API Reference

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Cloudforce One

Cloudforce OneBinary Storage

Retrieves a file from Binary Storage

client.cloudforceOne.binaryStorage.get(stringhash, BinaryStorageGetParams { account_id } params, RequestOptionsoptions?): void

GET/accounts/{account_id}/cloudforce-one/binary/{hash}

Posts a file to Binary Storage

client.cloudforceOne.binaryStorage.create(BinaryStorageCreateParams { account_id, file } params, RequestOptionsoptions?): BinaryStorageCreateResponse { content_type, md5, sha1, sha256 }

POST/accounts/{account_id}/cloudforce-one/binary

ModelsExpand Collapse

BinaryStorageCreateResponse { content_type, md5, sha1, sha256 }

content_type: string

md5: string

sha1: string

sha256: string

Cloudforce OneRequests

List Requests

client.cloudforceOne.requests.list(RequestListParams { account_id, page, per_page, 8 more } params, RequestOptionsoptions?): SinglePage<ListItem { id, created, priority, 9 more } >

POST/accounts/{account_id}/cloudforce-one/requests

Get a Request

client.cloudforceOne.requests.get(stringrequestID, RequestGetParams { account_id } params, RequestOptionsoptions?): Item { id, content, created, 10 more }

GET/accounts/{account_id}/cloudforce-one/requests/{request_id}

Create a New Request.

client.cloudforceOne.requests.create(RequestCreateParams { account_id, content, priority, 3 more } params, RequestOptionsoptions?): Item { id, content, created, 10 more }

POST/accounts/{account_id}/cloudforce-one/requests/new

Update a Request

client.cloudforceOne.requests.update(stringrequestID, RequestUpdateParams { account_id, content, priority, 3 more } params, RequestOptionsoptions?): Item { id, content, created, 10 more }

PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}

Delete a Request

client.cloudforceOne.requests.delete(stringrequestID, RequestDeleteParams { account_id } params, RequestOptionsoptions?): RequestDeleteResponse { errors, messages, success }

DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}

Get Request Quota

client.cloudforceOne.requests.quota(RequestQuotaParams { account_id } params, RequestOptionsoptions?): Quota { anniversary_date, quarter_anniversary_date, quota, remaining }

GET/accounts/{account_id}/cloudforce-one/requests/quota

Get Request Types

client.cloudforceOne.requests.types(RequestTypesParams { account_id } params, RequestOptionsoptions?): SinglePage<RequestTypesResponse>

GET/accounts/{account_id}/cloudforce-one/requests/types

Get Request Priority, Status, and TLP constants

client.cloudforceOne.requests.constants(RequestConstantsParams { account_id } params, RequestOptionsoptions?): RequestConstants { priority, status, tlp }

GET/accounts/{account_id}/cloudforce-one/requests/constants

ModelsExpand Collapse

Item { id, content, created, 10 more }

id: string

UUID.

maxLength36

content: string

Request content.

created: string

formatdate-time

priority: string

formatdate-time

request: string

Requested information from request.

summary: string

Brief description of the request.

tlp: "clear" | "amber" | "amber-strict" | 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

updated: string

formatdate-time

completed?: string

formatdate-time

message_tokens?: number

Tokens for the request messages.

readable_id?: string

Readable Request ID.

status?: "open" | "accepted" | "reported" | 3 more

Request Status.

One of the following:

"open"

"accepted"

"reported"

"approved"

"completed"

"declined"

tokens?: number

Tokens for the request.

ListItem { id, created, priority, 9 more }

id: string

UUID.

maxLength36

created: string

Request creation time.

formatdate-time

priority: "routine" | "high" | "urgent"

One of the following:

"routine"

"high"

"urgent"

request: string

Requested information from request.

summary: string

Brief description of the request.

tlp: "clear" | "amber" | "amber-strict" | 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

updated: string

Request last updated time.

formatdate-time

completed?: string

Request completion time.

formatdate-time

message_tokens?: number

Tokens for the request messages.

readable_id?: string

Readable Request ID.

status?: "open" | "accepted" | "reported" | 3 more

Request Status.

One of the following:

"open"

"accepted"

"reported"

"approved"

"completed"

"declined"

tokens?: number

Tokens for the request.

Quota { anniversary_date, quarter_anniversary_date, quota, remaining }

anniversary_date?: string

Anniversary date is when annual quota limit is refreshed.

formatdate-time

quarter_anniversary_date?: string

Quarter anniversary date is when quota limit is refreshed each quarter.

formatdate-time

quota?: number

Tokens for the quarter.

remaining?: number

Tokens remaining for the quarter.

RequestConstants { priority, status, tlp }

priority?: Array<"routine" | "high" | "urgent">

One of the following:

"routine"

"high"

"urgent"

status?: Array<"open" | "accepted" | "reported" | 3 more>

One of the following:

"open"

"accepted"

"reported"

"approved"

"completed"

"declined"

tlp?: Array<"clear" | "amber" | "amber-strict" | 2 more>

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

RequestTypes = Array<RequestTypesResponse>

RequestDeleteResponse { errors, messages, success }

errors: Array<Error>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

messages: Array<Message>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

success: true

Whether the API call was successful.

RequestTypesResponse = string

Request Types.

Cloudforce OneRequestsMessage

List Request Messages

client.cloudforceOne.requests.message.get(stringrequestID, MessageGetParams { account_id, page, per_page, 4 more } params, RequestOptionsoptions?): SinglePage<Message { id, author, content, 3 more } >

POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/message

Create a New Request Message

client.cloudforceOne.requests.message.create(stringrequestID, MessageCreateParams { account_id, content } params, RequestOptionsoptions?): Message { id, author, content, 3 more }

POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/new

Update a Request Message

client.cloudforceOne.requests.message.update(numbermessageID, MessageUpdateParams { account_id, request_id, content } params, RequestOptionsoptions?): Message { id, author, content, 3 more }

PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}

Delete a Request Message

client.cloudforceOne.requests.message.delete(numbermessageID, MessageDeleteParams { account_id, request_id } params, RequestOptionsoptions?): MessageDeleteResponse { errors, messages, success }

DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}

ModelsExpand Collapse

Message { id, author, content, 3 more }

id: number

Message ID.

author: string

Author of message.

content: string

Content of message.

is_follow_on_request: boolean

Whether the message is a follow-on request.

updated: string

Defines the message last updated time.

formatdate-time

created?: string

Defines the message creation time.

formatdate-time

MessageDeleteResponse { errors, messages, success }

errors: Array<Error>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

messages: Array<Message>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

success: true

Whether the API call was successful.

Cloudforce OneRequestsPriority

Get a Priority Intelligence Requirement

client.cloudforceOne.requests.priority.get(stringpriorityID, PriorityGetParams { account_id } params, RequestOptionsoptions?): Item { id, content, created, 10 more }

GET/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}

Create a New Priority Intelligence Requirement

client.cloudforceOne.requests.priority.create(PriorityCreateParams { account_id, labels, priority, 2 more } params, RequestOptionsoptions?): Priority { id, created, labels, 4 more }

POST/accounts/{account_id}/cloudforce-one/requests/priority/new

Update a Priority Intelligence Requirement

client.cloudforceOne.requests.priority.update(stringpriorityID, PriorityUpdateParams { account_id, labels, priority, 2 more } params, RequestOptionsoptions?): Item { id, content, created, 10 more }

PUT/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}

Delete a Priority Intelligence Requirement

client.cloudforceOne.requests.priority.delete(stringpriorityID, PriorityDeleteParams { account_id } params, RequestOptionsoptions?): PriorityDeleteResponse { errors, messages, success }

DELETE/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}

Get Priority Intelligence Requirement Quota

client.cloudforceOne.requests.priority.quota(PriorityQuotaParams { account_id } params, RequestOptionsoptions?): Quota { anniversary_date, quarter_anniversary_date, quota, remaining }

GET/accounts/{account_id}/cloudforce-one/requests/priority/quota

ModelsExpand Collapse

Label = string

Priority { id, created, labels, 4 more }

id: string

UUID.

maxLength36

created: string

Priority creation time.

formatdate-time

labels: Array<Label>

List of labels.

priority: number

Priority.

requirement: string

Requirement.

tlp: "clear" | "amber" | "amber-strict" | 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

updated: string

Priority last updated time.

formatdate-time

PriorityEdit { labels, priority, requirement, tlp }

labels: Array<Label>

List of labels.

priority: number

Priority.

requirement: string

Requirement.

tlp: "clear" | "amber" | "amber-strict" | 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

PriorityDeleteResponse { errors, messages, success }

errors: Array<Error>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

messages: Array<Message>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

success: true

Whether the API call was successful.

