List events

client.CloudforceOne.ThreatEvents.List(ctx, params) (*[]ThreatEventListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events

Lists events, with filters passed as query parameters. datasetId accepts dataset UUIDs or one scope value used alone: all (or *) and operational select the intelligence datasets you can read, and analytics selects the analytics datasets you can read. A scope value covers at most 50 datasets. Without datasetId, the default Cloudforce One Threat Events dataset is used. To send filters in a JSON body instead, use threat-intel events search.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

Accepted Permissions (at least one required)

Cloudforce One WriteCloudforce One Read

ParametersExpand Collapse

params ThreatEventListParams

AccountID param.Field[string]

Path param: Account ID.

Cache param.Field[ThreatEventListParamsCache]Optional

Query param: Cache strategy. ‘from-graph’ serves results from the graph-node KV cache when all requested UUIDs are cached; falls back to normal path on partial/zero hit.

const ThreatEventListParamsCacheFromGraph ThreatEventListParamsCache = "from-graph"

Cursor param.Field[string]Optional

Query param: Cursor for pagination. When provided, filters are embedded in the cursor so you only need to pass cursor and pageSize. Returned in the previous response’s result_info.cursor field. Use cursor-based pagination for deep pagination (beyond 100,000 records) or for optimal performance.

DatasetID param.Field[[]string]Optional

Query param: Dataset UUIDs to query, or one standalone scope value: ‘all’/’*’ or ‘operational’ for readable intelligence datasets (isAnalytics=false), or ‘analytics’ for readable analytics datasets (isAnalytics=true). Scope values query at most 50 datasets. If not provided, uses the default dataset.

ForceRefresh param.Field[bool]Optional

Query param

Format param.Field[ThreatEventListParamsFormat]Optional

Query param

const ThreatEventListParamsFormatJson ThreatEventListParamsFormat = "json"

const ThreatEventListParamsFormatStix2 ThreatEventListParamsFormat = "stix2"

const ThreatEventListParamsFormatTaxii ThreatEventListParamsFormat = "taxii"

Order param.Field[ThreatEventListParamsOrder]Optional

Query param

const ThreatEventListParamsOrderAsc ThreatEventListParamsOrder = "asc"

const ThreatEventListParamsOrderDesc ThreatEventListParamsOrder = "desc"

OrderBy param.Field[string]Optional

Query param

Page param.Field[float64]Optional

Query param: Page number (1-indexed) for offset-based pagination. Limited to offset of 100,000 records. For deep pagination, use cursor-based pagination instead.

PageSize param.Field[float64]Optional

Query param: Number of results per page. Maximum 25,000.

Search param.Field[[]ThreatEventListParamsSearch]Optional

Query param: JSON-encoded. Structured search as a JSON array of {field, op, value} objects, AND’d together. Max 10 conditions per request. in and notIn take an array of up to 100 values. Exclusions: not drops events without a value for the field; notIn and notContains keep them. On intelligence datasets, a notIn list containing "unknown" also drops them; analytics datasets treat "unknown" as a literal value.

type ThreatEventListParamsSearchObject struct{…}

Field ThreatEventListParamsSearchObjectField

One of the following:

const ThreatEventListParamsSearchObjectFieldAttacker ThreatEventListParamsSearchObjectField = "attacker"

const ThreatEventListParamsSearchObjectFieldAttackerCountry ThreatEventListParamsSearchObjectField = "attackerCountry"

const ThreatEventListParamsSearchObjectFieldCategory ThreatEventListParamsSearchObjectField = "category"

const ThreatEventListParamsSearchObjectFieldCreatedAt ThreatEventListParamsSearchObjectField = "createdAt"

const ThreatEventListParamsSearchObjectFieldDate ThreatEventListParamsSearchObjectField = "date"

const ThreatEventListParamsSearchObjectFieldEvent ThreatEventListParamsSearchObjectField = "event"

const ThreatEventListParamsSearchObjectFieldIndicator ThreatEventListParamsSearchObjectField = "indicator"

const ThreatEventListParamsSearchObjectFieldIndicatorType ThreatEventListParamsSearchObjectField = "indicatorType"

const ThreatEventListParamsSearchObjectFieldMitreAttack ThreatEventListParamsSearchObjectField = "mitreAttack"

const ThreatEventListParamsSearchObjectFieldMitreCapec ThreatEventListParamsSearchObjectField = "mitreCapec"

const ThreatEventListParamsSearchObjectFieldTags ThreatEventListParamsSearchObjectField = "tags"

const ThreatEventListParamsSearchObjectFieldTargetCountry ThreatEventListParamsSearchObjectField = "targetCountry"

const ThreatEventListParamsSearchObjectFieldTargetIndustry ThreatEventListParamsSearchObjectField = "targetIndustry"

const ThreatEventListParamsSearchObjectFieldTLP ThreatEventListParamsSearchObjectField = "tlp"

const ThreatEventListParamsSearchObjectFieldUUID ThreatEventListParamsSearchObjectField = "uuid"

Op ThreatEventListParamsSearchObjectOp

One of the following:

const ThreatEventListParamsSearchObjectOpEquals ThreatEventListParamsSearchObjectOp = "equals"

const ThreatEventListParamsSearchObjectOpNot ThreatEventListParamsSearchObjectOp = "not"

const ThreatEventListParamsSearchObjectOpGt ThreatEventListParamsSearchObjectOp = "gt"

const ThreatEventListParamsSearchObjectOpGte ThreatEventListParamsSearchObjectOp = "gte"

const ThreatEventListParamsSearchObjectOpLt ThreatEventListParamsSearchObjectOp = "lt"

const ThreatEventListParamsSearchObjectOpLte ThreatEventListParamsSearchObjectOp = "lte"

const ThreatEventListParamsSearchObjectOpLike ThreatEventListParamsSearchObjectOp = "like"

const ThreatEventListParamsSearchObjectOpContains ThreatEventListParamsSearchObjectOp = "contains"

const ThreatEventListParamsSearchObjectOpStartsWith ThreatEventListParamsSearchObjectOp = "startsWith"

const ThreatEventListParamsSearchObjectOpEndsWith ThreatEventListParamsSearchObjectOp = "endsWith"

const ThreatEventListParamsSearchObjectOpFind ThreatEventListParamsSearchObjectOp = "find"

const ThreatEventListParamsSearchObjectOpNotContains ThreatEventListParamsSearchObjectOp = "notContains"

Value string

maxLength512

minLength1