---
title: Creates bulk DOS event with relationships and indicators
---

[Skip to content](#_top)

[API Reference](https://developers.cloudflare.com/api/python)

[Cloudforce One](https://developers.cloudflare.com/api/python/resources/cloudforce_one)

[Threat Events](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events)

Copy Markdown

Open in **Claude**Open in **ChatGPT**Open in **Cursor**

---

**Copy Markdown****View as Markdown**

# Creates bulk DOS event with relationships and indicators

Deprecated: This endpoint is deprecated and will be removed in a future version.

cloudforce\_one.threat\_events.bulk\_create\_relationships(ThreatEventBulkCreateRelationshipsParams\*\*kwargs) -> [ThreatEventBulkCreateRelationshipsResponse](<https://developers.cloudflare.com/api/python/resources/cloudforce_one#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_relationships_response%20%3E%20(schema)>)

POST/accounts/{account\_id}/cloudforce-one/events/create/bulk/relationships

This method is deprecated. Please use `event_create_bulk` instead

##### Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. [Create a token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/).

**Example:**`Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY`

##### Accepted Permissions (at least one required)

`Cloudforce One Write``Cloudforce One Read`

##### ParametersExpand Collapse

account\_id: str

Account ID.

[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20account_id%20%3E%20(schema)>)

<details>

<summary>

data: Iterable\[Data]

</summary>

category: str

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20category">Link to this property</a>

date: Union\[str, datetime]

formatdate-time

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20date">Link to this property</a>

event: str

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20event">Link to this property</a>

<details>

<summary>

raw: DataRaw

</summary>

data: Optional\[Dict\[str, object]]

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20raw%20%3E%20(property)%20data">Link to this property</a>

source: Optional\[str]

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20raw%20%3E%20(property)%20source">Link to this property</a>

tlp: Optional\[str]

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20raw%20%3E%20(property)%20tlp">Link to this property</a>

</details>

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20raw">Link to this property</a>

tlp: str

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20tlp">Link to this property</a>

account\_id: Optional\[float]

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20accountId">Link to this property</a>

attacker: Optional\[str]

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20attacker">Link to this property</a>

attacker\_country: Optional\[str]

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20attackerCountry">Link to this property</a>

dataset\_id: Optional\[str]

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20datasetId">Link to this property</a>

indicator: Optional\[str]

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20indicator">Link to this property</a>

<details>

<summary>

indicators: Optional\[Iterable\[DataIndicator]]

Array of indicators for this event. Supports multiple indicators per event for complex scenarios.

</summary>

indicator\_type: str

The type of indicator (e.g., DOMAIN, IP, JA3, HASH)

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20indicators%20%3E%20(items)%20%3E%20(property)%20indicatorType">Link to this property</a>

value: str

The indicator value (e.g., domain name, IP address, hash)

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20indicators%20%3E%20(items)%20%3E%20(property)%20value">Link to this property</a>

</details>

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20indicators">Link to this property</a>

indicator\_type: Optional\[str]

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20indicatorType">Link to this property</a>

insight: Optional\[str]

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20insight">Link to this property</a>

tags: Optional\[Sequence\[str]]

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20tags">Link to this property</a>

target\_country: Optional\[str]

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20targetCountry">Link to this property</a>

target\_industry: Optional\[str]

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)%20%3E%20(items)%20%3E%20(property)%20targetIndustry">Link to this property</a>

</details>

[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20data%20%3E%20(schema)>)

dataset\_id: str

[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20bulk_create_relationships%20%3E%20(params)%20default%20%3E%20(param)%20datasetId%20%3E%20(schema)>)

##### ReturnsExpand Collapse

<details>

<summary>

class ThreatEventBulkCreateRelationshipsResponse: …

Result of bulk relationship creation operation

</summary>

created\_events\_count: float

Number of events created

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_relationships_response%20%3E%20(schema)%20%3E%20(property)%20createdEventsCount">Link to this property</a>

created\_indicators\_count: float

Number of indicators created

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_relationships_response%20%3E%20(schema)%20%3E%20(property)%20createdIndicatorsCount">Link to this property</a>

created\_relationships\_count: float

Number of relationships created

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_relationships_response%20%3E%20(schema)%20%3E%20(property)%20createdRelationshipsCount">Link to this property</a>

error\_count: float

Number of errors encountered

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_relationships_response%20%3E%20(schema)%20%3E%20(property)%20errorCount">Link to this property</a>

<details>

<summary>

errors: Optional\[List\[Error]]

Array of error details

</summary>

error: str

Error message

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_relationships_response%20%3E%20(schema)%20%3E%20(property)%20errors%20%3E%20(items)%20%3E%20(property)%20error">Link to this property</a>

event\_index: float

Index of the event that caused the error

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_relationships_response%20%3E%20(schema)%20%3E%20(property)%20errors%20%3E%20(items)%20%3E%20(property)%20eventIndex">Link to this property</a>

</details>

<a href="#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_relationships_response%20%3E%20(schema)%20%3E%20(property)%20errors">Link to this property</a>

</details>

[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_relationships_response%20%3E%20(schema)>)

### Creates bulk DOS event with relationships and indicators

Python

HTTPTypeScriptPythonGoTerraform

```
import os
from datetime import datetime
from cloudflare import Cloudflare

client = Cloudflare(
    api_token=os.environ.get("CLOUDFLARE_API_TOKEN"),  # This is the default and can be omitted
)
response = client.cloudforce_one.threat_events.bulk_create_relationships(
    account_id="account_id",
    data=[{
        "category": "Domain Resolution",
        "date": datetime.fromisoformat("2022-04-01T00:00:00"),
        "event": "An attacker registered the domain domain.com",
        "raw": {
            "data": {
                "foo": "bar"
            }
        },
        "tlp": "amber",
    }],
    dataset_id="durableObjectName",
)
print(response.created_events_count)
```

200 example

```
{
  "createdEventsCount": 0,
  "createdIndicatorsCount": 0,
  "createdRelationshipsCount": 0,
  "errorCount": 0,
  "errors": [
    {
      "error": "error",
      "eventIndex": 0
    }
  ]
}
```

##### Returns Examples

200 example

```
{
  "createdEventsCount": 0,
  "createdIndicatorsCount": 0,
  "createdRelationshipsCount": 0,
  "errorCount": 0,
  "errors": [
    {
      "error": "error",
      "eventIndex": 0
    }
  ]
}
```