Cloudforce OneRequestsAssets

Get a Request Asset

client.cloudforceOne.requests.assets.get(stringassetID, AssetGetParams { account_id, request_id } params, RequestOptionsoptions?): SinglePage<AssetGetResponse { id, name, created, 2 more } >

GET/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}

List Request Assets

client.cloudforceOne.requests.assets.create(stringrequestID, AssetCreateParams { account_id, page, per_page } params, RequestOptionsoptions?): SinglePage<AssetCreateResponse { id, name, created, 2 more } >

POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset

Update a Request Asset

client.cloudforceOne.requests.assets.update(stringassetID, AssetUpdateParams { account_id, request_id, source } params, RequestOptionsoptions?): AssetUpdateResponse { id, name, created, 2 more }

PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}

Delete a Request Asset

client.cloudforceOne.requests.assets.delete(stringassetID, AssetDeleteParams { account_id, request_id } params, RequestOptionsoptions?): AssetDeleteResponse { errors, messages, success }

DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}

ModelsExpand Collapse

AssetGetResponse { id, name, created, 2 more }

id: number

Asset ID.

name: string

Asset name.

created?: string

Defines the asset creation time.

formatdate-time

description?: string

Asset description.

file_type?: string

Asset file type.

AssetCreateResponse { id, name, created, 2 more }

id: number

Asset ID.

name: string

Asset name.

created?: string

Defines the asset creation time.

formatdate-time

description?: string

Asset description.

file_type?: string

Asset file type.

AssetUpdateResponse { id, name, created, 2 more }

id: number

Asset ID.

name: string

Asset name.

created?: string

Defines the asset creation time.

formatdate-time

description?: string

Asset description.

file_type?: string

Asset file type.

AssetDeleteResponse { errors, messages, success }

errors: Array<Error>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

messages: Array<Message>

code: number

minimum1000

message: string

documentation_url?: string

source?: Source { pointer }

pointer?: string

success: true

Whether the API call was successful.

Cloudforce OneScans

Cloudforce OneScansResults

Get the Latest Scan Result

client.cloudforceOne.scans.results.get(stringconfigID, ResultGetParams { account_id } params, RequestOptionsoptions?): ResultGetResponse { 1.1.1.1 }

GET/accounts/{account_id}/cloudforce-one/scans/results/{config_id}

ModelsExpand Collapse

ScanResult { number, proto, status }

number?: number

proto?: string

status?: string

ResultGetResponse { 1.1.1.1 }

"1.1.1.1": Array<ScanResult { number, proto, status } >

number?: number

proto?: string

status?: string

Cloudforce OneScansConfig

List Scan Configs

client.cloudforceOne.scans.config.list(ConfigListParams { account_id } params, RequestOptionsoptions?): SinglePage<ConfigListResponse { id, account_id, frequency, 2 more } >

GET/accounts/{account_id}/cloudforce-one/scans/config

Create a new Scan Config

client.cloudforceOne.scans.config.create(ConfigCreateParams { account_id, ips, frequency, ports } params, RequestOptionsoptions?): ConfigCreateResponse { id, account_id, frequency, 2 more }

POST/accounts/{account_id}/cloudforce-one/scans/config

Update an existing Scan Config

client.cloudforceOne.scans.config.edit(stringconfigID, ConfigEditParams { account_id, frequency, ips, ports } params, RequestOptionsoptions?): ConfigEditResponse { id, account_id, frequency, 2 more }

PATCH/accounts/{account_id}/cloudforce-one/scans/config/{config_id}

Delete a Scan Config

client.cloudforceOne.scans.config.delete(stringconfigID, ConfigDeleteParams { account_id } params, RequestOptionsoptions?): ConfigDeleteResponse

DELETE/accounts/{account_id}/cloudforce-one/scans/config/{config_id}

ModelsExpand Collapse

ConfigListResponse { id, account_id, frequency, 2 more }

id: string

Defines the Config ID.

account_id: string

frequency: number

Defines the number of days between each scan (0 = One-off scan).

ips: Array<string>

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: Array<string>

Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. [“1-80”, “443”]). “default” scans the 100 most commonly open ports.

ConfigCreateResponse { id, account_id, frequency, 2 more }

id: string

Defines the Config ID.

account_id: string

frequency: number

Defines the number of days between each scan (0 = One-off scan).

ips: Array<string>

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: Array<string>

Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. [“1-80”, “443”]). “default” scans the 100 most commonly open ports.

ConfigEditResponse { id, account_id, frequency, 2 more }

id: string

Defines the Config ID.

account_id: string

frequency: number

Defines the number of days between each scan (0 = One-off scan).

ips: Array<string>

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: Array<string>

Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. [“1-80”, “443”]). “default” scans the 100 most commonly open ports.

ConfigDeleteResponse = unknown

Cloudforce OneThreat Events

Filter and list events

client.cloudforceOne.threatEvents.list(ThreatEventListParams { account_id, cache, cursor, 9 more } params, RequestOptionsoptions?): ThreatEventListResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

GET/accounts/{account_id}/cloudforce-one/events

Reads an event

Deprecated

client.cloudforceOne.threatEvents.get(stringeventID, ThreatEventGetParams { account_id } params, RequestOptionsoptions?): ThreatEventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

GET/accounts/{account_id}/cloudforce-one/events/{event_id}

Creates a new event

client.cloudforceOne.threatEvents.create(ThreatEventCreateParams { account_id, category, date, 15 more } params, RequestOptionsoptions?): ThreatEventCreateResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

POST/accounts/{account_id}/cloudforce-one/events/create

Updates an event

client.cloudforceOne.threatEvents.edit(stringeventID, ThreatEventEditParams { account_id, datasetId, attacker, 12 more } params, RequestOptionsoptions?): ThreatEventEditResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}

Creates bulk events

client.cloudforceOne.threatEvents.bulkCreate(ThreatEventBulkCreateParams { account_id, data, datasetId, includeCreatedEvents } params, RequestOptionsoptions?): ThreatEventBulkCreateResponse { createdEventsCount, createdTagsCount, errorCount, 4 more }

POST/accounts/{account_id}/cloudforce-one/events/create/bulk

Creates bulk DOS event with relationships and indicators

Deprecated

client.cloudforceOne.threatEvents.bulkCreateRelationships(ThreatEventBulkCreateRelationshipsParams { account_id, data, datasetId } params, RequestOptionsoptions?): ThreatEventBulkCreateRelationshipsResponse { createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more }

POST/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships

ModelsExpand Collapse

ThreatEventListResponse = Array<ThreatEventListResponseItem>

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

ThreatEventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

ThreatEventCreateResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

ThreatEventEditResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

ThreatEventBulkCreateResponse { createdEventsCount, createdTagsCount, errorCount, 4 more }

Detailed result of bulk event creation with auto-tag management

createdEventsCount: number

Number of events created

createdTagsCount: number

Number of new tags created in SoT

errorCount: number

Number of errors encountered

queuedIndicatorsCount: number

Number of indicators queued for async processing

createBulkEventsRequestId?: string

Correlation ID for async indicator processing

formatuuid

createdEvents?: Array<CreatedEvent>

Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true

eventIndex: number

Original index in the input data array

shardId: string

Dataset ID of the shard where the event was created

uuid: string

UUID of the created event

formatuuid

errors?: Array<Error>

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

ThreatEventBulkCreateRelationshipsResponse { createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more }

Result of bulk relationship creation operation

createdEventsCount: number

Number of events created

createdIndicatorsCount: number

Number of indicators created

createdRelationshipsCount: number

Number of relationships created

errorCount: number

Number of errors encountered

errors?: Array<Error>

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

Cloudforce OneThreat EventsAggregate

Aggregate events by single or multiple columns with optional date filtering

client.cloudforceOne.threatEvents.aggregate.list(AggregateListParams { account_id, aggregateBy, datasetId, 4 more } params, RequestOptionsoptions?): AggregateListResponse { aggregateBy, aggregations, total, dateRange }

GET/accounts/{account_id}/cloudforce-one/events/aggregate

ModelsExpand Collapse

AggregateListResponse { aggregateBy, aggregations, total, dateRange }

aggregateBy: string

Column(s) that were aggregated by

aggregations: Array<Aggregation>

Array of aggregation results with dynamic fields based on aggregateBy columns

count: number

Number of events for this aggregation

date?: string

Date (if groupByDate is true)

total: number

Total number of events in the aggregation

dateRange?: DateRange { endDate, startDate }

Date range used for filtering

endDate?: string

startDate?: string

Cloudforce OneThreat EventsGraphql

GraphQL endpoint for event aggregation

client.cloudforceOne.threatEvents.graphql.create(GraphqlCreateParams { account_id } params, RequestOptionsoptions?): GraphqlCreateResponse { data, errors }

POST/accounts/{account_id}/cloudforce-one/events/graphql

ModelsExpand Collapse

GraphqlCreateResponse { data, errors }

data?: unknown

errors?: Array<unknown> | null

Cloudforce OneThreat EventsGraph

Query graph neighborhood from R2 Data Catalog

client.cloudforceOne.threatEvents.graph.list(GraphListParams { account_id, cursor, datasetIds, 7 more } params, RequestOptionsoptions?): GraphListResponse { edges, node, nodes }

GET/accounts/{account_id}/cloudforce-one/events/graph

ModelsExpand Collapse

GraphListResponse { edges, node, nodes }

edges: Array<Edge>

id: string

Deterministic composite edge id (source→target:relationshipType)

relationshipType: string

source: string

Compact id of the source node (type:uuid)

sourceId: string

sourceType: string

target: string

Compact id of the target node (type:uuid)

targetId: string

targetType: string

node: Record<string, unknown> | null

Focal node object (legacy single-seed). Null when unavailable.

nodes: Array<Record<string, unknown>>

Cloudforce OneThreat EventsQueries

List all saved event queries

client.cloudforceOne.threatEvents.queries.list(QueryListParams { account_id } params, RequestOptionsoptions?): QueryListResponse { id, account_id, alert_enabled, 10 more }

GET/accounts/{account_id}/cloudforce-one/events/queries

Create a saved event query

client.cloudforceOne.threatEvents.queries.create(QueryCreateParams { account_id, alert_enabled, alert_rollup_enabled, 4 more } params, RequestOptionsoptions?): QueryCreateResponse { id, account_id, alert_enabled, 10 more }

POST/accounts/{account_id}/cloudforce-one/events/queries/create

Read a saved event query

client.cloudforceOne.threatEvents.queries.get(numberqueryID, QueryGetParams { account_id } params, RequestOptionsoptions?): QueryGetResponse { id, account_id, alert_enabled, 10 more }

GET/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Update a saved event query

client.cloudforceOne.threatEvents.queries.edit(numberqueryID, QueryEditParams { account_id, alert_enabled, alert_rollup_enabled, 4 more } params, RequestOptionsoptions?): QueryEditResponse { id, account_id, alert_enabled, 10 more }

PATCH/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Delete a saved event query

client.cloudforceOne.threatEvents.queries.delete(numberqueryID, QueryDeleteParams { account_id } params, RequestOptionsoptions?): void

DELETE/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

ModelsExpand Collapse

QueryListResponse = Array<QueryListResponseItem>

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

QueryCreateResponse { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

QueryGetResponse { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

QueryEditResponse { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

Cloudforce OneThreat EventsRelationships

Filter and list events related to specific event

Deprecated

client.cloudforceOne.threatEvents.relationships.list(stringeventID, RelationshipListParams { account_id, datasetId, direction, 6 more } params, RequestOptionsoptions?): RelationshipListResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships

ModelsExpand Collapse

RelationshipListResponse = Array<RelationshipListResponseItem>

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

Cloudforce OneThreat EventsIndicators

Lists indicators across multiple datasets

client.cloudforceOne.threatEvents.indicators.list(IndicatorListParams { account_id, cache, createdAfter, 15 more } params, RequestOptionsoptions?): IndicatorListResponse { properties, type }

GET/accounts/{account_id}/cloudforce-one/events/indicators

ModelsExpand Collapse

IndicatorListResponse { properties, type }

properties: Properties { completeness, indicators, pagination }

completeness: Completeness { properties, type }

properties: Properties { complete, failedDatasets, failedShards, warnings }

complete: Complete { type }

type: string

failedDatasets: FailedDatasets { items, type }

items: Items { type }

type: string

type: string

failedShards: FailedShards { items, type }

items: Items { properties, type }

properties: Properties { datasetId, shardId }

datasetId: DatasetID { type }

type: string

shardId: ShardID { type }

type: string

type: string

type: string

warnings: Warnings { items, type }

items: Items { type }

type: string

type: string

type: string

indicators: Indicators { items, type }

items: Items { createdAt, indicatorType, sources, 8 more }

createdAt: string

formatdate-time

indicatorType: string

sources: Array<Source>

RSS article sources from which this indicator was extracted.

resourceId: string

formatuuid

resourceType: "article"

system: "threat-signals"

title: string | null

Threat Signals article title; null for historical provenance without a stored title.

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

datasetId: string

eventId: string

eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

relatedEventsHasMore?: boolean

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags?: Array<Tag>

categoryId?: string | null

The UUID of the tag category, or null when the tag is uncategorized.

categoryName?: string

uuid?: string

value?: string

tlp?: string | null

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

type: string

pagination: Pagination { properties, type }

properties: Properties { count, cursor, has_more, 4 more }

count: Count { type }

type: string

cursor: Cursor { description, nullable, type }

description: string

nullable: boolean

type: string

has_more: HasMore { description, type }

description: string

type: string

page: Page { type }

type: string

per_page: PerPage { type }

type: string

total_count: TotalCount { description, nullable, type }

description: string

nullable: boolean

type: string

total_count_is_exact: TotalCountIsExact { description, type }

description: string

type: string

type: string

type: string

Cloudforce OneThreat EventsIndicatorsAggregate

Aggregate indicators by column(s)

client.cloudforceOne.threatEvents.indicators.aggregate.list(AggregateListParams { account_id, aggregateBy, createdAfter, 7 more } params, RequestOptionsoptions?): AggregateListResponse { aggregateBy, aggregations, failedDatasets, total }

GET/accounts/{account_id}/cloudforce-one/events/indicators/aggregate

ModelsExpand Collapse

AggregateListResponse { aggregateBy, aggregations, failedDatasets, total }

aggregateBy: string

Column(s) that were aggregated by

aggregations: Array<Aggregation>

Array of aggregation results with dynamic fields based on aggregateBy columns

count: number

Number of indicators for this aggregation

failedDatasets: number

Number of datasets whose aggregation failed and were excluded from the result

total: number

Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships

Cloudforce OneThreat EventsIndicatorsTypes

Lists indicator types across multiple datasets

client.cloudforceOne.threatEvents.indicators.types.list(TypeListParams { account_id, datasetIds } params, RequestOptionsoptions?): TypeListResponse { items, type }

GET/accounts/{account_id}/cloudforce-one/events/indicator-types

ModelsExpand Collapse

TypeListResponse { items, type }

items: Items { type }

type: string

type: string

Cloudforce OneThreat EventsIndicatorsBy Dataset

Lists indicators

Deprecated

client.cloudforceOne.threatEvents.indicators.byDataset.list(stringdatasetID, ByDatasetListParams { account_id, indicatorType, name, 3 more } params, RequestOptionsoptions?): ByDatasetListResponse { indicators, pagination }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators

Reads an indicator

client.cloudforceOne.threatEvents.indicators.byDataset.get(stringindicatorID, ByDatasetGetParams { account_id, dataset_id } params, RequestOptionsoptions?): ByDatasetGetResponse { createdAt, indicatorType, updatedAt, 7 more }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}

ModelsExpand Collapse

ByDatasetListResponse { indicators, pagination }

indicators: Array<Indicator>

createdAt: string

formatdate-time

indicatorType: string

sources: Array<Source>

RSS article sources from which this indicator was extracted.

resourceId: string

formatuuid

resourceType: "article"

system: "threat-signals"

title: string | null

Threat Signals article title; null for historical provenance without a stored title.

