Skip to content
Cloudflare API
Start here
API Reference
Cloudforce One
Threat Events

Tags

Lists all tags (SoT)
client.cloudforceOne.threatEvents.tags.list(TagListParams { account_id, cache, categoryUuid, 4 more } params, RequestOptionsoptions?): TagListResponse { pagination, tags }
GET/accounts/{account_id}/cloudforce-one/events/tags
Creates a new tag
client.cloudforceOne.threatEvents.tags.create(TagCreateParams { account_id, value, activeDuration, 21 more } params, RequestOptionsoptions?): TagCreateResponse { uuid, value, activeDuration, 34 more }
POST/accounts/{account_id}/cloudforce-one/events/tags/create
Updates a tag (SoT)
client.cloudforceOne.threatEvents.tags.edit(stringtagUUID, TagEditParams { account_id, activeDuration, actorCategory, 21 more } params, RequestOptionsoptions?): TagEditResponse { uuid, value, activeDuration, 34 more }
PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}
Deletes a tag (SoT)
client.cloudforceOne.threatEvents.tags.delete(stringtagUUID, TagDeleteParams { account_id } params, RequestOptionsoptions?): TagDeleteResponse { uuid }
DELETE/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}
ModelsExpand Collapse
TagListResponse { pagination, tags }
tags: Array<Tag>
uuid: string
value: string
activeDuration?: string
activeDuration_annotated?: ActiveDurationAnnotated | null
value: string
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
actorCategory?: string
actorCategory_annotated?: ActorCategoryAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more | null
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
aliasGroupNames?: Array<string>
aliasGroupNamesInternal?: Array<string>
attributionOrganization?: string
attributionOrganization_annotated?: AttributionOrganizationAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
categoryName?: string
categoryUuid?: string
confidence?: number | null

Overall tag confidence (1-10).

maximum10
minimum1
createdAt?: string
dateOfDiscovery?: string
description?: string
externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string
description?: string | null
externalReferences_annotated?: Array<ExternalReferencesAnnotated> | null
value: string
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
internalAliases?: Array<InternalAlias>

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more | null
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
internalDescription?: string
lastSeen?: string
motive?: string
motive_annotated?: MotiveAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
opsecLevel?: string
opsecLevel_annotated?: OpsecLevelAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
originCountryISO?: string | null

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated?: OriginCountryISOAnnotated | null
value: string | null
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
priority?: number
priority_annotated?: PriorityAnnotated | null
value: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
properties?: Record<string, unknown> | null

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel?: string
sophisticationLevel_annotated?: SophisticationLevelAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
tlp?: "red" | "amber" | "amber-strict" | 4 more | null

Tag-level TLP handling marking.

One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
updatedAt?: string
version?: number
TagCreateResponse { uuid, value, activeDuration, 34 more }
uuid: string
value: string
activeDuration?: string
activeDuration_annotated?: ActiveDurationAnnotated | null
value: string
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
actorCategory?: string
actorCategory_annotated?: ActorCategoryAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more | null
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
aliasGroupNames?: Array<string>
aliasGroupNamesInternal?: Array<string>
attributionOrganization?: string
attributionOrganization_annotated?: AttributionOrganizationAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
categoryName?: string
categoryUuid?: string
confidence?: number | null

Overall tag confidence (1-10).

maximum10
minimum1
createdAt?: string
dateOfDiscovery?: string
description?: string
externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string
description?: string | null
externalReferences_annotated?: Array<ExternalReferencesAnnotated> | null
value: string
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
internalAliases?: Array<InternalAlias>

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more | null
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
internalDescription?: string
lastSeen?: string
motive?: string
motive_annotated?: MotiveAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
opsecLevel?: string
opsecLevel_annotated?: OpsecLevelAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
originCountryISO?: string | null

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated?: OriginCountryISOAnnotated | null
value: string | null
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
priority?: number
priority_annotated?: PriorityAnnotated | null
value: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
properties?: Record<string, unknown> | null

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel?: string
sophisticationLevel_annotated?: SophisticationLevelAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
tlp?: "red" | "amber" | "amber-strict" | 4 more | null

Tag-level TLP handling marking.

One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
updatedAt?: string
version?: number
TagEditResponse { uuid, value, activeDuration, 34 more }
uuid: string
value: string
activeDuration?: string
activeDuration_annotated?: ActiveDurationAnnotated | null
value: string
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
actorCategory?: string
actorCategory_annotated?: ActorCategoryAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more | null
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
aliasGroupNames?: Array<string>
aliasGroupNamesInternal?: Array<string>
attributionOrganization?: string
attributionOrganization_annotated?: AttributionOrganizationAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
categoryName?: string
categoryUuid?: string
confidence?: number | null

Overall tag confidence (1-10).

maximum10
minimum1
createdAt?: string
dateOfDiscovery?: string
description?: string
externalReferences?: Array<ExternalReference>

Structured external references ({ url, description }). Public: returned to all accounts.

url: string
description?: string | null
externalReferences_annotated?: Array<ExternalReferencesAnnotated> | null
value: string
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
internalAliases?: Array<InternalAlias>

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "amber-strict" | 4 more | null
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
internalDescription?: string
lastSeen?: string
motive?: string
motive_annotated?: MotiveAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
opsecLevel?: string
opsecLevel_annotated?: OpsecLevelAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
originCountryISO?: string | null

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated?: OriginCountryISOAnnotated | null
value: string | null
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
priority?: number
priority_annotated?: PriorityAnnotated | null
value: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
properties?: Record<string, unknown> | null

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel?: string
sophisticationLevel_annotated?: SophisticationLevelAnnotated | null
value: string
confidence?: number
tlp?: "red" | "amber" | "amber-strict" | 4 more
One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
tlp?: "red" | "amber" | "amber-strict" | 4 more | null

Tag-level TLP handling marking.

One of the following:
"red"
"amber"
"amber-strict"
"green"
"clear"
"purple"
"amber+strict"
updatedAt?: string
version?: number
TagDeleteResponse { uuid }
uuid: string

TagsCategories

Lists all tag categories (SoT)
client.cloudforceOne.threatEvents.tags.categories.list(CategoryListParams { account_id, search } params, RequestOptionsoptions?): CategoryListResponse { categories }
GET/accounts/{account_id}/cloudforce-one/events/tags/categories
Creates a new tag category (SoT)
client.cloudforceOne.threatEvents.tags.categories.create(CategoryCreateParams { account_id, name, description, schema } params, RequestOptionsoptions?): CategoryCreateResponse { name, uuid, createdAt, 3 more }
POST/accounts/{account_id}/cloudforce-one/events/tags/categories/create
Updates a tag category (SoT)
client.cloudforceOne.threatEvents.tags.categories.edit(stringcategoryUUID, CategoryEditParams { account_id, description, name, schema } params, RequestOptionsoptions?): CategoryEditResponse { name, uuid, createdAt, 3 more }
PATCH/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}
Deletes a tag category (SoT)
client.cloudforceOne.threatEvents.tags.categories.delete(stringcategoryUUID, CategoryDeleteParams { account_id } params, RequestOptionsoptions?): CategoryDeleteResponse { uuid }
DELETE/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}
ModelsExpand Collapse
CategoryListResponse { categories }
categories: Array<Category>
name: string
uuid: string
createdAt?: string
description?: string
schema?: Array<Schema> | null

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string
kind: "string" | "number" | "enum" | 3 more
One of the following:
"string"
"number"
"enum"
"date"
"array"
"object"
allowedValues?: Array<string>
annotations?: Annotations { confidence, tlp }
confidence?: boolean
tlp?: boolean
element?: unknown
enforcement?: "error" | "warn" | "off"
One of the following:
"error"
"warn"
"off"
format?: "date" | "url" | "duration" | "country"
One of the following:
"date"
"url"
"duration"
"country"
label?: string
maxLength128
minLength1
maxLength?: number
exclusiveMinimum
minimum0
numberConstraint?: NumberConstraint { integer, max, min }
integer?: boolean
max?: number
min?: number
properties?: Record<string, unknown>

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required?: boolean
updatedAt?: string
CategoryCreateResponse { name, uuid, createdAt, 3 more }
name: string
uuid: string
createdAt?: string
description?: string
schema?: Array<Schema> | null

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string
kind: "string" | "number" | "enum" | 3 more
One of the following:
"string"
"number"
"enum"
"date"
"array"
"object"
allowedValues?: Array<string>
annotations?: Annotations { confidence, tlp }
confidence?: boolean
tlp?: boolean
element?: unknown
enforcement?: "error" | "warn" | "off"
One of the following:
"error"
"warn"
"off"
format?: "date" | "url" | "duration" | "country"
One of the following:
"date"
"url"
"duration"
"country"
label?: string
maxLength128
minLength1
maxLength?: number
exclusiveMinimum
minimum0
numberConstraint?: NumberConstraint { integer, max, min }
integer?: boolean
max?: number
min?: number
properties?: Record<string, unknown>

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required?: boolean
updatedAt?: string
CategoryEditResponse { name, uuid, createdAt, 3 more }
name: string
uuid: string
createdAt?: string
description?: string
schema?: Array<Schema> | null

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string
kind: "string" | "number" | "enum" | 3 more
One of the following:
"string"
"number"
"enum"
"date"
"array"
"object"
allowedValues?: Array<string>
annotations?: Annotations { confidence, tlp }
confidence?: boolean
tlp?: boolean
element?: unknown
enforcement?: "error" | "warn" | "off"
One of the following:
"error"
"warn"
"off"
format?: "date" | "url" | "duration" | "country"
One of the following:
"date"
"url"
"duration"
"country"
label?: string
maxLength128
minLength1
maxLength?: number
exclusiveMinimum
minimum0
numberConstraint?: NumberConstraint { integer, max, min }
integer?: boolean
max?: number
min?: number
properties?: Record<string, unknown>

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required?: boolean
updatedAt?: string
CategoryDeleteResponse { uuid }
uuid: string

TagsIndicators

List indicators related to a tag
client.cloudforceOne.threatEvents.tags.indicators.list(stringtagUUID, IndicatorListParams { account_id, datasetIds, indicatorType, 4 more } params, RequestOptionsoptions?): IndicatorListResponse { indicators, pagination }
GET/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators
ModelsExpand Collapse
IndicatorListResponse { indicators, pagination }
indicators: Array<Indicator>
createdAt: string
formatdate-time
indicatorType: string
updatedAt: string
formatdate-time
uuid: string
value: string
datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>
datasetId: string
eventId: string
eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags?: Array<Tag>
categoryId?: string | null

The UUID of the tag category, or null when the tag is uncategorized.

categoryName?: string
uuid?: string
value?: string
tlp?: string | null

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

TagsIndicatorsBy Dataset

List indicators related to a tag within a dataset (deprecated)
Deprecated
client.cloudforceOne.threatEvents.tags.indicators.byDataset.list(stringtagUUID, ByDatasetListParams { account_id, dataset_id, indicatorType, 4 more } params, RequestOptionsoptions?): ByDatasetListResponse { indicators, pagination }
GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators
ModelsExpand Collapse
ByDatasetListResponse { indicators, pagination }
indicators: Array<Indicator>
createdAt: string
formatdate-time
indicatorType: string
updatedAt: string
formatdate-time
uuid: string
value: string
datasetId?: string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents?: Array<RelatedEvent>
datasetId: string
eventId: string
eventDate?: string | null

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags?: Array<Tag>
categoryId?: string | null

The UUID of the tag category, or null when the tag is uncategorized.

categoryName?: string
uuid?: string
value?: string
tlp?: string | null

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.