--- title: Threat Events --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) [Cloudforce One](https://developers.cloudflare.com/api/resources/cloudforce_one) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Threat Events ##### [Filter and list events](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/list) GET/accounts/{account\_id}/cloudforce-one/events ##### [Reads an event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/get) Deprecated GET/accounts/{account\_id}/cloudforce-one/events/{event\_id} ##### [Creates a new event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/create) POST/accounts/{account\_id}/cloudforce-one/events/create ##### [Updates an event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/edit) PATCH/accounts/{account\_id}/cloudforce-one/events/{event\_id} ##### [Creates bulk events](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/bulk_create) POST/accounts/{account\_id}/cloudforce-one/events/create/bulk ##### [Creates bulk DOS event with relationships and indicators](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/methods/bulk_create_relationships) Deprecated POST/accounts/{account\_id}/cloudforce-one/events/create/bulk/relationships ##### ModelsExpand Collapse
ThreatEventListResponse = array of object {attacker, attackerCountry, attackerCountryAlpha3, 26 more } attacker: string Link to this property attackerCountry: string Link to this property attackerCountryAlpha3: string Link to this property category: string Link to this property datasetId: string Link to this property date: string Link to this property event: string Link to this property hasChildren: boolean Link to this property indicator: string Link to this property indicatorType: string Link to this property indicatorTypeId: number Link to this property killChain: number Link to this property mitreAttack: array of string Link to this property mitreCapec: array of string Link to this property numReferenced: number Link to this property numReferences: number Link to this property rawId: string Link to this property referenced: array of string Link to this property referencedIds: array of number Link to this property references: array of string Link to this property referencesIds: array of number Link to this property tags: array of string Link to this property targetCountry: string Link to this property targetCountryAlpha3: string Link to this property targetIndustry: string Link to this property tlp: string Link to this property uuid: string Link to this property insight: optional string Link to this property releasabilityId: optional string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_list_response%20%3E%20(schema)>)
ThreatEventGetResponse object {attacker, attackerCountry, attackerCountryAlpha3, 26 more } attacker: string Link to this property attackerCountry: string Link to this property attackerCountryAlpha3: string Link to this property category: string Link to this property datasetId: string Link to this property date: string Link to this property event: string Link to this property hasChildren: boolean Link to this property indicator: string Link to this property indicatorType: string Link to this property indicatorTypeId: number Link to this property killChain: number Link to this property mitreAttack: array of string Link to this property mitreCapec: array of string Link to this property numReferenced: number Link to this property numReferences: number Link to this property rawId: string Link to this property referenced: array of string Link to this property referencedIds: array of number Link to this property references: array of string Link to this property referencesIds: array of number Link to this property tags: array of string Link to this property targetCountry: string Link to this property targetCountryAlpha3: string Link to this property targetIndustry: string Link to this property tlp: string Link to this property uuid: string Link to this property insight: optional string Link to this property releasabilityId: optional string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_get_response%20%3E%20(schema)>)
ThreatEventCreateResponse object {attacker, attackerCountry, attackerCountryAlpha3, 26 more } attacker: string Link to this property attackerCountry: string Link to this property attackerCountryAlpha3: string Link to this property category: string Link to this property datasetId: string Link to this property date: string Link to this property event: string Link to this property hasChildren: boolean Link to this property indicator: string Link to this property indicatorType: string Link to this property indicatorTypeId: number Link to this property killChain: number Link to this property mitreAttack: array of string Link to this property mitreCapec: array of string Link to this property numReferenced: number Link to this property numReferences: number Link to this property rawId: string Link to this property referenced: array of string Link to this property referencedIds: array of number Link to this property references: array of string Link to this property referencesIds: array of number Link to this property tags: array of string Link to this property targetCountry: string Link to this property targetCountryAlpha3: string Link to this property targetIndustry: string Link to this property tlp: string Link to this property uuid: string Link to this property insight: optional string Link to this property releasabilityId: optional string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_create_response%20%3E%20(schema)>)
ThreatEventEditResponse object {attacker, attackerCountry, attackerCountryAlpha3, 26 more } attacker: string Link to this property attackerCountry: string Link to this property attackerCountryAlpha3: string Link to this property category: string Link to this property datasetId: string Link to this property date: string Link to this property event: string Link to this property hasChildren: boolean Link to this property indicator: string Link to this property indicatorType: string Link to this property indicatorTypeId: number Link to this property killChain: number Link to this property mitreAttack: array of string Link to this property mitreCapec: array of string Link to this property numReferenced: number Link to this property numReferences: number Link to this property rawId: string Link to this property referenced: array of string Link to this property referencedIds: array of number Link to this property references: array of string Link to this property referencesIds: array of number Link to this property tags: array of string Link to this property targetCountry: string Link to this property targetCountryAlpha3: string Link to this property targetIndustry: string Link to this property tlp: string Link to this property uuid: string Link to this property insight: optional string Link to this property releasabilityId: optional string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_edit_response%20%3E%20(schema)>)
ThreatEventBulkCreateResponse object {createdEventsCount, createdTagsCount, errorCount, 4 more } Detailed result of bulk event creation with auto-tag management createdEventsCount: number Number of events created Link to this property createdTagsCount: number Number of new tags created in SoT Link to this property errorCount: number Number of errors encountered Link to this property queuedIndicatorsCount: number Number of indicators queued for async processing Link to this property createBulkEventsRequestId: optional string Correlation ID for async indicator processing formatuuid Link to this property
createdEvents: optional array of object {eventIndex, shardId, uuid } Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true eventIndex: number Original index in the input data array Link to this property shardId: string Dataset ID of the shard where the event was created Link to this property uuid: string UUID of the created event formatuuid Link to this property
Link to this property
errors: optional array of object {error, eventIndex } Array of error details error: string Error message Link to this property eventIndex: number Index of the event that caused the error Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_response%20%3E%20(schema)>)
ThreatEventBulkCreateRelationshipsResponse object {createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more } Result of bulk relationship creation operation createdEventsCount: number Number of events created Link to this property createdIndicatorsCount: number Number of indicators created Link to this property createdRelationshipsCount: number Number of relationships created Link to this property errorCount: number Number of errors encountered Link to this property
errors: optional array of object {error, eventIndex } Array of error details error: string Error message Link to this property eventIndex: number Index of the event that caused the error Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events%20%3E%20(model)%20threat_event_bulk_create_relationships_response%20%3E%20(schema)>) #### Threat EventsAggregate ##### [Aggregate events by single or multiple columns with optional date filtering](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/aggregate/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/aggregate ##### ModelsExpand Collapse
AggregateListResponse object {aggregateBy, aggregations, total, dateRange } aggregateBy: string Column(s) that were aggregated by Link to this property
aggregations: array of object {count, date } Array of aggregation results with dynamic fields based on aggregateBy columns count: number Number of events for this aggregation Link to this property date: optional string Date (if groupByDate is true) Link to this property
Link to this property total: number Total number of events in the aggregation Link to this property
dateRange: optional object {endDate, startDate } Date range used for filtering endDate: optional string Link to this property startDate: optional string Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.aggregate%20%3E%20(model)%20aggregate_list_response%20%3E%20(schema)>) #### Threat EventsGraphql ##### [GraphQL endpoint for event aggregation](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/graphql/methods/create) POST/accounts/{account\_id}/cloudforce-one/events/graphql ##### ModelsExpand Collapse
GraphqlCreateResponse object {data, errors } data: optional unknown Link to this property errors: optional array of unknown Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.graphql%20%3E%20(model)%20graphql_create_response%20%3E%20(schema)>) #### Threat EventsGraph ##### [Query graph neighborhood from R2 Data Catalog](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/graph/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/graph ##### ModelsExpand Collapse
GraphListResponse object {edges, node, nodes }
edges: array of object {id, relationshipType, source, 5 more } id: string Deterministic composite edge id (source→target:relationshipType) Link to this property relationshipType: string Link to this property source: string Compact id of the source node (type:uuid) Link to this property sourceId: string Link to this property sourceType: string Link to this property target: string Compact id of the target node (type:uuid) Link to this property targetId: string Link to this property targetType: string Link to this property
Link to this property node: map\[unknown] Focal node object (legacy single-seed). Null when unavailable. Link to this property nodes: array of map\[unknown] Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.graph%20%3E%20(model)%20graph_list_response%20%3E%20(schema)>) #### Threat EventsQueries ##### [List all saved event queries](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/queries ##### [Create a saved event query](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/create) POST/accounts/{account\_id}/cloudforce-one/events/queries/create ##### [Read a saved event query](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/get) GET/accounts/{account\_id}/cloudforce-one/events/queries/{query\_id} ##### [Update a saved event query](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/edit) PATCH/accounts/{account\_id}/cloudforce-one/events/queries/{query\_id} ##### [Delete a saved event query](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/queries/methods/delete) DELETE/accounts/{account\_id}/cloudforce-one/events/queries/{query\_id} ##### ModelsExpand Collapse
QueryListResponse = array of object {id, account\_id, alert\_enabled, 10 more } id: number Unique identifier for the saved query Link to this property account\_id: number Account ID Link to this property alert\_enabled: boolean Whether alerts are enabled Link to this property alert\_rollup\_enabled: boolean Whether alert rollup is enabled Link to this property created\_at: string Creation timestamp Link to this property name: string Name of the saved query Link to this property query\_json: string JSON string containing the query parameters Link to this property rule\_enabled: boolean Whether rule is enabled Link to this property updated\_at: string Last update timestamp Link to this property user\_email: string Email of the user who created the query Link to this property custom\_threat\_feed\_id: optional number Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id: optional string WAF rules list ID for blocking Link to this property rule\_scope: optional string Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_list_response%20%3E%20(schema)>)
QueryCreateResponse object {id, account\_id, alert\_enabled, 10 more } id: number Unique identifier for the saved query Link to this property account\_id: number Account ID Link to this property alert\_enabled: boolean Whether alerts are enabled Link to this property alert\_rollup\_enabled: boolean Whether alert rollup is enabled Link to this property created\_at: string Creation timestamp Link to this property name: string Name of the saved query Link to this property query\_json: string JSON string containing the query parameters Link to this property rule\_enabled: boolean Whether rule is enabled Link to this property updated\_at: string Last update timestamp Link to this property user\_email: string Email of the user who created the query Link to this property custom\_threat\_feed\_id: optional number Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id: optional string WAF rules list ID for blocking Link to this property rule\_scope: optional string Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_create_response%20%3E%20(schema)>)
QueryGetResponse object {id, account\_id, alert\_enabled, 10 more } id: number Unique identifier for the saved query Link to this property account\_id: number Account ID Link to this property alert\_enabled: boolean Whether alerts are enabled Link to this property alert\_rollup\_enabled: boolean Whether alert rollup is enabled Link to this property created\_at: string Creation timestamp Link to this property name: string Name of the saved query Link to this property query\_json: string JSON string containing the query parameters Link to this property rule\_enabled: boolean Whether rule is enabled Link to this property updated\_at: string Last update timestamp Link to this property user\_email: string Email of the user who created the query Link to this property custom\_threat\_feed\_id: optional number Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id: optional string WAF rules list ID for blocking Link to this property rule\_scope: optional string Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_get_response%20%3E%20(schema)>)
