API Reference

Cloudforce One

Threat Events

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Tags

Lists all tags (SoT)

GET/accounts/{account_id}/cloudforce-one/events/tags

Creates a new tag

POST/accounts/{account_id}/cloudforce-one/events/tags/create

Updates a tag (SoT)

PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

Deletes a tag (SoT)

DELETE/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

ModelsExpand Collapse

TagListResponse object { pagination, tags }

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

tags: array of object { uuid, value, activeDuration, 34 more }

uuid: string

value: string

activeDuration: optional string

activeDuration_annotated: optional object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory: optional string

actorCategory_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

attributionOrganization: optional string

attributionOrganization_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName: optional string

categoryUuid: optional string

confidence: optional number

Overall tag confidence (1-10).

maximum10

minimum1

createdAt: optional string

dateOfDiscovery: optional string

description: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

externalReferences_annotated: optional array of object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases: optional array of object { value, confidence, tlp }

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription: optional string

lastSeen: optional string

motive: optional string

motive_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel: optional string

opsecLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO: optional string

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority: optional number

priority_annotated: optional object { value, tlp }

value: number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties: optional map[unknown]

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel: optional string

sophisticationLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp: optional "red" or "amber" or "amber-strict" or 4 more

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt: optional string

version: optional number

TagCreateResponse object { uuid, value, activeDuration, 34 more }

uuid: string

value: string

activeDuration: optional string

activeDuration_annotated: optional object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory: optional string

actorCategory_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

attributionOrganization: optional string

attributionOrganization_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName: optional string

categoryUuid: optional string

confidence: optional number

Overall tag confidence (1-10).

maximum10

minimum1

createdAt: optional string

dateOfDiscovery: optional string

description: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

externalReferences_annotated: optional array of object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases: optional array of object { value, confidence, tlp }

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription: optional string

lastSeen: optional string

motive: optional string

motive_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel: optional string

opsecLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO: optional string

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority: optional number

priority_annotated: optional object { value, tlp }

value: number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties: optional map[unknown]

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel: optional string

sophisticationLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp: optional "red" or "amber" or "amber-strict" or 4 more

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt: optional string

version: optional number

TagEditResponse object { uuid, value, activeDuration, 34 more }

uuid: string

value: string

activeDuration: optional string

activeDuration_annotated: optional object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory: optional string

actorCategory_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

attributionOrganization: optional string

attributionOrganization_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName: optional string

categoryUuid: optional string

confidence: optional number

Overall tag confidence (1-10).

maximum10

minimum1

createdAt: optional string

dateOfDiscovery: optional string

description: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

externalReferences_annotated: optional array of object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases: optional array of object { value, confidence, tlp }

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription: optional string

lastSeen: optional string

motive: optional string

motive_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel: optional string

opsecLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO: optional string

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority: optional number

priority_annotated: optional object { value, tlp }

value: number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties: optional map[unknown]

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel: optional string

sophisticationLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp: optional "red" or "amber" or "amber-strict" or 4 more

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt: optional string

version: optional number

TagDeleteResponse object { uuid }

uuid: string

TagsCategories

Lists all tag categories (SoT)

GET/accounts/{account_id}/cloudforce-one/events/tags/categories

Creates a new tag category (SoT)

POST/accounts/{account_id}/cloudforce-one/events/tags/categories/create

Updates a tag category (SoT)

PATCH/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

Deletes a tag category (SoT)

DELETE/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

ModelsExpand Collapse

CategoryListResponse object { categories }

categories: array of object { name, uuid, createdAt, 3 more }

name: string

uuid: string

createdAt: optional string

description: optional string

schema: optional array of object { key, kind, allowedValues, 9 more }

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string

kind: "string" or "number" or "enum" or 3 more

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowedValues: optional array of string

annotations: optional object { confidence, tlp }

confidence: optional boolean

tlp: optional boolean

element: optional unknown

enforcement: optional "error" or "warn" or "off"

One of the following:

"error"

"warn"

"off"

format: optional "date" or "url" or "duration" or "country"

One of the following:

"date"

"url"

"duration"

"country"

label: optional string

maxLength128

minLength1

maxLength: optional number

exclusiveMinimum

minimum0

numberConstraint: optional object { integer, max, min }

integer: optional boolean

max: optional number

min: optional number

properties: optional map[unknown]

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required: optional boolean

updatedAt: optional string

CategoryCreateResponse object { name, uuid, createdAt, 3 more }

name: string

uuid: string

createdAt: optional string

description: optional string

schema: optional array of object { key, kind, allowedValues, 9 more }

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string

kind: "string" or "number" or "enum" or 3 more

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowedValues: optional array of string

annotations: optional object { confidence, tlp }

confidence: optional boolean

tlp: optional boolean

element: optional unknown

enforcement: optional "error" or "warn" or "off"

One of the following:

"error"

"warn"

"off"

format: optional "date" or "url" or "duration" or "country"

One of the following:

"date"

"url"

"duration"

"country"

label: optional string

maxLength128

minLength1

maxLength: optional number

exclusiveMinimum

minimum0

numberConstraint: optional object { integer, max, min }

integer: optional boolean

max: optional number

min: optional number

properties: optional map[unknown]

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required: optional boolean

updatedAt: optional string

CategoryEditResponse object { name, uuid, createdAt, 3 more }

name: string

uuid: string

createdAt: optional string

description: optional string

schema: optional array of object { key, kind, allowedValues, 9 more }

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string

kind: "string" or "number" or "enum" or 3 more

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowedValues: optional array of string

annotations: optional object { confidence, tlp }

confidence: optional boolean

tlp: optional boolean

element: optional unknown

enforcement: optional "error" or "warn" or "off"

One of the following:

"error"

"warn"

"off"

format: optional "date" or "url" or "duration" or "country"

One of the following:

"date"

"url"

"duration"

"country"

label: optional string

maxLength128

minLength1

maxLength: optional number

exclusiveMinimum

minimum0

numberConstraint: optional object { integer, max, min }

integer: optional boolean

max: optional number

min: optional number

properties: optional map[unknown]

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required: optional boolean

updatedAt: optional string

CategoryDeleteResponse object { uuid }

uuid: string

TagsIndicators

List indicators related to a tag

GET/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators

ModelsExpand Collapse

IndicatorListResponse object { indicators, pagination }

indicators: array of object { createdAt, indicatorType, updatedAt, 6 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags: optional array of object { categoryId, categoryName, uuid, value }

categoryId: optional string

The UUID of the tag category, or null when the tag is uncategorized.

categoryName: optional string

uuid: optional string

value: optional string

tlp: optional string

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

TagsIndicatorsBy Dataset

List indicators related to a tag within a dataset (deprecated)

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators

ModelsExpand Collapse

ByDatasetListResponse object { indicators, pagination }

indicators: array of object { createdAt, indicatorType, updatedAt, 6 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags: optional array of object { categoryId, categoryName, uuid, value }

categoryId: optional string

The UUID of the tag category, or null when the tag is uncategorized.

categoryName: optional string

uuid: optional string

value: optional string

tlp: optional string

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number