API Reference

Cloudforce One

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Threat Events

Filter and list events

client.cloudforceOne.threatEvents.list(ThreatEventListParams { account_id, cache, cursor, 9 more } params, RequestOptionsoptions?): ThreatEventListResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

GET/accounts/{account_id}/cloudforce-one/events

Reads an event

Deprecated

client.cloudforceOne.threatEvents.get(stringeventID, ThreatEventGetParams { account_id } params, RequestOptionsoptions?): ThreatEventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

GET/accounts/{account_id}/cloudforce-one/events/{event_id}

Creates a new event

client.cloudforceOne.threatEvents.create(ThreatEventCreateParams { account_id, category, date, 14 more } params, RequestOptionsoptions?): ThreatEventCreateResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

POST/accounts/{account_id}/cloudforce-one/events/create

Updates an event

client.cloudforceOne.threatEvents.edit(stringeventID, ThreatEventEditParams { account_id, datasetId, attacker, 12 more } params, RequestOptionsoptions?): ThreatEventEditResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}

Creates bulk events

client.cloudforceOne.threatEvents.bulkCreate(ThreatEventBulkCreateParams { account_id, data, datasetId, includeCreatedEvents } params, RequestOptionsoptions?): ThreatEventBulkCreateResponse { createdEventsCount, createdTagsCount, errorCount, 4 more }

POST/accounts/{account_id}/cloudforce-one/events/create/bulk

Creates bulk DOS event with relationships and indicators

Deprecated

client.cloudforceOne.threatEvents.bulkCreateRelationships(ThreatEventBulkCreateRelationshipsParams { account_id, data, datasetId } params, RequestOptionsoptions?): ThreatEventBulkCreateRelationshipsResponse { createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more }

POST/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships

ModelsExpand Collapse

ThreatEventListResponse = Array<ThreatEventListResponseItem>

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

ThreatEventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

ThreatEventCreateResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

ThreatEventEditResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

ThreatEventBulkCreateResponse { createdEventsCount, createdTagsCount, errorCount, 4 more }

Detailed result of bulk event creation with auto-tag management

createdEventsCount: number

Number of events created

createdTagsCount: number

Number of new tags created in SoT

errorCount: number

Number of errors encountered

queuedIndicatorsCount: number

Number of indicators queued for async processing

createBulkEventsRequestId?: string

Correlation ID for async indicator processing

formatuuid

createdEvents?: Array<CreatedEvent>

Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true

eventIndex: number

Original index in the input data array

shardId: string

Dataset ID of the shard where the event was created

uuid: string

UUID of the created event

formatuuid

errors?: Array<Error>

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

ThreatEventBulkCreateRelationshipsResponse { createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more }

Result of bulk relationship creation operation

createdEventsCount: number

Number of events created

createdIndicatorsCount: number

Number of indicators created

createdRelationshipsCount: number

Number of relationships created

errorCount: number

Number of errors encountered

errors?: Array<Error>

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

Threat EventsAggregate

Aggregate events by single or multiple columns with optional date filtering

client.cloudforceOne.threatEvents.aggregate.list(AggregateListParams { account_id, aggregateBy, datasetId, 4 more } params, RequestOptionsoptions?): AggregateListResponse { aggregateBy, aggregations, total, dateRange }

GET/accounts/{account_id}/cloudforce-one/events/aggregate

ModelsExpand Collapse

AggregateListResponse { aggregateBy, aggregations, total, dateRange }

aggregateBy: string

Column(s) that were aggregated by

aggregations: Array<Aggregation>

Array of aggregation results with dynamic fields based on aggregateBy columns

count: number

Number of events for this aggregation

date?: string

Date (if groupByDate is true)

total: number

Total number of events in the aggregation

dateRange?: DateRange { endDate, startDate }

Date range used for filtering

endDate?: string

startDate?: string

Threat EventsGraphql

GraphQL endpoint for event aggregation

client.cloudforceOne.threatEvents.graphql.create(GraphqlCreateParams { account_id } params, RequestOptionsoptions?): GraphqlCreateResponse { data, errors }

