Skip to content
Cloudflare API
Start here
API Reference
Cloudforce One

Threat Events

List events
cloudforce_one.threat_events.list(ThreatEventListParams**kwargs) -> ThreatEventListResponse
GET/accounts/{account_id}/cloudforce-one/events
Get an event (legacy)
Deprecated
cloudforce_one.threat_events.get(strevent_id, ThreatEventGetParams**kwargs) -> ThreatEventGetResponse
GET/accounts/{account_id}/cloudforce-one/events/{event_id}
Create an event
cloudforce_one.threat_events.create(ThreatEventCreateParams**kwargs) -> ThreatEventCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/create
Update an event
cloudforce_one.threat_events.edit(strevent_id, ThreatEventEditParams**kwargs) -> ThreatEventEditResponse
PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}
Create events in bulk
cloudforce_one.threat_events.bulk_create(ThreatEventBulkCreateParams**kwargs) -> ThreatEventBulkCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/create/bulk
Create events with relationships in bulk (legacy)
Deprecated
cloudforce_one.threat_events.bulk_create_relationships(ThreatEventBulkCreateRelationshipsParams**kwargs) -> ThreatEventBulkCreateRelationshipsResponse
POST/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships
ModelsExpand Collapse
List[ThreatEventListResponseItem]
attacker: str
attacker_country: str
attacker_country_alpha3: str
category: str
dataset_id: str
date: str
event: str
has_children: bool
indicator: str
indicator_type: str
indicator_type_id: float
kill_chain: float
mitre_attack: List[str]
mitre_capec: List[str]
num_referenced: float
num_references: float
raw_id: str
referenced: List[str]
referenced_ids: List[float]
references: List[str]
references_ids: List[float]
tags: List[str]
target_country: str
target_country_alpha3: str
target_industry: str
tlp: str
uuid: str
insight: Optional[str]
releasability_id: Optional[str]
class ThreatEventGetResponse: …
attacker: str
attacker_country: str
attacker_country_alpha3: str
category: str
dataset_id: str
date: str
event: str
has_children: bool
indicator: str
indicator_type: str
indicator_type_id: float
kill_chain: float
mitre_attack: List[str]
mitre_capec: List[str]
num_referenced: float
num_references: float
raw_id: str
referenced: List[str]
referenced_ids: List[float]
references: List[str]
references_ids: List[float]
tags: List[str]
target_country: str
target_country_alpha3: str
target_industry: str
tlp: str
uuid: str
insight: Optional[str]
releasability_id: Optional[str]
class ThreatEventCreateResponse: …
attacker: str
attacker_country: str
attacker_country_alpha3: str
category: str
dataset_id: str
date: str
event: str
has_children: bool
indicator: str
indicator_type: str
indicator_type_id: float
kill_chain: float
mitre_attack: List[str]
mitre_capec: List[str]
num_referenced: float
num_references: float
raw_id: str
referenced: List[str]
referenced_ids: List[float]
references: List[str]
references_ids: List[float]
tags: List[str]
target_country: str
target_country_alpha3: str
target_industry: str
tlp: str
uuid: str
insight: Optional[str]
releasability_id: Optional[str]
class ThreatEventEditResponse: …
attacker: str
attacker_country: str
attacker_country_alpha3: str
category: str
dataset_id: str
date: str
event: str
has_children: bool
indicator: str
indicator_type: str
indicator_type_id: float
kill_chain: float
mitre_attack: List[str]
mitre_capec: List[str]
num_referenced: float
num_references: float
raw_id: str
referenced: List[str]
referenced_ids: List[float]
references: List[str]
references_ids: List[float]
tags: List[str]
target_country: str
target_country_alpha3: str
target_industry: str
tlp: str
uuid: str
insight: Optional[str]
releasability_id: Optional[str]
class ThreatEventBulkCreateResponse: …

Detailed result of bulk event creation with auto-tag management

created_events_count: float

Number of events created

created_tags_count: float

Number of new tags created in SoT

error_count: float

Number of errors encountered

queued_indicators_count: float

Number of indicators queued for async processing

create_bulk_events_request_id: Optional[str]

Correlation ID for async indicator processing

formatuuid
created_events: Optional[List[CreatedEvent]]

Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true

event_index: float

Original index in the input data array

shard_id: str

Dataset ID of the shard where the event was created

uuid: str

UUID of the created event

formatuuid
errors: Optional[List[Error]]

Array of error details

error: str

Error message

event_index: float

Index of the event that caused the error

class ThreatEventBulkCreateRelationshipsResponse: …

Result of bulk relationship creation operation

created_events_count: float

Number of events created

created_indicators_count: float

Number of indicators created

created_relationships_count: float

Number of relationships created

error_count: float

Number of errors encountered

errors: Optional[List[Error]]

