--- title: Creates a new event --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [Cloudforce One](https://developers.cloudflare.com/api/python/resources/cloudforce_one) [Threat Events](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Creates a new event cloudforce\_one.threat\_events.create(ThreatEventCreateParams\*\*kwargs) -> [ThreatEventCreateResponse]() POST/accounts/{account\_id}/cloudforce-one/events/create To create a dataset, see the [`Create Dataset`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create/) endpoint. When `datasetId` parameter is unspecified, it will be created in a default dataset named `Cloudforce One Threat Events`. ##### Security API Token The preferred authorization scheme for interacting with the Cloudflare API. [Create a token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). **Example:**`Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY` ##### Accepted Permissions (at least one required) `Cloudforce One Write``Cloudforce One Read` ##### ParametersExpand Collapse account\_id: str Account ID. [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20account_id%20%3E%20(schema)>) category: str [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20category%20%3E%20(schema)>) date: Union\[str, datetime] formatdate-time [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20date%20%3E%20(schema)>) event: str [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20event%20%3E%20(schema)>)
raw: Raw data: Optional\[Dict\[str, object]] Link to this property source: Optional\[str] Link to this property tlp: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20raw%20%3E%20(schema)>) tlp: str [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20tlp%20%3E%20(schema)>) account\_id: Optional\[float] [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20accountId%20%3E%20(schema)>) attacker: Optional\[str] [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20attacker%20%3E%20(schema)>) attacker\_country: Optional\[str] [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20attackerCountry%20%3E%20(schema)>) dataset\_id: Optional\[str] [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20datasetId%20%3E%20(schema)>) indicator: Optional\[str] [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20indicator%20%3E%20(schema)>)
indicators: Optional\[Iterable\[Indicator]] Array of indicators for this event. Supports multiple indicators per event for complex scenarios. indicator\_type: str The type of indicator (e.g., DOMAIN, IP, JA3, HASH) Link to this property value: str The indicator value (e.g., domain name, IP address, hash) Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20indicators%20%3E%20(schema)>) indicator\_type: Optional\[str] [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20indicatorType%20%3E%20(schema)>) insight: Optional\[str] [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20insight%20%3E%20(schema)>)
source: Optional\[Source] Controlled provenance for an event and its indicators derived from a Threat Signals article. resource\_id: str formatuuid Link to this property resource\_type: Literal\["article"] Link to this property system: Literal\["threat-signals"] Link to this property title: Optional\[str] Threat Signals article title; null for historical provenance without a stored title. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20source%20%3E%20(schema)>) tags: Optional\[Sequence\[str]] [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20tags%20%3E%20(schema)>) target\_country: Optional\[str] [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20targetCountry%20%3E%20(schema)>) target\_industry: Optional\[str] [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20create%20%3E%20(params)%20default%20%3E%20(param)%20targetIndustry%20%3E%20(schema)>) ##### ReturnsExpand Collapse
class ThreatEventCreateResponse: … attacker: str Link to this property attacker\_country: str Link to this property attacker\_country\_alpha3: str Link to this property category: str Link to this property dataset\_id: str Link to this property date: str Link to this property event: str Link to this property has\_children: bool Link to this property indicator: str Link to this property indicator\_type: str Link to this property indicator\_type\_id: float Link to this property kill\_chain: float Link to this property mitre\_attack: List\[str] Link to this property mitre\_capec: List\[str] Link to this property num\_referenced: float Link to this property num\_references: float Link to this property raw\_id: str Link to this property referenced: List\[str] Link to this property referenced\_ids: List\[float] Link to this property references: List\[str] Link to this property references\_ids: List\[float] Link to this property tags: List\[str] Link to this property target\_country: str Link to this property target\_country\_alpha3: str Link to this property target\_industry: str Link to this property tlp: str Link to this property uuid: str Link to this property insight: Optional\[str] Link to this property releasability\_id: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_create_response%20%3E%20(schema)>) ### Creates a new event Python HTTPTypeScriptPythonGoTerraform ``` import os from datetime import datetime from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) threat_event = client.cloudforce_one.threat_events.create( path_account_id="account_id", category="Domain Resolution", date=datetime.fromisoformat("2022-04-01T00:00:00"), event="An attacker registered the domain domain.com", raw={ "data": { "foo": "bar" } }, tlp="amber", ) print(threat_event.uuid) ``` 200 example ``` { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ``` ##### Returns Examples 200 example ``` { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ```