--- title: Threat Events --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [Cloudforce One](https://developers.cloudflare.com/api/python/resources/cloudforce_one) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Threat Events ##### [Filter and list events](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/methods/list) cloudforce\_one.threat\_events.list(ThreatEventListParams\*\*kwargs) -> [ThreatEventListResponse]() GET/accounts/{account\_id}/cloudforce-one/events ##### [Reads an event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/methods/get) Deprecated cloudforce\_one.threat\_events.get(strevent\_id, ThreatEventGetParams\*\*kwargs) -> [ThreatEventGetResponse]() GET/accounts/{account\_id}/cloudforce-one/events/{event\_id} ##### [Creates a new event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/methods/create) cloudforce\_one.threat\_events.create(ThreatEventCreateParams\*\*kwargs) -> [ThreatEventCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/create ##### [Updates an event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/methods/edit) cloudforce\_one.threat\_events.edit(strevent\_id, ThreatEventEditParams\*\*kwargs) -> [ThreatEventEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/events/{event\_id} ##### [Creates bulk events](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/methods/bulk_create) cloudforce\_one.threat\_events.bulk\_create(ThreatEventBulkCreateParams\*\*kwargs) -> [ThreatEventBulkCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/create/bulk ##### [Creates bulk DOS event with relationships and indicators](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/methods/bulk_create_relationships) Deprecated cloudforce\_one.threat\_events.bulk\_create\_relationships(ThreatEventBulkCreateRelationshipsParams\*\*kwargs) -> [ThreatEventBulkCreateRelationshipsResponse]() POST/accounts/{account\_id}/cloudforce-one/events/create/bulk/relationships ##### ModelsExpand Collapse
List\[ThreatEventListResponseItem] attacker: str Link to this property attacker\_country: str Link to this property attacker\_country\_alpha3: str Link to this property category: str Link to this property dataset\_id: str Link to this property date: str Link to this property event: str Link to this property has\_children: bool Link to this property indicator: str Link to this property indicator\_type: str Link to this property indicator\_type\_id: float Link to this property kill\_chain: float Link to this property mitre\_attack: List\[str] Link to this property mitre\_capec: List\[str] Link to this property num\_referenced: float Link to this property num\_references: float Link to this property raw\_id: str Link to this property referenced: List\[str] Link to this property referenced\_ids: List\[float] Link to this property references: List\[str] Link to this property references\_ids: List\[float] Link to this property tags: List\[str] Link to this property target\_country: str Link to this property target\_country\_alpha3: str Link to this property target\_industry: str Link to this property tlp: str Link to this property uuid: str Link to this property insight: Optional\[str] Link to this property releasability\_id: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_list_response%20%3E%20(schema)>)
class ThreatEventGetResponse: … attacker: str Link to this property attacker\_country: str Link to this property attacker\_country\_alpha3: str Link to this property category: str Link to this property dataset\_id: str Link to this property date: str Link to this property event: str Link to this property has\_children: bool Link to this property indicator: str Link to this property indicator\_type: str Link to this property indicator\_type\_id: float Link to this property kill\_chain: float Link to this property mitre\_attack: List\[str] Link to this property mitre\_capec: List\[str] Link to this property num\_referenced: float Link to this property num\_references: float Link to this property raw\_id: str Link to this property referenced: List\[str] Link to this property referenced\_ids: List\[float] Link to this property references: List\[str] Link to this property references\_ids: List\[float] Link to this property tags: List\[str] Link to this property target\_country: str Link to this property target\_country\_alpha3: str Link to this property target\_industry: str Link to this property tlp: str Link to this property uuid: str Link to this property insight: Optional\[str] Link to this property releasability\_id: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_get_response%20%3E%20(schema)>)
class ThreatEventCreateResponse: … attacker: str Link to this property attacker\_country: str Link to this property attacker\_country\_alpha3: str Link to this property category: str Link to this property dataset\_id: str Link to this property date: str Link to this property event: str Link to this property has\_children: bool Link to this property indicator: str Link to this property indicator\_type: str Link to this property indicator\_type\_id: float Link to this property kill\_chain: float Link to this property mitre\_attack: List\[str] Link to this property mitre\_capec: List\[str] Link to this property num\_referenced: float Link to this property num\_references: float Link to this property raw\_id: str Link to this property referenced: List\[str] Link to this property referenced\_ids: List\[float] Link to this property references: List\[str] Link to this property references\_ids: List\[float] Link to this property tags: List\[str] Link to this property target\_country: str Link to this property target\_country\_alpha3: str Link to this property target\_industry: str Link to this property tlp: str Link to this property uuid: str Link to this property insight: Optional\[str] Link to this property releasability\_id: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_create_response%20%3E%20(schema)>)
class ThreatEventEditResponse: … attacker: str Link to this property attacker\_country: str Link to this property attacker\_country\_alpha3: str Link to this property category: str Link to this property dataset\_id: str Link to this property date: str Link to this property event: str Link to this property has\_children: bool Link to this property indicator: str Link to this property indicator\_type: str Link to this property indicator\_type\_id: float Link to this property kill\_chain: float Link to this property mitre\_attack: List\[str] Link to this property mitre\_capec: List\[str] Link to this property num\_referenced: float Link to this property num\_references: float Link to this property raw\_id: str Link to this property referenced: List\[str] Link to this property referenced\_ids: List\[float] Link to this property references: List\[str] Link to this property references\_ids: List\[float] Link to this property tags: List\[str] Link to this property target\_country: str Link to this property target\_country\_alpha3: str Link to this property target\_industry: str Link to this property tlp: str Link to this property uuid: str Link to this property insight: Optional\[str] Link to this property releasability\_id: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_edit_response%20%3E%20(schema)>)
class ThreatEventBulkCreateResponse: … Detailed result of bulk event creation with auto-tag management created\_events\_count: float Number of events created Link to this property created\_tags\_count: float Number of new tags created in SoT Link to this property error\_count: float Number of errors encountered Link to this property queued\_indicators\_count: float Number of indicators queued for async processing Link to this property create\_bulk\_events\_request\_id: Optional\[str] Correlation ID for async indicator processing formatuuid Link to this property
created\_events: Optional\[List\[CreatedEvent]] Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true event\_index: float Original index in the input data array Link to this property shard\_id: str Dataset ID of the shard where the event was created Link to this property uuid: str UUID of the created event formatuuid Link to this property
Link to this property
errors: Optional\[List\[Error]] Array of error details error: str Error message Link to this property event\_index: float Index of the event that caused the error Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_response%20%3E%20(schema)>)
