Creates bulk DOS event with relationships and indicators

POST/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships

This method is deprecated. Please use event_create_bulk instead

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

Accepted Permissions (at least one required)

Cloudforce One WriteCloudforce One Read

Path ParametersExpand Collapse

account_id: string

Account ID.

Body ParametersJSONExpand Collapse

data: array of object { category, date, event, 13 more }

category: string

date: string

formatdate-time

event: string

raw: object { data, source, tlp }

data: map[unknown]

source: optional string

tlp: optional string

tlp: string

accountId: optional number

attacker: optional string

attackerCountry: optional string

datasetId: optional string

indicator: optional string

indicators: optional array of object { indicatorType, value }

Array of indicators for this event. Supports multiple indicators per event for complex scenarios.

indicatorType: string

The type of indicator (e.g., DOMAIN, IP, JA3, HASH)

value: string

The indicator value (e.g., domain name, IP address, hash)

indicatorType: optional string

insight: optional string

tags: optional array of string

targetCountry: optional string

targetIndustry: optional string

datasetId: string

ReturnsExpand Collapse

createdEventsCount: number

Number of events created

createdIndicatorsCount: number

Number of indicators created

createdRelationshipsCount: number

Number of relationships created

errorCount: number

Number of errors encountered

errors: optional array of object { error, eventIndex }

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

Creates bulk DOS event with relationships and indicators

curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/cloudforce-one/events/create/bulk/relationships \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
    -d '{
          "data": [
            {
              "category": "Domain Resolution",
              "date": "2022-04-01T00:00:00Z",
              "event": "An attacker registered the domain domain.com",
              "raw": {
                "data": {
                  "foo": "bar"
                }
              },
              "tlp": "amber"
            }
          ],
          "datasetId": "durableObjectName"
        }'

{
  "createdEventsCount": 0,
  "createdIndicatorsCount": 0,
  "createdRelationshipsCount": 0,
  "errorCount": 0,
  "errors": [
    {
      "error": "error",
      "eventIndex": 0
    }
  ]
}

Returns Examples

{
  "createdEventsCount": 0,
  "createdIndicatorsCount": 0,
  "createdRelationshipsCount": 0,
  "errorCount": 0,
  "errors": [
    {
      "error": "error",
      "eventIndex": 0
    }
  ]
}