--- title: Filter and list events --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/python) [Cloudforce One](https://developers.cloudflare.com/api/python/resources/cloudforce_one) [Threat Events](https://developers.cloudflare.com/api/python/resources/cloudforce_one/subresources/threat_events) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Filter and list events cloudforce\_one.threat\_events.list(ThreatEventListParams\*\*kwargs) -> [ThreatEventListResponse]() GET/accounts/{account\_id}/cloudforce-one/events Use `datasetId=all` or `datasetId=*` for the legacy all-datasets scope, `datasetId=analytics` for datasets with `isAnalytics=true`, or `datasetId=operational` for datasets with `isAnalytics=false` (limited to 50). Scope values must be used alone. When `datasetId` is unspecified, events are listed from the default Cloudforce One Threat Events dataset. To list existing datasets, use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint. ##### Security API Token The preferred authorization scheme for interacting with the Cloudflare API. [Create a token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/). **Example:**`Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY` ##### Accepted Permissions (at least one required) `Cloudforce One Write``Cloudforce One Read` ##### ParametersExpand Collapse account\_id: str Account ID. [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20account_id%20%3E%20(schema)>) cache: Optional\[Literal\["from-graph"]] Cache strategy. ‘from-graph’ serves results from the graph-node KV cache when all requested UUIDs are cached; falls back to normal path on partial/zero hit. [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20cache%20%3E%20(schema)>) cursor: Optional\[str] Cursor for pagination. When provided, filters are embedded in the cursor so you only need to pass cursor and pageSize. Returned in the previous response’s result\_info.cursor field. Use cursor-based pagination for deep pagination (beyond 100,000 records) or for optimal performance. [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20cursor%20%3E%20(schema)>) dataset\_id: Optional\[Sequence\[str]] Dataset UUIDs to query, or one standalone scope value: ‘all’/’\*’ for the legacy all-datasets behavior, ‘analytics’ for isAnalytics=true datasets, or ‘operational’ for isAnalytics=false datasets. If not provided, uses the default dataset. [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20datasetId%20%3E%20(schema)>) force\_refresh: Optional\[[bool]()] [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20forceRefresh%20%3E%20(schema)>)
format: Optional\[Literal\["json", "stix2", "taxii"]] One of the following: "json" Link to this property "stix2" Link to this property "taxii" Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20format%20%3E%20(schema)>)
order: Optional\[Literal\["asc", "desc"]] One of the following: "asc" Link to this property "desc" Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20order%20%3E%20(schema)>) order\_by: Optional\[str] [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20orderBy%20%3E%20(schema)>) page: Optional\[float] Page number (1-indexed) for offset-based pagination. Limited to offset of 100,000 records. For deep pagination, use cursor-based pagination instead. [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20page%20%3E%20(schema)>) page\_size: Optional\[float] Number of results per page. Maximum 25,000. [Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20pageSize%20%3E%20(schema)>)
search: Optional\[Iterable\[Search]] One of the following:
class SearchUnionMember0: …
field: Literal\["attacker", "attackerCountry", "category", 12 more] One of the following: "attacker" Link to this property "attackerCountry" Link to this property "category" Link to this property "createdAt" Link to this property "date" Link to this property "event" Link to this property "indicator" Link to this property "indicatorType" Link to this property "mitreAttack" Link to this property "mitreCapec" Link to this property "tags" Link to this property "targetCountry" Link to this property "targetIndustry" Link to this property "tlp" Link to this property "uuid" Link to this property
Link to this property
op: Literal\["equals", "not", "gt", 8 more] One of the following: "equals" Link to this property "not" Link to this property "gt" Link to this property "gte" Link to this property "lt" Link to this property "lte" Link to this property "like" Link to this property "contains" Link to this property "startsWith" Link to this property "endsWith" Link to this property "find" Link to this property
Link to this property value: str maxLength512 minLength1 Link to this property
Link to this property
class SearchUnionMember1: …
field: Literal\["attacker", "attackerCountry", "category", 12 more] One of the following: "attacker" Link to this property "attackerCountry" Link to this property "category" Link to this property "createdAt" Link to this property "date" Link to this property "event" Link to this property "indicator" Link to this property "indicatorType" Link to this property "mitreAttack" Link to this property "mitreCapec" Link to this property "tags" Link to this property "targetCountry" Link to this property "targetIndustry" Link to this property "tlp" Link to this property "uuid" Link to this property
Link to this property op: Literal\["in"] Link to this property value: Sequence\[str] Link to this property
Link to this property
class SearchUnionMember2: … field: Literal\["killChain"] Link to this property
op: Literal\["equals", "not", "gt", 3 more] One of the following: "equals" Link to this property "not" Link to this property "gt" Link to this property "gte" Link to this property "lt" Link to this property "lte" Link to this property
Link to this property
value: Union\[float, str] One of the following: float Link to this property str Link to this property
Link to this property
Link to this property
class SearchUnionMember3: … field: Literal\["killChain"] Link to this property op: Literal\["in"] Link to this property
value: Sequence\[Union\[float, str]] One of the following: float Link to this property str Link to this property
Link to this property
Link to this property
class SearchUnionMember4: … field: Literal\["hasChildren"] Link to this property
op: Literal\["equals", "not", "gt", 3 more] One of the following: "equals" Link to this property "not" Link to this property "gt" Link to this property "gte" Link to this property "lt" Link to this property "lte" Link to this property
Link to this property
value: Union\[bool, object] One of the following: bool Link to this property object Link to this property
Link to this property
Link to this property
class SearchUnionMember5: … field: Literal\["hasChildren"] Link to this property op: Literal\["in"] Link to this property
value: Iterable\[Union\[bool, object]] One of the following: bool Link to this property object Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20search%20%3E%20(schema)>)
search\_branches: Optional\[Iterable\[Iterable\[SearchBranch]]] JSON-encoded. OR branches of structured search filters. Filters within a branch are AND’d, branches are OR’d, and the result is AND’d with search: AND(search) AND OR(AND(branch 1), ...). Max 8 branches of 1-10 conditions each. Not supported for analytics datasets, and indicator filters are not yet supported inside branches. Cursor pages carry the original branches, so do not resend them with cursor. One of the following:
class SearchBranchUnionMember0: …
field: Literal\["attacker", "attackerCountry", "category", 12 more] One of the following: "attacker" Link to this property "attackerCountry" Link to this property "category" Link to this property "createdAt" Link to this property "date" Link to this property "event" Link to this property "indicator" Link to this property "indicatorType" Link to this property "mitreAttack" Link to this property "mitreCapec" Link to this property "tags" Link to this property "targetCountry" Link to this property "targetIndustry" Link to this property "tlp" Link to this property "uuid" Link to this property
Link to this property
op: Literal\["equals", "not", "gt", 8 more] One of the following: "equals" Link to this property "not" Link to this property "gt" Link to this property "gte" Link to this property "lt" Link to this property "lte" Link to this property "like" Link to this property "contains" Link to this property "startsWith" Link to this property "endsWith" Link to this property "find" Link to this property
Link to this property value: str maxLength512 minLength1 Link to this property
Link to this property
class SearchBranchUnionMember1: …
field: Literal\["attacker", "attackerCountry", "category", 12 more] One of the following: "attacker" Link to this property "attackerCountry" Link to this property "category" Link to this property "createdAt" Link to this property "date" Link to this property "event" Link to this property "indicator" Link to this property "indicatorType" Link to this property "mitreAttack" Link to this property "mitreCapec" Link to this property "tags" Link to this property "targetCountry" Link to this property "targetIndustry" Link to this property "tlp" Link to this property "uuid" Link to this property