class ThreatEventBulkCreateRelationshipsResponse: … Result of bulk relationship creation operation created\_events\_count: float Number of events created Link to this property created\_indicators\_count: float Number of indicators created Link to this property created\_relationships\_count: float Number of relationships created Link to this property error\_count: float Number of errors encountered Link to this property
errors: Optional\[List\[Error]] Array of error details error: str Error message Link to this property event\_index: float Index of the event that caused the error Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_relationships_response%20%3E%20(schema)>) #### Threat EventsAggregate ##### [Aggregate events by single or multiple columns with optional date filtering](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/aggregate/methods/list) cloudforce\_one.threat\_events.aggregate.list(AggregateListParams\*\*kwargs) -> [AggregateListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/aggregate ##### ModelsExpand Collapse
class AggregateListResponse: … aggregate\_by: str Column(s) that were aggregated by Link to this property
aggregations: List\[Aggregation] Array of aggregation results with dynamic fields based on aggregateBy columns count: float Number of events for this aggregation Link to this property date: Optional\[str] Date (if groupByDate is true) Link to this property
Link to this property total: float Total number of events in the aggregation Link to this property
date\_range: Optional\[DateRange] Date range used for filtering end\_date: Optional\[str] Link to this property start\_date: Optional\[str] Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.aggregate%20%3E%20(model)%20aggregate_list_response%20%3E%20(schema)>) #### Threat EventsGraphql ##### [GraphQL endpoint for event aggregation](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/graphql/methods/create) cloudforce\_one.threat\_events.graphql.create(GraphqlCreateParams\*\*kwargs) -> [GraphqlCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/graphql ##### ModelsExpand Collapse
class GraphqlCreateResponse: … data: Optional\[object] Link to this property errors: Optional\[List\[object]] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.graphql%20%3E%20(model)%20graphql_create_response%20%3E%20(schema)>) #### Threat EventsGraph ##### [Query graph neighborhood from R2 Data Catalog](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/graph/methods/list) cloudforce\_one.threat\_events.graph.list(GraphListParams\*\*kwargs) -> [GraphListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/graph ##### ModelsExpand Collapse
class GraphListResponse: …
edges: List\[Edge] id: str Deterministic composite edge id (source→target:relationshipType) Link to this property relationship\_type: str Link to this property source: str Compact id of the source node (type:uuid) Link to this property source\_id: str Link to this property source\_type: str Link to this property target: str Compact id of the target node (type:uuid) Link to this property target\_id: str Link to this property target\_type: str Link to this property
Link to this property node: Optional\[Dict\[str, object]] Focal node object (legacy single-seed). Null when unavailable. Link to this property nodes: List\[Dict\[str, object]] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.graph%20%3E%20(model)%20graph_list_response%20%3E%20(schema)>) #### Threat EventsQueries ##### [List all saved event queries](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/list) cloudforce\_one.threat\_events.queries.list(QueryListParams\*\*kwargs) -> [QueryListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/queries ##### [Create a saved event query](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/create) cloudforce\_one.threat\_events.queries.create(QueryCreateParams\*\*kwargs) -> [QueryCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/queries/create ##### [Read a saved event query](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/get) cloudforce\_one.threat\_events.queries.get(intquery\_id, QueryGetParams\*\*kwargs) -> [QueryGetResponse]() GET/accounts/{account\_id}/cloudforce-one/events/queries/{query\_id} ##### [Update a saved event query](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/edit) cloudforce\_one.threat\_events.queries.edit(intquery\_id, QueryEditParams\*\*kwargs) -> [QueryEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/events/queries/{query\_id} ##### [Delete a saved event query](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/delete) cloudforce\_one.threat\_events.queries.delete(intquery\_id, QueryDeleteParams\*\*kwargs) DELETE/accounts/{account\_id}/cloudforce-one/events/queries/{query\_id} ##### ModelsExpand Collapse
List\[QueryListResponseItem] id: int Unique identifier for the saved query Link to this property account\_id: int Account ID Link to this property alert\_enabled: bool Whether alerts are enabled Link to this property alert\_rollup\_enabled: bool Whether alert rollup is enabled Link to this property created\_at: str Creation timestamp Link to this property name: str Name of the saved query Link to this property query\_json: str JSON string containing the query parameters Link to this property rule\_enabled: bool Whether rule is enabled Link to this property updated\_at: str Last update timestamp Link to this property user\_email: str Email of the user who created the query Link to this property custom\_threat\_feed\_id: Optional\[int] Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id: Optional\[str] WAF rules list ID for blocking Link to this property rule\_scope: Optional\[str] Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_list_response%20%3E%20(schema)>)
class QueryCreateResponse: … id: int Unique identifier for the saved query Link to this property account\_id: int Account ID Link to this property alert\_enabled: bool Whether alerts are enabled Link to this property alert\_rollup\_enabled: bool Whether alert rollup is enabled Link to this property created\_at: str Creation timestamp Link to this property name: str Name of the saved query Link to this property query\_json: str JSON string containing the query parameters Link to this property rule\_enabled: bool Whether rule is enabled Link to this property updated\_at: str Last update timestamp Link to this property user\_email: str Email of the user who created the query Link to this property custom\_threat\_feed\_id: Optional\[int] Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id: Optional\[str] WAF rules list ID for blocking Link to this property rule\_scope: Optional\[str] Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_create_response%20%3E%20(schema)>)
class QueryGetResponse: … id: int Unique identifier for the saved query Link to this property account\_id: int Account ID Link to this property alert\_enabled: bool Whether alerts are enabled Link to this property alert\_rollup\_enabled: bool Whether alert rollup is enabled Link to this property created\_at: str Creation timestamp Link to this property name: str Name of the saved query Link to this property query\_json: str JSON string containing the query parameters Link to this property rule\_enabled: bool Whether rule is enabled Link to this property updated\_at: str Last update timestamp Link to this property user\_email: str Email of the user who created the query Link to this property custom\_threat\_feed\_id: Optional\[int] Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id: Optional\[str] WAF rules list ID for blocking Link to this property rule\_scope: Optional\[str] Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_get_response%20%3E%20(schema)>)
class QueryEditResponse: … id: int Unique identifier for the saved query Link to this property account\_id: int Account ID Link to this property alert\_enabled: bool Whether alerts are enabled Link to this property alert\_rollup\_enabled: bool Whether alert rollup is enabled Link to this property created\_at: str Creation timestamp Link to this property name: str Name of the saved query Link to this property query\_json: str JSON string containing the query parameters Link to this property rule\_enabled: bool Whether rule is enabled Link to this property updated\_at: str Last update timestamp Link to this property user\_email: str Email of the user who created the query Link to this property custom\_threat\_feed\_id: Optional\[int] Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id: Optional\[str] WAF rules list ID for blocking Link to this property rule\_scope: Optional\[str] Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_edit_response%20%3E%20(schema)>) #### Threat EventsRelationships ##### [Filter and list events related to specific event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/relationships/methods/list) Deprecated cloudforce\_one.threat\_events.relationships.list(strevent\_id, RelationshipListParams\*\*kwargs) -> [RelationshipListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/{event\_id}/relationships ##### ModelsExpand Collapse