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

datasetId: string

eventId: string

eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

relatedEventsHasMore?: boolean

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags?: Array<Tag>

categoryId?: string | null

The UUID of the tag category, or null when the tag is uncategorized.

categoryName?: string

uuid?: string

value?: string

tlp?: string | null

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: Pagination { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

ByDatasetGetResponse { createdAt, indicatorType, updatedAt, 7 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

datasetId: string

eventId: string

eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

relatedEventsHasMore?: boolean

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags?: Array<Tag>

categoryId?: string | null

The UUID of the tag category, or null when the tag is uncategorized.

categoryName?: string

uuid?: string

value?: string

tlp?: string | null

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

Cloudforce OneThreat EventsIndicatorsBy DatasetTags

List mirrored tags for an indicator dataset

client.cloudforceOne.threatEvents.indicators.byDataset.tags.list(stringdatasetID, TagListParams { account_id } params, RequestOptionsoptions?): TagListResponse

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags

ModelsExpand Collapse

TagListResponse = Array<unknown>

Array of mirror tag rows

Cloudforce OneThreat EventsAttackers

Lists attackers across multiple datasets

client.cloudforceOne.threatEvents.attackers.list(AttackerListParams { account_id, datasetIds } params, RequestOptionsoptions?): AttackerListResponse { items, type }

GET/accounts/{account_id}/cloudforce-one/events/attackers

ModelsExpand Collapse

AttackerListResponse { items, type }

items: Items { type }

type: string

type: string

Cloudforce OneThreat EventsCategories

Lists categories across multiple datasets

client.cloudforceOne.threatEvents.categories.list(CategoryListParams { account_id, datasetIds } params, RequestOptionsoptions?): CategoryListResponse { killChain, name, uuid, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/categories

Reads a category

Deprecated

client.cloudforceOne.threatEvents.categories.get(stringcategoryID, CategoryGetParams { account_id } params, RequestOptionsoptions?): CategoryGetResponse { killChain, name, uuid, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Creates a new category

client.cloudforceOne.threatEvents.categories.create(CategoryCreateParams { account_id, killChain, name, 3 more } params, RequestOptionsoptions?): CategoryCreateResponse { killChain, name, uuid, 3 more }

POST/accounts/{account_id}/cloudforce-one/events/categories/create

Updates a category

Deprecated

client.cloudforceOne.threatEvents.categories.edit(stringcategoryID, CategoryEditParams { account_id, killChain, mitreAttack, 3 more } params, RequestOptionsoptions?): CategoryEditResponse { killChain, name, uuid, 3 more }

PATCH/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Deletes a category

Deprecated

client.cloudforceOne.threatEvents.categories.delete(stringcategoryID, CategoryDeleteParams { account_id } params, RequestOptionsoptions?): CategoryDeleteResponse { uuid }

DELETE/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

ModelsExpand Collapse

CategoryListResponse = Array<CategoryListResponseItem>

killChain: number

name: string

uuid: string

mitreAttack?: Array<string>

mitreCapec?: Array<string>

shortname?: string

CategoryGetResponse { killChain, name, uuid, 3 more }

killChain: number

name: string

uuid: string

mitreAttack?: Array<string>

mitreCapec?: Array<string>

shortname?: string

CategoryCreateResponse { killChain, name, uuid, 3 more }

killChain: number

name: string

uuid: string

mitreAttack?: Array<string>

mitreCapec?: Array<string>

shortname?: string

CategoryEditResponse { killChain, name, uuid, 3 more }

killChain: number

name: string

uuid: string

mitreAttack?: Array<string>

mitreCapec?: Array<string>

shortname?: string

CategoryDeleteResponse { uuid }

uuid: string

Cloudforce OneThreat EventsCategoriesCatalog

Lists categories

client.cloudforceOne.threatEvents.categories.catalog.list(CatalogListParams { account_id } params, RequestOptionsoptions?): CatalogListResponse { killChain, name, uuid, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/categories/catalog

ModelsExpand Collapse

CatalogListResponse = Array<CatalogListResponseItem>

killChain: number

name: string

uuid: string

mitreAttack?: Array<string>

mitreCapec?: Array<string>

shortname?: string

Cloudforce OneThreat EventsCountries

Retrieves countries information for all countries

client.cloudforceOne.threatEvents.countries.list(CountryListParams { account_id } params, RequestOptionsoptions?): CountryListResponse { result, success }

GET/accounts/{account_id}/cloudforce-one/events/countries

ModelsExpand Collapse

CountryListResponse = Array<CountryListResponseItem>

result: Array<Result>

alpha2: string

alpha3: string

name: string

success: string

Cloudforce OneThreat EventsCrons

Cloudforce OneThreat EventsDatasets

Lists all datasets in an account

client.cloudforceOne.threatEvents.datasets.list(DatasetListParams { account_id, includeDeleted } params, RequestOptionsoptions?): DatasetListResponse { indicatorWriteMode, isAnalytics, isPublic, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/dataset

Reads a dataset

client.cloudforceOne.threatEvents.datasets.get(stringdatasetID, DatasetGetParams { account_id } params, RequestOptionsoptions?): DatasetGetResponse { isAnalytics, isPublic, name, uuid }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Creates a dataset

client.cloudforceOne.threatEvents.datasets.create(DatasetCreateParams { account_id, isPublic, name } params, RequestOptionsoptions?): DatasetCreateResponse { isAnalytics, isPublic, name, uuid }

POST/accounts/{account_id}/cloudforce-one/events/dataset/create

Updates an existing dataset

client.cloudforceOne.threatEvents.datasets.edit(stringdatasetID, DatasetEditParams { account_id, isPublic, name } params, RequestOptionsoptions?): DatasetEditResponse { isAnalytics, isPublic, name, uuid }

PATCH/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Delete a dataset

client.cloudforceOne.threatEvents.datasets.delete(stringdatasetID, DatasetDeleteParams { account_id } params, RequestOptionsoptions?): DatasetDeleteResponse { name, uuid }

DELETE/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Reads raw data for an event by UUID

Deprecated

client.cloudforceOne.threatEvents.datasets.raw(stringeventID, DatasetRawParams { account_id, dataset_id } params, RequestOptionsoptions?): DatasetRawResponse { id, accountId, created, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}

ModelsExpand Collapse

DatasetListResponse = Array<DatasetListResponseItem>

indicatorWriteMode: "read_only" | "create_only" | "full"

Effective indicator mutation capability after account/dataset authorization and dataset storage capability are applied. API Gateway method permissions are separate and must also allow the requested operation.

