Threat Events
Filter and list events
Creates a new event
Updates an event
Creates bulk events
Creates bulk DOS event with relationships and indicators
ModelsExpand Collapse
ThreatEventBulkCreateResponse object { createdEventsCount, createdTagsCount, errorCount, 4 more } Detailed result of bulk event creation with auto-tag management
Detailed result of bulk event creation with auto-tag management
Threat EventsAggregate
Aggregate events by single or multiple columns with optional date filtering
Threat EventsGraphql
GraphQL endpoint for event aggregation
Threat EventsGraph
Query graph neighborhood from R2 Data Catalog
Threat EventsQueries
List all saved event queries
Create a saved event query
Read a saved event query
Update a saved event query
Delete a saved event query
ModelsExpand Collapse
Threat EventsRelationships
Filter and list events related to specific event
Threat EventsIndicators
Lists indicators across multiple datasets
ModelsExpand Collapse
IndicatorListResponse object { properties, type }
properties: object { completeness, indicators, pagination }
completeness: object { properties, type }
indicators: object { items, type }
items: object { createdAt, indicatorType, sources, 8 more }
sources: array of object { resourceId, resourceType, system, title } RSS article sources from which this indicator was extracted.
RSS article sources from which this indicator was extracted.
relatedEvents: optional array of object { datasetId, eventId, eventDate } Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.
Threat EventsIndicatorsAggregate
Aggregate indicators by column(s)
Threat EventsIndicatorsTypes
Lists indicator types across multiple datasets
Threat EventsIndicatorsBy Dataset
Lists indicators
Reads an indicator
ModelsExpand Collapse
ByDatasetListResponse object { indicators, pagination }
indicators: array of object { createdAt, indicatorType, sources, 8 more }
sources: array of object { resourceId, resourceType, system, title } RSS article sources from which this indicator was extracted.
RSS article sources from which this indicator was extracted.
relatedEvents: optional array of object { datasetId, eventId, eventDate } Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.
ByDatasetGetResponse object { createdAt, indicatorType, updatedAt, 7 more }
relatedEvents: optional array of object { datasetId, eventId, eventDate } Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.
Threat EventsIndicatorsBy DatasetTags
List mirrored tags for an indicator dataset
Threat EventsAttackers
Lists attackers across multiple datasets
Threat EventsCategories
Lists categories across multiple datasets
Creates a new category
Updates a category
Deletes a category
ModelsExpand Collapse
Threat EventsCategoriesCatalog
Lists categories
Threat EventsCountries
Retrieves countries information for all countries
Threat EventsCrons
Threat EventsDatasets
Lists all datasets in an account
Reads a dataset
Creates a dataset
Updates an existing dataset
Delete a dataset
Reads raw data for an event by UUID
ModelsExpand Collapse
DatasetListResponse = array of object { indicatorWriteMode, isAnalytics, isPublic, 3 more }
Threat EventsDatasetsHealth
Threat EventsDatasetsEvents
Reads an event
Threat EventsRaw
Reads data for a raw event
Updates a raw event
Threat EventsRelate
Removes an event reference
Threat EventsTags
Lists all tags (SoT)
Creates a new tag
Updates a tag (SoT)
Deletes a tag (SoT)
ModelsExpand Collapse
TagListResponse object { pagination, tags }
tags: array of object { uuid, value, activeDuration, 34 more }
aliases: optional array of object { value, confidence, tlp } Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).
Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).
externalReferences: optional array of object { url, description } Structured external references ({ url, description }). Public: returned to all accounts.
Structured external references ({ url, description }). Public: returned to all accounts.
internalAliases: optional array of object { value, confidence, tlp } Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.
Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.
ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.
Parsed custom field values. Null when the tag has no custom fields.
TagCreateResponse object { uuid, value, activeDuration, 34 more }
aliases: optional array of object { value, confidence, tlp } Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).
Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).
externalReferences: optional array of object { url, description } Structured external references ({ url, description }). Public: returned to all accounts.
Structured external references ({ url, description }). Public: returned to all accounts.
internalAliases: optional array of object { value, confidence, tlp } Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.
Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.
ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.
Parsed custom field values. Null when the tag has no custom fields.
TagEditResponse object { uuid, value, activeDuration, 34 more }
aliases: optional array of object { value, confidence, tlp } Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).
Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).
externalReferences: optional array of object { url, description } Structured external references ({ url, description }). Public: returned to all accounts.
Structured external references ({ url, description }). Public: returned to all accounts.
internalAliases: optional array of object { value, confidence, tlp } Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.
Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.
ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.
Parsed custom field values. Null when the tag has no custom fields.
Threat EventsTagsCategories
Lists all tag categories (SoT)
Creates a new tag category (SoT)
Updates a tag category (SoT)
Deletes a tag category (SoT)
ModelsExpand Collapse
CategoryListResponse object { categories }
categories: array of object { name, uuid, createdAt, 3 more }
schema: optional array of object { key, kind, allowedValues, 11 more } Parsed FieldDefinition[] defining custom fields for this category, or null if none.
Parsed FieldDefinition[] defining custom fields for this category, or null if none.
Marks a field as unavailable for new values while retaining its definition for historical values.
Enum values unavailable for new writes but retained in allowedValues for historical display.
CategoryCreateResponse object { name, uuid, createdAt, 3 more }
schema: optional array of object { key, kind, allowedValues, 11 more } Parsed FieldDefinition[] defining custom fields for this category, or null if none.
Parsed FieldDefinition[] defining custom fields for this category, or null if none.
Marks a field as unavailable for new values while retaining its definition for historical values.
Enum values unavailable for new writes but retained in allowedValues for historical display.
CategoryEditResponse object { name, uuid, createdAt, 3 more }
schema: optional array of object { key, kind, allowedValues, 11 more } Parsed FieldDefinition[] defining custom fields for this category, or null if none.
Parsed FieldDefinition[] defining custom fields for this category, or null if none.
Marks a field as unavailable for new values while retaining its definition for historical values.
Enum values unavailable for new writes but retained in allowedValues for historical display.
Threat EventsTagsIndicators
List indicators related to a tag
ModelsExpand Collapse
IndicatorListResponse object { indicators, pagination }
indicators: array of object { createdAt, indicatorType, updatedAt, 7 more }
relatedEvents: optional array of object { datasetId, eventId, eventDate } Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.
Threat EventsTagsIndicatorsBy Dataset
List indicators related to a tag within a dataset (deprecated)
ModelsExpand Collapse
ByDatasetListResponse object { indicators, pagination }
indicators: array of object { createdAt, indicatorType, updatedAt, 7 more }
relatedEvents: optional array of object { datasetId, eventId, eventDate } Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.