Array of error details

error: str

Error message

event_index: float

Index of the event that caused the error

Threat EventsAggregate

Aggregate events
cloudforce_one.threat_events.aggregate.list(AggregateListParams**kwargs) -> AggregateListResponse
GET/accounts/{account_id}/cloudforce-one/events/aggregate
ModelsExpand Collapse
class AggregateListResponse: …
aggregate_by: str

Column(s) that were aggregated by

aggregations: List[Aggregation]

Array of aggregation results with dynamic fields based on aggregateBy columns

count: float

Number of events for this aggregation

date: Optional[str]

Date (if groupByDate is true)

total: float

Total number of events in the aggregation

date_range: Optional[DateRange]

Date range used for filtering

end_date: Optional[str]
start_date: Optional[str]

Threat EventsGraphql

Run a GraphQL aggregation over events
cloudforce_one.threat_events.graphql.create(GraphqlCreateParams**kwargs) -> GraphqlCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/graphql
ModelsExpand Collapse
class GraphqlCreateResponse: …
data: Optional[object]
errors: Optional[List[object]]

Threat EventsGraph

Query graph neighborhood from R2 Data Catalog
cloudforce_one.threat_events.graph.list(GraphListParams**kwargs) -> GraphListResponse
GET/accounts/{account_id}/cloudforce-one/events/graph
ModelsExpand Collapse
class GraphListResponse: …
edges: List[Edge]
id: str

Deterministic composite edge id (source→target:relationshipType)

relationship_type: str
source: str

Compact id of the source node (type:uuid)

source_id: str
source_type: str
target: str

Compact id of the target node (type:uuid)

target_id: str
target_type: str
node: Optional[Dict[str, object]]

Focal node object (legacy single-seed). Null when unavailable.

nodes: List[Dict[str, object]]

Threat EventsQueries

List saved event queries
cloudforce_one.threat_events.queries.list(QueryListParams**kwargs) -> QueryListResponse
GET/accounts/{account_id}/cloudforce-one/events/queries
Create a saved event query
cloudforce_one.threat_events.queries.create(QueryCreateParams**kwargs) -> QueryCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/queries/create
Get a saved event query
cloudforce_one.threat_events.queries.get(intquery_id, QueryGetParams**kwargs) -> QueryGetResponse
GET/accounts/{account_id}/cloudforce-one/events/queries/{query_id}
Update a saved event query
cloudforce_one.threat_events.queries.edit(intquery_id, QueryEditParams**kwargs) -> QueryEditResponse
PATCH/accounts/{account_id}/cloudforce-one/events/queries/{query_id}
Delete a saved event query
cloudforce_one.threat_events.queries.delete(intquery_id, QueryDeleteParams**kwargs)
DELETE/accounts/{account_id}/cloudforce-one/events/queries/{query_id}
ModelsExpand Collapse
List[QueryListResponseItem]
id: int

Unique identifier for the saved query

account_id: int

Account ID

Deprecatedalert_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: str

Creation timestamp

name: str

Name of the saved query

query_json: str

JSON string containing the query parameters

Deprecatedrule_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: str

Last update timestamp

user_email: str

Email of the user who created the query

Deprecatedcustom_threat_feed_id: Optional[int]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

class QueryCreateResponse: …
id: int

Unique identifier for the saved query

account_id: int

Account ID

Deprecatedalert_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: str

Creation timestamp

name: str

Name of the saved query

query_json: str

JSON string containing the query parameters

Deprecatedrule_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: str

Last update timestamp

user_email: str

Email of the user who created the query

Deprecatedcustom_threat_feed_id: Optional[int]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

class QueryGetResponse: …
id: int

Unique identifier for the saved query

account_id: int

Account ID

Deprecatedalert_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: str

Creation timestamp

name: str

Name of the saved query

query_json: str

JSON string containing the query parameters

Deprecatedrule_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: str

Last update timestamp

user_email: str

Email of the user who created the query

Deprecatedcustom_threat_feed_id: Optional[int]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

class QueryEditResponse: …
id: int

Unique identifier for the saved query

account_id: int

Account ID

Deprecatedalert_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: str

Creation timestamp

name: str

Name of the saved query

query_json: str

JSON string containing the query parameters

Deprecatedrule_enabled: bool

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: str

Last update timestamp

user_email: str

Email of the user who created the query

Deprecatedcustom_threat_feed_id: Optional[int]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope: Optional[str]

Deprecated: saved-query alerting and rules were removed. Always null.