List\[RelationshipListResponseItem] attacker: str Link to this property attacker\_country: str Link to this property attacker\_country\_alpha3: str Link to this property category: str Link to this property dataset\_id: str Link to this property date: str Link to this property event: str Link to this property has\_children: bool Link to this property indicator: str Link to this property indicator\_type: str Link to this property indicator\_type\_id: float Link to this property kill\_chain: float Link to this property mitre\_attack: List\[str] Link to this property mitre\_capec: List\[str] Link to this property num\_referenced: float Link to this property num\_references: float Link to this property raw\_id: str Link to this property referenced: List\[str] Link to this property referenced\_ids: List\[float] Link to this property references: List\[str] Link to this property references\_ids: List\[float] Link to this property tags: List\[str] Link to this property target\_country: str Link to this property target\_country\_alpha3: str Link to this property target\_industry: str Link to this property tlp: str Link to this property uuid: str Link to this property insight: Optional\[str] Link to this property releasability\_id: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.relationships%20%3E%20(model)%20relationship_list_response%20%3E%20(schema)>) #### Threat EventsIndicators ##### [Lists indicators across multiple datasets](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/indicators/methods/list) cloudforce\_one.threat\_events.indicators.list(IndicatorListParams\*\*kwargs) -> [IndicatorListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/indicators ##### ModelsExpand Collapse
class IndicatorListResponse: …
properties: Properties
completeness: PropertiesCompleteness
properties: PropertiesCompletenessProperties
complete: PropertiesCompletenessPropertiesComplete type: str Link to this property
Link to this property
failed\_datasets: PropertiesCompletenessPropertiesFailedDatasets
items: PropertiesCompletenessPropertiesFailedDatasetsItems type: str Link to this property
Link to this property type: str Link to this property
Link to this property
failed\_shards: PropertiesCompletenessPropertiesFailedShards
items: PropertiesCompletenessPropertiesFailedShardsItems
properties: PropertiesCompletenessPropertiesFailedShardsItemsProperties
dataset\_id: PropertiesCompletenessPropertiesFailedShardsItemsPropertiesDatasetID type: str Link to this property
Link to this property
shard\_id: PropertiesCompletenessPropertiesFailedShardsItemsPropertiesShardID type: str Link to this property
Link to this property
Link to this property type: str Link to this property
Link to this property type: str Link to this property
Link to this property
warnings: PropertiesCompletenessPropertiesWarnings
items: PropertiesCompletenessPropertiesWarningsItems type: str Link to this property
Link to this property type: str Link to this property
Link to this property
Link to this property type: str Link to this property
Link to this property
indicators: PropertiesIndicators
items: PropertiesIndicatorsItems created\_at: datetime formatdate-time Link to this property indicator\_type: str Link to this property
sources: List\[PropertiesIndicatorsItemsSource] RSS article sources from which this indicator was extracted. resource\_id: str formatuuid Link to this property resource\_type: Literal\["article"] Link to this property system: Literal\["threat-signals"] Link to this property title: Optional\[str] Threat Signals article title; null for historical provenance without a stored title. Link to this property
Link to this property updated\_at: datetime formatdate-time Link to this property uuid: str Link to this property value: str Link to this property dataset\_id: Optional\[str] The dataset ID this indicator belongs to. Included in list responses. Link to this property
related\_events: Optional\[List\[PropertiesIndicatorsItemsRelatedEvent]] Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. dataset\_id: str Link to this property event\_id: str Link to this property event\_date: Optional\[str] ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property related\_events\_has\_more: Optional\[bool] True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags: Optional\[List\[PropertiesIndicatorsItemsTag]] category\_id: Optional\[str] The UUID of the tag category, or null when the tag is uncategorized. Link to this property category\_name: Optional\[str] Link to this property uuid: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property tlp: Optional\[str] Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property type: str Link to this property
Link to this property
pagination: PropertiesPagination
properties: PropertiesPaginationProperties
count: PropertiesPaginationPropertiesCount type: str Link to this property
Link to this property
cursor: PropertiesPaginationPropertiesCursor description: str Link to this property nullable: bool Link to this property type: str Link to this property
Link to this property
has\_more: PropertiesPaginationPropertiesHasMore description: str Link to this property type: str Link to this property
Link to this property
page: PropertiesPaginationPropertiesPage type: str Link to this property
Link to this property
per\_page: PropertiesPaginationPropertiesPerPage type: str Link to this property
Link to this property
total\_count: PropertiesPaginationPropertiesTotalCount description: str Link to this property nullable: bool Link to this property type: str Link to this property
Link to this property
total\_count\_is\_exact: PropertiesPaginationPropertiesTotalCountIsExact description: str Link to this property type: str Link to this property
Link to this property
Link to this property type: str Link to this property
Link to this property
Link to this property type: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>) #### Threat EventsIndicatorsAggregate ##### [Aggregate indicators by column(s)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/aggregate/methods/list) cloudforce\_one.threat\_events.indicators.aggregate.list(AggregateListParams\*\*kwargs) -> [AggregateListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/indicators/aggregate ##### ModelsExpand Collapse
class AggregateListResponse: … aggregate\_by: str Column(s) that were aggregated by Link to this property
aggregations: List\[Aggregation] Array of aggregation results with dynamic fields based on aggregateBy columns count: float Number of indicators for this aggregation Link to this property
Link to this property failed\_datasets: float Number of datasets whose aggregation failed and were excluded from the result Link to this property total: float Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.aggregate%20%3E%20(model)%20aggregate_list_response%20%3E%20(schema)>) #### Threat EventsIndicatorsTypes ##### [Lists indicator types across multiple datasets](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/types/methods/list) cloudforce\_one.threat\_events.indicators.types.list(TypeListParams\*\*kwargs) -> [TypeListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/indicator-types ##### ModelsExpand Collapse
class TypeListResponse: …
items: Items type: str Link to this property
Link to this property type: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.types%20%3E%20(model)%20type_list_response%20%3E%20(schema)>) #### Threat EventsIndicatorsBy Dataset ##### [Lists indicators](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/by_dataset/methods/list) Deprecated cloudforce\_one.threat\_events.indicators.by\_dataset.list(strdataset\_id, ByDatasetListParams\*\*kwargs) -> [ByDatasetListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/indicators ##### [Reads an indicator](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/by_dataset/methods/get) cloudforce\_one.threat\_events.indicators.by\_dataset.get(strindicator\_id, ByDatasetGetParams\*\*kwargs) -> [ByDatasetGetResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/indicators/{indicator\_id} ##### ModelsExpand Collapse