One of the following:

"read_only"

"create_only"

"full"

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

deletedAt?: string

DatasetGetResponse { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

DatasetCreateResponse { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

DatasetEditResponse { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

DatasetDeleteResponse { name, uuid }

name: string

uuid: string

DatasetRawResponse { id, accountId, created, 3 more }

id: number

accountId: number

created: string

data: string

source: string

tlp: string

Cloudforce OneThreat EventsDatasetsHealth

Cloudforce OneThreat EventsDatasetsEvents

Reads an event

client.cloudforceOne.threatEvents.datasets.events.get(stringeventID, EventGetParams { account_id, dataset_id } params, RequestOptionsoptions?): EventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}

ModelsExpand Collapse

EventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

Cloudforce OneThreat EventsRaw

Reads data for a raw event

client.cloudforceOne.threatEvents.raw.get(stringrawID, RawGetParams { account_id, event_id } params, RequestOptionsoptions?): RawGetResponse { id, accountId, created, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

Updates a raw event

client.cloudforceOne.threatEvents.raw.edit(stringrawID, RawEditParams { account_id, event_id, data, 2 more } params, RequestOptionsoptions?): RawEditResponse { id, data }

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

ModelsExpand Collapse

RawGetResponse { id, accountId, created, 3 more }

id: string

accountId: number

created: string

data: unknown

source: string

tlp: string

RawEditResponse { id, data }

id: string

data: unknown

Cloudforce OneThreat EventsRelate

Removes an event reference

client.cloudforceOne.threatEvents.relate.delete(stringeventID, RelateDeleteParams { account_id } params, RequestOptionsoptions?): RelateDeleteResponse { success }

DELETE/accounts/{account_id}/cloudforce-one/events/relate/{event_id}

ModelsExpand Collapse

RelateDeleteResponse { success }

success: boolean

Cloudforce OneThreat EventsTags

Lists all tags (SoT)

client.cloudforceOne.threatEvents.tags.list(TagListParams { account_id, cache, categoryUuid, 4 more } params, RequestOptionsoptions?): TagListResponse { pagination, tags }

GET/accounts/{account_id}/cloudforce-one/events/tags

Creates a new tag

client.cloudforceOne.threatEvents.tags.create(TagCreateParams { account_id, value, activeDuration, 21 more } params, RequestOptionsoptions?): TagCreateResponse { uuid, value, activeDuration, 34 more }

POST/accounts/{account_id}/cloudforce-one/events/tags/create

Updates a tag (SoT)

client.cloudforceOne.threatEvents.tags.edit(stringtagUUID, TagEditParams { account_id, activeDuration, actorCategory, 21 more } params, RequestOptionsoptions?): TagEditResponse { uuid, value, activeDuration, 34 more }

PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

Deletes a tag (SoT)

client.cloudforceOne.threatEvents.tags.delete(stringtagUUID, TagDeleteParams { account_id } params, RequestOptionsoptions?): TagDeleteResponse { uuid }

DELETE/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

ModelsExpand Collapse

TagListResponse { pagination, tags }

pagination: Pagination { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

tags: Array<Tag>

uuid: string

value: string

activeDuration?: string

activeDuration_annotated?: ActiveDurationAnnotated | null

value: string

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory?: string

actorCategory_annotated?: ActorCategoryAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames?: Array<string>

aliasGroupNamesInternal?: Array<string>

attributionOrganization?: string

attributionOrganization_annotated?: AttributionOrganizationAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName?: string

categoryUuid?: string

confidence?: number | null

Overall tag confidence (1-10).

maximum10

minimum1

createdAt?: string

dateOfDiscovery?: string

description?: string

externalReferenceLinks?: Array<string>

externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description?: string | null

externalReferences_annotated?: Array<ExternalReferencesAnnotated> | null

value: string

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases?: Array<InternalAlias>

Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription?: string

lastSeen?: string

motive?: string

motive_annotated?: MotiveAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel?: string

opsecLevel_annotated?: OpsecLevelAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO?: string | null

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated?: OriginCountryISOAnnotated | null

value: string | null

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority?: number

priority_annotated?: PriorityAnnotated | null

value: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties?: Record<string, unknown> | null

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel?: string

sophisticationLevel_annotated?: SophisticationLevelAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt?: string

version?: number

TagCreateResponse { uuid, value, activeDuration, 34 more }

uuid: string

value: string

activeDuration?: string

activeDuration_annotated?: ActiveDurationAnnotated | null

value: string

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory?: string

actorCategory_annotated?: ActorCategoryAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames?: Array<string>

aliasGroupNamesInternal?: Array<string>

attributionOrganization?: string

attributionOrganization_annotated?: AttributionOrganizationAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName?: string

categoryUuid?: string

confidence?: number | null

Overall tag confidence (1-10).

maximum10

minimum1

createdAt?: string

dateOfDiscovery?: string

description?: string

externalReferenceLinks?: Array<string>

externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description?: string | null

externalReferences_annotated?: Array<ExternalReferencesAnnotated> | null

value: string

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases?: Array<InternalAlias>

Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription?: string

lastSeen?: string

motive?: string

motive_annotated?: MotiveAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel?: string

opsecLevel_annotated?: OpsecLevelAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO?: string | null

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated?: OriginCountryISOAnnotated | null

value: string | null

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority?: number

priority_annotated?: PriorityAnnotated | null

value: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties?: Record<string, unknown> | null

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel?: string

sophisticationLevel_annotated?: SophisticationLevelAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt?: string

version?: number

TagEditResponse { uuid, value, activeDuration, 34 more }

uuid: string

value: string

activeDuration?: string

activeDuration_annotated?: ActiveDurationAnnotated | null

value: string

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory?: string

actorCategory_annotated?: ActorCategoryAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames?: Array<string>

aliasGroupNamesInternal?: Array<string>

attributionOrganization?: string

attributionOrganization_annotated?: AttributionOrganizationAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName?: string

categoryUuid?: string

confidence?: number | null

Overall tag confidence (1-10).

maximum10

minimum1

createdAt?: string

dateOfDiscovery?: string

description?: string

externalReferenceLinks?: Array<string>

externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description?: string | null

externalReferences_annotated?: Array<ExternalReferencesAnnotated> | null

value: string

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases?: Array<InternalAlias>

Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription?: string

lastSeen?: string

motive?: string

motive_annotated?: MotiveAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel?: string

opsecLevel_annotated?: OpsecLevelAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO?: string | null

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated?: OriginCountryISOAnnotated | null

value: string | null

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority?: number

priority_annotated?: PriorityAnnotated | null

value: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties?: Record<string, unknown> | null

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel?: string

sophisticationLevel_annotated?: SophisticationLevelAnnotated | null

value: string

confidence?: number

tlp?: "red" | "amber" | "amber-strict" | 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp?: "red" | "amber" | "amber-strict" | 4 more | null

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt?: string

version?: number

TagDeleteResponse { uuid }

uuid: string

Cloudforce OneThreat EventsTagsCategories

Lists all tag categories (SoT)

client.cloudforceOne.threatEvents.tags.categories.list(CategoryListParams { account_id, search } params, RequestOptionsoptions?): CategoryListResponse { categories }

GET/accounts/{account_id}/cloudforce-one/events/tags/categories

Creates a new tag category (SoT)

client.cloudforceOne.threatEvents.tags.categories.create(CategoryCreateParams { account_id, name, description, schema } params, RequestOptionsoptions?): CategoryCreateResponse { name, uuid, createdAt, 3 more }

POST/accounts/{account_id}/cloudforce-one/events/tags/categories/create

Updates a tag category (SoT)

Deprecated

client.cloudforceOne.threatEvents.tags.categories.edit(stringcategoryUUID, CategoryEditParams { account_id, description, name, schema } params, RequestOptionsoptions?): CategoryEditResponse { name, uuid, createdAt, 3 more }

PATCH/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

Deletes a tag category (SoT)

Deprecated

client.cloudforceOne.threatEvents.tags.categories.delete(stringcategoryUUID, CategoryDeleteParams { account_id } params, RequestOptionsoptions?): CategoryDeleteResponse { uuid }