QueryEditResponse object {id, account\_id, alert\_enabled, 10 more } id: number Unique identifier for the saved query Link to this property account\_id: number Account ID Link to this property alert\_enabled: boolean Whether alerts are enabled Link to this property alert\_rollup\_enabled: boolean Whether alert rollup is enabled Link to this property created\_at: string Creation timestamp Link to this property name: string Name of the saved query Link to this property query\_json: string JSON string containing the query parameters Link to this property rule\_enabled: boolean Whether rule is enabled Link to this property updated\_at: string Last update timestamp Link to this property user\_email: string Email of the user who created the query Link to this property custom\_threat\_feed\_id: optional number Intel Indicator Feed ID (numeric) Link to this property rule\_list\_id: optional string WAF rules list ID for blocking Link to this property rule\_scope: optional string Scope for the rule Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.queries%20%3E%20(model)%20query_edit_response%20%3E%20(schema)>) #### Threat EventsRelationships ##### [Filter and list events related to specific event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/relationships/methods/list) Deprecated GET/accounts/{account\_id}/cloudforce-one/events/{event\_id}/relationships ##### ModelsExpand Collapse
RelationshipListResponse = array of object {attacker, attackerCountry, attackerCountryAlpha3, 26 more } attacker: string Link to this property attackerCountry: string Link to this property attackerCountryAlpha3: string Link to this property category: string Link to this property datasetId: string Link to this property date: string Link to this property event: string Link to this property hasChildren: boolean Link to this property indicator: string Link to this property indicatorType: string Link to this property indicatorTypeId: number Link to this property killChain: number Link to this property mitreAttack: array of string Link to this property mitreCapec: array of string Link to this property numReferenced: number Link to this property numReferences: number Link to this property rawId: string Link to this property referenced: array of string Link to this property referencedIds: array of number Link to this property references: array of string Link to this property referencesIds: array of number Link to this property tags: array of string Link to this property targetCountry: string Link to this property targetCountryAlpha3: string Link to this property targetIndustry: string Link to this property tlp: string Link to this property uuid: string Link to this property insight: optional string Link to this property releasabilityId: optional string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.relationships%20%3E%20(model)%20relationship_list_response%20%3E%20(schema)>) #### Threat EventsIndicators ##### [Lists indicators across multiple datasets](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/indicators/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/indicators ##### ModelsExpand Collapse
IndicatorListResponse object {properties, type }
properties: object {completeness, indicators, pagination }
completeness: object {properties, type }
properties: object {complete, failedDatasets, failedShards, warnings }
complete: object {type } type: string Link to this property
Link to this property
failedDatasets: object {items, type }
items: object {type } type: string Link to this property
Link to this property type: string Link to this property
Link to this property
failedShards: object {items, type }
items: object {properties, type }
properties: object {datasetId, shardId }
datasetId: object {type } type: string Link to this property
Link to this property
shardId: object {type } type: string Link to this property
Link to this property
Link to this property type: string Link to this property
Link to this property type: string Link to this property
Link to this property
warnings: object {items, type }
items: object {type } type: string Link to this property
Link to this property type: string Link to this property
Link to this property
Link to this property type: string Link to this property
Link to this property
indicators: object {items, type }
items: object {createdAt, indicatorType, sources, 8 more } createdAt: string formatdate-time Link to this property indicatorType: string Link to this property
sources: array of object {resourceId, resourceType, system, title } RSS article sources from which this indicator was extracted. resourceId: string formatuuid Link to this property resourceType: "article" Link to this property system: "threat-signals" Link to this property title: string Threat Signals article title; null for historical provenance without a stored title. Link to this property
Link to this property updatedAt: string formatdate-time Link to this property uuid: string Link to this property value: string Link to this property datasetId: optional string The dataset ID this indicator belongs to. Included in list responses. Link to this property
relatedEvents: optional array of object {datasetId, eventId, eventDate } Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. datasetId: string Link to this property eventId: string Link to this property eventDate: optional string ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property relatedEventsHasMore: optional boolean True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags: optional array of object {categoryId, categoryName, uuid, value } categoryId: optional string The UUID of the tag category, or null when the tag is uncategorized. Link to this property categoryName: optional string Link to this property uuid: optional string Link to this property value: optional string Link to this property
Link to this property tlp: optional string Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property type: string Link to this property
Link to this property
pagination: object {properties, type }
properties: object {count, cursor, has\_more, 4 more }
count: object {type } type: string Link to this property
Link to this property
cursor: object {description, nullable, type } description: string Link to this property nullable: boolean Link to this property type: string Link to this property
Link to this property
has\_more: object {description, type } description: string Link to this property type: string Link to this property
Link to this property
page: object {type } type: string Link to this property
Link to this property
per\_page: object {type } type: string Link to this property
Link to this property
total\_count: object {description, nullable, type } description: string Link to this property nullable: boolean Link to this property type: string Link to this property
Link to this property
total\_count\_is\_exact: object {description, type } description: string Link to this property type: string Link to this property
Link to this property
Link to this property type: string Link to this property
Link to this property
Link to this property type: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>) #### Threat EventsIndicatorsAggregate ##### [Aggregate indicators by column(s)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/aggregate/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/indicators/aggregate ##### ModelsExpand Collapse
AggregateListResponse object {aggregateBy, aggregations, failedDatasets, total } aggregateBy: string Column(s) that were aggregated by Link to this property
aggregations: array of object {count } Array of aggregation results with dynamic fields based on aggregateBy columns count: number Number of indicators for this aggregation Link to this property
Link to this property failedDatasets: number Number of datasets whose aggregation failed and were excluded from the result Link to this property total: number Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.aggregate%20%3E%20(model)%20aggregate_list_response%20%3E%20(schema)>) #### Threat EventsIndicatorsTypes ##### [Lists indicator types across multiple datasets](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/types/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/indicator-types ##### ModelsExpand Collapse
TypeListResponse object {items, type }
items: object {type } type: string Link to this property
Link to this property type: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.types%20%3E%20(model)%20type_list_response%20%3E%20(schema)>) #### Threat EventsIndicatorsBy Dataset ##### [Lists indicators](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/by_dataset/methods/list) Deprecated GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/indicators ##### [Reads an indicator](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/by_dataset/methods/get) GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/indicators/{indicator\_id} ##### ModelsExpand Collapse