class ByDatasetListResponse: …
indicators: List\[Indicator] created\_at: datetime formatdate-time Link to this property indicator\_type: str Link to this property
sources: List\[IndicatorSource] RSS article sources from which this indicator was extracted. resource\_id: str formatuuid Link to this property resource\_type: Literal\["article"] Link to this property system: Literal\["threat-signals"] Link to this property title: Optional\[str] Threat Signals article title; null for historical provenance without a stored title. Link to this property
Link to this property updated\_at: datetime formatdate-time Link to this property uuid: str Link to this property value: str Link to this property dataset\_id: Optional\[str] The dataset ID this indicator belongs to. Included in list responses. Link to this property
related\_events: Optional\[List\[IndicatorRelatedEvent]] Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. dataset\_id: str Link to this property event\_id: str Link to this property event\_date: Optional\[str] ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property related\_events\_has\_more: Optional\[bool] True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags: Optional\[List\[IndicatorTag]] category\_id: Optional\[str] The UUID of the tag category, or null when the tag is uncategorized. Link to this property category\_name: Optional\[str] Link to this property uuid: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property tlp: Optional\[str] Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property
pagination: Pagination page: float Link to this property page\_size: float Link to this property total\_count: float Link to this property total\_pages: float Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.by_dataset%20%3E%20(model)%20by_dataset_list_response%20%3E%20(schema)>)
class ByDatasetGetResponse: … created\_at: datetime formatdate-time Link to this property indicator\_type: str Link to this property updated\_at: datetime formatdate-time Link to this property uuid: str Link to this property value: str Link to this property dataset\_id: Optional\[str] The dataset ID this indicator belongs to. Included in list responses. Link to this property
related\_events: Optional\[List\[RelatedEvent]] Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. dataset\_id: str Link to this property event\_id: str Link to this property event\_date: Optional\[str] ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property related\_events\_has\_more: Optional\[bool] True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags: Optional\[List\[Tag]] category\_id: Optional\[str] The UUID of the tag category, or null when the tag is uncategorized. Link to this property category\_name: Optional\[str] Link to this property uuid: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property tlp: Optional\[str] Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.by_dataset%20%3E%20(model)%20by_dataset_get_response%20%3E%20(schema)>) #### Threat EventsIndicatorsBy DatasetTags ##### [List mirrored tags for an indicator dataset](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/by_dataset/subresources/tags/methods/list) cloudforce\_one.threat\_events.indicators.by\_dataset.tags.list(strdataset\_id, TagListParams\*\*kwargs) -> [TagListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/indicators/tags ##### ModelsExpand Collapse List\[object] Array of mirror tag rows [Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.by_dataset.tags%20%3E%20(model)%20tag_list_response%20%3E%20(schema)>) #### Threat EventsAttackers ##### [Lists attackers across multiple datasets](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/attackers/methods/list) cloudforce\_one.threat\_events.attackers.list(AttackerListParams\*\*kwargs) -> [AttackerListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/attackers ##### ModelsExpand Collapse
class AttackerListResponse: …
items: Items type: str Link to this property
Link to this property type: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.attackers%20%3E%20(model)%20attacker_list_response%20%3E%20(schema)>) #### Threat EventsCategories ##### [Lists categories across multiple datasets](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/list) cloudforce\_one.threat\_events.categories.list(CategoryListParams\*\*kwargs) -> [CategoryListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/categories ##### [Reads a category](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/get) Deprecated cloudforce\_one.threat\_events.categories.get(strcategory\_id, CategoryGetParams\*\*kwargs) -> [CategoryGetResponse]() GET/accounts/{account\_id}/cloudforce-one/events/categories/{category\_id} ##### [Creates a new category](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/create) cloudforce\_one.threat\_events.categories.create(CategoryCreateParams\*\*kwargs) -> [CategoryCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/categories/create ##### [Updates a category](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/edit) Deprecated cloudforce\_one.threat\_events.categories.edit(strcategory\_id, CategoryEditParams\*\*kwargs) -> [CategoryEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/events/categories/{category\_id} ##### [Deletes a category](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/delete) Deprecated cloudforce\_one.threat\_events.categories.delete(strcategory\_id, CategoryDeleteParams\*\*kwargs) -> [CategoryDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/events/categories/{category\_id} ##### ModelsExpand Collapse
List\[CategoryListResponseItem] kill\_chain: float Link to this property name: str Link to this property uuid: str Link to this property mitre\_attack: Optional\[List\[str]] Link to this property mitre\_capec: Optional\[List\[str]] Link to this property shortname: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>)
class CategoryGetResponse: … kill\_chain: float Link to this property name: str Link to this property uuid: str Link to this property mitre\_attack: Optional\[List\[str]] Link to this property mitre\_capec: Optional\[List\[str]] Link to this property shortname: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_get_response%20%3E%20(schema)>)
class CategoryCreateResponse: … kill\_chain: float Link to this property name: str Link to this property uuid: str Link to this property mitre\_attack: Optional\[List\[str]] Link to this property mitre\_capec: Optional\[List\[str]] Link to this property shortname: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_create_response%20%3E%20(schema)>)
class CategoryEditResponse: … kill\_chain: float Link to this property name: str Link to this property uuid: str Link to this property mitre\_attack: Optional\[List\[str]] Link to this property mitre\_capec: Optional\[List\[str]] Link to this property shortname: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_edit_response%20%3E%20(schema)>)
class CategoryDeleteResponse: … uuid: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_delete_response%20%3E%20(schema)>) #### Threat EventsCategoriesCatalog ##### [Lists categories](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/categories/subresources/catalog/methods/list) cloudforce\_one.threat\_events.categories.catalog.list(CatalogListParams\*\*kwargs) -> [CatalogListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/categories/catalog ##### ModelsExpand Collapse
List\[CatalogListResponseItem] kill\_chain: float Link to this property name: str Link to this property uuid: str Link to this property mitre\_attack: Optional\[List\[str]] Link to this property mitre\_capec: Optional\[List\[str]] Link to this property shortname: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories.catalog%20%3E%20(model)%20catalog_list_response%20%3E%20(schema)>) #### Threat EventsCountries ##### [Retrieves countries information for all countries](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/countries/methods/list) cloudforce\_one.threat\_events.countries.list(CountryListParams\*\*kwargs) -> [CountryListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/countries ##### ModelsExpand Collapse
List\[CountryListResponseItem]
result: List\[CountryListResponseItemResult] alpha2: str Link to this property alpha3: str Link to this property name: str Link to this property