DELETE/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

ModelsExpand Collapse

CategoryListResponse { categories }

categories: Array<Category>

name: string

uuid: string

createdAt?: string

description?: string

schema?: Array<Schema> | null

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string

kind: "string" | "number" | "enum" | 3 more

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowedValues?: Array<string>

annotations?: Annotations { confidence, tlp }

confidence?: boolean

tlp?: boolean

deprecated?: boolean

Marks a field as unavailable for new values while retaining its definition for historical values.

deprecatedValues?: Array<string>

Enum values unavailable for new writes but retained in allowedValues for historical display.

element?: unknown

enforcement?: "error" | "warn" | "off"

One of the following:

"error"

"warn"

"off"

format?: "date" | "url" | "duration" | "country"

One of the following:

"date"

"url"

"duration"

"country"

label?: string

maxLength128

minLength1

maxLength?: number

exclusiveMinimum

minimum0

numberConstraint?: NumberConstraint { integer, max, min }

integer?: boolean

max?: number

min?: number

properties?: Record<string, unknown>

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required?: boolean

updatedAt?: string

CategoryCreateResponse { name, uuid, createdAt, 3 more }

name: string

uuid: string

createdAt?: string

description?: string

schema?: Array<Schema> | null

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string

kind: "string" | "number" | "enum" | 3 more

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowedValues?: Array<string>

annotations?: Annotations { confidence, tlp }

confidence?: boolean

tlp?: boolean

deprecated?: boolean

Marks a field as unavailable for new values while retaining its definition for historical values.

deprecatedValues?: Array<string>

Enum values unavailable for new writes but retained in allowedValues for historical display.

element?: unknown

enforcement?: "error" | "warn" | "off"

One of the following:

"error"

"warn"

"off"

format?: "date" | "url" | "duration" | "country"

One of the following:

"date"

"url"

"duration"

"country"

label?: string

maxLength128

minLength1

maxLength?: number

exclusiveMinimum

minimum0

numberConstraint?: NumberConstraint { integer, max, min }

integer?: boolean

max?: number

min?: number

properties?: Record<string, unknown>

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required?: boolean

updatedAt?: string

CategoryEditResponse { name, uuid, createdAt, 3 more }

name: string

uuid: string

createdAt?: string

description?: string

schema?: Array<Schema> | null

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string

kind: "string" | "number" | "enum" | 3 more

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowedValues?: Array<string>

annotations?: Annotations { confidence, tlp }

confidence?: boolean

tlp?: boolean

deprecated?: boolean

Marks a field as unavailable for new values while retaining its definition for historical values.

deprecatedValues?: Array<string>

Enum values unavailable for new writes but retained in allowedValues for historical display.

element?: unknown

enforcement?: "error" | "warn" | "off"

One of the following:

"error"

"warn"

"off"

format?: "date" | "url" | "duration" | "country"

One of the following:

"date"

"url"

"duration"

"country"

label?: string

maxLength128

minLength1

maxLength?: number

exclusiveMinimum

minimum0

numberConstraint?: NumberConstraint { integer, max, min }

integer?: boolean

max?: number

min?: number

properties?: Record<string, unknown>

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required?: boolean

updatedAt?: string

CategoryDeleteResponse { uuid }

uuid: string

Cloudforce OneThreat EventsTagsIndicators

List indicators related to a tag

client.cloudforceOne.threatEvents.tags.indicators.list(stringtagUUID, IndicatorListParams { account_id, datasetIds, indicatorType, 4 more } params, RequestOptionsoptions?): IndicatorListResponse { indicators, pagination }

GET/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators

ModelsExpand Collapse

IndicatorListResponse { indicators, pagination }

indicators: Array<Indicator>

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

datasetId: string

eventId: string

eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

relatedEventsHasMore?: boolean

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags?: Array<Tag>

categoryId?: string | null

The UUID of the tag category, or null when the tag is uncategorized.

categoryName?: string

uuid?: string

value?: string

tlp?: string | null

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: Pagination { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

Cloudforce OneThreat EventsTagsIndicatorsBy Dataset

List indicators related to a tag within a dataset (deprecated)

Deprecated

client.cloudforceOne.threatEvents.tags.indicators.byDataset.list(stringtagUUID, ByDatasetListParams { account_id, dataset_id, indicatorType, 4 more } params, RequestOptionsoptions?): ByDatasetListResponse { indicators, pagination }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators

ModelsExpand Collapse

ByDatasetListResponse { indicators, pagination }

indicators: Array<Indicator>

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

datasetId: string

eventId: string

eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

relatedEventsHasMore?: boolean

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags?: Array<Tag>

categoryId?: string | null

The UUID of the tag category, or null when the tag is uncategorized.

categoryName?: string

uuid?: string

value?: string

tlp?: string | null

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: Pagination { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

Cloudforce OneThreat EventsEvent Tags

Adds a tag to an event

client.cloudforceOne.threatEvents.eventTags.create(stringeventID, EventTagCreateParams { account_id, tags } params, RequestOptionsoptions?): EventTagCreateResponse { success }

POST/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create

Removes a tag from an event

client.cloudforceOne.threatEvents.eventTags.delete(stringeventID, EventTagDeleteParams { account_id } params, RequestOptionsoptions?): EventTagDeleteResponse { success }

DELETE/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}

ModelsExpand Collapse

EventTagCreateResponse { success }

success: boolean

EventTagDeleteResponse { success }

success: boolean

Cloudforce OneThreat EventsTarget Industries

Lists target industries across multiple datasets

client.cloudforceOne.threatEvents.targetIndustries.list(TargetIndustryListParams { account_id, datasetIds } params, RequestOptionsoptions?): TargetIndustryListResponse { items, type }

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries

ModelsExpand Collapse

TargetIndustryListResponse { items, type }

items: Items { type }

type: string

type: string

Cloudforce OneThreat EventsTarget IndustriesBy Dataset

Lists all target industries for a specific dataset

client.cloudforceOne.threatEvents.targetIndustries.byDataset.list(stringdatasetID, ByDatasetListParams { account_id } params, RequestOptionsoptions?): ByDatasetListResponse { items, type }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries

ModelsExpand Collapse

ByDatasetListResponse { items, type }

items: Items { type }

type: string

type: string

Cloudforce OneThreat EventsTarget IndustriesCatalog

Lists all target industries from industry map catalog

client.cloudforceOne.threatEvents.targetIndustries.catalog.list(CatalogListParams { account_id } params, RequestOptionsoptions?): CatalogListResponse { items, type }

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog

ModelsExpand Collapse

CatalogListResponse { items, type }

items: Items { type }

type: string

type: string

Cloudforce OneThreat EventsInsights

Cloudforce OneThreat Signals

Threat Signals API for managing threat intelligence feeds, articles, indicators, and AI skills in Cloudforce One.

Prerequisites

1. API token — requests must use an API token with Cloudforce One permissions; write operations (creating, editing, or deleting feeds, skills, and tags) require write access.
2. Plan limits — access on the Free plan is limited; feed quotas and managed default skills apply.

Cloudforce OneThreat SignalsSearch

Search Threat Signals articles using AI Search

client.cloudforceOne.threatSignals.search.search(SearchSearchParams { account_id, query, feed_id, max_results } params, RequestOptionsoptions?): SearchSearchResponse { count, results }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/search

ModelsExpand Collapse

SearchSearchResponse { count, results }

count: number

Number of unique article candidates returned in this response. Equal to results.length.

minimum0

results: Array<Result>

article_id: string

formatuuid

dataset_id: string | null

formatuuid

event_id: string | null

formatuuid

feed_id: string

formatuuid

score: number

text: string

Cloudforce OneThreat SignalsCategories

List Threat Signals feed categories

client.cloudforceOne.threatSignals.categories.list(CategoryListParams { account_id } params, RequestOptionsoptions?): CategoryListResponse { categories }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/categories

ModelsExpand Collapse

CategoryListResponse { categories }

categories: Array<Category>

id: string

Wire value accepted by the feed category_id field.

formatuuid

description: string

Plain-language description of the category.

name: string

Human-readable display label.

