API Reference

Cloudforce One

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Threat Events

Filter and list events

GET/accounts/{account_id}/cloudforce-one/events

Reads an event

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/{event_id}

Creates a new event

POST/accounts/{account_id}/cloudforce-one/events/create

Updates an event

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}

Creates bulk events

POST/accounts/{account_id}/cloudforce-one/events/create/bulk

Creates bulk DOS event with relationships and indicators

Deprecated

POST/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships

ModelsExpand Collapse

ThreatEventListResponse = array of object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventGetResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventCreateResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventEditResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventBulkCreateResponse object { createdEventsCount, createdTagsCount, errorCount, 4 more }

Detailed result of bulk event creation with auto-tag management

createdEventsCount: number

Number of events created

createdTagsCount: number

Number of new tags created in SoT

errorCount: number

Number of errors encountered

queuedIndicatorsCount: number

Number of indicators queued for async processing

createBulkEventsRequestId: optional string

Correlation ID for async indicator processing

formatuuid

createdEvents: optional array of object { eventIndex, shardId, uuid }

Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true

eventIndex: number

Original index in the input data array

shardId: string

Dataset ID of the shard where the event was created

uuid: string

UUID of the created event

formatuuid

errors: optional array of object { error, eventIndex }

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

ThreatEventBulkCreateRelationshipsResponse object { createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more }

Result of bulk relationship creation operation

createdEventsCount: number

Number of events created

createdIndicatorsCount: number

Number of indicators created

createdRelationshipsCount: number

Number of relationships created

errorCount: number

Number of errors encountered

errors: optional array of object { error, eventIndex }

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

Threat EventsAggregate

Aggregate events by single or multiple columns with optional date filtering

GET/accounts/{account_id}/cloudforce-one/events/aggregate

ModelsExpand Collapse

AggregateListResponse object { aggregateBy, aggregations, total, dateRange }

aggregateBy: string

Column(s) that were aggregated by

aggregations: array of object { count, date }

Array of aggregation results with dynamic fields based on aggregateBy columns

count: number

Number of events for this aggregation

date: optional string

Date (if groupByDate is true)

total: number

Total number of events in the aggregation

dateRange: optional object { endDate, startDate }

Date range used for filtering

endDate: optional string

startDate: optional string

Threat EventsGraphql

GraphQL endpoint for event aggregation

POST/accounts/{account_id}/cloudforce-one/events/graphql

ModelsExpand Collapse

GraphqlCreateResponse object { data, errors }

data: optional unknown

errors: optional array of unknown

Threat EventsGraph

Query graph neighborhood from R2 Data Catalog

GET/accounts/{account_id}/cloudforce-one/events/graph

ModelsExpand Collapse

GraphListResponse object { edges, node, nodes }

edges: array of object { id, relationshipType, source, 5 more }

id: string

Deterministic composite edge id (source→target:relationshipType)

relationshipType: string

source: string

Compact id of the source node (type:uuid)

sourceId: string

sourceType: string

target: string

Compact id of the target node (type:uuid)

targetId: string

targetType: string

node: map[unknown]

Focal node object (legacy single-seed). Null when unavailable.

nodes: array of map[unknown]

Threat EventsQueries

List all saved event queries

GET/accounts/{account_id}/cloudforce-one/events/queries

Create a saved event query

POST/accounts/{account_id}/cloudforce-one/events/queries/create

Read a saved event query

GET/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Update a saved event query

PATCH/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Delete a saved event query

DELETE/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

ModelsExpand Collapse

QueryListResponse = array of object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id: optional number

Intel Indicator Feed ID (numeric)

rule_list_id: optional string

WAF rules list ID for blocking

rule_scope: optional string

Scope for the rule

QueryCreateResponse object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id: optional number

Intel Indicator Feed ID (numeric)

rule_list_id: optional string

WAF rules list ID for blocking

rule_scope: optional string

Scope for the rule

QueryGetResponse object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id: optional number

Intel Indicator Feed ID (numeric)

rule_list_id: optional string

WAF rules list ID for blocking

rule_scope: optional string

Scope for the rule

QueryEditResponse object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id: optional number

