Threat Events

Filter and list events

GET/accounts/{account_id}/cloudforce-one/events

Reads an event

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/{event_id}

Creates a new event

POST/accounts/{account_id}/cloudforce-one/events/create

Updates an event

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}

Creates bulk events

POST/accounts/{account_id}/cloudforce-one/events/create/bulk

Creates bulk DOS event with relationships and indicators

Deprecated

POST/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships

ModelsExpand Collapse

ThreatEventListResponse = array of object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventGetResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventCreateResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventEditResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventBulkCreateResponse object { createdEventsCount, createdTagsCount, errorCount, 4 more }

Detailed result of bulk event creation with auto-tag management

createdEventsCount: number

Number of events created

createdTagsCount: number

Number of new tags created in SoT

errorCount: number

Number of errors encountered

queuedIndicatorsCount: number

Number of indicators queued for async processing

createBulkEventsRequestId: optional string

Correlation ID for async indicator processing

formatuuid

createdEvents: optional array of object { eventIndex, shardId, uuid }

Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true

eventIndex: number

Original index in the input data array

shardId: string

Dataset ID of the shard where the event was created

uuid: string

UUID of the created event

formatuuid

errors: optional array of object { error, eventIndex }

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

ThreatEventBulkCreateRelationshipsResponse object { createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more }

Result of bulk relationship creation operation

createdEventsCount: number

Number of events created

createdIndicatorsCount: number

Number of indicators created

createdRelationshipsCount: number

Number of relationships created

errorCount: number

Number of errors encountered

errors: optional array of object { error, eventIndex }

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

Threat EventsAggregate

Aggregate events by single or multiple columns with optional date filtering

GET/accounts/{account_id}/cloudforce-one/events/aggregate

ModelsExpand Collapse

AggregateListResponse object { aggregateBy, aggregations, total, dateRange }

aggregateBy: string

Column(s) that were aggregated by

aggregations: array of object { count, date }

Array of aggregation results with dynamic fields based on aggregateBy columns

Number of events for this aggregation

date: optional string

Date (if groupByDate is true)

total: number

Total number of events in the aggregation

dateRange: optional object { endDate, startDate }

Date range used for filtering

endDate: optional string

startDate: optional string

Threat EventsGraphql

GraphQL endpoint for event aggregation

POST/accounts/{account_id}/cloudforce-one/events/graphql

ModelsExpand Collapse

GraphqlCreateResponse object { data, errors }

data: optional unknown

errors: optional array of unknown

Threat EventsGraph

Query graph neighborhood from R2 Data Catalog

GET/accounts/{account_id}/cloudforce-one/events/graph

ModelsExpand Collapse

GraphListResponse object { edges, node, nodes }

edges: array of object { id, relationshipType, source, 5 more }

id: string

Deterministic composite edge id (source→target:relationshipType)

relationshipType: string

source: string

Compact id of the source node (type:uuid)

sourceId: string

sourceType: string

target: string

Compact id of the target node (type:uuid)

targetId: string

targetType: string

node: map[unknown]

Focal node object (legacy single-seed). Null when unavailable.

nodes: array of map[unknown]

Threat EventsQueries

List all saved event queries

GET/accounts/{account_id}/cloudforce-one/events/queries

Create a saved event query

POST/accounts/{account_id}/cloudforce-one/events/queries/create

Read a saved event query

GET/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Update a saved event query

PATCH/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Delete a saved event query

DELETE/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

ModelsExpand Collapse

QueryListResponse = array of object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id: optional number

Intel Indicator Feed ID (numeric)

rule_list_id: optional string

WAF rules list ID for blocking

rule_scope: optional string

Scope for the rule

QueryCreateResponse object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id: optional number

Intel Indicator Feed ID (numeric)

rule_list_id: optional string

WAF rules list ID for blocking

rule_scope: optional string

Scope for the rule

QueryGetResponse object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id: optional number

Intel Indicator Feed ID (numeric)

rule_list_id: optional string

WAF rules list ID for blocking

rule_scope: optional string

Scope for the rule

QueryEditResponse object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id: optional number

Intel Indicator Feed ID (numeric)

rule_list_id: optional string

WAF rules list ID for blocking

rule_scope: optional string

Scope for the rule

Threat EventsRelationships

Filter and list events related to specific event

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships

ModelsExpand Collapse

RelationshipListResponse = array of object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

Threat EventsIndicators

Lists indicators across multiple datasets

GET/accounts/{account_id}/cloudforce-one/events/indicators

ModelsExpand Collapse

IndicatorListResponse object { properties, type }

properties: object { completeness, indicators, pagination }

completeness: object { properties, type }

properties: object { complete, failedDatasets, failedShards, warnings }

complete: object { type }

type: string

failedDatasets: object { items, type }

items: object { type }

type: string

failedShards: object { items, type }

items: object { properties, type }

properties: object { datasetId, shardId }

datasetId: object { type }

type: string

shardId: object { type }

type: string

warnings: object { items, type }

items: object { type }

type: string

indicators: object { items, type }

items: object { createdAt, indicatorType, sources, 7 more }

createdAt: string

formatdate-time

indicatorType: string

sources: array of object { resourceId, resourceType, system }

RSS article sources from which this indicator was extracted.

resourceId: string

formatuuid

resourceType: "article"

system: "threat-signals"

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags: optional array of object { categoryId, categoryName, uuid, value }

categoryId: optional string

The UUID of the tag category, or null when the tag is uncategorized.

categoryName: optional string

uuid: optional string

value: optional string

tlp: optional string

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

type: string

pagination: object { properties, type }

properties: object { count, cursor, has_more, 4 more }

type: string

cursor: object { description, nullable, type }

description: string

nullable: boolean

type: string

has_more: object { description, type }

description: string

type: string

page: object { type }

type: string

per_page: object { type }

type: string

total_count: object { description, nullable, type }

description: string

nullable: boolean

type: string

total_count_is_exact: object { description, type }

description: string

type: string

Threat EventsIndicatorsAggregate

Aggregate indicators by column(s)

GET/accounts/{account_id}/cloudforce-one/events/indicators/aggregate

ModelsExpand Collapse

AggregateListResponse object { aggregateBy, aggregations, failedDatasets, total }

aggregateBy: string

Column(s) that were aggregated by

aggregations: array of object { count }

Array of aggregation results with dynamic fields based on aggregateBy columns

Number of indicators for this aggregation

failedDatasets: number

Number of datasets whose aggregation failed and were excluded from the result

total: number

Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships

Threat EventsIndicatorsTypes

Lists indicator types across multiple datasets

GET/accounts/{account_id}/cloudforce-one/events/indicator-types

ModelsExpand Collapse

TypeListResponse object { items, type }

items: object { type }

type: string

Threat EventsIndicatorsBy Dataset

Lists indicators

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators

Reads an indicator

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}

ModelsExpand Collapse

ByDatasetListResponse object { indicators, pagination }

indicators: array of object { createdAt, indicatorType, sources, 7 more }

createdAt: string

formatdate-time

indicatorType: string

sources: array of object { resourceId, resourceType, system }

RSS article sources from which this indicator was extracted.

resourceId: string

formatuuid

resourceType: "article"

system: "threat-signals"

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags: optional array of object { categoryId, categoryName, uuid, value }

categoryId: optional string

The UUID of the tag category, or null when the tag is uncategorized.

categoryName: optional string

uuid: optional string

value: optional string

tlp: optional string

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

ByDatasetGetResponse object { createdAt, indicatorType, updatedAt, 6 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags: optional array of object { categoryId, categoryName, uuid, value }

categoryId: optional string

The UUID of the tag category, or null when the tag is uncategorized.

categoryName: optional string

uuid: optional string

value: optional string

tlp: optional string

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

Threat EventsIndicatorsBy DatasetTags

List mirrored tags for an indicator dataset

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags

ModelsExpand Collapse

TagListResponse = array of unknown

Array of mirror tag rows

Threat EventsAttackers

Lists attackers across multiple datasets

GET/accounts/{account_id}/cloudforce-one/events/attackers

ModelsExpand Collapse

AttackerListResponse object { items, type }

items: object { type }

type: string

Threat EventsCategories

Lists categories across multiple datasets

GET/accounts/{account_id}/cloudforce-one/events/categories

Reads a category

GET/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Creates a new category

POST/accounts/{account_id}/cloudforce-one/events/categories/create

Updates a category

PATCH/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Deletes a category

DELETE/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

ModelsExpand Collapse

CategoryListResponse = array of object { killChain, name, uuid, 3 more }

killChain: number

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryGetResponse object { killChain, name, uuid, 3 more }

killChain: number

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryCreateResponse object { killChain, name, uuid, 3 more }

killChain: number

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryEditResponse object { killChain, name, uuid, 3 more }

killChain: number

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryDeleteResponse object { uuid }

uuid: string

Threat EventsCategoriesCatalog

Lists categories

GET/accounts/{account_id}/cloudforce-one/events/categories/catalog

ModelsExpand Collapse

CatalogListResponse = array of object { killChain, name, uuid, 3 more }

killChain: number

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

Threat EventsCountries

Retrieves countries information for all countries

GET/accounts/{account_id}/cloudforce-one/events/countries

ModelsExpand Collapse

CountryListResponse = array of object { result, success }

result: array of object { alpha2, alpha3, name }

alpha2: string

alpha3: string

success: string

Threat EventsCrons

Threat EventsDatasets

Lists all datasets in an account

GET/accounts/{account_id}/cloudforce-one/events/dataset

Reads a dataset

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Creates a dataset

POST/accounts/{account_id}/cloudforce-one/events/dataset/create

Updates an existing dataset

PATCH/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Delete a dataset

DELETE/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Reads raw data for an event by UUID

GET/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}

ModelsExpand Collapse

DatasetListResponse = array of object { indicatorWriteMode, isAnalytics, isPublic, 3 more }

indicatorWriteMode: "read_only" or "create_only" or "full"

Effective indicator mutation capability after account/dataset authorization and dataset storage capability are applied. API Gateway method permissions are separate and must also allow the requested operation.

One of the following:

"read_only"

"create_only"

"full"

isAnalytics: boolean

isPublic: boolean

uuid: string

deletedAt: optional string

DatasetGetResponse object { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

uuid: string

DatasetCreateResponse object { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

uuid: string

DatasetEditResponse object { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

uuid: string

DatasetDeleteResponse object { name, uuid }

uuid: string

DatasetRawResponse object { id, accountId, created, 3 more }

id: number

accountId: number

created: string

data: string

source: string

tlp: string

Threat EventsDatasetsHealth

Threat EventsDatasetsEvents

Reads an event

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}

ModelsExpand Collapse

EventGetResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

Threat EventsRaw

Reads data for a raw event

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

Updates a raw event

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

ModelsExpand Collapse

RawGetResponse object { id, accountId, created, 3 more }

id: string

accountId: number

created: string

data: unknown

source: string

tlp: string

RawEditResponse object { id, data }

id: string

data: unknown

Threat EventsRelate

Removes an event reference

DELETE/accounts/{account_id}/cloudforce-one/events/relate/{event_id}

ModelsExpand Collapse

RelateDeleteResponse object { success }

success: boolean

Threat EventsTags

Lists all tags (SoT)

GET/accounts/{account_id}/cloudforce-one/events/tags

Creates a new tag

POST/accounts/{account_id}/cloudforce-one/events/tags/create

Updates a tag (SoT)

PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

Deletes a tag (SoT)

DELETE/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

ModelsExpand Collapse

TagListResponse object { pagination, tags }

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

tags: array of object { uuid, value, activeDuration, 34 more }

uuid: string

value: string

activeDuration: optional string

activeDuration_annotated: optional object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory: optional string

actorCategory_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

attributionOrganization: optional string

attributionOrganization_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName: optional string

categoryUuid: optional string

confidence: optional number

Overall tag confidence (1-10).

maximum10

minimum1

createdAt: optional string

dateOfDiscovery: optional string

description: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

externalReferences_annotated: optional array of object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases: optional array of object { value, confidence, tlp }

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription: optional string

lastSeen: optional string

motive: optional string

motive_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel: optional string

opsecLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO: optional string

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority: optional number

priority_annotated: optional object { value, tlp }

value: number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties: optional map[unknown]

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel: optional string

sophisticationLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp: optional "red" or "amber" or "amber-strict" or 4 more

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt: optional string

version: optional number

TagCreateResponse object { uuid, value, activeDuration, 34 more }

uuid: string

value: string

activeDuration: optional string

activeDuration_annotated: optional object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory: optional string

actorCategory_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

attributionOrganization: optional string

attributionOrganization_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName: optional string

categoryUuid: optional string

confidence: optional number

Overall tag confidence (1-10).

maximum10

minimum1

createdAt: optional string

dateOfDiscovery: optional string

description: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

externalReferences_annotated: optional array of object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases: optional array of object { value, confidence, tlp }

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription: optional string

lastSeen: optional string

motive: optional string

motive_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel: optional string

opsecLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO: optional string

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority: optional number

priority_annotated: optional object { value, tlp }

value: number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties: optional map[unknown]

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel: optional string

sophisticationLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp: optional "red" or "amber" or "amber-strict" or 4 more

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt: optional string

version: optional number

TagEditResponse object { uuid, value, activeDuration, 34 more }

uuid: string

value: string

activeDuration: optional string

activeDuration_annotated: optional object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory: optional string

actorCategory_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

attributionOrganization: optional string

attributionOrganization_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName: optional string

categoryUuid: optional string

confidence: optional number

Overall tag confidence (1-10).

maximum10

minimum1

createdAt: optional string

dateOfDiscovery: optional string

description: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

externalReferences_annotated: optional array of object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases: optional array of object { value, confidence, tlp }

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription: optional string

lastSeen: optional string

motive: optional string

motive_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel: optional string

opsecLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO: optional string

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority: optional number

priority_annotated: optional object { value, tlp }

value: number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties: optional map[unknown]

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel: optional string

sophisticationLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp: optional "red" or "amber" or "amber-strict" or 4 more

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt: optional string

version: optional number

TagDeleteResponse object { uuid }

uuid: string

Threat EventsTagsCategories

Lists all tag categories (SoT)

GET/accounts/{account_id}/cloudforce-one/events/tags/categories

Creates a new tag category (SoT)

POST/accounts/{account_id}/cloudforce-one/events/tags/categories/create

Updates a tag category (SoT)

PATCH/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

Deletes a tag category (SoT)

DELETE/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

ModelsExpand Collapse

CategoryListResponse object { categories }

categories: array of object { name, uuid, createdAt, 3 more }

uuid: string

createdAt: optional string

description: optional string

schema: optional array of object { key, kind, allowedValues, 9 more }

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string

kind: "string" or "number" or "enum" or 3 more

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowedValues: optional array of string

annotations: optional object { confidence, tlp }

confidence: optional boolean

tlp: optional boolean

element: optional unknown

enforcement: optional "error" or "warn" or "off"

One of the following:

"error"

"warn"

"off"

format: optional "date" or "url" or "duration" or "country"

One of the following:

"date"

"url"

"duration"

"country"

label: optional string

maxLength128

minLength1

maxLength: optional number

exclusiveMinimum

minimum0

numberConstraint: optional object { integer, max, min }

integer: optional boolean

max: optional number

min: optional number

properties: optional map[unknown]

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required: optional boolean

updatedAt: optional string

CategoryCreateResponse object { name, uuid, createdAt, 3 more }

uuid: string

createdAt: optional string

description: optional string

schema: optional array of object { key, kind, allowedValues, 9 more }

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string

kind: "string" or "number" or "enum" or 3 more

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowedValues: optional array of string

annotations: optional object { confidence, tlp }

confidence: optional boolean

tlp: optional boolean

element: optional unknown

enforcement: optional "error" or "warn" or "off"

One of the following:

"error"

"warn"

"off"

format: optional "date" or "url" or "duration" or "country"

One of the following:

"date"

"url"

"duration"

"country"

label: optional string

maxLength128

minLength1

maxLength: optional number

exclusiveMinimum

minimum0

numberConstraint: optional object { integer, max, min }

integer: optional boolean

max: optional number

min: optional number

properties: optional map[unknown]

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required: optional boolean

updatedAt: optional string

CategoryEditResponse object { name, uuid, createdAt, 3 more }

uuid: string

createdAt: optional string

description: optional string

schema: optional array of object { key, kind, allowedValues, 9 more }

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string

kind: "string" or "number" or "enum" or 3 more

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowedValues: optional array of string

annotations: optional object { confidence, tlp }

confidence: optional boolean

tlp: optional boolean

element: optional unknown

enforcement: optional "error" or "warn" or "off"