ByDatasetListResponse object {indicators, pagination }
indicators: array of object {createdAt, indicatorType, sources, 8 more } createdAt: string formatdate-time Link to this property indicatorType: string Link to this property
sources: array of object {resourceId, resourceType, system, title } RSS article sources from which this indicator was extracted. resourceId: string formatuuid Link to this property resourceType: "article" Link to this property system: "threat-signals" Link to this property title: string Threat Signals article title; null for historical provenance without a stored title. Link to this property
Link to this property updatedAt: string formatdate-time Link to this property uuid: string Link to this property value: string Link to this property datasetId: optional string The dataset ID this indicator belongs to. Included in list responses. Link to this property
relatedEvents: optional array of object {datasetId, eventId, eventDate } Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. datasetId: string Link to this property eventId: string Link to this property eventDate: optional string ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property relatedEventsHasMore: optional boolean True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags: optional array of object {categoryId, categoryName, uuid, value } categoryId: optional string The UUID of the tag category, or null when the tag is uncategorized. Link to this property categoryName: optional string Link to this property uuid: optional string Link to this property value: optional string Link to this property
Link to this property tlp: optional string Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property
pagination: object {page, pageSize, totalCount, totalPages } page: number Link to this property pageSize: number Link to this property totalCount: number Link to this property totalPages: number Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.by_dataset%20%3E%20(model)%20by_dataset_list_response%20%3E%20(schema)>)
ByDatasetGetResponse object {createdAt, indicatorType, updatedAt, 7 more } createdAt: string formatdate-time Link to this property indicatorType: string Link to this property updatedAt: string formatdate-time Link to this property uuid: string Link to this property value: string Link to this property datasetId: optional string The dataset ID this indicator belongs to. Included in list responses. Link to this property
relatedEvents: optional array of object {datasetId, eventId, eventDate } Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. datasetId: string Link to this property eventId: string Link to this property eventDate: optional string ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property relatedEventsHasMore: optional boolean True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags: optional array of object {categoryId, categoryName, uuid, value } categoryId: optional string The UUID of the tag category, or null when the tag is uncategorized. Link to this property categoryName: optional string Link to this property uuid: optional string Link to this property value: optional string Link to this property
Link to this property tlp: optional string Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.by_dataset%20%3E%20(model)%20by_dataset_get_response%20%3E%20(schema)>) #### Threat EventsIndicatorsBy DatasetTags ##### [List mirrored tags for an indicator dataset](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/indicators/subresources/by_dataset/subresources/tags/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/indicators/tags ##### ModelsExpand Collapse TagListResponse = array of unknown Array of mirror tag rows [Link to this property](<#(resource)%20cloudforce_one.threat_events.indicators.by_dataset.tags%20%3E%20(model)%20tag_list_response%20%3E%20(schema)>) #### Threat EventsAttackers ##### [Lists attackers across multiple datasets](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/attackers/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/attackers ##### ModelsExpand Collapse
AttackerListResponse object {items, type }
items: object {type } type: string Link to this property
Link to this property type: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.attackers%20%3E%20(model)%20attacker_list_response%20%3E%20(schema)>) #### Threat EventsCategories ##### [Lists categories across multiple datasets](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/categories ##### [Reads a category](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/get) Deprecated GET/accounts/{account\_id}/cloudforce-one/events/categories/{category\_id} ##### [Creates a new category](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/create) POST/accounts/{account\_id}/cloudforce-one/events/categories/create ##### [Updates a category](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/edit) Deprecated PATCH/accounts/{account\_id}/cloudforce-one/events/categories/{category\_id} ##### [Deletes a category](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/categories/methods/delete) Deprecated DELETE/accounts/{account\_id}/cloudforce-one/events/categories/{category\_id} ##### ModelsExpand Collapse
CategoryListResponse = array of object {killChain, name, uuid, 3 more } killChain: number Link to this property name: string Link to this property uuid: string Link to this property mitreAttack: optional array of string Link to this property mitreCapec: optional array of string Link to this property shortname: optional string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>)
CategoryGetResponse object {killChain, name, uuid, 3 more } killChain: number Link to this property name: string Link to this property uuid: string Link to this property mitreAttack: optional array of string Link to this property mitreCapec: optional array of string Link to this property shortname: optional string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_get_response%20%3E%20(schema)>)
CategoryCreateResponse object {killChain, name, uuid, 3 more } killChain: number Link to this property name: string Link to this property uuid: string Link to this property mitreAttack: optional array of string Link to this property mitreCapec: optional array of string Link to this property shortname: optional string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_create_response%20%3E%20(schema)>)
CategoryEditResponse object {killChain, name, uuid, 3 more } killChain: number Link to this property name: string Link to this property uuid: string Link to this property mitreAttack: optional array of string Link to this property mitreCapec: optional array of string Link to this property shortname: optional string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_edit_response%20%3E%20(schema)>)
CategoryDeleteResponse object {uuid } uuid: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories%20%3E%20(model)%20category_delete_response%20%3E%20(schema)>) #### Threat EventsCategoriesCatalog ##### [Lists categories](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/categories/subresources/catalog/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/categories/catalog ##### ModelsExpand Collapse
CatalogListResponse = array of object {killChain, name, uuid, 3 more } killChain: number Link to this property name: string Link to this property uuid: string Link to this property mitreAttack: optional array of string Link to this property mitreCapec: optional array of string Link to this property shortname: optional string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.categories.catalog%20%3E%20(model)%20catalog_list_response%20%3E%20(schema)>) #### Threat EventsCountries ##### [Retrieves countries information for all countries](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/countries/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/countries ##### ModelsExpand Collapse
