Skip to content
Cloudflare API
Start here
API Reference
Cloudforce One
Threat Events

Create events in bulk

client.CloudforceOne.ThreatEvents.BulkNew(ctx, params) (*ThreatEventBulkNewResponse, error)
POST/accounts/{account_id}/cloudforce-one/events/create/bulk

Creates multiple events in one dataset. datasetId is required; to find dataset IDs, use threat-intel datasets list. Set includeCreatedEvents to return the UUIDs of the created events.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
Accepted Permissions (at least one required)
Cloudforce One WriteCloudforce One Read
ParametersExpand Collapse
params ThreatEventBulkNewParams
AccountID param.Field[string]

Path param: Account ID.

Data param.Field[[]ThreatEventBulkNewParamsData]

Body param

Category string
Date Time
formatdate-time
Event string
Raw ThreatEventBulkNewParamsDataRaw
Data map[string, unknown]
Source stringOptional
TLP stringOptional
TLP string
AccountID float64Optional
Attacker stringOptional
AttackerCountry stringOptional
DatasetID stringOptional
Indicator stringOptional
Indicators []ThreatEventBulkNewParamsDataIndicatorOptional

Array of indicators for this event. Supports multiple indicators per event for complex scenarios.

IndicatorType string

The type of indicator (e.g., DOMAIN, IP, JA3, HASH)

Value string

The indicator value (e.g., domain name, IP address, hash)

IndicatorType stringOptional
Insight stringOptional
Tags []stringOptional
TargetCountry stringOptional
TargetIndustry stringOptional
DatasetID param.Field[string]

Body param

IncludeCreatedEvents param.Field[bool]Optional

Body param: When true, response includes array of created event UUIDs and shard IDs. Useful for tracking which events were created and where.

ReturnsExpand Collapse
type ThreatEventBulkNewResponse struct{…}

Detailed result of bulk event creation with auto-tag management

CreatedEventsCount float64

Number of events created

CreatedTagsCount float64

Number of new tags created in SoT

ErrorCount float64

Number of errors encountered

QueuedIndicatorsCount float64

Number of indicators queued for async processing

CreateBulkEventsRequestID stringOptional

Correlation ID for async indicator processing

formatuuid
CreatedEvents []ThreatEventBulkNewResponseCreatedEventOptional

Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true

EventIndex float64

Original index in the input data array

ShardID string

Dataset ID of the shard where the event was created

UUID string

UUID of the created event

formatuuid
Errors []ThreatEventBulkNewResponseErrorOptional

Array of error details

Error string

Error message

EventIndex float64

Index of the event that caused the error

Create events in bulk

package main

import (
  "context"
  "fmt"
  "time"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.CloudforceOne.ThreatEvents.BulkNew(context.TODO(), cloudforce_one.ThreatEventBulkNewParams{
    AccountID: cloudflare.F("account_id"),
    Data: cloudflare.F([]cloudforce_one.ThreatEventBulkNewParamsData{cloudforce_one.ThreatEventBulkNewParamsData{
      Category: cloudflare.F("Domain Resolution"),
      Date: cloudflare.F(time.Now()),
      Event: cloudflare.F("An attacker registered the domain domain.com"),
      Raw: cloudflare.F(cloudforce_one.ThreatEventBulkNewParamsDataRaw{
        Data: cloudflare.F(map[string]interface{}{
        "foo": "bar",
        }),
      }),
      TLP: cloudflare.F("amber"),
    }}),
    DatasetID: cloudflare.F("durableObjectName"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.CreatedEventsCount)
}

{
  "createdEventsCount": 0,
  "createdTagsCount": 0,
  "errorCount": 0,
  "queuedIndicatorsCount": 0,
  "createBulkEventsRequestId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
  "createdEvents": [
    {
      "eventIndex": 0,
      "shardId": "shardId",
      "uuid": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
    }
  ],
  "errors": [
    {
      "error": "error",
      "eventIndex": 0
    }
  ]
}
Returns Examples
{
  "createdEventsCount": 0,
  "createdTagsCount": 0,
  "errorCount": 0,
  "queuedIndicatorsCount": 0,
  "createBulkEventsRequestId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
  "createdEvents": [
    {
      "eventIndex": 0,
      "shardId": "shardId",
      "uuid": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
    }
  ],
  "errors": [
    {
      "error": "error",
      "eventIndex": 0
    }
  ]
}