Datasets

List datasets

GET/accounts/{account_id}/cloudforce-one/events/dataset

Get a dataset

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Create a dataset

POST/accounts/{account_id}/cloudforce-one/events/dataset/create

Update a dataset

PATCH/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Delete a dataset

DELETE/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Get raw data for an event (legacy)

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}

ModelsExpand Collapse

DatasetListResponse = array of object { indicatorWriteMode, isAnalytics, isPublic, 3 more }

indicatorWriteMode: "read_only" or "create_only" or "full"

Effective indicator mutation capability after account/dataset authorization and dataset storage capability are applied. API Gateway method permissions are separate and must also allow the requested operation.

One of the following:

"read_only"

"create_only"

"full"

isAnalytics: boolean

isPublic: boolean

uuid: string

deletedAt: optional string

DatasetGetResponse object { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

uuid: string

DatasetCreateResponse object { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

uuid: string

DatasetEditResponse object { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

uuid: string

DatasetDeleteResponse object { name, uuid }

uuid: string

DatasetRawResponse object { id, accountId, created, 3 more }

id: number

accountId: number

created: string

data: string

source: string

tlp: string

DatasetsHealth

DatasetsEvents

Get an event

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}

ModelsExpand Collapse

EventGetResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string