CountryListResponse = array of object {result, success }
result: array of object {alpha2, alpha3, name } alpha2: string Link to this property alpha3: string Link to this property name: string Link to this property
Link to this property success: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.countries%20%3E%20(model)%20country_list_response%20%3E%20(schema)>) #### Threat EventsCrons #### Threat EventsDatasets ##### [Lists all datasets in an account](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/dataset ##### [Reads a dataset](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/get) GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id} ##### [Creates a dataset](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/create) POST/accounts/{account\_id}/cloudforce-one/events/dataset/create ##### [Updates an existing dataset](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/edit) PATCH/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id} ##### [Delete a dataset](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/delete) DELETE/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id} ##### [Reads raw data for an event by UUID](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/raw) Deprecated GET/accounts/{account\_id}/cloudforce-one/events/raw/{dataset\_id}/{event\_id} ##### ModelsExpand Collapse
DatasetListResponse = array of object {indicatorWriteMode, isAnalytics, isPublic, 3 more }
indicatorWriteMode: "read\_only"or "create\_only"or "full" Effective indicator mutation capability after account/dataset authorization and dataset storage capability are applied. API Gateway method permissions are separate and must also allow the requested operation. One of the following: "read\_only" Link to this property "create\_only" Link to this property "full" Link to this property
Link to this property isAnalytics: boolean Link to this property isPublic: boolean Link to this property name: string Link to this property uuid: string Link to this property deletedAt: optional string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_list_response%20%3E%20(schema)>)
DatasetGetResponse object {isAnalytics, isPublic, name, uuid } isAnalytics: boolean Link to this property isPublic: boolean Link to this property name: string Link to this property uuid: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_get_response%20%3E%20(schema)>)
DatasetCreateResponse object {isAnalytics, isPublic, name, uuid } isAnalytics: boolean Link to this property isPublic: boolean Link to this property name: string Link to this property uuid: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_create_response%20%3E%20(schema)>)
DatasetEditResponse object {isAnalytics, isPublic, name, uuid } isAnalytics: boolean Link to this property isPublic: boolean Link to this property name: string Link to this property uuid: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_edit_response%20%3E%20(schema)>)
DatasetDeleteResponse object {name, uuid } name: string Link to this property uuid: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_delete_response%20%3E%20(schema)>)
DatasetRawResponse object {id, accountId, created, 3 more } id: number Link to this property accountId: number Link to this property created: string Link to this property data: string Link to this property source: string Link to this property tlp: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets%20%3E%20(model)%20dataset_raw_response%20%3E%20(schema)>) #### Threat EventsDatasetsHealth #### Threat EventsDatasetsEvents ##### [Reads an event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/subresources/events/methods/get) GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/events/{event\_id} ##### ModelsExpand Collapse
EventGetResponse object {attacker, attackerCountry, attackerCountryAlpha3, 26 more } attacker: string Link to this property attackerCountry: string Link to this property attackerCountryAlpha3: string Link to this property category: string Link to this property datasetId: string Link to this property date: string Link to this property event: string Link to this property hasChildren: boolean Link to this property indicator: string Link to this property indicatorType: string Link to this property indicatorTypeId: number Link to this property killChain: number Link to this property mitreAttack: array of string Link to this property mitreCapec: array of string Link to this property numReferenced: number Link to this property numReferences: number Link to this property rawId: string Link to this property referenced: array of string Link to this property referencedIds: array of number Link to this property references: array of string Link to this property referencesIds: array of number Link to this property tags: array of string Link to this property targetCountry: string Link to this property targetCountryAlpha3: string Link to this property targetIndustry: string Link to this property tlp: string Link to this property uuid: string Link to this property insight: optional string Link to this property releasabilityId: optional string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.datasets.events%20%3E%20(model)%20event_get_response%20%3E%20(schema)>) #### Threat EventsRaw ##### [Reads data for a raw event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/raw/methods/get) GET/accounts/{account\_id}/cloudforce-one/events/{event\_id}/raw/{raw\_id} ##### [Updates a raw event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/raw/methods/edit) PATCH/accounts/{account\_id}/cloudforce-one/events/{event\_id}/raw/{raw\_id} ##### ModelsExpand Collapse
RawGetResponse object {id, accountId, created, 3 more } id: string Link to this property accountId: number Link to this property created: string Link to this property data: unknown Link to this property source: string Link to this property tlp: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.raw%20%3E%20(model)%20raw_get_response%20%3E%20(schema)>)
RawEditResponse object {id, data } id: string Link to this property data: unknown Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.raw%20%3E%20(model)%20raw_edit_response%20%3E%20(schema)>) #### Threat EventsRelate ##### [Removes an event reference](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/relate/methods/delete) DELETE/accounts/{account\_id}/cloudforce-one/events/relate/{event\_id} ##### ModelsExpand Collapse
RelateDeleteResponse object {success } success: boolean Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.relate%20%3E%20(model)%20relate_delete_response%20%3E%20(schema)>) #### Threat EventsTags ##### [Lists all tags (SoT)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/tags ##### [Creates a new tag](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/create) POST/accounts/{account\_id}/cloudforce-one/events/tags/create ##### [Updates a tag (SoT)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/edit) PATCH/accounts/{account\_id}/cloudforce-one/events/tags/{tag\_uuid} ##### [Deletes a tag (SoT)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/methods/delete) DELETE/accounts/{account\_id}/cloudforce-one/events/tags/{tag\_uuid} ##### ModelsExpand Collapse
TagListResponse object {pagination, tags }
pagination: object {page, pageSize, totalCount, totalPages } page: number Link to this property pageSize: number Link to this property totalCount: number Link to this property totalPages: number Link to this property
Link to this property
tags: array of object {uuid, value, activeDuration, 34 more } uuid: string Link to this property value: string Link to this property activeDuration: optional string Link to this property
activeDuration\_annotated: optional object {value, tlp } value: string Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property actorCategory: optional string Link to this property
actorCategory\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