Link to this property op: Literal\["in"] Link to this property value: Sequence\[str] Link to this property
Link to this property
class SearchBranchUnionMember2: … field: Literal\["killChain"] Link to this property
op: Literal\["equals", "not", "gt", 3 more] One of the following: "equals" Link to this property "not" Link to this property "gt" Link to this property "gte" Link to this property "lt" Link to this property "lte" Link to this property
Link to this property
value: Union\[float, str] One of the following: float Link to this property str Link to this property
Link to this property
Link to this property
class SearchBranchUnionMember3: … field: Literal\["killChain"] Link to this property op: Literal\["in"] Link to this property
value: Sequence\[Union\[float, str]] One of the following: float Link to this property str Link to this property
Link to this property
Link to this property
class SearchBranchUnionMember4: … field: Literal\["hasChildren"] Link to this property
op: Literal\["equals", "not", "gt", 3 more] One of the following: "equals" Link to this property "not" Link to this property "gt" Link to this property "gte" Link to this property "lt" Link to this property "lte" Link to this property
Link to this property
value: Union\[bool, object] One of the following: bool Link to this property object Link to this property
Link to this property
Link to this property
class SearchBranchUnionMember5: … field: Literal\["hasChildren"] Link to this property op: Literal\["in"] Link to this property
value: Iterable\[Union\[bool, object]] One of the following: bool Link to this property object Link to this property
Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20searchBranches%20%3E%20(schema)>) ##### ReturnsExpand Collapse
List\[ThreatEventListResponseItem] attacker: str Link to this property attacker\_country: str Link to this property attacker\_country\_alpha3: str Link to this property category: str Link to this property dataset\_id: str Link to this property date: str Link to this property event: str Link to this property has\_children: bool Link to this property indicator: str Link to this property indicator\_type: str Link to this property indicator\_type\_id: float Link to this property kill\_chain: float Link to this property mitre\_attack: List\[str] Link to this property mitre\_capec: List\[str] Link to this property num\_referenced: float Link to this property num\_references: float Link to this property raw\_id: str Link to this property referenced: List\[str] Link to this property referenced\_ids: List\[float] Link to this property references: List\[str] Link to this property references\_ids: List\[float] Link to this property tags: List\[str] Link to this property target\_country: str Link to this property target\_country\_alpha3: str Link to this property target\_industry: str Link to this property tlp: str Link to this property uuid: str Link to this property insight: Optional\[str] Link to this property releasability\_id: Optional\[str] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_list_response%20%3E%20(schema)>) ### Filter and list events Python HTTPTypeScriptPythonGoTerraform ``` import os from cloudflare import Cloudflare client = Cloudflare( api_token=os.environ.get("CLOUDFLARE_API_TOKEN"), # This is the default and can be omitted ) threat_events = client.cloudforce_one.threat_events.list( account_id="account_id", ) print(threat_events) ``` 200 example ``` [ { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ] ``` ##### Returns Examples 200 example ``` [ { "attacker": "Flying Yeti", "attackerCountry": "CN", "attackerCountryAlpha3": "CHN", "category": "Domain Resolution", "datasetId": "dataset-example-id", "date": "2022-04-01T00:00:00Z", "event": "An attacker registered the domain domain.com", "hasChildren": true, "indicator": "domain.com", "indicatorType": "domain", "indicatorTypeId": 5, "killChain": 0, "mitreAttack": [ " " ], "mitreCapec": [ " " ], "numReferenced": 0, "numReferences": 0, "rawId": "453gw34w3", "referenced": [ " " ], "referencedIds": [ 0 ], "references": [ " " ], "referencesIds": [ 0 ], "tags": [ "malware" ], "targetCountry": "US", "targetCountryAlpha3": "USA", "targetIndustry": "Agriculture", "tlp": "amber", "uuid": "12345678-1234-1234-1234-1234567890ab", "insight": "insight", "releasabilityId": "releasabilityId" } ] ```