## Filter and list events

`client.cloudforceOne.threatEvents.list(ThreatEventListParamsparams, RequestOptionsoptions?): ThreatEventListResponse`

**get** `/accounts/{account_id}/cloudforce-one/events`

When `datasetId` is unspecified, events will be listed from the `Cloudforce One Threat Events` dataset. To list existing datasets (and their IDs), use the [`List Datasets`](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_events/subresources/datasets/methods/list/) endpoint). Also, must provide query parameters.

### Parameters

- `params: ThreatEventListParams`

  - `account_id: string`

    Path param: Account ID.

  - `cursor?: string`

    Query param: Cursor for pagination. When provided, filters are embedded in the cursor so you only need to pass cursor and pageSize. Returned in the previous response's result_info.cursor field. Use cursor-based pagination for deep pagination (beyond 100,000 records) or for optimal performance.

  - `datasetId?: Array<string>`

    Query param

  - `forceRefresh?: boolean`

    Query param

  - `format?: "json" | "stix2"`

    Query param

    - `"json"`

    - `"stix2"`

  - `order?: "asc" | "desc"`

    Query param

    - `"asc"`

    - `"desc"`

  - `orderBy?: string`

    Query param

  - `page?: number`

    Query param: Page number (1-indexed) for offset-based pagination. Limited to offset of 100,000 records. For deep pagination, use cursor-based pagination instead.

  - `pageSize?: number`

    Query param: Number of results per page. Maximum 25,000.

  - `search?: Array<Search>`

    Query param

    - `field?: string`

      Event field to search on. Allowed: attacker, attackerCountry, category, createdAt, date, event, indicator, indicatorType, killChain, mitreAttack, tags, targetCountry, targetIndustry, tlp, uuid.

    - `op?: "equals" | "not" | "gt" | 9 more`

      Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'tags', op:'in', value:['malware','apt']}.

      - `"equals"`

      - `"not"`

      - `"gt"`

      - `"gte"`

      - `"lt"`

      - `"lte"`

      - `"like"`

      - `"contains"`

      - `"startsWith"`

      - `"endsWith"`

      - `"in"`

      - `"find"`

    - `value?: string | number | Array<string | number>`

      Search value. String or number for most operators. Array for 'in' operator (max 100 items).

      - `string`

      - `number`

      - `Array<string | number>`

        - `string`

        - `number`

### Returns

- `ThreatEventListResponse = Array<ThreatEventListResponseItem>`

  - `attacker: string`

  - `attackerCountry: string`

  - `category: string`

  - `datasetId: string`

  - `date: string`

  - `event: string`

  - `hasChildren: boolean`

  - `indicator: string`

  - `indicatorType: string`

  - `indicatorTypeId: number`

  - `killChain: number`

  - `mitreAttack: Array<string>`

  - `mitreCapec: Array<string>`

  - `numReferenced: number`

  - `numReferences: number`

  - `rawId: string`

  - `referenced: Array<string>`

  - `referencedIds: Array<number>`

  - `references: Array<string>`

  - `referencesIds: Array<number>`

  - `tags: Array<string>`

  - `targetCountry: string`

  - `targetIndustry: string`

  - `tlp: string`

  - `uuid: string`

  - `insight?: string`

  - `releasabilityId?: string`

### Example

```node
import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const threatEvents = await client.cloudforceOne.threatEvents.list({ account_id: 'account_id' });

console.log(threatEvents);
```

#### Response

```json
[
  {
    "attacker": "Flying Yeti",
    "attackerCountry": "CN",
    "category": "Domain Resolution",
    "datasetId": "dataset-example-id",
    "date": "2022-04-01T00:00:00Z",
    "event": "An attacker registered the domain domain.com",
    "hasChildren": true,
    "indicator": "domain.com",
    "indicatorType": "domain",
    "indicatorTypeId": 5,
    "killChain": 0,
    "mitreAttack": [
      " "
    ],
    "mitreCapec": [
      " "
    ],
    "numReferenced": 0,
    "numReferences": 0,
    "rawId": "453gw34w3",
    "referenced": [
      " "
    ],
    "referencedIds": [
      0
    ],
    "references": [
      " "
    ],
    "referencesIds": [
      0
    ],
    "tags": [
      "malware"
    ],
    "targetCountry": "US",
    "targetIndustry": "Agriculture",
    "tlp": "amber",
    "uuid": "12345678-1234-1234-1234-1234567890ab",
    "insight": "insight",
    "releasabilityId": "releasabilityId"
  }
]
```