---
title: Creates bulk DOS event with relationships and indicators
---

[Skip to content](#%5Ftop) 

[API Reference](https://developers.cloudflare.com/api/go)

[Cloudforce One](https://developers.cloudflare.com/api/go/resources/cloudforce%5Fone)

[Threat Events](https://developers.cloudflare.com/api/go/resources/cloudforce%5Fone/subresources/threat%5Fevents)

Copy Markdown

Open in **Claude**

Open in **ChatGPT**

Open in **Cursor**

---

**Copy Markdown**

**View as Markdown**

# Creates bulk DOS event with relationships and indicators

Deprecated: This endpoint is deprecated and will be removed in a future version.

client.CloudforceOne.ThreatEvents.BulkNewRelationships(ctx, params) (\*[ThreatEventBulkNewRelationshipsResponse](https://developers.cloudflare.com/api/go/resources/cloudforce%5Fone#%28resource%29%20cloudforce%5Fone.threat%5Fevents%20%3E%20%28model%29%20ThreatEventBulkNewRelationshipsResponse%20%3E%20%28schema%29), error)

POST/accounts/{account\_id}/cloudforce-one/events/create/bulk/relationships

This method is deprecated. Please use `event_create_bulk` instead

##### Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. [Create a token](https://developers.cloudflare.com/fundamentals/api/get-started/create-token/).

**Example:**`Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY`

##### Accepted Permissions (at least one required)

`Cloudforce One Write` `Cloudforce One Read`

##### ParametersExpand Collapse 

params ThreatEventBulkNewRelationshipsParams

AccountID param.Field\[string\]

Path param: Account ID.

Data param.Field\[\[\]ThreatEventBulkNewRelationshipsParamsData\]

Body param

Category string

Date Time

formatdate-time

Event string

Raw ThreatEventBulkNewRelationshipsParamsDataRaw

Data map\[string, unknown\]

Source stringOptional

TLP stringOptional

TLP string

AccountID float64Optional

Attacker stringOptional

AttackerCountry stringOptional

DatasetID stringOptional

Indicator stringOptional

Indicators \[\]ThreatEventBulkNewRelationshipsParamsDataIndicatorOptional

Array of indicators for this event. Supports multiple indicators per event for complex scenarios.

IndicatorType string

The type of indicator (e.g., DOMAIN, IP, JA3, HASH)

Value string

The indicator value (e.g., domain name, IP address, hash)

IndicatorType stringOptional

Insight stringOptional

Tags \[\]stringOptional

TargetCountry stringOptional

TargetIndustry stringOptional

DatasetID param.Field\[string\]

Body param

##### ReturnsExpand Collapse 

type ThreatEventBulkNewRelationshipsResponse struct{…}

Result of bulk relationship creation operation

CreatedEventsCount float64

Number of events created

CreatedIndicatorsCount float64

Number of indicators created

CreatedRelationshipsCount float64

Number of relationships created

ErrorCount float64

Number of errors encountered

Errors \[\]ThreatEventBulkNewRelationshipsResponseErrorOptional

Array of error details

Error string

Error message

EventIndex float64

Index of the event that caused the error

### Creates bulk DOS event with relationships and indicators

Go

HTTPHTTP

TypeScriptTypeScript

PythonPython

GoGo

TerraformTerraform

```
package main

import (
  "context"
  "fmt"
  "time"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.CloudforceOne.ThreatEvents.BulkNewRelationships(context.TODO(), cloudforce_one.ThreatEventBulkNewRelationshipsParams{
    AccountID: cloudflare.F("account_id"),
    Data: cloudflare.F([]cloudforce_one.ThreatEventBulkNewRelationshipsParamsData{cloudforce_one.ThreatEventBulkNewRelationshipsParamsData{
      Category: cloudflare.F("Domain Resolution"),
      Date: cloudflare.F(time.Now()),
      Event: cloudflare.F("An attacker registered the domain domain.com"),
      Raw: cloudflare.F(cloudforce_one.ThreatEventBulkNewRelationshipsParamsDataRaw{
        Data: cloudflare.F(map[string]interface{}{
        "foo": "bar",
        }),
      }),
      TLP: cloudflare.F("amber"),
    }}),
    DatasetID: cloudflare.F("durableObjectName"),
  })
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.CreatedEventsCount)
}

```

200 example

```
{
  "createdEventsCount": 0,
  "createdIndicatorsCount": 0,
  "createdRelationshipsCount": 0,
  "errorCount": 0,
  "errors": [
    {
      "error": "error",
      "eventIndex": 0
    }
  ]
}
```

##### Returns Examples

200 example

```
{
  "createdEventsCount": 0,
  "createdIndicatorsCount": 0,
  "createdRelationshipsCount": 0,
  "errorCount": 0,
  "errors": [
    {
      "error": "error",
      "eventIndex": 0
    }
  ]
}
```