Cloudforce OneThreat SignalsFeeds

List Threat Signals feeds

client.cloudforceOne.threatSignals.feeds.list(FeedListParams { account_id, category, enabled, 6 more } params, RequestOptionsoptions?): V4PagePagination<FeedListResponse { count, feeds, page, 2 more } >

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds

Create Threat Signals feed

client.cloudforceOne.threatSignals.feeds.create(FeedCreateParams { account_id, category_id, curated_feed_id, 5 more } params, RequestOptionsoptions?): FeedCreateResponse { id, category_id, category_name, 12 more }

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds

Update Threat Signals feed

client.cloudforceOne.threatSignals.feeds.edit(stringfeedID, FeedEditParams { account_id, category_id, display_name, 3 more } params, RequestOptionsoptions?): FeedEditResponse { id, category_id, category_name, 12 more }

PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}

Delete Threat Signals feed

client.cloudforceOne.threatSignals.feeds.delete(stringfeedID, FeedDeleteParams { account_id } params, RequestOptionsoptions?): FeedDeleteResponse { id, category_id, category_name, 12 more }

DELETE/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}

Trigger Threat Signals feed poll

client.cloudforceOne.threatSignals.feeds.poll(FeedPollParams { account_id, feed_id } params, RequestOptionsoptions?): FeedPollResponse { errors, feeds, triggered }

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/poll

ModelsExpand Collapse

FeedListResponse { count, feeds, page, 2 more }

count: number

Number of feeds on this page.

feeds: Array<Feed>

id: string

formatuuid

category_id: string | null

Feed category identifier. Null when unset.

category_name: string | null

Display name of the feed category. Null when unset or unresolvable.

created_at: string

curated_feed_id: string | null

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: string | null

enabled: boolean

last_polled_at: string | null

poll_interval_s: number

source_type: string

custom for a feed added by URL, curated for a curated catalog feed.

status: string

Polling health: active, or error after a failed poll.

subscribed_at: string | null

title: string | null

updated_at: string

url: string

page: number

per_page: number

total_count: number

FeedCreateResponse { id, category_id, category_name, 12 more }

id: string

formatuuid

category_id: string | null

Feed category identifier. Null when unset.

category_name: string | null

Display name of the feed category. Null when unset or unresolvable.

created_at: string

curated_feed_id: string | null

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: string | null

enabled: boolean

last_polled_at: string | null

poll_interval_s: number

source_type: string

custom for a feed added by URL, curated for a curated catalog feed.

status: string

Polling health: active, or error after a failed poll.

subscribed_at: string | null

title: string | null

updated_at: string

url: string

FeedEditResponse { id, category_id, category_name, 12 more }

id: string

formatuuid

category_id: string | null

Feed category identifier. Null when unset.

category_name: string | null

Display name of the feed category. Null when unset or unresolvable.

created_at: string

curated_feed_id: string | null

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: string | null

enabled: boolean

last_polled_at: string | null

poll_interval_s: number

source_type: string

custom for a feed added by URL, curated for a curated catalog feed.

status: string

Polling health: active, or error after a failed poll.

subscribed_at: string | null

title: string | null

updated_at: string

url: string

FeedDeleteResponse { id, category_id, category_name, 12 more }

id: string

formatuuid

category_id: string | null

Feed category identifier. Null when unset.

category_name: string | null

Display name of the feed category. Null when unset or unresolvable.

created_at: string

curated_feed_id: string | null

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: string | null

enabled: boolean

last_polled_at: string | null

poll_interval_s: number

source_type: string

custom for a feed added by URL, curated for a curated catalog feed.

status: string

Polling health: active, or error after a failed poll.

subscribed_at: string | null

title: string | null

updated_at: string

url: string

FeedPollResponse { errors, feeds, triggered }

errors: number

feeds: Array<Feed>

feed_id: string

formatuuid

status: "workflow_created" | "error"

One of the following:

"workflow_created"

"error"

workflow_id: string

feed_enabled?: boolean

triggered: number

Cloudforce OneThreat SignalsFeedsRaw

Get Threat Signals feed XML

client.cloudforceOne.threatSignals.feeds.raw.get(stringfeedID, RawGetParams { account_id, format } params, RequestOptionsoptions?): RawGetResponse

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/raw

ModelsExpand Collapse

RawGetResponse = string

Cloudforce OneThreat SignalsFeedsSkills

Get Threat Signals feed skills

client.cloudforceOne.threatSignals.feeds.skills.get(stringfeedID, SkillGetParams { account_id } params, RequestOptionsoptions?): SkillGetResponse { feed_id, skills }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/skills

Set Threat Signals feed skills

client.cloudforceOne.threatSignals.feeds.skills.update(stringfeedID, SkillUpdateParams { account_id, skill_ids } params, RequestOptionsoptions?): SkillUpdateResponse { feed_id, skills }

PUT/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/skills

ModelsExpand Collapse

SkillGetResponse { feed_id, skills }

feed_id: string

formatuuid

skills: Array<Skill>

id: string

config: string | null

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

name: string

output_schema: string | null

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" | "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

SkillUpdateResponse { feed_id, skills }

feed_id: string

formatuuid

skills: Array<Skill>

position: number

Zero-based pipeline position.

skill_id: string

Cloudforce OneThreat SignalsArticles

List Threat Signals articles

client.cloudforceOne.threatSignals.articles.list(ArticleListParams { account_id, article_id, cursor, 17 more } params, RequestOptionsoptions?): ArticleListResponse { articles, has_more, next_cursor, 2 more }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles

Bulk update Threat Signals article read status

client.cloudforceOne.threatSignals.articles.bulkEdit(ArticleBulkEditParams { account_id, article_ids, read } params, RequestOptionsoptions?): ArticleBulkEditResponse { updated_count }

PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles

Get Threat Signals article

client.cloudforceOne.threatSignals.articles.get(stringarticleID, ArticleGetParams { account_id } params, RequestOptionsoptions?): ArticleGetResponse { id, bullet_points, content_r2_key, 16 more }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}

Update Threat Signals article read status

client.cloudforceOne.threatSignals.articles.edit(stringarticleID, ArticleEditParams { account_id, read } params, RequestOptionsoptions?): ArticleEditResponse { id, bullet_points, content_r2_key, 16 more }

PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}

ModelsExpand Collapse

ArticleListResponse { articles, has_more, next_cursor, 2 more }

articles: Array<Article>

id: string

formatuuid

dataset_id: string | null

Threat Events dataset identifier for the article redirect. Null when the account feeds dataset mapping is unavailable.

event_id: string | null

Threat Events event identifier associated with this article for a UI redirect. Null when no event has been linked.

feed_display_name: string | null

feed_id: string

formatuuid

fetched_at: string

link: string | null

published_at: string | null

read: boolean

read_at: string | null

summary: string | null

Persisted enrichment summary. Null until enrichment produces a summary.

tags: Array<Tag>

applied_by: "ai" | "analyst" | "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string | null

formatuuid

uuid: string

formatuuid

value: string

title: string | null

has_more: boolean

next_cursor: string | null

total_count: number | null

total_count_is_exact: boolean

ArticleBulkEditResponse { updated_count }

updated_count: number

ArticleGetResponse { id, bullet_points, content_r2_key, 16 more }

id: string

formatuuid

bullet_points: BulletPoints | null

impact: string

what_happened: string

who_affected: string

content_r2_key: string | null

feed_display_name: string | null

feed_id: string

formatuuid

fetched_at: string

indicator_extraction_status: "in_progress" | "complete" | "failed" | "unknown"

Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded.