aliases: optional array of object {value, confidence, tlp } Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts). value: string Link to this property confidence: optional number maximum10 minimum1 Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property aliasGroupNames: optional array of string Link to this property aliasGroupNamesInternal: optional array of string Link to this property attributionOrganization: optional string Link to this property
attributionOrganization\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property categoryName: optional string Link to this property categoryUuid: optional string Link to this property confidence: optional number Overall tag confidence (1-10). maximum10 minimum1 Link to this property createdAt: optional string Link to this property dateOfDiscovery: optional string Link to this property description: optional string Link to this property externalReferenceLinks: optional array of string Link to this property
externalReferences: optional array of object {url, description } Structured external references ({ url, description }). Public: returned to all accounts. url: string Link to this property description: optional string Link to this property
Link to this property
externalReferences\_annotated: optional array of object {value, tlp } value: string Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
internalAliases: optional array of object {value, confidence, tlp } Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses. value: string Link to this property confidence: optional number maximum10 minimum1 Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property internalDescription: optional string Link to this property lastSeen: optional string Link to this property motive: optional string Link to this property
motive\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property opsecLevel: optional string Link to this property
opsecLevel\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property originCountryISO: optional string ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace. Link to this property
originCountryISO\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property priority: optional number Link to this property
priority\_annotated: optional object {value, tlp } value: number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property properties: optional map\[unknown] Parsed custom field values. Null when the tag has no custom fields. Link to this property sophisticationLevel: optional string Link to this property
sophisticationLevel\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more Tag-level TLP handling marking. One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property updatedAt: optional string Link to this property version: optional number Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_list_response%20%3E%20(schema)>)
TagCreateResponse object {uuid, value, activeDuration, 34 more } uuid: string Link to this property value: string Link to this property activeDuration: optional string Link to this property
activeDuration\_annotated: optional object {value, tlp } value: string Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property actorCategory: optional string Link to this property
actorCategory\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
aliases: optional array of object {value, confidence, tlp } Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts). value: string Link to this property confidence: optional number maximum10 minimum1 Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property aliasGroupNames: optional array of string Link to this property aliasGroupNamesInternal: optional array of string Link to this property attributionOrganization: optional string Link to this property
attributionOrganization\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property categoryName: optional string Link to this property categoryUuid: optional string Link to this property confidence: optional number Overall tag confidence (1-10). maximum10 minimum1 Link to this property createdAt: optional string Link to this property dateOfDiscovery: optional string Link to this property description: optional string Link to this property externalReferenceLinks: optional array of string Link to this property
externalReferences: optional array of object {url, description } Structured external references ({ url, description }). Public: returned to all accounts. url: string Link to this property description: optional string Link to this property
Link to this property
externalReferences\_annotated: optional array of object {value, tlp } value: string Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
internalAliases: optional array of object {value, confidence, tlp } Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses. value: string Link to this property confidence: optional number maximum10 minimum1 Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property internalDescription: optional string Link to this property lastSeen: optional string Link to this property motive: optional string Link to this property
motive\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property opsecLevel: optional string Link to this property
opsecLevel\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property originCountryISO: optional string ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace. Link to this property
originCountryISO\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property priority: optional number Link to this property
priority\_annotated: optional object {value, tlp } value: number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property properties: optional map\[unknown] Parsed custom field values. Null when the tag has no custom fields. Link to this property sophisticationLevel: optional string Link to this property
sophisticationLevel\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more Tag-level TLP handling marking. One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property updatedAt: optional string Link to this property version: optional number Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_create_response%20%3E%20(schema)>)
TagEditResponse object {uuid, value, activeDuration, 34 more } uuid: string Link to this property value: string Link to this property activeDuration: optional string Link to this property
activeDuration\_annotated: optional object {value, tlp } value: string Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property actorCategory: optional string Link to this property
actorCategory\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
aliases: optional array of object {value, confidence, tlp } Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts). value: string Link to this property confidence: optional number maximum10 minimum1 Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property aliasGroupNames: optional array of string Link to this property aliasGroupNamesInternal: optional array of string Link to this property attributionOrganization: optional string Link to this property
attributionOrganization\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property categoryName: optional string Link to this property categoryUuid: optional string Link to this property confidence: optional number Overall tag confidence (1-10). maximum10 minimum1 Link to this property createdAt: optional string Link to this property dateOfDiscovery: optional string Link to this property description: optional string Link to this property externalReferenceLinks: optional array of string Link to this property
externalReferences: optional array of object {url, description } Structured external references ({ url, description }). Public: returned to all accounts. url: string Link to this property description: optional string Link to this property
Link to this property
externalReferences\_annotated: optional array of object {value, tlp } value: string Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
internalAliases: optional array of object {value, confidence, tlp } Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses. value: string Link to this property confidence: optional number maximum10 minimum1 Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property internalDescription: optional string Link to this property lastSeen: optional string Link to this property motive: optional string Link to this property