Threat EventsRelationships

List related events (legacy)
Deprecated
cloudforce_one.threat_events.relationships.list(strevent_id, RelationshipListParams**kwargs) -> RelationshipListResponse
GET/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships
ModelsExpand Collapse
List[RelationshipListResponseItem]
attacker: str
attacker_country: str
attacker_country_alpha3: str
category: str
dataset_id: str
date: str
event: str
has_children: bool
indicator: str
indicator_type: str
indicator_type_id: float
kill_chain: float
mitre_attack: List[str]
mitre_capec: List[str]
num_referenced: float
num_references: float
raw_id: str
referenced: List[str]
referenced_ids: List[float]
references: List[str]
references_ids: List[float]
tags: List[str]
target_country: str
target_country_alpha3: str
target_industry: str
tlp: str
uuid: str
insight: Optional[str]
releasability_id: Optional[str]

Threat EventsIndicators

List indicators
cloudforce_one.threat_events.indicators.list(IndicatorListParams**kwargs) -> IndicatorListResponse
GET/accounts/{account_id}/cloudforce-one/events/indicators
ModelsExpand Collapse
class IndicatorListResponse: …
properties: Properties
completeness: PropertiesCompleteness
properties: PropertiesCompletenessProperties
complete: PropertiesCompletenessPropertiesComplete
type: str
failed_datasets: PropertiesCompletenessPropertiesFailedDatasets
items: PropertiesCompletenessPropertiesFailedDatasetsItems
type: str
type: str
failed_shards: PropertiesCompletenessPropertiesFailedShards
items: PropertiesCompletenessPropertiesFailedShardsItems
properties: PropertiesCompletenessPropertiesFailedShardsItemsProperties
dataset_id: PropertiesCompletenessPropertiesFailedShardsItemsPropertiesDatasetID
type: str
shard_id: PropertiesCompletenessPropertiesFailedShardsItemsPropertiesShardID
type: str
type: str
type: str
warnings: PropertiesCompletenessPropertiesWarnings
items: PropertiesCompletenessPropertiesWarningsItems
type: str
type: str
type: str
indicators: PropertiesIndicators
items: PropertiesIndicatorsItems
created_at: datetime
formatdate-time
indicator_type: str
sources: List[PropertiesIndicatorsItemsSource]

RSS article sources from which this indicator was extracted.

resource_id: str
formatuuid
resource_type: Literal["article"]
system: Literal["threat-signals"]
title: Optional[str]

Threat Signals article title; null for historical provenance without a stored title.

updated_at: datetime
formatdate-time
uuid: str
value: str
dataset_id: Optional[str]

The dataset ID this indicator belongs to. Included in list responses.

related_events: Optional[List[PropertiesIndicatorsItemsRelatedEvent]]

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

dataset_id: str
event_id: str
event_date: Optional[str]

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

related_events_has_more: Optional[bool]

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags: Optional[List[PropertiesIndicatorsItemsTag]]
category_id: Optional[str]

The UUID of the tag category, or null when the tag is uncategorized.

category_name: Optional[str]
uuid: Optional[str]
value: Optional[str]
tlp: Optional[str]

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

type: str
type: str

Threat EventsIndicatorsAggregate

Aggregate indicators by column(s)
cloudforce_one.threat_events.indicators.aggregate.list(AggregateListParams**kwargs) -> AggregateListResponse
GET/accounts/{account_id}/cloudforce-one/events/indicators/aggregate
ModelsExpand Collapse
class AggregateListResponse: …
aggregate_by: str

Column(s) that were aggregated by

aggregations: List[Aggregation]

Array of aggregation results with dynamic fields based on aggregateBy columns

count: float

Number of indicators for this aggregation

failed_datasets: float

Number of datasets whose aggregation failed and were excluded from the result

total: float

Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships

Threat EventsIndicatorsTypes

List indicator types
cloudforce_one.threat_events.indicators.types.list(TypeListParams**kwargs) -> TypeListResponse
GET/accounts/{account_id}/cloudforce-one/events/indicator-types
ModelsExpand Collapse
class TypeListResponse: …
items: Items
type: str
type: str

Threat EventsIndicatorsBy Dataset

List indicators in a dataset (legacy)
Deprecated
cloudforce_one.threat_events.indicators.by_dataset.list(strdataset_id, ByDatasetListParams**kwargs) -> ByDatasetListResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators
Get an indicator
cloudforce_one.threat_events.indicators.by_dataset.get(strindicator_id, ByDatasetGetParams**kwargs) -> ByDatasetGetResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}
ModelsExpand Collapse
class ByDatasetListResponse: …
indicators: List[Indicator]
created_at: datetime
formatdate-time
indicator_type: str
sources: List[IndicatorSource]

RSS article sources from which this indicator was extracted.

resource_id: str
formatuuid
resource_type: Literal["article"]
system: Literal["threat-signals"]
title: Optional[str]

Threat Signals article title; null for historical provenance without a stored title.

updated_at: datetime
formatdate-time
uuid: str
value: str
dataset_id: Optional[str]