One of the following:

"error"

"warn"

"off"

format: optional "date" or "url" or "duration" or "country"

One of the following:

"date"

"url"

"duration"

"country"

label: optional string

maxLength128

minLength1

maxLength: optional number

exclusiveMinimum

minimum0

numberConstraint: optional object { integer, max, min }

integer: optional boolean

max: optional number

min: optional number

properties: optional map[unknown]

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required: optional boolean

updatedAt: optional string

CategoryDeleteResponse object { uuid }

uuid: string

Threat EventsTagsIndicators

List indicators related to a tag

GET/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators

ModelsExpand Collapse

IndicatorListResponse object { indicators, pagination }

indicators: array of object { createdAt, indicatorType, updatedAt, 6 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags: optional array of object { categoryId, categoryName, uuid, value }

categoryId: optional string

The UUID of the tag category, or null when the tag is uncategorized.

categoryName: optional string

uuid: optional string

value: optional string

tlp: optional string

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

Threat EventsTagsIndicatorsBy Dataset

List indicators related to a tag within a dataset (deprecated)

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators

ModelsExpand Collapse

ByDatasetListResponse object { indicators, pagination }

indicators: array of object { createdAt, indicatorType, updatedAt, 6 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags: optional array of object { categoryId, categoryName, uuid, value }

categoryId: optional string

The UUID of the tag category, or null when the tag is uncategorized.

categoryName: optional string

uuid: optional string

value: optional string

tlp: optional string

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

Threat EventsEvent Tags

Adds a tag to an event

POST/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create

Removes a tag from an event

DELETE/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}

ModelsExpand Collapse

EventTagCreateResponse object { success }

success: boolean

EventTagDeleteResponse object { success }

success: boolean

Threat EventsTarget Industries

Lists target industries across multiple datasets

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries

ModelsExpand Collapse

TargetIndustryListResponse object { items, type }

items: object { type }

type: string

Threat EventsTarget IndustriesBy Dataset

Lists all target industries for a specific dataset

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries

ModelsExpand Collapse

ByDatasetListResponse object { items, type }

items: object { type }

type: string

Threat EventsTarget IndustriesCatalog

Lists all target industries from industry map catalog

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog

ModelsExpand Collapse

CatalogListResponse object { items, type }

items: object { type }

type: string

Threat Events

ModelsExpand Collapse

Threat EventsAggregate

ModelsExpand Collapse

Threat EventsGraphql

ModelsExpand Collapse

Threat EventsGraph

ModelsExpand Collapse

Threat EventsQueries

ModelsExpand Collapse

Threat EventsRelationships

ModelsExpand Collapse

Threat EventsIndicators

ModelsExpand Collapse

Threat EventsIndicatorsAggregate

ModelsExpand Collapse

Threat EventsIndicatorsTypes

ModelsExpand Collapse

Threat EventsIndicatorsBy Dataset

ModelsExpand Collapse

Threat EventsIndicatorsBy DatasetTags

ModelsExpand Collapse

Threat EventsAttackers

ModelsExpand Collapse

Threat EventsCategories

ModelsExpand Collapse

Threat EventsCategoriesCatalog

ModelsExpand Collapse

Threat EventsCountries

ModelsExpand Collapse

Threat EventsCrons

Threat EventsDatasets

ModelsExpand Collapse

Threat EventsDatasetsHealth

Threat EventsDatasetsEvents

ModelsExpand Collapse

Threat EventsRaw

ModelsExpand Collapse

Threat EventsRelate

ModelsExpand Collapse

Threat EventsTags

ModelsExpand Collapse

Threat EventsTagsCategories

ModelsExpand Collapse

Threat EventsTagsIndicators

ModelsExpand Collapse

Threat EventsTagsIndicatorsBy Dataset

ModelsExpand Collapse

Threat EventsEvent Tags

ModelsExpand Collapse

Threat EventsTarget Industries

ModelsExpand Collapse

Threat EventsTarget IndustriesBy Dataset

ModelsExpand Collapse

Threat EventsTarget IndustriesCatalog

ModelsExpand Collapse

Threat EventsInsights