# Indicator Feeds ## Get indicator feeds owned by this account `intel.indicator_feeds.list(IndicatorFeedListParams**kwargs) -> SyncSinglePage[IndicatorFeedListResponse]` **get** `/accounts/{account_id}/intel/indicator-feeds` Retrieves details for all accessible custom threat indicator feeds. ### Parameters - `account_id: str` Identifier ### Returns - `class IndicatorFeedListResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) page = client.intel.indicator_feeds.list( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) page = page.result[0] print(page.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": [ { "id": 1, "created_on": "2023-05-12T12:21:56.777653Z", "description": "user specified description 1", "is_attributable": false, "is_downloadable": false, "is_public": false, "modified_on": "2023-06-18T03:13:34.123321Z", "name": "user_specified_name_1" }, { "id": 2, "created_on": "2023-05-21T21:43:52.867525Z", "description": "User specified description 2", "is_attributable": false, "is_downloadable": false, "is_public": false, "modified_on": "2023-06-28T18:46:18.764425Z", "name": "user_specified_name_2" } ] } ``` ## Get indicator feed metadata `intel.indicator_feeds.get(intfeed_id, IndicatorFeedGetParams**kwargs) -> IndicatorFeedGetResponse` **get** `/accounts/{account_id}/intel/indicator-feeds/{feed_id}` Retrieves details for a specific custom threat indicator feed. ### Parameters - `account_id: str` Identifier - `feed_id: int` Indicator feed ID ### Returns - `class IndicatorFeedGetResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `latest_upload_status: Optional[Literal["Mirroring", "Unifying", "Loading", 3 more]]` Status of the latest snapshot uploaded - `"Mirroring"` - `"Unifying"` - `"Loading"` - `"Provisioning"` - `"Complete"` - `"Error"` - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed - `provider_id: Optional[str]` The unique identifier for the provider - `provider_name: Optional[str]` The provider of the indicator feed ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) indicator_feed = client.intel.indicator_feeds.get( feed_id=12, account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(indicator_feed.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": 1, "created_on": "2023-05-12T12:21:56.777653Z", "description": "example feed description", "is_attributable": false, "is_downloadable": false, "is_public": false, "latest_upload_status": "Complete", "modified_on": "2023-06-18T03:13:34.123321Z", "name": "example_feed_1", "provider_id": "provider_id", "provider_name": "provider_name" } } ``` ## Create new indicator feed `intel.indicator_feeds.create(IndicatorFeedCreateParams**kwargs) -> IndicatorFeedCreateResponse` **post** `/accounts/{account_id}/intel/indicator-feeds` Creates a new custom threat indicator feed for sharing threat intelligence data. ### Parameters - `account_id: str` Identifier - `description: Optional[str]` The description of the example test - `name: Optional[str]` The name of the indicator feed ### Returns - `class IndicatorFeedCreateResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) indicator_feed = client.intel.indicator_feeds.create( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(indicator_feed.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": 1, "created_on": "2023-05-12T12:21:56.777653Z", "description": "example feed description", "is_attributable": false, "is_downloadable": false, "is_public": false, "modified_on": "2023-06-18T03:13:34.123321Z", "name": "example_feed_1" } } ``` ## Update indicator feed metadata `intel.indicator_feeds.update(intfeed_id, IndicatorFeedUpdateParams**kwargs) -> IndicatorFeedUpdateResponse` **put** `/accounts/{account_id}/intel/indicator-feeds/{feed_id}` Revises details for a specific custom threat indicator feed. ### Parameters - `account_id: str` Identifier - `feed_id: int` Indicator feed ID - `description: Optional[str]` The new description of the feed - `is_attributable: Optional[bool]` The new is_attributable value of the feed - `is_downloadable: Optional[bool]` The new is_downloadable value of the feed - `is_public: Optional[bool]` The new is_public value of the feed - `name: Optional[str]` The new name of the feed ### Returns - `class IndicatorFeedUpdateResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) indicator_feed = client.intel.indicator_feeds.update( feed_id=12, account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(indicator_feed.id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "id": 1, "created_on": "2023-05-12T12:21:56.777653Z", "description": "example feed description", "is_attributable": false, "is_downloadable": false, "is_public": false, "modified_on": "2023-06-18T03:13:34.123321Z", "name": "example_feed_1" } } ``` ## Get indicator feed data `intel.indicator_feeds.data(intfeed_id, IndicatorFeedDataParams**kwargs) -> IndicatorFeedDataResponse` **get** `/accounts/{account_id}/intel/indicator-feeds/{feed_id}/data` Retrieves the raw data entries in a custom threat indicator feed. ### Parameters - `account_id: str` Identifier - `feed_id: int` Indicator feed ID ### Returns - `str` ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) response = client.intel.indicator_feeds.data( feed_id=12, account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(response) ``` ## Domain Types ### Indicator Feed List Response - `class IndicatorFeedListResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed ### Indicator Feed Get Response - `class IndicatorFeedGetResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `latest_upload_status: Optional[Literal["Mirroring", "Unifying", "Loading", 3 more]]` Status of the latest snapshot uploaded - `"Mirroring"` - `"Unifying"` - `"Loading"` - `"Provisioning"` - `"Complete"` - `"Error"` - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed - `provider_id: Optional[str]` The unique