--- title: Creates a new event --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/go) [Cloudforce One](https://developers.cloudflare.com/api/go/resources/cloudforce_one) [Threat Events](https://developers.cloudflare.com/api/go/resources/cloudforce_one/subresources/threat_events) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Creates a new event client.CloudforceOne.ThreatEvents.New(ctx, params) (\*[ThreatEventNewResponse](), error) POST/accounts/{account\_id}/cloudforce-one/events/create To create a dataset, see the [`Create Dataset`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create/) endpoint. When `datasetId` parameter is unspecified, it will be created in a default dataset named `Cloudforce One Threat Events`. ##### Security API Token The preferred authorization scheme for interacting with the Cloudflare API. [Create a token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). **Example:**`Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY` ##### Accepted Permissions (at least one required) `Cloudforce One Write``Cloudforce One Read` ##### ParametersExpand Collapse
params ThreatEventNewParams PathAccountID param.Field\[string] Path param: Account ID. Link to this property Category param.Field\[string] Body param Link to this property Date param.Field\[Time] Body param formatdate-time Link to this property Event param.Field\[string] Body param Link to this property
Raw param.Field\[ThreatEventNewParamsRaw] Body param Data map\[string, unknown] Link to this property Source stringOptional Link to this property TLP stringOptional Link to this property
Link to this property TLP param.Field\[string] Body param Link to this property BodyAccountID param.Field\[float64]Optional Body param Link to this property Attacker param.Field\[string]Optional Body param Link to this property AttackerCountry param.Field\[string]Optional Body param Link to this property DatasetID param.Field\[string]Optional Body param Link to this property Indicator param.Field\[string]Optional Body param Link to this property
Indicators param.Field\[\[]ThreatEventNewParamsIndicator]Optional Body param: Array of indicators for this event. Supports multiple indicators per event for complex scenarios. IndicatorType string The type of indicator (e.g., DOMAIN, IP, JA3, HASH) Link to this property Value string The indicator value (e.g., domain name, IP address, hash) Link to this property
Link to this property IndicatorType param.Field\[string]Optional Body param Link to this property Insight param.Field\[string]Optional Body param Link to this property
Source param.Field\[ThreatEventNewParamsSource]Optional Body param: Controlled provenance for an event and its indicators derived from a Threat Signals article. ResourceID string formatuuid Link to this property ResourceType ThreatEventNewParamsSourceResourceType Link to this property System ThreatEventNewParamsSourceSystem Link to this property Title stringOptional Threat Signals article title; null for historical provenance without a stored title. Link to this property
Link to this property Tags param.Field\[\[]string]Optional Body param Link to this property TargetCountry param.Field\[string]Optional Body param Link to this property TargetIndustry param.Field\[string]Optional Body param Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default>) ##### ReturnsExpand Collapse
type ThreatEventNewResponse struct{…} Attacker string Link to this property AttackerCountry string Link to this property AttackerCountryAlpha3 string Link to this property Category string Link to this property DatasetID string Link to this property Date string Link to this property Event string Link to this property HasChildren bool Link to this property Indicator string Link to this property IndicatorType string Link to this property IndicatorTypeID float64 Link to this property KillChain float64 Link to this property MitreAttack \[]string Link to this property MitreCapec \[]string Link to this property NumReferenced float64 Link to this property NumReferences float64 Link to this property RawID string Link to this property Referenced \[]string Link to this property ReferencedIDs \[]float64 Link to this property References \[]string Link to this property ReferencesIDs \[]float64 Link to this property Tags \[]string Link to this property TargetCountry string Link to this property TargetCountryAlpha3 string Link to this property TargetIndustry string Link to this property TLP string Link to this property UUID string Link to this property Insight stringOptional Link to this property ReleasabilityID stringOptional Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20ThreatEventNewResponse%20%3E%20(schema)>) ### Creates a new event Go HTTPTypeScriptPythonGoTerraform ``` package main import ( "context" "fmt" "time" "github.com/cloudflare/cloudflare-go" "github.com/cloudflare/cloudflare-go/cloudforce_one" "github.com/cloudflare/cloudflare-go/option" ) func main() { client := cloudflare.NewClient( option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"), ) threatEvent, err := client.CloudforceOne.ThreatEvents.New(context.TODO(), cloudforce_one.ThreatEventNewParams{ PathAccountID: cloudflare.F("account_id"), Category: cloudflare.F("Domain Resolution"), Date: cloudflare.F(time.Now()), Event: cloudflare.F("An attacker registered the domain domain.com"), Raw: cloudflare.F(cloudforce_one.ThreatEventNewParamsRaw{ Data: cloudflare.F(map[string]interface{}{ "foo": "bar", }), }), TLP: cloudflare.F("amber"), }) if err != nil { panic(err.Error()) } fmt.Printf("%+v\n", threatEvent.UUID) } ``` 200 example ``` { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ``` ##### Returns Examples 200 example ``` { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ```