Filter and list events related to specific event

client.cloudforceOne.threatEvents.relationships.list(, , ?): RelationshipListResponse { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships

The event_id must be defined (to list existing events (and their IDs), use the Filter and List Events endpoint). Also, must provide query parameters.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

Accepted Permissions (at least one required)

Cloudforce One WriteCloudforce One Read

ParametersExpand Collapse

eventID: string

Event UUID.

params: RelationshipListParams { account_id, datasetId, direction, 6 more }

account_id: string

Path param: Account ID.

datasetId: string

Query param: The dataset ID to search within.

direction?: "ancestors" | "descendants" | "both"

Query param: The direction to traverse the graph. Defaults to ‘both’ to search all.

One of the following:

"ancestors"

"descendants"

"both"

includeParent?: boolean

Query param: Whether to include the starting event in the results. Defaults to true.

indicatorTypeIds?: Array<string>

Query param: An optional array of indicator type IDs to filter the results by.

maxDepth?: number

Query param: The maximum depth to traverse. Defaults to 5.

page?: number

Query param

pageSize?: number

Query param

relationshipTypes?: string | Array<string>

Query param: An optional array of relationship types to filter by.

One of the following:

string

Array<string>

ReturnsExpand Collapse

RelationshipListResponse = Array<RelationshipListResponseItem>

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: Array<string>

mitreCapec: Array<string>

numReferenced: number

numReferences: number

rawId: string

referenced: Array<string>

referencedIds: Array<number>

references: Array<string>

referencesIds: Array<number>

tags: Array<string>

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight?: string

releasabilityId?: string

Filter and list events related to specific event

import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const relationships = await client.cloudforceOne.threatEvents.relationships.list('event_id', {
  account_id: 'account_id',
  datasetId: 'datasetId',
});

console.log(relationships);

[
  {
    "attacker": "Flying Yeti",
    "attackerCountry": "CN",
    "attackerCountryAlpha3": "CHN",
    "category": "Domain Resolution",
    "datasetId": "dataset-example-id",
    "date": "2022-04-01T00:00:00Z",
    "event": "An attacker registered the domain domain.com",
    "hasChildren": true,
    "indicator": "domain.com",
    "indicatorType": "domain",
    "indicatorTypeId": 5,
    "killChain": 0,
    "mitreAttack": [
      " "
    ],
    "mitreCapec": [
      " "
    ],
    "numReferenced": 0,
    "numReferences": 0,
    "rawId": "453gw34w3",
    "referenced": [
      " "
    ],
    "referencedIds": [
      0
    ],
    "references": [
      " "
    ],
    "referencesIds": [
      0
    ],
    "tags": [
      "malware"
    ],
    "targetCountry": "US",
    "targetCountryAlpha3": "USA",
    "targetIndustry": "Agriculture",
    "tlp": "amber",
    "uuid": "12345678-1234-1234-1234-1234567890ab",
    "insight": "insight",
    "releasabilityId": "releasabilityId"
  }
]

Returns Examples

[
  {
    "attacker": "Flying Yeti",
    "attackerCountry": "CN",
    "attackerCountryAlpha3": "CHN",
    "category": "Domain Resolution",
    "datasetId": "dataset-example-id",
    "date": "2022-04-01T00:00:00Z",
    "event": "An attacker registered the domain domain.com",
    "hasChildren": true,
    "indicator": "domain.com",
    "indicatorType": "domain",
    "indicatorTypeId": 5,
    "killChain": 0,
    "mitreAttack": [
      " "
    ],
    "mitreCapec": [
      " "
    ],
    "numReferenced": 0,
    "numReferences": 0,
    "rawId": "453gw34w3",
    "referenced": [
      " "
    ],
    "referencedIds": [
      0
    ],
    "references": [
      " "
    ],
    "referencesIds": [
      0
    ],
    "tags": [
      "malware"
    ],
    "targetCountry": "US",
    "targetCountryAlpha3": "USA",
    "targetIndustry": "Agriculture",
    "tlp": "amber",
    "uuid": "12345678-1234-1234-1234-1234567890ab",
    "insight": "insight",
    "releasabilityId": "releasabilityId"
  }
]