Link to this property success: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.countries%20%3E%20(model)%20country_list_response%20%3E%20(schema)>) #### Threat EventsCrons #### Threat EventsDatasets ##### [Lists all datasets in an account](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list) cloudforce\_one.threat\_events.datasets.list(DatasetListParams\*\*kwargs) -> [DatasetListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset ##### [Reads a dataset](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/get) cloudforce\_one.threat\_events.datasets.get(strdataset\_id, DatasetGetParams\*\*kwargs) -> [DatasetGetResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id} ##### [Creates a dataset](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create) cloudforce\_one.threat\_events.datasets.create(DatasetCreateParams\*\*kwargs) -> [DatasetCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/dataset/create ##### [Updates an existing dataset](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/edit) cloudforce\_one.threat\_events.datasets.edit(strdataset\_id, DatasetEditParams\*\*kwargs) -> [DatasetEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id} ##### [Delete a dataset](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/delete) cloudforce\_one.threat\_events.datasets.delete(strdataset\_id, DatasetDeleteParams\*\*kwargs) -> [DatasetDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id} ##### [Reads raw data for an event by UUID](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/raw) Deprecated cloudforce\_one.threat\_events.datasets.raw(strevent\_id, DatasetRawParams\*\*kwargs) -> [DatasetRawResponse]() GET/accounts/{account\_id}/cloudforce-one/events/raw/{dataset\_id}/{event\_id} ##### ModelsExpand Collapse
List\[DatasetListResponseItem]
indicator\_write\_mode: Literal\["read\_only", "create\_only", "full"] Effective indicator mutation capability after account/dataset authorization and dataset storage capability are applied. API Gateway method permissions are separate and must also allow the requested operation. One of the following: "read\_only" Link to this property "create\_only" Link to this property "full" Link to this property
Link to this property is\_analytics: bool Link to this property is\_public: bool Link to this property name: str Link to this property uuid: str Link to this property deleted\_at: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_list_response%20%3E%20(schema)>)
class DatasetGetResponse: … is\_analytics: bool Link to this property is\_public: bool Link to this property name: str Link to this property uuid: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_get_response%20%3E%20(schema)>)
class DatasetCreateResponse: … is\_analytics: bool Link to this property is\_public: bool Link to this property name: str Link to this property uuid: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_create_response%20%3E%20(schema)>)
class DatasetEditResponse: … is\_analytics: bool Link to this property is\_public: bool Link to this property name: str Link to this property uuid: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_edit_response%20%3E%20(schema)>)
class DatasetDeleteResponse: … name: str Link to this property uuid: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_delete_response%20%3E%20(schema)>)
class DatasetRawResponse: … id: float Link to this property account\_id: float Link to this property created: str Link to this property data: str Link to this property source: str Link to this property tlp: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_raw_response%20%3E%20(schema)>) #### Threat EventsDatasetsHealth #### Threat EventsDatasetsEvents ##### [Reads an event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/datasets/subresources/events/methods/get) cloudforce\_one.threat\_events.datasets.events.get(strevent\_id, EventGetParams\*\*kwargs) -> [EventGetResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/events/{event\_id} ##### ModelsExpand Collapse
class EventGetResponse: … attacker: str Link to this property attacker\_country: str Link to this property attacker\_country\_alpha3: str Link to this property category: str Link to this property dataset\_id: str Link to this property date: str Link to this property event: str Link to this property has\_children: bool Link to this property indicator: str Link to this property indicator\_type: str Link to this property indicator\_type\_id: float Link to this property kill\_chain: float Link to this property mitre\_attack: List\[str] Link to this property mitre\_capec: List\[str] Link to this property num\_referenced: float Link to this property num\_references: float Link to this property raw\_id: str Link to this property referenced: List\[str] Link to this property referenced\_ids: List\[float] Link to this property references: List\[str] Link to this property references\_ids: List\[float] Link to this property tags: List\[str] Link to this property target\_country: str Link to this property target\_country\_alpha3: str Link to this property target\_industry: str Link to this property tlp: str Link to this property uuid: str Link to this property insight: Optional\[str] Link to this property releasability\_id: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets.events%20%3E%20(model)%20event_get_response%20%3E%20(schema)>) #### Threat EventsRaw ##### [Reads data for a raw event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/raw/methods/get) cloudforce\_one.threat\_events.raw.get(strraw\_id, RawGetParams\*\*kwargs) -> [RawGetResponse]() GET/accounts/{account\_id}/cloudforce-one/events/{event\_id}/raw/{raw\_id} ##### [Updates a raw event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/raw/methods/edit) cloudforce\_one.threat\_events.raw.edit(strraw\_id, RawEditParams\*\*kwargs) -> [RawEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/events/{event\_id}/raw/{raw\_id} ##### ModelsExpand Collapse
class RawGetResponse: … id: str Link to this property account\_id: float Link to this property created: str Link to this property data: object Link to this property source: str Link to this property tlp: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>)
class RawEditResponse: … id: str Link to this property data: object Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.raw%20%3E%20(model)%20raw_edit_response%20%3E%20(schema)>) #### Threat EventsRelate ##### [Removes an event reference](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/relate/methods/delete) cloudforce\_one.threat\_events.relate.delete(strevent\_id, RelateDeleteParams\*\*kwargs) -> [RelateDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/events/relate/{event\_id} ##### ModelsExpand Collapse
class RelateDeleteResponse: … success: bool Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.relate%20%3E%20(model)%20relate_delete_response%20%3E%20(schema)>) #### Threat EventsTags ##### [Lists all tags (SoT)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/list) cloudforce\_one.threat\_events.tags.list(TagListParams\*\*kwargs) -> [TagListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/tags ##### [Creates a new tag](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/create) cloudforce\_one.threat\_events.tags.create(TagCreateParams\*\*kwargs) -> [TagCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/tags/create ##### [Updates a tag (SoT)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/edit) cloudforce\_one.threat\_events.tags.edit(strtag\_uuid, TagEditParams\*\*kwargs) -> [TagEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/events/tags/{tag\_uuid} ##### [Deletes a tag (SoT)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/delete) cloudforce\_one.threat\_events.tags.delete(strtag\_uuid, TagDeleteParams\*\*kwargs) -> [TagDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/events/tags/{tag\_uuid} ##### ModelsExpand Collapse
class TagListResponse: …
pagination: Pagination page: float Link to this property page\_size: float Link to this property total\_count: float Link to this property total\_pages: float Link to this property
Link to this property
tags: List\[Tag] uuid: str Link to this property value: str Link to this property active\_duration: Optional\[str] Link to this property
active\_duration\_annotated: Optional\[TagActiveDurationAnnotated] value: str Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property actor\_category: Optional\[str] Link to this property
