API Reference

Cloudforce One

Threat Events

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Datasets

Lists all datasets in an account

GET/accounts/{account_id}/cloudforce-one/events/dataset

Reads a dataset

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Creates a dataset

POST/accounts/{account_id}/cloudforce-one/events/dataset/create

Updates an existing dataset

PATCH/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Delete a dataset

DELETE/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Reads raw data for an event by UUID

GET/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}

ModelsExpand Collapse

DatasetListResponse = array of object { indicatorWriteMode, isAnalytics, isPublic, 3 more }

indicatorWriteMode: "read_only" or "create_only" or "full"

Effective indicator mutation capability after account/dataset authorization and dataset storage capability are applied. API Gateway method permissions are separate and must also allow the requested operation.

One of the following:

"read_only"

"create_only"

"full"

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

deletedAt: optional string

DatasetGetResponse object { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

DatasetCreateResponse object { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

DatasetEditResponse object { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

DatasetDeleteResponse object { name, uuid }

name: string

uuid: string

DatasetRawResponse object { id, accountId, created, 3 more }

id: number

accountId: number

created: string

data: string

source: string

tlp: string

DatasetsHealth

DatasetsEvents

Reads an event

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}

ModelsExpand Collapse

EventGetResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string