motive\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property opsecLevel: optional string Link to this property
opsecLevel\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property originCountryISO: optional string ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace. Link to this property
originCountryISO\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property priority: optional number Link to this property
priority\_annotated: optional object {value, tlp } value: number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property properties: optional map\[unknown] Parsed custom field values. Null when the tag has no custom fields. Link to this property sophisticationLevel: optional string Link to this property
sophisticationLevel\_annotated: optional object {value, confidence, tlp } value: string Link to this property confidence: optional number Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property
Link to this property
tlp: optional "red"or "amber"or "amber-strict"or 4 more Tag-level TLP handling marking. One of the following: "red" Link to this property "amber" Link to this property "amber-strict" Link to this property "green" Link to this property "clear" Link to this property "purple" Link to this property "amber+strict" Link to this property
Link to this property updatedAt: optional string Link to this property version: optional number Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_edit_response%20%3E%20(schema)>)
TagDeleteResponse object {uuid } uuid: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags%20%3E%20(model)%20tag_delete_response%20%3E%20(schema)>) #### Threat EventsTagsCategories ##### [Lists all tag categories (SoT)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/tags/categories ##### [Creates a new tag category (SoT)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/create) POST/accounts/{account\_id}/cloudforce-one/events/tags/categories/create ##### [Updates a tag category (SoT)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/edit) Deprecated PATCH/accounts/{account\_id}/cloudforce-one/events/tags/categories/{category\_uuid} ##### [Deletes a tag category (SoT)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/categories/methods/delete) Deprecated DELETE/accounts/{account\_id}/cloudforce-one/events/tags/categories/{category\_uuid} ##### ModelsExpand Collapse
CategoryListResponse object {categories }
categories: array of object {name, uuid, createdAt, 3 more } name: string Link to this property uuid: string Link to this property createdAt: optional string Link to this property description: optional string Link to this property
schema: optional array of object {key, kind, allowedValues, 11 more } Parsed FieldDefinition\[] defining custom fields for this category, or null if none. key: string Link to this property
kind: "string"or "number"or "enum"or 3 more One of the following: "string" Link to this property "number" Link to this property "enum" Link to this property "date" Link to this property "array" Link to this property "object" Link to this property
Link to this property allowedValues: optional array of string Link to this property
annotations: optional object {confidence, tlp } confidence: optional boolean Link to this property tlp: optional boolean Link to this property
Link to this property deprecated: optional boolean Marks a field as unavailable for new values while retaining its definition for historical values. Link to this property deprecatedValues: optional array of string Enum values unavailable for new writes but retained in allowedValues for historical display. Link to this property element: optional unknown Link to this property
enforcement: optional "error"or "warn"or "off" One of the following: "error" Link to this property "warn" Link to this property "off" Link to this property
Link to this property
format: optional "date"or "url"or "duration"or "country" One of the following: "date" Link to this property "url" Link to this property "duration" Link to this property "country" Link to this property
Link to this property label: optional string maxLength128 minLength1 Link to this property maxLength: optional number exclusiveMinimum minimum0 Link to this property
numberConstraint: optional object {integer, max, min } integer: optional boolean Link to this property max: optional number Link to this property min: optional number Link to this property
Link to this property properties: optional map\[unknown] Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive). Link to this property required: optional boolean Link to this property
Link to this property updatedAt: optional string Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_list_response%20%3E%20(schema)>)
CategoryCreateResponse object {name, uuid, createdAt, 3 more } name: string Link to this property uuid: string Link to this property createdAt: optional string Link to this property description: optional string Link to this property
schema: optional array of object {key, kind, allowedValues, 11 more } Parsed FieldDefinition\[] defining custom fields for this category, or null if none. key: string Link to this property
kind: "string"or "number"or "enum"or 3 more One of the following: "string" Link to this property "number" Link to this property "enum" Link to this property "date" Link to this property "array" Link to this property "object" Link to this property
Link to this property allowedValues: optional array of string Link to this property
annotations: optional object {confidence, tlp } confidence: optional boolean Link to this property tlp: optional boolean Link to this property
Link to this property deprecated: optional boolean Marks a field as unavailable for new values while retaining its definition for historical values. Link to this property deprecatedValues: optional array of string Enum values unavailable for new writes but retained in allowedValues for historical display. Link to this property element: optional unknown Link to this property
enforcement: optional "error"or "warn"or "off" One of the following: "error" Link to this property "warn" Link to this property "off" Link to this property
Link to this property
format: optional "date"or "url"or "duration"or "country" One of the following: "date" Link to this property "url" Link to this property "duration" Link to this property "country" Link to this property
Link to this property label: optional string maxLength128 minLength1 Link to this property maxLength: optional number exclusiveMinimum minimum0 Link to this property
numberConstraint: optional object {integer, max, min } integer: optional boolean Link to this property max: optional number Link to this property min: optional number Link to this property
Link to this property properties: optional map\[unknown] Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive). Link to this property required: optional boolean Link to this property
Link to this property updatedAt: optional string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_create_response%20%3E%20(schema)>)
CategoryEditResponse object {name, uuid, createdAt, 3 more } name: string Link to this property uuid: string Link to this property createdAt: optional string Link to this property description: optional string Link to this property
schema: optional array of object {key, kind, allowedValues, 11 more } Parsed FieldDefinition\[] defining custom fields for this category, or null if none. key: string Link to this property
kind: "string"or "number"or "enum"or 3 more One of the following: "string" Link to this property "number" Link to this property "enum" Link to this property "date" Link to this property "array" Link to this property "object" Link to this property
Link to this property allowedValues: optional array of string Link to this property
annotations: optional object {confidence, tlp } confidence: optional boolean Link to this property tlp: optional boolean Link to this property