Intel Indicator Feed ID (numeric)

rule_list_id: optional string

WAF rules list ID for blocking

rule_scope: optional string

Scope for the rule

Threat EventsRelationships

Filter and list events related to specific event

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships

ModelsExpand Collapse

RelationshipListResponse = array of object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

Threat EventsIndicators

Lists indicators across multiple datasets

GET/accounts/{account_id}/cloudforce-one/events/indicators

ModelsExpand Collapse

IndicatorListResponse object { properties, type }

properties: object { indicators, pagination }

indicators: object { items, type }

items: object { createdAt, indicatorType, updatedAt, 5 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId }

datasetId: string

eventId: string

tags: optional array of object { categoryName, uuid, value }

categoryName: optional string

uuid: optional string

value: optional string

type: string

pagination: object { properties, type }

properties: object { count, page, per_page, total_count }

count: object { type }

type: string

page: object { type }

type: string

per_page: object { type }

type: string

total_count: object { type }

type: string

type: string

type: string

Threat EventsIndicatorsAggregate

Aggregate indicators by column(s)

GET/accounts/{account_id}/cloudforce-one/events/indicators/aggregate

ModelsExpand Collapse

AggregateListResponse object { aggregateBy, aggregations, failedDatasets, total }

aggregateBy: string

Column(s) that were aggregated by

aggregations: array of object { count }

Array of aggregation results with dynamic fields based on aggregateBy columns

count: number

Number of indicators for this aggregation

failedDatasets: number

Number of datasets whose aggregation failed and were excluded from the result

total: number

Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships

Threat EventsIndicatorsTypes

Lists indicator types across multiple datasets

GET/accounts/{account_id}/cloudforce-one/events/indicator-types

ModelsExpand Collapse

TypeListResponse object { items, type }

items: object { type }

type: string

type: string

Threat EventsIndicatorsBy Dataset

Lists indicators

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators

Reads an indicator

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}

ModelsExpand Collapse

ByDatasetListResponse object { indicators, pagination }

indicators: array of object { createdAt, indicatorType, updatedAt, 5 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId }

datasetId: string

eventId: string

tags: optional array of object { categoryName, uuid, value }

categoryName: optional string

uuid: optional string

value: optional string

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

ByDatasetGetResponse object { createdAt, indicatorType, updatedAt, 5 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId }

datasetId: string

eventId: string

tags: optional array of object { categoryName, uuid, value }

categoryName: optional string

uuid: optional string

value: optional string

Threat EventsIndicatorsBy DatasetTags

List mirrored tags for an indicator dataset

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags

ModelsExpand Collapse

TagListResponse = array of unknown

Array of mirror tag rows

Threat EventsAttackers

Lists attackers across multiple datasets

GET/accounts/{account_id}/cloudforce-one/events/attackers

ModelsExpand Collapse

AttackerListResponse object { items, type }

items: object { type }

type: string

type: string

Threat EventsCategories

Lists categories across multiple datasets

GET/accounts/{account_id}/cloudforce-one/events/categories

Reads a category

GET/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Creates a new category

POST/accounts/{account_id}/cloudforce-one/events/categories/create

Updates a category

PATCH/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Deletes a category

DELETE/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

ModelsExpand Collapse

CategoryListResponse = array of object { killChain, name, uuid, 3 more }

killChain: number

name: string

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryGetResponse object { killChain, name, uuid, 3 more }

killChain: number

name: string

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryCreateResponse object { killChain, name, uuid, 3 more }

killChain: number

name: string

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryEditResponse object { killChain, name, uuid, 3 more }

killChain: number

name: string

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryDeleteResponse object { uuid }

uuid: string

Threat EventsCategoriesCatalog

Lists categories

GET/accounts/{account_id}/cloudforce-one/events/categories/catalog

ModelsExpand Collapse

CatalogListResponse = array of object { killChain, name, uuid, 3 more }

killChain: number

name: string

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

Threat EventsCountries

Retrieves countries information for all countries

GET/accounts/{account_id}/cloudforce-one/events/countries

ModelsExpand Collapse

CountryListResponse = array of object { result, success }

result: array of object { alpha2, alpha3, name }

alpha2: string

alpha3: string

name: string

success: string

Threat EventsCrons

Threat EventsDatasets

Lists all datasets in an account

GET/accounts/{account_id}/cloudforce-one/events/dataset

Reads a dataset

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Creates a dataset

POST/accounts/{account_id}/cloudforce-one/events/dataset/create

Updates an existing dataset

PATCH/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Delete a dataset

DELETE/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Reads raw data for an event by UUID