The dataset ID this indicator belongs to. Included in list responses.

related_events: Optional[List[IndicatorRelatedEvent]]

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

dataset_id: str
event_id: str
event_date: Optional[str]

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

related_events_has_more: Optional[bool]

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags: Optional[List[IndicatorTag]]
category_id: Optional[str]

The UUID of the tag category, or null when the tag is uncategorized.

category_name: Optional[str]
uuid: Optional[str]
value: Optional[str]
tlp: Optional[str]

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

class ByDatasetGetResponse: …
created_at: datetime
formatdate-time
indicator_type: str
updated_at: datetime
formatdate-time
uuid: str
value: str
dataset_id: Optional[str]

The dataset ID this indicator belongs to. Included in list responses.

related_events: Optional[List[RelatedEvent]]

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

dataset_id: str
event_id: str
event_date: Optional[str]

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

related_events_has_more: Optional[bool]

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags: Optional[List[Tag]]
category_id: Optional[str]

The UUID of the tag category, or null when the tag is uncategorized.

category_name: Optional[str]
uuid: Optional[str]
value: Optional[str]
tlp: Optional[str]

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

Threat EventsIndicatorsBy DatasetTags

List tags on a dataset's indicators
cloudforce_one.threat_events.indicators.by_dataset.tags.list(strdataset_id, TagListParams**kwargs) -> TagListResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags
ModelsExpand Collapse
List[object]

Array of mirror tag rows

Threat EventsAttackers

List attackers
cloudforce_one.threat_events.attackers.list(AttackerListParams**kwargs) -> AttackerListResponse
GET/accounts/{account_id}/cloudforce-one/events/attackers
ModelsExpand Collapse
class AttackerListResponse: …
items: Items
type: str
type: str

Threat EventsCategories

List event categories used in datasets
cloudforce_one.threat_events.categories.list(CategoryListParams**kwargs) -> CategoryListResponse
GET/accounts/{account_id}/cloudforce-one/events/categories
Get an event category (legacy)
Deprecated
cloudforce_one.threat_events.categories.get(strcategory_id, CategoryGetParams**kwargs) -> CategoryGetResponse
GET/accounts/{account_id}/cloudforce-one/events/categories/{category_id}
Create an event category
cloudforce_one.threat_events.categories.create(CategoryCreateParams**kwargs) -> CategoryCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/categories/create
Update an event category (legacy)
Deprecated
cloudforce_one.threat_events.categories.edit(strcategory_id, CategoryEditParams**kwargs) -> CategoryEditResponse
PATCH/accounts/{account_id}/cloudforce-one/events/categories/{category_id}
Delete an event category (legacy)
Deprecated
cloudforce_one.threat_events.categories.delete(strcategory_id, CategoryDeleteParams**kwargs) -> CategoryDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/events/categories/{category_id}
ModelsExpand Collapse
List[CategoryListResponseItem]
kill_chain: float
name: str
uuid: str
mitre_attack: Optional[List[str]]
mitre_capec: Optional[List[str]]
shortname: Optional[str]
class CategoryGetResponse: …
kill_chain: float
name: str
uuid: str
mitre_attack: Optional[List[str]]
mitre_capec: Optional[List[str]]
shortname: Optional[str]
class CategoryCreateResponse: …
kill_chain: float
name: str
uuid: str
mitre_attack: Optional[List[str]]
mitre_capec: Optional[List[str]]
shortname: Optional[str]
class CategoryEditResponse: …
kill_chain: float
name: str
uuid: str
mitre_attack: Optional[List[str]]
mitre_capec: Optional[List[str]]
shortname: Optional[str]
class CategoryDeleteResponse: …
uuid: str

Threat EventsCategoriesCatalog

List all event categories
cloudforce_one.threat_events.categories.catalog.list(CatalogListParams**kwargs) -> CatalogListResponse
GET/accounts/{account_id}/cloudforce-one/events/categories/catalog
ModelsExpand Collapse
List[CatalogListResponseItem]
kill_chain: float
name: str
uuid: str
mitre_attack: Optional[List[str]]
mitre_capec: Optional[List[str]]
shortname: Optional[str]

Threat EventsCountries

List countries
cloudforce_one.threat_events.countries.list(CountryListParams**kwargs) -> CountryListResponse
GET/accounts/{account_id}/cloudforce-one/events/countries
ModelsExpand Collapse
List[CountryListResponseItem]
result: List[CountryListResponseItemResult]
alpha2: str
alpha3: str
name: str
success: str

Threat EventsCrons

Threat EventsDatasets

List datasets
cloudforce_one.threat_events.datasets.list(DatasetListParams**kwargs) -> DatasetListResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset
Get a dataset
cloudforce_one.threat_events.datasets.get(strdataset_id, DatasetGetParams**kwargs) -> DatasetGetResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}
Create a dataset
cloudforce_one.threat_events.datasets.create(DatasetCreateParams**kwargs) -> DatasetCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/dataset/create
Update a dataset
cloudforce_one.threat_events.datasets.edit(strdataset_id, DatasetEditParams**kwargs) -> DatasetEditResponse
PATCH/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}
Delete a dataset
cloudforce_one.threat_events.datasets.delete(strdataset_id, DatasetDeleteParams**kwargs) -> DatasetDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}
Get raw data for an event (legacy)
Deprecated
cloudforce_one.threat_events.datasets.raw(strevent_id, DatasetRawParams**kwargs) -> DatasetRawResponse
GET/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}
ModelsExpand Collapse
List[DatasetListResponseItem]
indicator_write_mode: Literal["read_only", "create_only", "full"]

Effective indicator mutation capability after account/dataset authorization and dataset storage capability are applied. API Gateway method permissions are separate and must also allow the requested operation.

One of the following:
"read_only"
"create_only"
"full"
is_analytics: bool
is_public: bool
name: str
uuid: str
deleted_at: Optional[str]
class DatasetGetResponse: …
is_analytics: bool
is_public: bool
name: str
uuid: str
class DatasetCreateResponse: …
is_analytics: bool
is_public: bool
name: str
uuid: str
class DatasetEditResponse: …
is_analytics: bool
is_public: bool
name: str
uuid: str
class DatasetDeleteResponse: …
name: str
uuid: str
class DatasetRawResponse: …
id: float
account_id: float
created: str
data: str
source: str
tlp: str

Threat EventsDatasetsHealth

Threat EventsDatasetsEvents

Get an event
cloudforce_one.threat_events.datasets.events.get(strevent_id, EventGetParams**kwargs) -> EventGetResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}
ModelsExpand Collapse
class EventGetResponse: …
attacker: str
attacker_country: str
attacker_country_alpha3: str
category: str
dataset_id: str
date: str
event: str
has_children: bool
indicator: str
indicator_type: str
indicator_type_id: float
kill_chain: float
mitre_attack: List[str]
mitre_capec: List[str]
num_referenced: float
num_references: float
raw_id: str
referenced: List[str]
referenced_ids: List[float]
references: List[str]
references_ids: List[float]
tags: List[str]
target_country: str
target_country_alpha3: str
target_industry: str
tlp: str
uuid: str
insight: Optional[str]
releasability_id: Optional[str]

Threat EventsRaw

Get raw event data by raw ID (legacy)
cloudforce_one.threat_events.raw.get(strraw_id, RawGetParams**kwargs) -> RawGetResponse
GET/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}
Update raw event data by raw ID (legacy)
cloudforce_one.threat_events.raw.edit(strraw_id, RawEditParams**kwargs) -> RawEditResponse
PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}
ModelsExpand Collapse
class RawGetResponse: …
id: str
account_id: float
created: str
data: object
source: str
tlp: str
class RawEditResponse: …
id: str
data: object

Threat EventsRelate

Remove event references (legacy)
cloudforce_one.threat_events.relate.delete(strevent_id, RelateDeleteParams**kwargs) -> RelateDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/events/relate/{event_id}
ModelsExpand Collapse
class RelateDeleteResponse: …
success: bool

Threat EventsTags

List tags
cloudforce_one.threat_events.tags.list(TagListParams**kwargs) -> TagListResponse
GET/accounts/{account_id}/cloudforce-one/events/tags
Create a tag
cloudforce_one.threat_events.tags.create(TagCreateParams**kwargs) -> TagCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/tags/create
Update a tag
cloudforce_one.threat_events.tags.edit(strtag_uuid, TagEditParams**kwargs) -> TagEditResponse
PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}
Delete a tag
cloudforce_one.threat_events.tags.delete(strtag_uuid, TagDeleteParams**kwargs) -> TagDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}
ModelsExpand Collapse
class TagListResponse: …
tags: List[Tag]
uuid: str
value: str
active_duration: Optional[str]
active_duration_annotated: Optional[TagActiveDurationAnnotated]
value: str
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
actor_category: Optional[str]
actor_category_annotated: Optional[TagActorCategoryAnnotated]
value: str
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
aliases: Optional[List[TagAlias]]

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: str
confidence: Optional[int]
maximum10
minimum1
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
alias_group_names: Optional[List[str]]
alias_group_names_internal: Optional[List[str]]
attribution_organization: Optional[str]
attribution_organization_annotated: Optional[TagAttributionOrganizationAnnotated]
value: str
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
category_name: Optional[str]
category_uuid: Optional[str]
confidence: Optional[int]

Overall tag confidence (1-10).

maximum10
minimum1
created_at: Optional[str]
date_of_discovery: Optional[str]
description: Optional[str]
external_references: Optional[List[TagExternalReference]]

Structured external references ({ url, description }). Public: returned to all accounts.

url: str
description: Optional[str]
external_references_annotated: Optional[List[TagExternalReferencesAnnotated]]
value: str
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
internal_aliases: Optional[List[TagInternalAlias]]

Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.

value: str
confidence: Optional[int]
maximum10
minimum1
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
internal_description: Optional[str]
last_seen: Optional[str]
motive: Optional[str]
motive_annotated: Optional[TagMotiveAnnotated]
value: str
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
opsec_level: Optional[str]
opsec_level_annotated: Optional[TagOpsecLevelAnnotated]
value: str
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
origin_country_iso: Optional[str]

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

origin_country_iso_annotated: Optional[TagOriginCountryISOAnnotated]
value: Optional[str]
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
priority: Optional[float]
priority_annotated: Optional[TagPriorityAnnotated]
value: float
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
properties: Optional[Dict[str, object]]

Parsed custom field values. Null when the tag has no custom fields.

sophistication_level: Optional[str]
sophistication_level_annotated: Optional[TagSophisticationLevelAnnotated]
value: str
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

Tag-level TLP handling marking.

One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
updated_at: Optional[str]
version: Optional[float]
class TagCreateResponse: …
uuid: str
value: str
active_duration: Optional[str]
active_duration_annotated: Optional[ActiveDurationAnnotated]
value: str
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
actor_category: Optional[str]
actor_category_annotated: Optional[ActorCategoryAnnotated]
value: str
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
aliases: Optional[List[Alias]]

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: str
confidence: Optional[int]
maximum10
minimum1
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
alias_group_names: Optional[List[str]]
alias_group_names_internal: Optional[List[str]]
attribution_organization: Optional[str]
attribution_organization_annotated: Optional[AttributionOrganizationAnnotated]
value: str
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
category_name: Optional[str]
category_uuid: Optional[str]
confidence: Optional[int]

Overall tag confidence (1-10).

maximum10
minimum1
created_at: Optional[str]
date_of_discovery: Optional[str]
description: Optional[str]
external_references: Optional[List[ExternalReference]]

Structured external references ({ url, description }). Public: returned to all accounts.

url: str
description: Optional[str]
external_references_annotated: Optional[List[ExternalReferencesAnnotated]]
value: str
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
internal_aliases: Optional[List[InternalAlias]]

Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.

value: str
confidence: Optional[int]
maximum10
minimum1
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
internal_description: Optional[str]
last_seen: Optional[str]
motive: Optional[str]
motive_annotated: Optional[MotiveAnnotated]
value: str
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
opsec_level: Optional[str]
opsec_level_annotated: Optional[OpsecLevelAnnotated]
value: str
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
origin_country_iso: Optional[str]

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

origin_country_iso_annotated: Optional[OriginCountryISOAnnotated]
value: Optional[str]
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
priority: Optional[float]
priority_annotated: Optional[PriorityAnnotated]
value: float
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
properties: Optional[Dict[str, object]]

Parsed custom field values. Null when the tag has no custom fields.

sophistication_level: Optional[str]
sophistication_level_annotated: Optional[SophisticationLevelAnnotated]
value: str
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

Tag-level TLP handling marking.

One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
updated_at: Optional[str]
version: Optional[float]
class TagEditResponse: …
uuid: str
value: str
active_duration: Optional[str]
active_duration_annotated: Optional[ActiveDurationAnnotated]
value: str
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
actor_category: Optional[str]
actor_category_annotated: Optional[ActorCategoryAnnotated]
value: str
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
aliases: Optional[List[Alias]]

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: str
confidence: Optional[int]
maximum10
minimum1
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
alias_group_names: Optional[List[str]]
alias_group_names_internal: Optional[List[str]]
attribution_organization: Optional[str]
attribution_organization_annotated: Optional[AttributionOrganizationAnnotated]
value: str
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
category_name: Optional[str]
category_uuid: Optional[str]
confidence: Optional[int]

Overall tag confidence (1-10).

maximum10
minimum1
created_at: Optional[str]
date_of_discovery: Optional[str]
description: Optional[str]
external_references: Optional[List[ExternalReference]]

Structured external references ({ url, description }). Public: returned to all accounts.

url: str
description: Optional[str]
external_references_annotated: Optional[List[ExternalReferencesAnnotated]]
value: str
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
internal_aliases: Optional[List[InternalAlias]]

Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.

value: str
confidence: Optional[int]
maximum10
minimum1
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
internal_description: Optional[str]
last_seen: Optional[str]
motive: Optional[str]
motive_annotated: Optional[MotiveAnnotated]
value: str
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
opsec_level: Optional[str]
opsec_level_annotated: Optional[OpsecLevelAnnotated]
value: str
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
origin_country_iso: Optional[str]

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

origin_country_iso_annotated: Optional[OriginCountryISOAnnotated]
value: Optional[str]
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
priority: Optional[float]
priority_annotated: Optional[PriorityAnnotated]
value: float
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
properties: Optional[Dict[str, object]]

Parsed custom field values. Null when the tag has no custom fields.

sophistication_level: Optional[str]
sophistication_level_annotated: Optional[SophisticationLevelAnnotated]
value: str
confidence: Optional[float]
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
tlp: Optional[Literal["red", "amber", "amber-strict", 4 more]]

Tag-level TLP handling marking.

One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
updated_at: Optional[str]
version: Optional[float]
class TagDeleteResponse: …
uuid: str

Threat EventsTagsCategories

List tag categories
cloudforce_one.threat_events.tags.categories.list(CategoryListParams**kwargs) -> CategoryListResponse
GET/accounts/{account_id}/cloudforce-one/events/tags/categories
Create a tag category
cloudforce_one.threat_events.tags.categories.create(CategoryCreateParams**kwargs) -> CategoryCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/tags/categories/create
Update a tag category (legacy)
Deprecated
cloudforce_one.threat_events.tags.categories.edit(strcategory_uuid, CategoryEditParams**kwargs) -> CategoryEditResponse
PATCH/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}
Delete a tag category (legacy)
Deprecated
cloudforce_one.threat_events.tags.categories.delete(strcategory_uuid, CategoryDeleteParams**kwargs) -> CategoryDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}
ModelsExpand Collapse
class CategoryListResponse: …
categories: List[Category]
name: str
uuid: str
created_at: Optional[str]
description: Optional[str]
schema: Optional[List[CategorySchema]]

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: str
kind: Literal["string", "number", "enum", 3 more]
One of the following:
"string"
"number"
"enum"
"date"
"array"
"object"
allowed_values: Optional[List[str]]
annotations: Optional[CategorySchemaAnnotations]
confidence: Optional[bool]
tlp: Optional[bool]
deprecated: Optional[bool]

Marks a field as unavailable for new values while retaining its definition for historical values.

deprecated_values: Optional[List[str]]

Enum values unavailable for new writes but retained in allowedValues for historical display.

element: Optional[object]
enforcement: Optional[Literal["error", "warn", "off"]]
One of the following:
"error"
"warn"
"off"
format: Optional[Literal["date", "url", "duration", "country"]]
One of the following:
"date"
"url"
"duration"
"country"
label: Optional[str]
maxLength128
minLength1
max_length: Optional[int]
exclusiveMinimum
minimum0
number_constraint: Optional[CategorySchemaNumberConstraint]
integer: Optional[bool]
max: Optional[float]
min: Optional[float]
properties: Optional[Dict[str, object]]

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required: Optional[bool]
updated_at: Optional[str]
class CategoryCreateResponse: …
name: str
uuid: str
created_at: Optional[str]
description: Optional[str]
schema: Optional[List[Schema]]

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: str
kind: Literal["string", "number", "enum", 3 more]
One of the following:
"string"
"number"
"enum"
"date"
"array"
"object"
allowed_values: Optional[List[str]]
annotations: Optional[SchemaAnnotations]
confidence: Optional[bool]
tlp: Optional[bool]
deprecated: Optional[bool]

Marks a field as unavailable for new values while retaining its definition for historical values.

deprecated_values: Optional[List[str]]

Enum values unavailable for new writes but retained in allowedValues for historical display.

element: Optional[object]
enforcement: Optional[Literal["error", "warn", "off"]]
One of the following:
"error"
"warn"
"off"
format: Optional[Literal["date", "url", "duration", "country"]]
One of the following:
"date"
"url"
"duration"
"country"
label: Optional[str]
maxLength128
minLength1
max_length: Optional[int]
exclusiveMinimum
minimum0
number_constraint: Optional[SchemaNumberConstraint]
integer: Optional[bool]
max: Optional[float]
min: Optional[float]
properties: Optional[Dict[str, object]]

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required: Optional[bool]
updated_at: Optional[str]
class CategoryEditResponse: …
name: str
uuid: str
created_at: Optional[str]
description: Optional[str]
schema: Optional[List[Schema]]

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: str
kind: Literal["string", "number", "enum", 3 more]
One of the following:
"string"
"number"
"enum"
"date"
"array"
"object"
allowed_values: Optional[List[str]]
annotations: Optional[SchemaAnnotations]
confidence: Optional[bool]
tlp: Optional[bool]
deprecated: Optional[bool]

Marks a field as unavailable for new values while retaining its definition for historical values.

