Creates bulk events

client.cloudforceOne.threatEvents.bulkCreate(, ?): ThreatEventBulkCreateResponse { createdEventsCount, createdTagsCount, errorCount, 4 more }

POST/accounts/{account_id}/cloudforce-one/events/create/bulk

The datasetId parameter must be defined. To list existing datasets (and their IDs) in your account, use the List Datasets endpoint.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

Accepted Permissions (at least one required)

Cloudforce One WriteCloudforce One Read

ParametersExpand Collapse

params: ThreatEventBulkCreateParams { account_id, data, datasetId, includeCreatedEvents }

account_id: string

Path param: Account ID.

data: Array<Data>

Body param

category: string

date: string

formatdate-time

event: string

raw: Raw { data, source, tlp }

data: Record<string, unknown> | null

source?: string

tlp?: string

tlp: string

accountId?: number

attacker?: string | null

attackerCountry?: string

datasetId?: string

indicator?: string

indicators?: Array<Indicator>

Array of indicators for this event. Supports multiple indicators per event for complex scenarios.

indicatorType: string

The type of indicator (e.g., DOMAIN, IP, JA3, HASH)

value: string

The indicator value (e.g., domain name, IP address, hash)

indicatorType?: string

insight?: string

tags?: Array<string>

targetCountry?: string

targetIndustry?: string

datasetId: string

Body param

includeCreatedEvents?: boolean

Body param: When true, response includes array of created event UUIDs and shard IDs. Useful for tracking which events were created and where.

ReturnsExpand Collapse

ThreatEventBulkCreateResponse { createdEventsCount, createdTagsCount, errorCount, 4 more }

Detailed result of bulk event creation with auto-tag management

createdEventsCount: number

Number of events created

createdTagsCount: number

Number of new tags created in SoT

errorCount: number

Number of errors encountered

queuedIndicatorsCount: number

Number of indicators queued for async processing

createBulkEventsRequestId?: string

Correlation ID for async indicator processing

formatuuid

createdEvents?: Array<CreatedEvent>

Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true

eventIndex: number

Original index in the input data array

shardId: string

Dataset ID of the shard where the event was created

uuid: string

UUID of the created event

formatuuid

errors?: Array<Error>

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

Creates bulk events

import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const response = await client.cloudforceOne.threatEvents.bulkCreate({
  account_id: 'account_id',
  data: [
    {
      category: 'Domain Resolution',
      date: '2022-04-01T00:00:00Z',
      event: 'An attacker registered the domain domain.com',
      raw: { data: { foo: 'bar' } },
      tlp: 'amber',
    },
  ],
  datasetId: 'durableObjectName',
});

console.log(response.createdEventsCount);

{
  "createdEventsCount": 0,
  "createdTagsCount": 0,
  "errorCount": 0,
  "queuedIndicatorsCount": 0,
  "createBulkEventsRequestId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
  "createdEvents": [
    {
      "eventIndex": 0,
      "shardId": "shardId",
      "uuid": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
    }
  ],
  "errors": [
    {
      "error": "error",
      "eventIndex": 0
    }
  ]
}

Returns Examples

{
  "createdEventsCount": 0,
  "createdTagsCount": 0,
  "errorCount": 0,
  "queuedIndicatorsCount": 0,
  "createBulkEventsRequestId": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e",
  "createdEvents": [
    {
      "eventIndex": 0,
      "shardId": "shardId",
      "uuid": "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
    }
  ],
  "errors": [
    {
      "error": "error",
      "eventIndex": 0
    }
  ]
}