Filter and list events

client.CloudforceOne.ThreatEvents.List(ctx, params) (*[]ThreatEventListResponse, error)

GET/accounts/{account_id}/cloudforce-one/events

Use datasetId=all or datasetId=* for the legacy all-datasets scope, datasetId=analytics for datasets with isAnalytics=true, or datasetId=operational for datasets with isAnalytics=false (limited to 50). Scope values must be used alone. When datasetId is unspecified, events are listed from the default Cloudforce One Threat Events dataset. To list existing datasets, use the List Datasets endpoint.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

Accepted Permissions (at least one required)

Cloudforce One WriteCloudforce One Read

ParametersExpand Collapse

params ThreatEventListParams

AccountID param.Field[string]

Path param: Account ID.

Cache param.Field[ThreatEventListParamsCache]Optional

Query param: Cache strategy. ‘from-graph’ serves results from the graph-node KV cache when all requested UUIDs are cached; falls back to normal path on partial/zero hit.

const ThreatEventListParamsCacheFromGraph ThreatEventListParamsCache = "from-graph"

Cursor param.Field[string]Optional

Query param: Cursor for pagination. When provided, filters are embedded in the cursor so you only need to pass cursor and pageSize. Returned in the previous response’s result_info.cursor field. Use cursor-based pagination for deep pagination (beyond 100,000 records) or for optimal performance.

DatasetID param.Field[[]string]Optional

Query param: Dataset UUIDs to query, or one standalone scope value: ‘all’/’*’ for the legacy all-datasets behavior, ‘analytics’ for isAnalytics=true datasets, or ‘operational’ for isAnalytics=false datasets. If not provided, uses the default dataset.

ForceRefresh param.Field[bool]Optional

Query param

Format param.Field[ThreatEventListParamsFormat]Optional

Query param

const ThreatEventListParamsFormatJson ThreatEventListParamsFormat = "json"

const ThreatEventListParamsFormatStix2 ThreatEventListParamsFormat = "stix2"

const ThreatEventListParamsFormatTaxii ThreatEventListParamsFormat = "taxii"

Order param.Field[ThreatEventListParamsOrder]Optional

Query param

const ThreatEventListParamsOrderAsc ThreatEventListParamsOrder = "asc"

const ThreatEventListParamsOrderDesc ThreatEventListParamsOrder = "desc"

OrderBy param.Field[string]Optional

Query param

Page param.Field[float64]Optional

Query param: Page number (1-indexed) for offset-based pagination. Limited to offset of 100,000 records. For deep pagination, use cursor-based pagination instead.

PageSize param.Field[float64]Optional

Query param: Number of results per page. Maximum 25,000.

Search param.Field[[]ThreatEventListParamsSearch]Optional

Query param

type ThreatEventListParamsSearchObject struct{…}

Field ThreatEventListParamsSearchObjectField

One of the following:

const ThreatEventListParamsSearchObjectFieldAttacker ThreatEventListParamsSearchObjectField = "attacker"

const ThreatEventListParamsSearchObjectFieldAttackerCountry ThreatEventListParamsSearchObjectField = "attackerCountry"

const ThreatEventListParamsSearchObjectFieldCategory ThreatEventListParamsSearchObjectField = "category"

const ThreatEventListParamsSearchObjectFieldCreatedAt ThreatEventListParamsSearchObjectField = "createdAt"

const ThreatEventListParamsSearchObjectFieldDate ThreatEventListParamsSearchObjectField = "date"

const ThreatEventListParamsSearchObjectFieldEvent ThreatEventListParamsSearchObjectField = "event"

const ThreatEventListParamsSearchObjectFieldIndicator ThreatEventListParamsSearchObjectField = "indicator"

const ThreatEventListParamsSearchObjectFieldIndicatorType ThreatEventListParamsSearchObjectField = "indicatorType"

const ThreatEventListParamsSearchObjectFieldMitreAttack ThreatEventListParamsSearchObjectField = "mitreAttack"

const ThreatEventListParamsSearchObjectFieldMitreCapec ThreatEventListParamsSearchObjectField = "mitreCapec"

const ThreatEventListParamsSearchObjectFieldTags ThreatEventListParamsSearchObjectField = "tags"

const ThreatEventListParamsSearchObjectFieldTargetCountry ThreatEventListParamsSearchObjectField = "targetCountry"

const ThreatEventListParamsSearchObjectFieldTargetIndustry ThreatEventListParamsSearchObjectField = "targetIndustry"

const ThreatEventListParamsSearchObjectFieldTLP ThreatEventListParamsSearchObjectField = "tlp"

const ThreatEventListParamsSearchObjectFieldUUID ThreatEventListParamsSearchObjectField = "uuid"

Op ThreatEventListParamsSearchObjectOp

One of the following:

const ThreatEventListParamsSearchObjectOpEquals ThreatEventListParamsSearchObjectOp = "equals"

const ThreatEventListParamsSearchObjectOpNot ThreatEventListParamsSearchObjectOp = "not"

const ThreatEventListParamsSearchObjectOpGt ThreatEventListParamsSearchObjectOp = "gt"

const ThreatEventListParamsSearchObjectOpGte ThreatEventListParamsSearchObjectOp = "gte"

const ThreatEventListParamsSearchObjectOpLt ThreatEventListParamsSearchObjectOp = "lt"

const ThreatEventListParamsSearchObjectOpLte ThreatEventListParamsSearchObjectOp = "lte"

const ThreatEventListParamsSearchObjectOpLike ThreatEventListParamsSearchObjectOp = "like"

const ThreatEventListParamsSearchObjectOpContains ThreatEventListParamsSearchObjectOp = "contains"

const ThreatEventListParamsSearchObjectOpStartsWith ThreatEventListParamsSearchObjectOp = "startsWith"

const ThreatEventListParamsSearchObjectOpEndsWith ThreatEventListParamsSearchObjectOp = "endsWith"

const ThreatEventListParamsSearchObjectOpFind ThreatEventListParamsSearchObjectOp = "find"

Value string

maxLength512

minLength1