POST/accounts/{account_id}/cloudforce-one/events/graphql

ModelsExpand Collapse

GraphqlCreateResponse { data, errors }

data?: unknown

errors?: Array<unknown> | null

Threat EventsGraph

Query graph neighborhood from R2 Data Catalog

client.cloudforceOne.threatEvents.graph.list(GraphListParams { account_id, cursor, datasetIds, 7 more } params, RequestOptionsoptions?): GraphListResponse { edges, node, nodes }

GET/accounts/{account_id}/cloudforce-one/events/graph

ModelsExpand Collapse

GraphListResponse { edges, node, nodes }

edges: Array<Edge>

id: string

Deterministic composite edge id (source→target:relationshipType)

relationshipType: string

source: string

Compact id of the source node (type:uuid)

sourceId: string

sourceType: string

target: string

Compact id of the target node (type:uuid)

targetId: string

targetType: string

node: Record<string, unknown> | null

Focal node object (legacy single-seed). Null when unavailable.

nodes: Array<Record<string, unknown>>

Threat EventsQueries

List all saved event queries

client.cloudforceOne.threatEvents.queries.list(QueryListParams { account_id } params, RequestOptionsoptions?): QueryListResponse { id, account_id, alert_enabled, 10 more }

GET/accounts/{account_id}/cloudforce-one/events/queries

Create a saved event query

client.cloudforceOne.threatEvents.queries.create(QueryCreateParams { account_id, alert_enabled, alert_rollup_enabled, 4 more } params, RequestOptionsoptions?): QueryCreateResponse { id, account_id, alert_enabled, 10 more }

POST/accounts/{account_id}/cloudforce-one/events/queries/create

Read a saved event query

client.cloudforceOne.threatEvents.queries.get(numberqueryID, QueryGetParams { account_id } params, RequestOptionsoptions?): QueryGetResponse { id, account_id, alert_enabled, 10 more }

GET/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Update a saved event query

client.cloudforceOne.threatEvents.queries.edit(numberqueryID, QueryEditParams { account_id, alert_enabled, alert_rollup_enabled, 4 more } params, RequestOptionsoptions?): QueryEditResponse { id, account_id, alert_enabled, 10 more }

PATCH/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Delete a saved event query

client.cloudforceOne.threatEvents.queries.delete(numberqueryID, QueryDeleteParams { account_id } params, RequestOptionsoptions?): void

DELETE/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

ModelsExpand Collapse

QueryListResponse = Array<QueryListResponseItem>

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

QueryCreateResponse { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

QueryGetResponse { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

QueryEditResponse { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

Threat EventsRelationships

Filter and list events related to specific event

client.cloudforceOne.threatEvents.relationships.list(stringeventID, RelationshipListParams { account_id, datasetId, direction, 6 more } params, RequestOptionsoptions?): RelationshipListResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships

ModelsExpand Collapse

RelationshipListResponse = Array<RelationshipListResponseItem>

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

Threat EventsIndicators

Lists indicators across multiple datasets

client.cloudforceOne.threatEvents.indicators.list(IndicatorListParams { account_id, cache, createdAfter, 15 more } params, RequestOptionsoptions?): IndicatorListResponse { properties, type }

GET/accounts/{account_id}/cloudforce-one/events/indicators

ModelsExpand Collapse

IndicatorListResponse { properties, type }

properties: Properties { completeness, indicators, pagination }

completeness: Completeness { properties, type }

properties: Properties { complete, failedDatasets, failedShards, warnings }

complete: Complete { type }

type: string

failedDatasets: FailedDatasets { items, type }

items: Items { type }

type: string

type: string

failedShards: FailedShards { items, type }

items: Items { properties, type }

properties: Properties { datasetId, shardId }

datasetId: DatasetID { type }

type: string

shardId: ShardID { type }

type: string

type: string

type: string

warnings: Warnings { items, type }

items: Items { type }

type: string

type: string

type: string

indicators: Indicators { items, type }

items: Items { createdAt, indicatorType, updatedAt, 5 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>

datasetId: string

eventId: string

eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags?: Array<Tag>

categoryName?: string

uuid?: string

value?: string

type: string

pagination: Pagination { properties, type }

properties: Properties { count, page, per_page, 2 more }

count: Count { type }

type: string

page: Page { type }

type: string

per_page: PerPage { type }

type: string

total_count: TotalCount { description, nullable, type }

description: string

nullable: boolean

type: string

total_count_is_exact: TotalCountIsExact { description, type }

description: string

type: string

type: string

type: string

Threat EventsIndicatorsAggregate

Aggregate indicators by column(s)

client.cloudforceOne.threatEvents.indicators.aggregate.list(AggregateListParams { account_id, aggregateBy, createdAfter, 7 more } params, RequestOptionsoptions?): AggregateListResponse { aggregateBy, aggregations, failedDatasets, total }

GET/accounts/{account_id}/cloudforce-one/events/indicators/aggregate

ModelsExpand Collapse

AggregateListResponse { aggregateBy, aggregations, failedDatasets, total }

aggregateBy: string

Column(s) that were aggregated by

aggregations: Array<Aggregation>

Array of aggregation results with dynamic fields based on aggregateBy columns

count: number

Number of indicators for this aggregation

failedDatasets: number

Number of datasets whose aggregation failed and were excluded from the result

total: number

Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships

Threat EventsIndicatorsTypes

Lists indicator types across multiple datasets

client.cloudforceOne.threatEvents.indicators.types.list(TypeListParams { account_id, datasetIds } params, RequestOptionsoptions?): TypeListResponse { items, type }

GET/accounts/{account_id}/cloudforce-one/events/indicator-types

ModelsExpand Collapse

TypeListResponse { items, type }

items: Items { type }

type: string

type: string

Threat EventsIndicatorsBy Dataset

Lists indicators

Deprecated

client.cloudforceOne.threatEvents.indicators.byDataset.list(stringdatasetID, ByDatasetListParams { account_id, indicatorType, name, 3 more } params, RequestOptionsoptions?): ByDatasetListResponse { indicators, pagination }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators

Reads an indicator

client.cloudforceOne.threatEvents.indicators.byDataset.get(stringindicatorID, ByDatasetGetParams { account_id, dataset_id } params, RequestOptionsoptions?): ByDatasetGetResponse { createdAt, indicatorType, updatedAt, 5 more }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}

ModelsExpand Collapse

ByDatasetListResponse { indicators, pagination }

indicators: Array<Indicator>

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>

datasetId: string

eventId: string

eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags?: Array<Tag>

categoryName?: string

uuid?: string

value?: string

pagination: Pagination { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

ByDatasetGetResponse { createdAt, indicatorType, updatedAt, 5 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>

datasetId: string

eventId: string

eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags?: Array<Tag>

categoryName?: string

uuid?: string

value?: string

Threat EventsIndicatorsBy DatasetTags

List mirrored tags for an indicator dataset

client.cloudforceOne.threatEvents.indicators.byDataset.tags.list(stringdatasetID, TagListParams { account_id } params, RequestOptionsoptions?): TagListResponse

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags

ModelsExpand Collapse

TagListResponse = Array<unknown>

Array of mirror tag rows

Threat EventsAttackers

Lists attackers across multiple datasets

client.cloudforceOne.threatEvents.attackers.list(AttackerListParams { account_id, datasetIds } params, RequestOptionsoptions?): AttackerListResponse { items, type }

GET/accounts/{account_id}/cloudforce-one/events/attackers

ModelsExpand Collapse

AttackerListResponse { items, type }

items: Items { type }

type: string

type: string

Threat EventsCategories

Lists categories across multiple datasets

client.cloudforceOne.threatEvents.categories.list(CategoryListParams { account_id, datasetIds } params, RequestOptionsoptions?): CategoryListResponse { killChain, name, uuid, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/categories

Reads a category

client.cloudforceOne.threatEvents.categories.get(stringcategoryID, CategoryGetParams { account_id } params, RequestOptionsoptions?): CategoryGetResponse { killChain, name, uuid, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Creates a new category

client.cloudforceOne.threatEvents.categories.create(CategoryCreateParams { account_id, killChain, name, 3 more } params, RequestOptionsoptions?): CategoryCreateResponse { killChain, name, uuid, 3 more }

POST/accounts/{account_id}/cloudforce-one/events/categories/create

Updates a category

client.cloudforceOne.threatEvents.categories.edit(stringcategoryID, CategoryEditParams { account_id, killChain, mitreAttack, 3 more } params, RequestOptionsoptions?): CategoryEditResponse { killChain, name, uuid, 3 more }

PATCH/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Deletes a category

client.cloudforceOne.threatEvents.categories.delete(stringcategoryID, CategoryDeleteParams { account_id } params, RequestOptionsoptions?): CategoryDeleteResponse { uuid }

DELETE/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

ModelsExpand Collapse

CategoryListResponse = Array<CategoryListResponseItem>

killChain: number

name: string

uuid: string

mitreAttack?: Array<string>

mitreCapec?: Array<string>

shortname?: string

CategoryGetResponse { killChain, name, uuid, 3 more }

killChain: number

name: string

uuid: string

mitreAttack?: Array<string>

mitreCapec?: Array<string>

shortname?: string

CategoryCreateResponse { killChain, name, uuid, 3 more }

killChain: number

name: string

uuid: string

mitreAttack?: Array<string>

mitreCapec?: Array<string>

shortname?: string

CategoryEditResponse { killChain, name, uuid, 3 more }

killChain: number

name: string

uuid: string

mitreAttack?: Array<string>

mitreCapec?: Array<string>

shortname?: string

CategoryDeleteResponse { uuid }

uuid: string

Threat EventsCategoriesCatalog

Lists categories

client.cloudforceOne.threatEvents.categories.catalog.list(CatalogListParams { account_id } params, RequestOptionsoptions?): CatalogListResponse { killChain, name, uuid, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/categories/catalog

ModelsExpand Collapse

CatalogListResponse = Array<CatalogListResponseItem>

killChain: number

name: string

uuid: string

mitreAttack?: Array<string>

mitreCapec?: Array<string>

shortname?: string

Threat EventsCountries

Retrieves countries information for all countries

client.cloudforceOne.threatEvents.countries.list(CountryListParams { account_id } params, RequestOptionsoptions?): CountryListResponse { result, success }

GET/accounts/{account_id}/cloudforce-one/events/countries

ModelsExpand Collapse

CountryListResponse = Array<CountryListResponseItem>

result: Array<Result>

alpha2: string

alpha3: string

name: string

success: string

Threat EventsCrons

Threat EventsDatasets

Lists all datasets in an account

client.cloudforceOne.threatEvents.datasets.list(DatasetListParams { account_id, includeDeleted } params, RequestOptionsoptions?): DatasetListResponse { isPublic, name, uuid, deletedAt }

GET/accounts/{account_id}/cloudforce-one/events/dataset

Reads a dataset

client.cloudforceOne.threatEvents.datasets.get(stringdatasetID, DatasetGetParams { account_id } params, RequestOptionsoptions?): DatasetGetResponse { isPublic, name, uuid, deletedAt }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Creates a dataset

client.cloudforceOne.threatEvents.datasets.create(DatasetCreateParams { account_id, isPublic, name } params, RequestOptionsoptions?): DatasetCreateResponse { isPublic, name, uuid, deletedAt }

POST/accounts/{account_id}/cloudforce-one/events/dataset/create

Updates an existing dataset

client.cloudforceOne.threatEvents.datasets.edit(stringdatasetID, DatasetEditParams { account_id, isPublic, name } params, RequestOptionsoptions?): DatasetEditResponse { isPublic, name, uuid, deletedAt }

PATCH/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Delete a dataset

client.cloudforceOne.threatEvents.datasets.delete(stringdatasetID, DatasetDeleteParams { account_id } params, RequestOptionsoptions?): DatasetDeleteResponse { name, uuid }

DELETE/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Reads raw data for an event by UUID

client.cloudforceOne.threatEvents.datasets.raw(stringeventID, DatasetRawParams { account_id, dataset_id } params, RequestOptionsoptions?): DatasetRawResponse { id, accountId, created, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}

ModelsExpand Collapse

DatasetListResponse = Array<DatasetListResponseItem>

isPublic: boolean

name: string

uuid: string

deletedAt?: string

DatasetGetResponse { isPublic, name, uuid, deletedAt }

isPublic: boolean

name: string

uuid: string

deletedAt?: string

DatasetCreateResponse { isPublic, name, uuid, deletedAt }

isPublic: boolean

name: string

uuid: string

deletedAt?: string

DatasetEditResponse { isPublic, name, uuid, deletedAt }

isPublic: boolean

name: string

uuid: string

deletedAt?: string

DatasetDeleteResponse { name, uuid }

name: string

uuid: string

DatasetRawResponse { id, accountId, created, 3 more }

id: number

accountId: number

created: string

data: string

source: string

tlp: string

Threat EventsDatasetsHealth

Threat EventsDatasetsEvents

Reads an event

client.cloudforceOne.threatEvents.datasets.events.get(stringeventID, EventGetParams { account_id, dataset_id } params, RequestOptionsoptions?): EventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}

ModelsExpand Collapse

EventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

Threat EventsRaw

Reads data for a raw event

client.cloudforceOne.threatEvents.raw.get(stringrawID, RawGetParams { account_id, event_id } params, RequestOptionsoptions?): RawGetResponse { id, accountId, created, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

Updates a raw event

client.cloudforceOne.threatEvents.raw.edit(stringrawID, RawEditParams { account_id, event_id, data, 2 more } params, RequestOptionsoptions?): RawEditResponse { id, data }

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

ModelsExpand Collapse

RawGetResponse { id, accountId, created, 3 more }

id: string

accountId: number

created: string

data: unknown

source: string

tlp: string

RawEditResponse { id, data }

id: string

data: unknown

Threat EventsRelate

Removes an event reference

client.cloudforceOne.threatEvents.relate.delete(stringeventID, RelateDeleteParams { account_id } params, RequestOptionsoptions?): RelateDeleteResponse { success }

DELETE/accounts/{account_id}/cloudforce-one/events/relate/{event_id}

ModelsExpand Collapse

RelateDeleteResponse { success }

success: boolean

Threat EventsTags

Lists all tags (SoT)

client.cloudforceOne.threatEvents.tags.list(TagListParams { account_id, cache, categoryUuid, 4 more } params, RequestOptionsoptions?): TagListResponse { pagination, tags }

GET/accounts/{account_id}/cloudforce-one/events/tags

Creates a new tag

client.cloudforceOne.threatEvents.tags.create(TagCreateParams { account_id, value, activeDuration, 23 more } params, RequestOptionsoptions?): TagCreateResponse { uuid, value, activeDuration, 25 more }

POST/accounts/{account_id}/cloudforce-one/events/tags/create

Updates a tag (SoT)

client.cloudforceOne.threatEvents.tags.edit(stringtagUUID, TagEditParams { account_id, activeDuration, actorCategory, 23 more } params, RequestOptionsoptions?): TagEditResponse { uuid, value, activeDuration, 25 more }

PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

Deletes a tag (SoT)

client.cloudforceOne.threatEvents.tags.delete(stringtagUUID, TagDeleteParams { account_id } params, RequestOptionsoptions?): TagDeleteResponse { uuid }

DELETE/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

ModelsExpand Collapse

TagListResponse { pagination, tags }

pagination: Pagination { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

tags: Array<Tag>

uuid: string

value: string

activeDuration?: string

actorCategory?: string

actorCategoryConfidence?: number

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "green" | "white" | null

One of the following:

"red"

"amber"

"green"

"white"

aliasGroupNames?: Array<string>

aliasGroupNamesInternal?: Array<string>

analyticPriority?: number

attributionConfidence?: string

attributionConfidenceScore?: number

maximum10

minimum1

attributionOrganization?: string

categoryName?: string

categoryUuid?: string

dateOfDiscovery?: string

externalReferenceLinks?: Array<string>

externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description?: string | null

internalAliases?: Array<InternalAlias>

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "green" | "white" | null

One of the following:

"red"

"amber"

"green"

"white"

internalDescription?: string

motive?: string

motiveConfidence?: number

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

opsecLevel?: string

originCountryConfidence?: number

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

originCountryISO?: string

originCountryISOAlpha3?: string

originCountryTlp?: "red" | "amber" | "green" | "white"

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:

"red"

"amber"

"green"

"white"

priority?: number

sophisticationLevel?: string

TagCreateResponse { uuid, value, activeDuration, 25 more }

uuid: string

value: string

activeDuration?: string

actorCategory?: string

actorCategoryConfidence?: number

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "green" | "white" | null

One of the following:

"red"

"amber"

"green"

"white"

aliasGroupNames?: Array<string>

aliasGroupNamesInternal?: Array<string>

analyticPriority?: number

attributionConfidence?: string

attributionConfidenceScore?: number

maximum10

minimum1

attributionOrganization?: string

categoryName?: string

categoryUuid?: string

dateOfDiscovery?: string

externalReferenceLinks?: Array<string>

externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description?: string | null

internalAliases?: Array<InternalAlias>

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "green" | "white" | null

One of the following:

"red"

"amber"

"green"

"white"

internalDescription?: string

motive?: string

motiveConfidence?: number

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

opsecLevel?: string

originCountryConfidence?: number

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

originCountryISO?: string

originCountryISOAlpha3?: string

originCountryTlp?: "red" | "amber" | "green" | "white"

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:

"red"

"amber"

"green"

"white"

priority?: number

sophisticationLevel?: string

TagEditResponse { uuid, value, activeDuration, 25 more }

uuid: string

value: string

activeDuration?: string

actorCategory?: string

actorCategoryConfidence?: number

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "green" | "white" | null

One of the following:

"red"

"amber"

"green"

"white"

aliasGroupNames?: Array<string>

aliasGroupNamesInternal?: Array<string>

analyticPriority?: number

attributionConfidence?: string

attributionConfidenceScore?: number

maximum10

minimum1

attributionOrganization?: string

categoryName?: string

categoryUuid?: string

dateOfDiscovery?: string

externalReferenceLinks?: Array<string>

externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description?: string | null

internalAliases?: Array<InternalAlias>

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence?: number | null

maximum10

minimum1

tlp?: "red" | "amber" | "green" | "white" | null

One of the following:

"red"

"amber"

"green"

"white"

internalDescription?: string

motive?: string

motiveConfidence?: number

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

opsecLevel?: string

originCountryConfidence?: number

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

originCountryISO?: string

originCountryISOAlpha3?: string

originCountryTlp?: "red" | "amber" | "green" | "white"

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:

"red"

"amber"

"green"

"white"

priority?: number

sophisticationLevel?: string

TagDeleteResponse { uuid }

uuid: string

Threat EventsTagsCategories

Lists all tag categories (SoT)

client.cloudforceOne.threatEvents.tags.categories.list(CategoryListParams { account_id, search } params, RequestOptionsoptions?): CategoryListResponse { categories }

GET/accounts/{account_id}/cloudforce-one/events/tags/categories

Creates a new tag category (SoT)

client.cloudforceOne.threatEvents.tags.categories.create(CategoryCreateParams { account_id, name, description } params, RequestOptionsoptions?): CategoryCreateResponse { name, uuid, createdAt, 2 more }

POST/accounts/{account_id}/cloudforce-one/events/tags/categories/create

Updates a tag category (SoT)

client.cloudforceOne.threatEvents.tags.categories.edit(stringcategoryUUID, CategoryEditParams { account_id, description, name } params, RequestOptionsoptions?): CategoryEditResponse { name, uuid, createdAt, 2 more }

PATCH/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

Deletes a tag category (SoT)

client.cloudforceOne.threatEvents.tags.categories.delete(stringcategoryUUID, CategoryDeleteParams { account_id } params, RequestOptionsoptions?): CategoryDeleteResponse { uuid }

DELETE/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

ModelsExpand Collapse

CategoryListResponse { categories }

categories: Array<Category>

name: string

uuid: string

createdAt?: string

description?: string

updatedAt?: string

CategoryCreateResponse { name, uuid, createdAt, 2 more }

name: string

uuid: string

createdAt?: string

description?: string

updatedAt?: string

CategoryEditResponse { name, uuid, createdAt, 2 more }

name: string

uuid: string

createdAt?: string

description?: string

updatedAt?: string

CategoryDeleteResponse { uuid }

uuid: string

Threat EventsTagsIndicators

List indicators related to a tag

client.cloudforceOne.threatEvents.tags.indicators.list(stringtagUUID, IndicatorListParams { account_id, datasetIds, indicatorType, 4 more } params, RequestOptionsoptions?): IndicatorListResponse { indicators, pagination }

GET/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators

ModelsExpand Collapse

IndicatorListResponse { indicators, pagination }

indicators: Array<Indicator>

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>

datasetId: string

eventId: string

eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags?: Array<Tag>

categoryName?: string

uuid?: string

value?: string

pagination: Pagination { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

Threat EventsTagsIndicatorsBy Dataset

List indicators related to a tag within a dataset (deprecated)

Deprecated

client.cloudforceOne.threatEvents.tags.indicators.byDataset.list(stringtagUUID, ByDatasetListParams { account_id, dataset_id, indicatorType, 4 more } params, RequestOptionsoptions?): ByDatasetListResponse { indicators, pagination }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators

ModelsExpand Collapse

ByDatasetListResponse { indicators, pagination }

indicators: Array<Indicator>

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>

datasetId: string

eventId: string

eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags?: Array<Tag>

categoryName?: string

uuid?: string

value?: string

pagination: Pagination { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

Threat EventsEvent Tags

Adds a tag to an event

client.cloudforceOne.threatEvents.eventTags.create(stringeventID, EventTagCreateParams { account_id, tags } params, RequestOptionsoptions?): EventTagCreateResponse { success }

POST/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create

Removes a tag from an event

client.cloudforceOne.threatEvents.eventTags.delete(stringeventID, EventTagDeleteParams { account_id } params, RequestOptionsoptions?): EventTagDeleteResponse { success }

DELETE/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}

ModelsExpand Collapse

EventTagCreateResponse { success }

success: boolean

EventTagDeleteResponse { success }

success: boolean

Threat EventsTarget Industries

Lists target industries across multiple datasets

client.cloudforceOne.threatEvents.targetIndustries.list(TargetIndustryListParams { account_id, datasetIds } params, RequestOptionsoptions?): TargetIndustryListResponse { items, type }

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries

ModelsExpand Collapse

TargetIndustryListResponse { items, type }

items: Items { type }

type: string

type: string

Threat EventsTarget IndustriesBy Dataset

Lists all target industries for a specific dataset

client.cloudforceOne.threatEvents.targetIndustries.byDataset.list(stringdatasetID, ByDatasetListParams { account_id } params, RequestOptionsoptions?): ByDatasetListResponse { items, type }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries

ModelsExpand Collapse

ByDatasetListResponse { items, type }

items: Items { type }

type: string

type: string

Threat EventsTarget IndustriesCatalog

Lists all target industries from industry map catalog

client.cloudforceOne.threatEvents.targetIndustries.catalog.list(CatalogListParams { account_id } params, RequestOptionsoptions?): CatalogListResponse { items, type }

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog

ModelsExpand Collapse

CatalogListResponse { items, type }

items: Items { type }

type: string

type: string

Threat EventsInsights