string
updatedAt?: string
CategoryDeleteResponse { uuid }
uuid: string

Cloudforce OneThreat EventsTagsIndicators

List indicators related to a tag
client.cloudforceOne.threatEvents.tags.indicators.list(stringtagUUID, IndicatorListParams { account_id, datasetIds, indicatorType, 4 more } params, RequestOptionsoptions?): IndicatorListResponse { indicators, pagination }
GET/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators
ModelsExpand Collapse
IndicatorListResponse { indicators, pagination }
indicators: Array<Indicator>
createdAt: string
formatdate-time
indicatorType: string
updatedAt: string
formatdate-time
uuid: string
value: string
datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>
datasetId: string
eventId: string
tags?: Array<Tag>
categoryName?: string
uuid?: string
value?: string

Cloudforce OneThreat EventsTagsIndicatorsBy Dataset

List indicators related to a tag within a dataset (deprecated)
Deprecated
client.cloudforceOne.threatEvents.tags.indicators.byDataset.list(stringtagUUID, ByDatasetListParams { account_id, dataset_id, indicatorType, 4 more } params, RequestOptionsoptions?): ByDatasetListResponse { indicators, pagination }
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators
ModelsExpand Collapse
ByDatasetListResponse { indicators, pagination }
indicators: Array<Indicator>
createdAt: string
formatdate-time
indicatorType: string
updatedAt: string
formatdate-time
uuid: string
value: string
datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>
datasetId: string
eventId: string
tags?: Array<Tag>
categoryName?: string
uuid?: string
value?: string

Cloudforce OneThreat EventsEvent Tags

Adds a tag to an event
client.cloudforceOne.threatEvents.eventTags.create(stringeventID, EventTagCreateParams { account_id, tags } params, RequestOptionsoptions?): EventTagCreateResponse { success }
POST/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create
Removes a tag from an event
client.cloudforceOne.threatEvents.eventTags.delete(stringeventID, EventTagDeleteParams { account_id } params, RequestOptionsoptions?): EventTagDeleteResponse { success }
DELETE/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}
ModelsExpand Collapse
EventTagCreateResponse { success }
success: boolean
EventTagDeleteResponse { success }
success: boolean

Cloudforce OneThreat EventsTarget Industries

Lists target industries across multiple datasets
client.cloudforceOne.threatEvents.targetIndustries.list(TargetIndustryListParams { account_id, datasetIds } params, RequestOptionsoptions?): TargetIndustryListResponse { items, type }
GET/accounts/{account_id}/cloudforce-one/events/targetIndustries
ModelsExpand Collapse
TargetIndustryListResponse { items, type }
items: Items { type }
type: string
type: string

Cloudforce OneThreat EventsTarget IndustriesBy Dataset

Lists all target industries for a specific dataset
client.cloudforceOne.threatEvents.targetIndustries.byDataset.list(stringdatasetID, ByDatasetListParams { account_id } params, RequestOptionsoptions?): ByDatasetListResponse { items, type }
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries
ModelsExpand Collapse
ByDatasetListResponse { items, type }
items: Items { type }
type: string
type: string

Cloudforce OneThreat EventsTarget IndustriesCatalog

Lists all target industries from industry map catalog
client.cloudforceOne.threatEvents.targetIndustries.catalog.list(CatalogListParams { account_id } params, RequestOptionsoptions?): CatalogListResponse { items, type }
GET/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog
ModelsExpand Collapse
CatalogListResponse { items, type }
items: Items { type }
type: string
type: string

Cloudforce OneThreat EventsInsights