identifier for the provider - `provider_name: Optional[str]` The provider of the indicator feed ### Indicator Feed Create Response - `class IndicatorFeedCreateResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed ### Indicator Feed Update Response - `class IndicatorFeedUpdateResponse: …` - `id: Optional[int]` The unique identifier for the indicator feed - `created_on: Optional[datetime]` The date and time when the data entry was created - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `modified_on: Optional[datetime]` The date and time when the data entry was last modified - `name: Optional[str]` The name of the indicator feed ### Indicator Feed Data Response - `str` # Snapshots ## Update indicator feed data `intel.indicator_feeds.snapshots.update(intfeed_id, SnapshotUpdateParams**kwargs) -> SnapshotUpdateResponse` **put** `/accounts/{account_id}/intel/indicator-feeds/{feed_id}/snapshot` Revises the raw data entries in a custom threat indicator feed. ### Parameters - `account_id: str` Identifier - `feed_id: int` Indicator feed ID - `source: Optional[str]` The file to upload ### Returns - `class SnapshotUpdateResponse: …` - `file_id: Optional[int]` Feed id - `filename: Optional[str]` Name of the file unified in our system - `status: Optional[str]` Current status of upload, should be unified ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) snapshot = client.intel.indicator_feeds.snapshots.update( feed_id=12, account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(snapshot.file_id) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "file_id": 1, "filename": "snapshot_file.unified", "status": "unified" } } ``` ## Domain Types ### Snapshot Update Response - `class SnapshotUpdateResponse: …` - `file_id: Optional[int]` Feed id - `filename: Optional[str]` Name of the file unified in our system - `status: Optional[str]` Current status of upload, should be unified # Permissions ## List indicator feed permissions `intel.indicator_feeds.permissions.list(PermissionListParams**kwargs) -> PermissionListResponse` **get** `/accounts/{account_id}/intel/indicator-feeds/permissions/view` Lists current access permissions for custom threat indicator feeds. ### Parameters - `account_id: str` Identifier ### Returns - `List[PermissionListResponseItem]` - `id: Optional[int]` The unique identifier for the indicator feed - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `name: Optional[str]` The name of the indicator feed ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) permissions = client.intel.indicator_feeds.permissions.list( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(permissions) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": [ { "id": 1, "description": "An important indicator list", "is_attributable": false, "is_downloadable": false, "is_public": false, "name": "indicator_list_1" }, { "id": 2, "description": "An even more important indicator list", "is_attributable": true, "is_downloadable": false, "is_public": true, "name": "indicator_list_2" } ] } ``` ## Grant permission to indicator feed `intel.indicator_feeds.permissions.create(PermissionCreateParams**kwargs) -> PermissionCreateResponse` **put** `/accounts/{account_id}/intel/indicator-feeds/permissions/add` Grants access permissions for a custom threat indicator feed to other accounts. ### Parameters - `account_id: str` Identifier - `account_tag: Optional[str]` The Cloudflare account tag of the account to change permissions on - `feed_id: Optional[int]` The ID of the feed to add/remove permissions on ### Returns - `class PermissionCreateResponse: …` - `success: Optional[bool]` Whether the update succeeded or not ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) permission = client.intel.indicator_feeds.permissions.create( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(permission.success) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "success": true } } ``` ## Revoke permission to indicator feed `intel.indicator_feeds.permissions.delete(PermissionDeleteParams**kwargs) -> PermissionDeleteResponse` **put** `/accounts/{account_id}/intel/indicator-feeds/permissions/remove` Revokes access permissions for a custom threat indicator feed. ### Parameters - `account_id: str` Identifier - `account_tag: Optional[str]` The Cloudflare account tag of the account to change permissions on - `feed_id: Optional[int]` The ID of the feed to add/remove permissions on ### Returns - `class PermissionDeleteResponse: …` - `success: Optional[bool]` Whether the update succeeded or not ### Example ```python import os from cloudflare import Cloudflare client = Cloudflare( api_email=os.environ.get("CLOUDFLARE_EMAIL"), # This is the default and can be omitted api_key=os.environ.get("CLOUDFLARE_API_KEY"), # This is the default and can be omitted ) permission = client.intel.indicator_feeds.permissions.delete( account_id="023e105f4ecef8ad9ca31a8372d0c353", ) print(permission.success) ``` #### Response ```json { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "success": true, "result": { "success": true } } ``` ## Domain Types ### Permission List Response - `List[PermissionListResponseItem]` - `id: Optional[int]` The unique identifier for the indicator feed - `description: Optional[str]` The description of the example test - `is_attributable: Optional[bool]` Whether the indicator feed can be attributed to a provider - `is_downloadable: Optional[bool]` Whether the indicator feed can be downloaded - `is_public: Optional[bool]` Whether the indicator feed is exposed to customers - `name: Optional[str]` The name of the indicator feed ### Permission Create Response - `class PermissionCreateResponse: …` - `success: Optional[bool]` Whether the update succeeded or not ### Permission Delete Response - `class PermissionDeleteResponse: …` - `success: Optional[bool]` Whether the update succeeded or not # Downloads