One of the following:

"in_progress"

"complete"

"failed"

"unknown"

link: string | null

metadata: Record<string, unknown> | null

published_at: string | null

read: boolean

read_at: string | null

source_count: number

summary: string | null

Persisted enrichment summary. Null until enrichment produces a summary.

summary_r2_key: string | null

tags: Array<Tag>

applied_by: "ai" | "analyst" | "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string | null

formatuuid

uuid: string

formatuuid

value: string

title: string | null

skill_version?: string | null

tag_skill_version?: string | null

ArticleEditResponse { id, bullet_points, content_r2_key, 16 more }

id: string

formatuuid

bullet_points: BulletPoints | null

impact: string

what_happened: string

who_affected: string

content_r2_key: string | null

feed_display_name: string | null

feed_id: string

formatuuid

fetched_at: string

indicator_extraction_status: "in_progress" | "complete" | "failed" | "unknown"

Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded.

One of the following:

"in_progress"

"complete"

"failed"

"unknown"

link: string | null

metadata: Record<string, unknown> | null

published_at: string | null

read: boolean

read_at: string | null

source_count: number

summary: string | null

Persisted enrichment summary. Null until enrichment produces a summary.

summary_r2_key: string | null

tags: Array<Tag>

applied_by: "ai" | "analyst" | "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string | null

formatuuid

uuid: string

formatuuid

value: string

title: string | null

skill_version?: string | null

tag_skill_version?: string | null

Cloudforce OneThreat SignalsArticlesContent

Get Threat Signals article content

client.cloudforceOne.threatSignals.articles.content.get(stringarticleID, ContentGetParams { account_id, format } params, RequestOptionsoptions?): ContentGetResponse

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/content

ModelsExpand Collapse

ContentGetResponse = string

Cloudforce OneThreat SignalsArticlesTags

Add tag to Threat Signals article

client.cloudforceOne.threatSignals.articles.tags.create(stringarticleID, TagCreateParams { account_id, tag_id } params, RequestOptionsoptions?): TagCreateResponse { applied_by, categoryId, uuid, value }

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tags

Remove tag from Threat Signals article

client.cloudforceOne.threatSignals.articles.tags.delete(stringtagID, TagDeleteParams { account_id, article_id } params, RequestOptionsoptions?): TagDeleteResponse { applied_by, categoryId, uuid, value }

DELETE/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tags/{tag_id}

Generate Threat Signals article AI tags

client.cloudforceOne.threatSignals.articles.tags.generate(stringarticleID, TagGenerateParams { account_id } params, RequestOptionsoptions?): TagGenerateResponse { tag_skill_version, tags }

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tag

ModelsExpand Collapse

TagCreateResponse { applied_by, categoryId, uuid, value }

applied_by: "ai" | "analyst" | "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string | null

formatuuid

uuid: string

formatuuid

value: string

TagDeleteResponse { applied_by, categoryId, uuid, value }

applied_by: "ai" | "analyst" | "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string | null

formatuuid

uuid: string

formatuuid

value: string

TagGenerateResponse { tag_skill_version, tags }

tag_skill_version: string

tags: Array<Tag>

Final hydrated assignment set; may be empty when no applicable tags are selected.

applied_by: "ai" | "analyst" | "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string | null

formatuuid

uuid: string

formatuuid

value: string

Cloudforce OneThreat SignalsArticlesSkill Outputs

Get Threat Signals article skill output

client.cloudforceOne.threatSignals.articles.skillOutputs.get(stringskillID, SkillOutputGetParams { account_id, article_id } params, RequestOptionsoptions?): SkillOutputGetResponse { article_id, custom_skill_version, output_schema, 2 more }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/skills/{skill_id}/output

ModelsExpand Collapse

SkillOutputGetResponse { article_id, custom_skill_version, output_schema, 2 more }

article_id: string

formatuuid

custom_skill_version: string | null

output_schema: string | null

JSON-encoded output schema of the skill. Null when the skill no longer exists.

skill_id: string

custom_output?: unknown

Skill output. Parsed JSON when the stored output is valid JSON, otherwise the raw string.

Cloudforce OneThreat SignalsIndicators

List Threat Signals article indicators

client.cloudforceOne.threatSignals.indicators.list(IndicatorListParams { account_id, article_id, cursor, 5 more } params, RequestOptionsoptions?): IndicatorListResponse { indicators, pagination }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/indicators

ModelsExpand Collapse

IndicatorListResponse { indicators, pagination }

indicators: Array<Indicator>

id: string

formatuuid

article_id: string

formatuuid

article_title: string | null

dataset_id: string | null

Threat Events dataset identifier for navigating from this indicator. Null when the account feeds dataset mapping is unavailable.

feed_display_name: string | null

feed_id: string

formatuuid

type: string

value: string

pagination: Pagination { count, cursor, has_more, 4 more }

count: number

minimum0

cursor: string | null

has_more: boolean

page: number

Ordinal of this cursor page; not a total-results offset.

minimum1

per_page: number

maximum100

minimum1

total_count: number | null

minimum0

total_count_is_exact: boolean

Cloudforce OneThreat SignalsSkills

List Threat Signals skills

client.cloudforceOne.threatSignals.skills.list(SkillListParams { account_id, page, per_page } params, RequestOptionsoptions?): V4PagePagination<SkillListResponse { count, custom_skills_available, page, 3 more } >

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills

Create Threat Signals skill

client.cloudforceOne.threatSignals.skills.create(SkillCreateParams { account_id, name, output_schema, 2 more } params, RequestOptionsoptions?): SkillCreateResponse { id, config, created_at, 7 more }

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills

Get Threat Signals skill

client.cloudforceOne.threatSignals.skills.get(stringskillID, SkillGetParams { account_id } params, RequestOptionsoptions?): SkillGetResponse { id, config, created_at, 7 more }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}

Update Threat Signals skill

client.cloudforceOne.threatSignals.skills.edit(stringskillID, SkillEditParams { account_id, config, is_active, 3 more } params, RequestOptionsoptions?): SkillEditResponse { id, config, created_at, 7 more }

PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}

Delete Threat Signals skill

client.cloudforceOne.threatSignals.skills.delete(stringskillID, SkillDeleteParams { account_id } params, RequestOptionsoptions?): SkillDeleteResponse { id, config, created_at, 7 more }

DELETE/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}

ModelsExpand Collapse

SkillListResponse { count, custom_skills_available, page, 3 more }

count: number

Number of skills on this page.

custom_skills_available: boolean

Whether the authenticated account may access custom-skill capabilities under Stakeout’s Threat Signals access-mode policy. This is a policy availability indicator, not a row-existence indicator. False for threat_signals_only mode; true for entitled, allowlisted, cfone_internal, and service modes.

page: number

per_page: number

skills: Array<Skill>

id: string

config: string | null

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

name: string

output_schema: string | null

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" | "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

total_count: number

SkillCreateResponse { id, config, created_at, 7 more }

id: string

config: string | null

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

name: string

output_schema: string | null

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" | "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

SkillGetResponse { id, config, created_at, 7 more }

id: string

config: string | null

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

name: string

output_schema: string | null

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" | "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

SkillEditResponse { id, config, created_at, 7 more }

id: string

config: string | null

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

name: string

output_schema: string | null

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" | "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

SkillDeleteResponse { id, config, created_at, 7 more }

id: string

config: string | null

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

name: string

output_schema: string | null

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" | "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

Cloudforce OneThreat SignalsSkillsTag Categories

Get Threat Signals skill tag categories

client.cloudforceOne.threatSignals.skills.tagCategories.get("default-tagging-skill"skillID, TagCategoryGetParams { account_id } params, RequestOptionsoptions?): TagCategoryGetResponse { category_uuids, skill_id }

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}/tag-categories

Replace Threat Signals skill tag categories

client.cloudforceOne.threatSignals.skills.tagCategories.update("default-tagging-skill"skillID, TagCategoryUpdateParams { account_id, category_uuids } params, RequestOptionsoptions?): TagCategoryUpdateResponse { category_uuids, skill_id }

PUT/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}/tag-categories

ModelsExpand Collapse

TagCategoryGetResponse { category_uuids, skill_id }

category_uuids: Array<string>

skill_id: "default-tagging-skill"

TagCategoryUpdateResponse { category_uuids, skill_id }

category_uuids: Array<string>

skill_id: "default-tagging-skill"