deprecated_values: Optional[List[str]]

Enum values unavailable for new writes but retained in allowedValues for historical display.

element: Optional[object]
enforcement: Optional[Literal["error", "warn", "off"]]
One of the following:
"error"
"warn"
"off"
format: Optional[Literal["date", "url", "duration", "country"]]
One of the following:
"date"
"url"
"duration"
"country"
label: Optional[str]
maxLength128
minLength1
max_length: Optional[int]
exclusiveMinimum
minimum0
number_constraint: Optional[SchemaNumberConstraint]
integer: Optional[bool]
max: Optional[float]
min: Optional[float]
properties: Optional[Dict[str, object]]

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required: Optional[bool]
updated_at: Optional[str]
class CategoryDeleteResponse: …
uuid: str

Threat EventsTagsIndicators

List a tag's indicators
cloudforce_one.threat_events.tags.indicators.list(strtag_uuid, IndicatorListParams**kwargs) -> IndicatorListResponse
GET/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators
ModelsExpand Collapse
class IndicatorListResponse: …
indicators: List[Indicator]
created_at: datetime
formatdate-time
indicator_type: str
updated_at: datetime
formatdate-time
uuid: str
value: str
dataset_id: Optional[str]

The dataset ID this indicator belongs to. Included in list responses.

related_events: Optional[List[IndicatorRelatedEvent]]

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

dataset_id: str
event_id: str
event_date: Optional[str]

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

related_events_has_more: Optional[bool]

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags: Optional[List[IndicatorTag]]
category_id: Optional[str]

The UUID of the tag category, or null when the tag is uncategorized.

category_name: Optional[str]
uuid: Optional[str]
value: Optional[str]
tlp: Optional[str]

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

failed_shard_count: Optional[float]

Number of shards that failed or timed out. Present only with partialResults.

partial_results: Optional[bool]

Present and true when one or more shards failed or timed out. Indicators from those shards may be missing from this page and from totalCount.

Threat EventsTagsIndicatorsBy Dataset

List indicators related to a tag within a dataset (deprecated)
Deprecated
cloudforce_one.threat_events.tags.indicators.by_dataset.list(strtag_uuid, ByDatasetListParams**kwargs) -> ByDatasetListResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators
ModelsExpand Collapse
class ByDatasetListResponse: …
indicators: List[Indicator]
created_at: datetime
formatdate-time
indicator_type: str
updated_at: datetime
formatdate-time
uuid: str
value: str
dataset_id: Optional[str]

The dataset ID this indicator belongs to. Included in list responses.

related_events: Optional[List[IndicatorRelatedEvent]]

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

dataset_id: str
event_id: str
event_date: Optional[str]

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

related_events_has_more: Optional[bool]

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags: Optional[List[IndicatorTag]]
category_id: Optional[str]

The UUID of the tag category, or null when the tag is uncategorized.

category_name: Optional[str]
uuid: Optional[str]
value: Optional[str]
tlp: Optional[str]

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

failed_shard_count: Optional[float]

Number of shards that failed or timed out. Present only with partialResults.

partial_results: Optional[bool]

Present and true when one or more shards failed or timed out. Indicators from those shards may be missing from this page and from totalCount.

Threat EventsEvent Tags

Add tags to an event (legacy)
cloudforce_one.threat_events.event_tags.create(strevent_id, EventTagCreateParams**kwargs) -> EventTagCreateResponse
POST/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create
Remove tags from an event (legacy)
cloudforce_one.threat_events.event_tags.delete(strevent_id, EventTagDeleteParams**kwargs) -> EventTagDeleteResponse
DELETE/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}
ModelsExpand Collapse
class EventTagCreateResponse: …
success: bool
class EventTagDeleteResponse: …
success: bool

Threat EventsTarget Industries

List target industries used in datasets
cloudforce_one.threat_events.target_industries.list(TargetIndustryListParams**kwargs) -> TargetIndustryListResponse
GET/accounts/{account_id}/cloudforce-one/events/targetIndustries
ModelsExpand Collapse
class TargetIndustryListResponse: …
items: Items
type: str
type: str

Threat EventsTarget IndustriesBy Dataset

List target industries in a dataset (legacy)
cloudforce_one.threat_events.target_industries.by_dataset.list(strdataset_id, ByDatasetListParams**kwargs) -> ByDatasetListResponse
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries
ModelsExpand Collapse
class ByDatasetListResponse: …
items: Items
type: str
type: str

Threat EventsTarget IndustriesCatalog

List all target industries
cloudforce_one.threat_events.target_industries.catalog.list(CatalogListParams**kwargs) -> CatalogListResponse
GET/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog
ModelsExpand Collapse
class CatalogListResponse: …
items: Items
type: str
type: str

Threat EventsInsights