API Reference

Cloudforce One

Threat Events

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Datasets

Lists all datasets in an account

client.cloudforceOne.threatEvents.datasets.list(DatasetListParams { account_id, includeDeleted } params, RequestOptionsoptions?): DatasetListResponse { indicatorWriteMode, isAnalytics, isPublic, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/dataset

Reads a dataset

client.cloudforceOne.threatEvents.datasets.get(stringdatasetID, DatasetGetParams { account_id } params, RequestOptionsoptions?): DatasetGetResponse { isAnalytics, isPublic, name, uuid }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Creates a dataset

client.cloudforceOne.threatEvents.datasets.create(DatasetCreateParams { account_id, isPublic, name } params, RequestOptionsoptions?): DatasetCreateResponse { isAnalytics, isPublic, name, uuid }

POST/accounts/{account_id}/cloudforce-one/events/dataset/create

Updates an existing dataset

client.cloudforceOne.threatEvents.datasets.edit(stringdatasetID, DatasetEditParams { account_id, isPublic, name } params, RequestOptionsoptions?): DatasetEditResponse { isAnalytics, isPublic, name, uuid }

PATCH/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Delete a dataset

client.cloudforceOne.threatEvents.datasets.delete(stringdatasetID, DatasetDeleteParams { account_id } params, RequestOptionsoptions?): DatasetDeleteResponse { name, uuid }

DELETE/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Reads raw data for an event by UUID

Deprecated

client.cloudforceOne.threatEvents.datasets.raw(stringeventID, DatasetRawParams { account_id, dataset_id } params, RequestOptionsoptions?): DatasetRawResponse { id, accountId, created, 3 more }

GET/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}

ModelsExpand Collapse

DatasetListResponse = Array<DatasetListResponseItem>

indicatorWriteMode: "read_only" | "create_only" | "full"

Effective indicator mutation capability after account/dataset authorization and dataset storage capability are applied. API Gateway method permissions are separate and must also allow the requested operation.

One of the following:

"read_only"

"create_only"

"full"

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

deletedAt?: string

DatasetGetResponse { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

DatasetCreateResponse { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

DatasetEditResponse { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

name: string

uuid: string

DatasetDeleteResponse { name, uuid }

name: string

uuid: string

DatasetRawResponse { id, accountId, created, 3 more }

id: number

accountId: number

created: string

data: string

source: string

tlp: string

DatasetsHealth

DatasetsEvents

Reads an event

client.cloudforceOne.threatEvents.datasets.events.get(stringeventID, EventGetParams { account_id, dataset_id } params, RequestOptionsoptions?): EventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}

ModelsExpand Collapse

EventGetResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string