GET/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}

ModelsExpand Collapse

DatasetListResponse = array of object { isPublic, name, uuid, deletedAt }

isPublic: boolean

name: string

uuid: string

deletedAt: optional string

DatasetGetResponse object { isPublic, name, uuid, deletedAt }

isPublic: boolean

name: string

uuid: string

deletedAt: optional string

DatasetCreateResponse object { isPublic, name, uuid, deletedAt }

isPublic: boolean

name: string

uuid: string

deletedAt: optional string

DatasetEditResponse object { isPublic, name, uuid, deletedAt }

isPublic: boolean

name: string

uuid: string

deletedAt: optional string

DatasetDeleteResponse object { name, uuid }

name: string

uuid: string

DatasetRawResponse object { id, accountId, created, 3 more }

id: number

accountId: number

created: string

data: string

source: string

tlp: string

Threat EventsDatasetsHealth

Threat EventsDatasetsEvents

Reads an event

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}

ModelsExpand Collapse

EventGetResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

Threat EventsIndicator Types

Lists all indicator types

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/indicatorTypes

ModelsExpand Collapse

IndicatorTypeListResponse object { items, type }

items: object { type }

type: string

type: string

Threat EventsRaw

Reads data for a raw event

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

Updates a raw event

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

ModelsExpand Collapse

RawGetResponse object { id, accountId, created, 3 more }

id: string

accountId: number

created: string

data: unknown

source: string

tlp: string

RawEditResponse object { id, data }

id: string

data: unknown

Threat EventsRelate

Removes an event reference

DELETE/accounts/{account_id}/cloudforce-one/events/relate/{event_id}

ModelsExpand Collapse

RelateDeleteResponse object { success }

success: boolean

Threat EventsTags

Lists all tags (SoT)

GET/accounts/{account_id}/cloudforce-one/events/tags

Creates a new tag

POST/accounts/{account_id}/cloudforce-one/events/tags/create

Updates a tag (SoT)

PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

Deletes a tag (SoT)

DELETE/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

ModelsExpand Collapse

TagListResponse object { pagination, tags }

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

tags: array of object { uuid, value, activeDuration, 25 more }

uuid: string

value: string

activeDuration: optional string

actorCategory: optional string

actorCategoryConfidence: optional number

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "green" or "white"

One of the following:

"red"

"amber"

"green"

"white"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

analyticPriority: optional number

attributionConfidence: optional string

attributionConfidenceScore: optional number

maximum10

minimum1

attributionOrganization: optional string

categoryName: optional string

categoryUuid: optional string

dateOfDiscovery: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

internalAliases: optional array of object { value, confidence, tlp }

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "green" or "white"

One of the following:

"red"

"amber"

"green"

"white"

internalDescription: optional string

motive: optional string

motiveConfidence: optional number

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

opsecLevel: optional string

originCountryConfidence: optional number

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

originCountryISO: optional string

originCountryISOAlpha3: optional string

originCountryTlp: optional "red" or "amber" or "green" or "white"

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:

"red"

"amber"

"green"

"white"

priority: optional number

sophisticationLevel: optional string

TagCreateResponse object { uuid, value, activeDuration, 25 more }

uuid: string

value: string

activeDuration: optional string

actorCategory: optional string

actorCategoryConfidence: optional number

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "green" or "white"

One of the following:

"red"

"amber"

"green"

"white"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

analyticPriority: optional number

attributionConfidence: optional string

attributionConfidenceScore: optional number

maximum10

minimum1

attributionOrganization: optional string

categoryName: optional string

categoryUuid: optional string

dateOfDiscovery: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

internalAliases: optional array of object { value, confidence, tlp }

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "green" or "white"

One of the following:

"red"

"amber"

"green"

"white"

internalDescription: optional string

motive: optional string

motiveConfidence: optional number

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

opsecLevel: optional string

originCountryConfidence: optional number

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

originCountryISO: optional string

originCountryISOAlpha3: optional string

originCountryTlp: optional "red" or "amber" or "green" or "white"

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:

"red"

"amber"

"green"

"white"

priority: optional number

sophisticationLevel: optional string

TagEditResponse object { uuid, value, activeDuration, 25 more }

uuid: string

value: string

activeDuration: optional string

actorCategory: optional string

actorCategoryConfidence: optional number

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "green" or "white"

One of the following:

"red"

"amber"

"green"

"white"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

analyticPriority: optional number

attributionConfidence: optional string

attributionConfidenceScore: optional number

maximum10

minimum1

attributionOrganization: optional string

categoryName: optional string

categoryUuid: optional string

dateOfDiscovery: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

internalAliases: optional array of object { value, confidence, tlp }

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "green" or "white"

One of the following:

"red"

"amber"

"green"

"white"

internalDescription: optional string

motive: optional string

motiveConfidence: optional number

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

opsecLevel: optional string

originCountryConfidence: optional number

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

originCountryISO: optional string

originCountryISOAlpha3: optional string

originCountryTlp: optional "red" or "amber" or "green" or "white"

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:

"red"

"amber"

"green"

"white"

priority: optional number

sophisticationLevel: optional string

TagDeleteResponse object { uuid }

uuid: string

Threat EventsTagsCategories

Lists all tag categories (SoT)

GET/accounts/{account_id}/cloudforce-one/events/tags/categories

Creates a new tag category (SoT)

POST/accounts/{account_id}/cloudforce-one/events/tags/categories/create

Updates a tag category (SoT)

PATCH/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

Deletes a tag category (SoT)

DELETE/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

ModelsExpand Collapse

CategoryListResponse object { categories }

categories: array of object { name, uuid, createdAt, 2 more }

name: string

uuid: string

createdAt: optional string

description: optional string

updatedAt: optional string

CategoryCreateResponse object { name, uuid, createdAt, 2 more }

name: string

uuid: string

createdAt: optional string

description: optional string

updatedAt: optional string

CategoryEditResponse object { name, uuid, createdAt, 2 more }

name: string

uuid: string

createdAt: optional string

description: optional string

updatedAt: optional string

CategoryDeleteResponse object { uuid }

uuid: string

Threat EventsTagsIndicators

List indicators related to a tag

GET/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators

ModelsExpand Collapse

IndicatorListResponse object { indicators, pagination }

indicators: array of object { createdAt, indicatorType, updatedAt, 5 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId }

datasetId: string

eventId: string

tags: optional array of object { categoryName, uuid, value }

categoryName: optional string

uuid: optional string

value: optional string

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

Threat EventsTagsIndicatorsBy Dataset

List indicators related to a tag within a dataset (deprecated)

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators

ModelsExpand Collapse

ByDatasetListResponse object { indicators, pagination }

indicators: array of object { createdAt, indicatorType, updatedAt, 5 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId }

datasetId: string

eventId: string

tags: optional array of object { categoryName, uuid, value }

categoryName: optional string

uuid: optional string

value: optional string

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

Threat EventsEvent Tags

Adds a tag to an event

POST/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create

Removes a tag from an event

DELETE/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}

ModelsExpand Collapse

EventTagCreateResponse object { success }

success: boolean

EventTagDeleteResponse object { success }

success: boolean

Threat EventsTarget Industries

Lists target industries across multiple datasets

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries

ModelsExpand Collapse

TargetIndustryListResponse object { items, type }

items: object { type }

type: string

type: string

Threat EventsTarget IndustriesBy Dataset

Lists all target industries for a specific dataset

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries

ModelsExpand Collapse

ByDatasetListResponse object { items, type }

items: object { type }

type: string

type: string

Threat EventsTarget IndustriesCatalog

Lists all target industries from industry map catalog

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog

ModelsExpand Collapse

CatalogListResponse object { items, type }

items: object { type }

type: string

type: string

Threat EventsInsights