actor\_category\_annotated: Optional\[TagActorCategoryAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
aliases: Optional\[List\[TagAlias]] Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts). value: str Link to this property confidence: Optional\[int] maximum10 minimum1 Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property alias\_group\_names: Optional\[List\[str]] Link to this property alias\_group\_names\_internal: Optional\[List\[str]] Link to this property attribution\_organization: Optional\[str] Link to this property
attribution\_organization\_annotated: Optional\[TagAttributionOrganizationAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property category\_name: Optional\[str] Link to this property category\_uuid: Optional\[str] Link to this property confidence: Optional\[int] Overall tag confidence (1-10). maximum10 minimum1 Link to this property created\_at: Optional\[str] Link to this property date\_of\_discovery: Optional\[str] Link to this property description: Optional\[str] Link to this property external\_reference\_links: Optional\[List\[str]] Link to this property
external\_references: Optional\[List\[TagExternalReference]] Structured external references ({ url, description }). Public: returned to all accounts. url: str Link to this property description: Optional\[str] Link to this property
Link to this property
external\_references\_annotated: Optional\[List\[TagExternalReferencesAnnotated]] value: str Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
internal\_aliases: Optional\[List\[TagInternalAlias]] Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses. value: str Link to this property confidence: Optional\[int] maximum10 minimum1 Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property internal\_description: Optional\[str] Link to this property last\_seen: Optional\[str] Link to this property motive: Optional\[str] Link to this property
motive\_annotated: Optional\[TagMotiveAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property opsec\_level: Optional\[str] Link to this property
opsec\_level\_annotated: Optional\[TagOpsecLevelAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property origin\_country\_iso: Optional\[str] ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace. Link to this property
origin\_country\_iso\_annotated: Optional\[TagOriginCountryISOAnnotated] value: Optional\[str] Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property priority: Optional\[float] Link to this property
priority\_annotated: Optional\[TagPriorityAnnotated] value: float Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property properties: Optional\[Dict\[str, object]] Parsed custom field values. Null when the tag has no custom fields. Link to this property sophistication\_level: Optional\[str] Link to this property
sophistication\_level\_annotated: Optional\[TagSophisticationLevelAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] Tag-level TLP handling marking. One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property updated\_at: Optional\[str] Link to this property version: Optional\[float] Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_list_response%20%3E%20(schema)>)
class TagCreateResponse: … uuid: str Link to this property value: str Link to this property active\_duration: Optional\[str] Link to this property
active\_duration\_annotated: Optional\[ActiveDurationAnnotated] value: str Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property actor\_category: Optional\[str] Link to this property
actor\_category\_annotated: Optional\[ActorCategoryAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
aliases: Optional\[List\[Alias]] Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts). value: str Link to this property confidence: Optional\[int] maximum10 minimum1 Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property alias\_group\_names: Optional\[List\[str]] Link to this property alias\_group\_names\_internal: Optional\[List\[str]] Link to this property attribution\_organization: Optional\[str] Link to this property
attribution\_organization\_annotated: Optional\[AttributionOrganizationAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property category\_name: Optional\[str] Link to this property category\_uuid: Optional\[str] Link to this property confidence: Optional\[int] Overall tag confidence (1-10). maximum10 minimum1 Link to this property created\_at: Optional\[str] Link to this property date\_of\_discovery: Optional\[str] Link to this property description: Optional\[str] Link to this property external\_reference\_links: Optional\[List\[str]] Link to this property
external\_references: Optional\[List\[ExternalReference]] Structured external references ({ url, description }). Public: returned to all accounts. url: str Link to this property description: Optional\[str] Link to this property
Link to this property
external\_references\_annotated: Optional\[List\[ExternalReferencesAnnotated]] value: str Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
internal\_aliases: Optional\[List\[InternalAlias]] Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses. value: str Link to this property confidence: Optional\[int] maximum10 minimum1 Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property internal\_description: Optional\[str] Link to this property last\_seen: Optional\[str] Link to this property motive: Optional\[str] Link to this property
motive\_annotated: Optional\[MotiveAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property opsec\_level: Optional\[str] Link to this property
opsec\_level\_annotated: Optional\[OpsecLevelAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property origin\_country\_iso: Optional\[str] ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace. Link to this property
origin\_country\_iso\_annotated: Optional\[OriginCountryISOAnnotated] value: Optional\[str] Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property priority: Optional\[float] Link to this property
priority\_annotated: Optional\[PriorityAnnotated] value: float Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property properties: Optional\[Dict\[str, object]] Parsed custom field values. Null when the tag has no custom fields. Link to this property sophistication\_level: Optional\[str] Link to this property
sophistication\_level\_annotated: Optional\[SophisticationLevelAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] Tag-level TLP handling marking. One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property updated\_at: Optional\[str] Link to this property version: Optional\[float] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_create_response%20%3E%20(schema)>)
class TagEditResponse: … uuid: str Link to this property value: str Link to this property active\_duration: Optional\[str] Link to this property
active\_duration\_annotated: Optional\[ActiveDurationAnnotated] value: str Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property actor\_category: Optional\[str] Link to this property
actor\_category\_annotated: Optional\[ActorCategoryAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
aliases: Optional\[List\[Alias]] Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts). value: str Link to this property confidence: Optional\[int] maximum10 minimum1 Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property alias\_group\_names: Optional\[List\[str]] Link to this property alias\_group\_names\_internal: Optional\[List\[str]] Link to this property attribution\_organization: Optional\[str] Link to this property
attribution\_organization\_annotated: Optional\[AttributionOrganizationAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property category\_name: Optional\[str] Link to this property category\_uuid: Optional\[str] Link to this property confidence: Optional\[int] Overall tag confidence (1-10). maximum10 minimum1 Link to this property created\_at: Optional\[str] Link to this property date\_of\_discovery: Optional\[str] Link to this property description: Optional\[str] Link to this property external\_reference\_links: Optional\[List\[str]] Link to this property
external\_references: Optional\[List\[ExternalReference]] Structured external references ({ url, description }). Public: returned to all accounts. url: str Link to this property description: Optional\[str] Link to this property
Link to this property