Link to this property deprecated: optional boolean Marks a field as unavailable for new values while retaining its definition for historical values. Link to this property deprecatedValues: optional array of string Enum values unavailable for new writes but retained in allowedValues for historical display. Link to this property element: optional unknown Link to this property
enforcement: optional "error"or "warn"or "off" One of the following: "error" Link to this property "warn" Link to this property "off" Link to this property
Link to this property
format: optional "date"or "url"or "duration"or "country" One of the following: "date" Link to this property "url" Link to this property "duration" Link to this property "country" Link to this property
Link to this property label: optional string maxLength128 minLength1 Link to this property maxLength: optional number exclusiveMinimum minimum0 Link to this property
numberConstraint: optional object {integer, max, min } integer: optional boolean Link to this property max: optional number Link to this property min: optional number Link to this property
Link to this property properties: optional map\[unknown] Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive). Link to this property required: optional boolean Link to this property
Link to this property updatedAt: optional string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_edit_response%20%3E%20(schema)>)
CategoryDeleteResponse object {uuid } uuid: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.categories%20%3E%20(model)%20category_delete_response%20%3E%20(schema)>) #### Threat EventsTagsIndicators ##### [List indicators related to a tag](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/indicators/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/tags/{tag\_uuid}/indicators ##### ModelsExpand Collapse
IndicatorListResponse object {indicators, pagination }
indicators: array of object {createdAt, indicatorType, updatedAt, 7 more } createdAt: string formatdate-time Link to this property indicatorType: string Link to this property updatedAt: string formatdate-time Link to this property uuid: string Link to this property value: string Link to this property datasetId: optional string The dataset ID this indicator belongs to. Included in list responses. Link to this property
relatedEvents: optional array of object {datasetId, eventId, eventDate } Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. datasetId: string Link to this property eventId: string Link to this property eventDate: optional string ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property relatedEventsHasMore: optional boolean True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags: optional array of object {categoryId, categoryName, uuid, value } categoryId: optional string The UUID of the tag category, or null when the tag is uncategorized. Link to this property categoryName: optional string Link to this property uuid: optional string Link to this property value: optional string Link to this property
Link to this property tlp: optional string Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property
pagination: object {page, pageSize, totalCount, totalPages } page: number Link to this property pageSize: number Link to this property totalCount: number Link to this property totalPages: number Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.indicators%20%3E%20(model)%20indicator_list_response%20%3E%20(schema)>) #### Threat EventsTagsIndicatorsBy Dataset ##### [List indicators related to a tag within a dataset (deprecated)](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/tags/subresources/indicators/subresources/by_dataset/methods/list) Deprecated GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/tags/{tag\_uuid}/indicators ##### ModelsExpand Collapse
ByDatasetListResponse object {indicators, pagination }
indicators: array of object {createdAt, indicatorType, updatedAt, 7 more } createdAt: string formatdate-time Link to this property indicatorType: string Link to this property updatedAt: string formatdate-time Link to this property uuid: string Link to this property value: string Link to this property datasetId: optional string The dataset ID this indicator belongs to. Included in list responses. Link to this property
relatedEvents: optional array of object {datasetId, eventId, eventDate } Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them. datasetId: string Link to this property eventId: string Link to this property eventDate: optional string ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added. Link to this property
Link to this property relatedEventsHasMore: optional boolean True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event. Link to this property
tags: optional array of object {categoryId, categoryName, uuid, value } categoryId: optional string The UUID of the tag category, or null when the tag is uncategorized. Link to this property categoryName: optional string Link to this property uuid: optional string Link to this property value: optional string Link to this property
Link to this property tlp: optional string Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set. Link to this property
Link to this property
pagination: object {page, pageSize, totalCount, totalPages } page: number Link to this property pageSize: number Link to this property totalCount: number Link to this property totalPages: number Link to this property
Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.tags.indicators.by_dataset%20%3E%20(model)%20by_dataset_list_response%20%3E%20(schema)>) #### Threat EventsEvent Tags ##### [Adds a tag to an event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/event_tags/methods/create) POST/accounts/{account\_id}/cloudforce-one/events/event\_tag/{event\_id}/create ##### [Removes a tag from an event](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/event_tags/methods/delete) DELETE/accounts/{account\_id}/cloudforce-one/events/event\_tag/{event\_id} ##### ModelsExpand Collapse
EventTagCreateResponse object {success } success: boolean Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.event_tags%20%3E%20(model)%20event_tag_create_response%20%3E%20(schema)>)
EventTagDeleteResponse object {success } success: boolean Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.event_tags%20%3E%20(model)%20event_tag_delete_response%20%3E%20(schema)>) #### Threat EventsTarget Industries ##### [Lists target industries across multiple datasets](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/target_industries/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/targetIndustries ##### ModelsExpand Collapse
TargetIndustryListResponse object {items, type }
items: object {type } type: string Link to this property
Link to this property type: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.target_industries%20%3E%20(model)%20target_industry_list_response%20%3E%20(schema)>) #### Threat EventsTarget IndustriesBy Dataset ##### [Lists all target industries for a specific dataset](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/target_industries/subresources/by_dataset/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/dataset/{dataset\_id}/targetIndustries ##### ModelsExpand Collapse
ByDatasetListResponse object {items, type }
items: object {type } type: string Link to this property
Link to this property type: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.target_industries.by_dataset%20%3E%20(model)%20by_dataset_list_response%20%3E%20(schema)>) #### Threat EventsTarget IndustriesCatalog ##### [Lists all target industries from industry map catalog](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/target_industries/subresources/catalog/methods/list) GET/accounts/{account\_id}/cloudforce-one/events/targetIndustries/catalog ##### ModelsExpand Collapse
CatalogListResponse object {items, type }
items: object {type } type: string Link to this property
Link to this property type: string Link to this property
[Link to this property](<#(resource)%20cloudforce_one.threat_events.target_industries.catalog%20%3E%20(model)%20catalog_list_response%20%3E%20(schema)>) #### Threat EventsInsights