Threat Events
List events
Create an event
Update an event
Create events in bulk
Create events with relationships in bulk (legacy)
ModelsExpand Collapse
ThreatEventBulkCreateResponse object { createdEventsCount, createdTagsCount, errorCount, 4 more } Detailed result of bulk event creation with auto-tag management
Detailed result of bulk event creation with auto-tag management
Threat EventsAggregate
Aggregate events
Threat EventsGraphql
Run a GraphQL aggregation over events
Threat EventsGraph
Query graph neighborhood from R2 Data Catalog
Threat EventsQueries
List saved event queries
Create a saved event query
Get a saved event query
Update a saved event query
Delete a saved event query
ModelsExpand Collapse
QueryListResponse = array of object { id, account_id, alert_enabled, 10 more }
Deprecated: saved-query alerting and rules were removed. Always false.
Deprecated: saved-query alerting and rules were removed. Always false.
Deprecated: saved-query alerting and rules were removed. Always false.
Deprecated: saved-query alerting and rules were removed. Always null.
QueryCreateResponse object { id, account_id, alert_enabled, 10 more }
Deprecated: saved-query alerting and rules were removed. Always false.
Deprecated: saved-query alerting and rules were removed. Always false.
Deprecated: saved-query alerting and rules were removed. Always false.
Deprecated: saved-query alerting and rules were removed. Always null.
QueryGetResponse object { id, account_id, alert_enabled, 10 more }
Deprecated: saved-query alerting and rules were removed. Always false.
Deprecated: saved-query alerting and rules were removed. Always false.
Deprecated: saved-query alerting and rules were removed. Always false.
Deprecated: saved-query alerting and rules were removed. Always null.
QueryEditResponse object { id, account_id, alert_enabled, 10 more }
Deprecated: saved-query alerting and rules were removed. Always false.
Deprecated: saved-query alerting and rules were removed. Always false.
Deprecated: saved-query alerting and rules were removed. Always false.
Deprecated: saved-query alerting and rules were removed. Always null.
Threat EventsRelationships
List related events (legacy)
Threat EventsIndicators
List indicators
ModelsExpand Collapse
IndicatorListResponse object { properties, type }
properties: object { completeness, indicators, pagination }
completeness: object { properties, type }
indicators: object { items, type }
items: object { createdAt, indicatorType, sources, 8 more }
sources: array of object { resourceId, resourceType, system, title } RSS article sources from which this indicator was extracted.
RSS article sources from which this indicator was extracted.
relatedEvents: optional array of object { datasetId, eventId, eventDate } Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.
Threat EventsIndicatorsAggregate
Aggregate indicators by column(s)
Threat EventsIndicatorsTypes
List indicator types
Threat EventsIndicatorsBy Dataset
List indicators in a dataset (legacy)
Get an indicator
ModelsExpand Collapse
ByDatasetListResponse object { indicators, pagination }
indicators: array of object { createdAt, indicatorType, sources, 8 more }
sources: array of object { resourceId, resourceType, system, title } RSS article sources from which this indicator was extracted.
RSS article sources from which this indicator was extracted.
relatedEvents: optional array of object { datasetId, eventId, eventDate } Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.
ByDatasetGetResponse object { createdAt, indicatorType, updatedAt, 7 more }
relatedEvents: optional array of object { datasetId, eventId, eventDate } Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.
Threat EventsIndicatorsBy DatasetTags
List tags on a dataset's indicators
Threat EventsAttackers
List attackers
Threat EventsCategories
List event categories used in datasets
Get an event category (legacy)
Create an event category
Update an event category (legacy)
Delete an event category (legacy)
ModelsExpand Collapse
Threat EventsCategoriesCatalog
List all event categories
Threat EventsCountries
List countries
Threat EventsCrons
Threat EventsDatasets
List datasets
Get a dataset
Create a dataset
Update a dataset
Delete a dataset
Get raw data for an event (legacy)
ModelsExpand Collapse
DatasetListResponse = array of object { indicatorWriteMode, isAnalytics, isPublic, 3 more }
Threat EventsDatasetsHealth
Threat EventsDatasetsEvents
Get an event
Threat EventsRaw
Get raw event data by raw ID (legacy)
Update raw event data by raw ID (legacy)
Threat EventsRelate
Remove event references (legacy)
Threat EventsTags
List tags
Create a tag
Update a tag
Delete a tag
ModelsExpand Collapse
TagListResponse object { pagination, tags }
tags: array of object { uuid, value, activeDuration, 34 more }
aliases: optional array of object { value, confidence, tlp } Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).
Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).
externalReferences: optional array of object { url, description } Structured external references ({ url, description }). Public: returned to all accounts.
Structured external references ({ url, description }). Public: returned to all accounts.
internalAliases: optional array of object { value, confidence, tlp } Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.
Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.
ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.
Parsed custom field values. Null when the tag has no custom fields.
TagCreateResponse object { uuid, value, activeDuration, 34 more }
aliases: optional array of object { value, confidence, tlp } Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).
Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).
externalReferences: optional array of object { url, description } Structured external references ({ url, description }). Public: returned to all accounts.
Structured external references ({ url, description }). Public: returned to all accounts.
internalAliases: optional array of object { value, confidence, tlp } Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.
Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.
ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.
Parsed custom field values. Null when the tag has no custom fields.
TagEditResponse object { uuid, value, activeDuration, 34 more }
aliases: optional array of object { value, confidence, tlp } Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).
Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).
externalReferences: optional array of object { url, description } Structured external references ({ url, description }). Public: returned to all accounts.
Structured external references ({ url, description }). Public: returned to all accounts.
internalAliases: optional array of object { value, confidence, tlp } Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.
Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.
ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.
Parsed custom field values. Null when the tag has no custom fields.
Threat EventsTagsCategories
List tag categories
Create a tag category
Update a tag category (legacy)
Delete a tag category (legacy)
ModelsExpand Collapse
CategoryListResponse object { categories }
categories: array of object { name, uuid, createdAt, 3 more }
schema: optional array of object { key, kind, allowedValues, 11 more } Parsed FieldDefinition[] defining custom fields for this category, or null if none.
Parsed FieldDefinition[] defining custom fields for this category, or null if none.
Marks a field as unavailable for new values while retaining its definition for historical values.
Enum values unavailable for new writes but retained in allowedValues for historical display.
CategoryCreateResponse object { name, uuid, createdAt, 3 more }
schema: optional array of object { key, kind, allowedValues, 11 more } Parsed FieldDefinition[] defining custom fields for this category, or null if none.
Parsed FieldDefinition[] defining custom fields for this category, or null if none.
Marks a field as unavailable for new values while retaining its definition for historical values.
Enum values unavailable for new writes but retained in allowedValues for historical display.
CategoryEditResponse object { name, uuid, createdAt, 3 more }
schema: optional array of object { key, kind, allowedValues, 11 more } Parsed FieldDefinition[] defining custom fields for this category, or null if none.
Parsed FieldDefinition[] defining custom fields for this category, or null if none.
Marks a field as unavailable for new values while retaining its definition for historical values.
Enum values unavailable for new writes but retained in allowedValues for historical display.
Threat EventsTagsIndicators
List a tag's indicators
ModelsExpand Collapse
IndicatorListResponse object { indicators, pagination, failedShardCount, partialResults }
indicators: array of object { createdAt, indicatorType, updatedAt, 7 more }
relatedEvents: optional array of object { datasetId, eventId, eventDate } Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.
Threat EventsTagsIndicatorsBy Dataset
List indicators related to a tag within a dataset (deprecated)
ModelsExpand Collapse
ByDatasetListResponse object { indicators, pagination, failedShardCount, partialResults }
indicators: array of object { createdAt, indicatorType, updatedAt, 7 more }
relatedEvents: optional array of object { datasetId, eventId, eventDate } Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.
True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.