external\_references\_annotated: Optional\[List\[ExternalReferencesAnnotated]] value: str Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
internal\_aliases: Optional\[List\[InternalAlias]] Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses. value: str Link to this property confidence: Optional\[int] maximum10 minimum1 Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property internal\_description: Optional\[str] Link to this property last\_seen: Optional\[str] Link to this property motive: Optional\[str] Link to this property
motive\_annotated: Optional\[MotiveAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property opsec\_level: Optional\[str] Link to this property
opsec\_level\_annotated: Optional\[OpsecLevelAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property origin\_country\_iso: Optional\[str] ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace. Link to this property
origin\_country\_iso\_annotated: Optional\[OriginCountryISOAnnotated] value: Optional\[str] Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property priority: Optional\[float] Link to this property
priority\_annotated: Optional\[PriorityAnnotated] value: float Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property properties: Optional\[Dict\[str, object]] Parsed custom field values. Null when the tag has no custom fields. Link to this property sophistication\_level: Optional\[str] Link to this property
sophistication\_level\_annotated: Optional\[SophisticationLevelAnnotated] value: str Link to this property confidence: Optional\[float] Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
tlp: Optional\[Literal\["red", "amber", "amber-strict", 4 more]] Tag-level TLP handling marking. One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property updated\_at: Optional\[str] Link to this property version: Optional\[float] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_edit_response%20%3E%20(schema)>)
class TagDeleteResponse: … uuid: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_delete_response%20%3E%20(schema)>) #### Threat EventsTagsCategories ##### [Lists all tag categories (SoT)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/list) cloudforce\_one.threat\_events.tags.categories.list(CategoryListParams\*\*kwargs) -> [CategoryListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/tags/categories ##### [Creates a new tag category (SoT)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/create) cloudforce\_one.threat\_events.tags.categories.create(CategoryCreateParams\*\*kwargs) -> [CategoryCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/tags/categories/create ##### [Updates a tag category (SoT)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/edit) Deprecated cloudforce\_one.threat\_events.tags.categories.edit(strcategory\_uuid, CategoryEditParams\*\*kwargs) -> [CategoryEditResponse]() PATCH/accounts/{account\_id}/cloudforce-one/events/tags/categories/{category\_uuid} ##### [Deletes a tag category (SoT)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/delete) Deprecated cloudforce\_one.threat\_events.tags.categories.delete(strcategory\_uuid, CategoryDeleteParams\*\*kwargs) -> [CategoryDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/events/tags/categories/{category\_uuid} ##### ModelsExpand Collapse
class CategoryListResponse: …
categories: List\[Category] name: str Link to this property uuid: str Link to this property created\_at: Optional\[str] Link to this property description: Optional\[str] Link to this property
schema: Optional\[List\[CategorySchema]] Parsed FieldDefinition\[] defining custom fields for this category, or null if none. key: str Link to this property
kind: Literal\["string", "number", "enum", 3 more] One of the following: "string" Link to this property "number" Link to this property "enum" Link to this property "date" Link to this property "array" Link to this property "object" Link to this property
Link to this property allowed\_values: Optional\[List\[str]] Link to this property
annotations: Optional\[CategorySchemaAnnotations] confidence: Optional\[bool] Link to this property tlp: Optional\[bool] Link to this property
Link to this property deprecated: Optional\[bool] Marks a field as unavailable for new values while retaining its definition for historical values. Link to this property deprecated\_values: Optional\[List\[str]] Enum values unavailable for new writes but retained in allowedValues for historical display. Link to this property element: Optional\[object] Link to this property
enforcement: Optional\[Literal\["error", "warn", "off"]] One of the following: "error" Link to this property "warn" Link to this property "off" Link to this property
Link to this property
format: Optional\[Literal\["date", "url", "duration", "country"]] One of the following: "date" Link to this property "url" Link to this property "duration" Link to this property "country" Link to this property
Link to this property label: Optional\[str] maxLength128 minLength1 Link to this property max\_length: Optional\[int] exclusiveMinimum minimum0 Link to this property
number\_constraint: Optional\[CategorySchemaNumberConstraint] integer: Optional\[bool] Link to this property max: Optional\[float] Link to this property min: Optional\[float] Link to this property
Link to this property properties: Optional\[Dict\[str, object]] Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive). Link to this property required: Optional\[bool] Link to this property
Link to this property updated\_at: Optional\[str] Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>)
class CategoryCreateResponse: … name: str Link to this property uuid: str Link to this property created\_at: Optional\[str] Link to this property description: Optional\[str] Link to this property
schema: Optional\[List\[Schema]] Parsed FieldDefinition\[] defining custom fields for this category, or null if none. key: str Link to this property
kind: Literal\["string", "number", "enum", 3 more] One of the following: "string" Link to this property "number" Link to this property "enum" Link to this property "date" Link to this property "array" Link to this property "object" Link to this property
Link to this property allowed\_values: Optional\[List\[str]] Link to this property
annotations: Optional\[SchemaAnnotations] confidence: Optional\[bool] Link to this property tlp: Optional\[bool] Link to this property
Link to this property deprecated: Optional\[bool] Marks a field as unavailable for new values while retaining its definition for historical values. Link to this property deprecated\_values: Optional\[List\[str]] Enum values unavailable for new writes but retained in allowedValues for historical display. Link to this property element: Optional\[object] Link to this property
enforcement: Optional\[Literal\["error", "warn", "off"]] One of the following: "error" Link to this property "warn" Link to this property "off" Link to this property
Link to this property
format: Optional\[Literal\["date", "url", "duration", "country"]] One of the following: "date" Link to this property "url" Link to this property "duration" Link to this property "country" Link to this property
Link to this property label: Optional\[str] maxLength128 minLength1 Link to this property max\_length: Optional\[int] exclusiveMinimum minimum0 Link to this property
number\_constraint: Optional\[SchemaNumberConstraint] integer: Optional\[bool] Link to this property max: Optional\[float] Link to this property min: Optional\[float] Link to this property
Link to this property properties: Optional\[Dict\[str, object]] Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive). Link to this property required: Optional\[bool] Link to this property
Link to this property updated\_at: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_create_response%20%3E%20(schema)>)
class CategoryEditResponse: … name: str Link to this property uuid: str Link to this property created\_at: Optional\[str] Link to this property description: Optional\[str] Link to this property
schema: Optional\[List\[Schema]] Parsed FieldDefinition\[] defining custom fields for this category, or null if none. key: str Link to this property
kind: Literal\["string", "number", "enum", 3 more] One of the following: "string" Link to this property "number" Link to this property "enum" Link to this property "date" Link to this property "array" Link to this property "object" Link to this property
Link to this property allowed\_values: Optional\[List\[str]] Link to this property
annotations: Optional\[SchemaAnnotations] confidence: Optional\[bool] Link to this property tlp: Optional\[bool] Link to this property
Link to this property deprecated: Optional\[bool] Marks a field as unavailable for new values while retaining its definition for historical values. Link to this property deprecated\_values: Optional\[List\[str]] Enum values unavailable for new writes but retained in allowedValues for historical display. Link to this property element: Optional\[object] Link to this property
enforcement: Optional\[Literal\["error", "warn", "off"]] One of the following: "error" Link to this property "warn" Link to this property "off" Link to this property
Link to this property
format: Optional\[Literal\["date", "url", "duration", "country"]] One of the following: "date" Link to this property "url" Link to this property "duration" Link to this property "country" Link to this property
Link to this property label: Optional\[str] maxLength128 minLength1 Link to this property max\_length: Optional\[int] exclusiveMinimum minimum0 Link to this property
number\_constraint: Optional\[SchemaNumberConstraint] integer: Optional\[bool] Link to this property max: Optional\[float] Link to this property min: Optional\[float] Link to this property
Link to this property properties: Optional\[Dict\[str, object]] Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive). Link to this property required: Optional\[bool] Link to this property
Link to this property updated\_at: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_edit_response%20%3E%20(schema)>)
class CategoryDeleteResponse: … uuid: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_delete_response%20%3E%20(schema)>) #### Threat EventsTagsIndicators ##### [List indicators related to a tag](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/indicators/methods/list) cloudforce\_one.threat\_events.tags.indicators.list(strtag\_uuid, IndicatorListParams\*\*kwargs) -> [IndicatorListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/tags/{tag\_uuid}/indicators ##### ModelsExpand Collapse
class IndicatorListResponse: …
indicators: List\[Indicator] created\_at: datetime formatdate-time Link to this property indicator\_type: str Link to this property updated\_at: datetime formatdate-time Link to this property uuid: str Link to this property value: str Link to this property dataset\_id: Optional\[str] The dataset ID this indicator belongs to. Included in list responses. Link to this property
related\_events: Optional\[List\[IndicatorRelatedEvent]] Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. dataset\_id: str Link to this property event\_id: str Link to this property event\_date: Optional\[str] ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property related\_events\_has\_more: Optional\[bool] True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags: Optional\[List\[IndicatorTag]] category\_id: Optional\[str] The UUID of the tag category, or null when the tag is uncategorized. Link to this property category\_name: Optional\[str] Link to this property uuid: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property tlp: Optional\[str] Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property
pagination: Pagination page: float Link to this property page\_size: float Link to this property total\_count: float Link to this property total\_pages: float Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>) #### Threat EventsTagsIndicatorsBy Dataset ##### [List indicators related to a tag within a dataset (deprecated)](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/indicators/subresources/by_dataset/methods/list) Deprecated cloudforce\_one.threat\_events.tags.indicators.by\_dataset.list(strtag\_uuid, ByDatasetListParams\*\*kwargs) -> [ByDatasetListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/tags/{tag\_uuid}/indicators ##### ModelsExpand Collapse
class ByDatasetListResponse: …
indicators: List\[Indicator] created\_at: datetime formatdate-time Link to this property indicator\_type: str Link to this property updated\_at: datetime formatdate-time Link to this property uuid: str Link to this property value: str Link to this property dataset\_id: Optional\[str] The dataset ID this indicator belongs to. Included in list responses. Link to this property
related\_events: Optional\[List\[IndicatorRelatedEvent]] Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. dataset\_id: str Link to this property event\_id: str Link to this property event\_date: Optional\[str] ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property related\_events\_has\_more: Optional\[bool] True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags: Optional\[List\[IndicatorTag]] category\_id: Optional\[str] The UUID of the tag category, or null when the tag is uncategorized. Link to this property category\_name: Optional\[str] Link to this property uuid: Optional\[str] Link to this property value: Optional\[str] Link to this property
Link to this property tlp: Optional\[str] Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property
pagination: Pagination page: float Link to this property page\_size: float Link to this property total\_count: float Link to this property total\_pages: float Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.indicators.by_dataset%20%3E%20(model)%20by_dataset_list_response%20%3E%20(schema)>) #### Threat EventsEvent Tags ##### [Adds a tag to an event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/event_tags/methods/create) cloudforce\_one.threat\_events.event\_tags.create(strevent\_id, EventTagCreateParams\*\*kwargs) -> [EventTagCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/event\_tag/{event\_id}/create ##### [Removes a tag from an event](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/event_tags/methods/delete) cloudforce\_one.threat\_events.event\_tags.delete(strevent\_id, EventTagDeleteParams\*\*kwargs) -> [EventTagDeleteResponse]() DELETE/accounts/{account\_id}/cloudforce-one/events/event\_tag/{event\_id} ##### ModelsExpand Collapse
class EventTagCreateResponse: … success: bool Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.event_tags%20%3E%20(model)%20event_tag_create_response%20%3E%20(schema)>)
class EventTagDeleteResponse: … success: bool Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.event_tags%20%3E%20(model)%20event_tag_delete_response%20%3E%20(schema)>) #### Threat EventsTarget Industries ##### [Lists target industries across multiple datasets](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/target_industries/methods/list) cloudforce\_one.threat\_events.target\_industries.list(TargetIndustryListParams\*\*kwargs) -> [TargetIndustryListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/targetIndustries ##### ModelsExpand Collapse
class TargetIndustryListResponse: …
items: Items type: str Link to this property
Link to this property type: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.target_industries%20%3E%20(model)%20target_industry_list_response%20%3E%20(schema)>) #### Threat EventsTarget IndustriesBy Dataset ##### [Lists all target industries for a specific dataset](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/target_industries/subresources/by_dataset/methods/list) cloudforce\_one.threat\_events.target\_industries.by\_dataset.list(strdataset\_id, ByDatasetListParams\*\*kwargs) -> [ByDatasetListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/targetIndustries ##### ModelsExpand Collapse
class ByDatasetListResponse: …
items: Items type: str Link to this property
Link to this property type: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.target_industries.by_dataset%20%3E%20(model)%20by_dataset_list_response%20%3E%20(schema)>) #### Threat EventsTarget IndustriesCatalog ##### [Lists all target industries from industry map catalog](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events/subresources/target_industries/subresources/catalog/methods/list) cloudforce\_one.threat\_events.target\_industries.catalog.list(CatalogListParams\*\*kwargs) -> [CatalogListResponse]() GET/accounts/{account\_id}/cloudforce-one/events/targetIndustries/catalog ##### ModelsExpand Collapse
class CatalogListResponse: …
items: Items type: str Link to this property
Link to this property type: str Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.target_industries.catalog%20%3E%20(model)%20catalog_list_response%20%3E%20(schema)>) #### Threat EventsInsights