Cloudforce One

Cloudforce OneScans

Cloudforce OneScansResults

Get the Latest Scan Result

GET/accounts/{account_id}/cloudforce-one/scans/results/{config_id}

ModelsExpand Collapse

ScanResult object { number, proto, status }

number: optional number

proto: optional string

status: optional string

ResultGetResponse object { "1.1.1.1" }

"1.1.1.1": array of ScanResult { number, proto, status }

number: optional number

proto: optional string

status: optional string

Cloudforce OneScansConfig

List Scan Configs

GET/accounts/{account_id}/cloudforce-one/scans/config

Create a new Scan Config

POST/accounts/{account_id}/cloudforce-one/scans/config

Update an existing Scan Config

PATCH/accounts/{account_id}/cloudforce-one/scans/config/{config_id}

Delete a Scan Config

DELETE/accounts/{account_id}/cloudforce-one/scans/config/{config_id}

ModelsExpand Collapse

ConfigListResponse object { id, account_id, frequency, 2 more }

id: string

Defines the Config ID.

account_id: string

frequency: number

Defines the number of days between each scan (0 = One-off scan).

ips: array of string

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: array of string

Defines a list of ports to scan. Valid values are:default, all, or a comma-separated list of ports or range of ports (e.g. [1-80, 443]). default scans the 100 most commonly open ports.

ConfigCreateResponse object { id, account_id, frequency, 2 more }

id: string

Defines the Config ID.

account_id: string

frequency: number

Defines the number of days between each scan (0 = One-off scan).

ips: array of string

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: array of string

Defines a list of ports to scan. Valid values are:default, all, or a comma-separated list of ports or range of ports (e.g. [1-80, 443]). default scans the 100 most commonly open ports.

ConfigEditResponse object { id, account_id, frequency, 2 more }

id: string

Defines the Config ID.

account_id: string

frequency: number

Defines the number of days between each scan (0 = One-off scan).

ips: array of string

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: array of string

Defines a list of ports to scan. Valid values are:default, all, or a comma-separated list of ports or range of ports (e.g. [1-80, 443]). default scans the 100 most commonly open ports.

ConfigDeleteResponse = unknown

Cloudforce OneBinary Storage

Retrieves a file from Binary Storage

GET/accounts/{account_id}/cloudforce-one/binary/{hash}

Posts a file to Binary Storage

POST/accounts/{account_id}/cloudforce-one/binary

ModelsExpand Collapse

BinaryStorageCreateResponse object { content_type, md5, sha1, sha256 }

content_type: string

md5: string

sha1: string

sha256: string

Cloudforce OneRequests

List Requests

POST/accounts/{account_id}/cloudforce-one/requests

Get a Request

GET/accounts/{account_id}/cloudforce-one/requests/{request_id}

Create a New Request.

POST/accounts/{account_id}/cloudforce-one/requests/new

Update a Request

PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}

Delete a Request

DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}

Get Request Quota

GET/accounts/{account_id}/cloudforce-one/requests/quota

Get Request Types

GET/accounts/{account_id}/cloudforce-one/requests/types

Get Request Priority, Status, and TLP constants

GET/accounts/{account_id}/cloudforce-one/requests/constants

ModelsExpand Collapse

Item object { id, content, created, 10 more }

id: string

UUID.

maxLength36

content: string

Request content.

created: string

formatdate-time

priority: string

formatdate-time

request: string

Requested information from request.

summary: string

Brief description of the request.

tlp: "clear" or "amber" or "amber-strict" or 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

updated: string

formatdate-time

completed: optional string

formatdate-time

message_tokens: optional number

Tokens for the request messages.

readable_id: optional string

Readable Request ID.

status: optional "open" or "accepted" or "reported" or 3 more

Request Status.

One of the following:

"open"

"accepted"

"reported"

"approved"

"completed"

"declined"

tokens: optional number

Tokens for the request.

ListItem object { id, created, priority, 9 more }

id: string

UUID.

maxLength36

created: string

Request creation time.

formatdate-time

priority: "routine" or "high" or "urgent"

One of the following:

"routine"

"high"

"urgent"

request: string

Requested information from request.

summary: string

Brief description of the request.

tlp: "clear" or "amber" or "amber-strict" or 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

updated: string

Request last updated time.

formatdate-time

completed: optional string

Request completion time.

formatdate-time

message_tokens: optional number

Tokens for the request messages.

readable_id: optional string

Readable Request ID.

status: optional "open" or "accepted" or "reported" or 3 more

Request Status.

One of the following:

"open"

"accepted"

"reported"

"approved"

"completed"

"declined"

tokens: optional number

Tokens for the request.

Quota object { anniversary_date, quarter_anniversary_date, quota, remaining }

anniversary_date: optional string

Anniversary date is when annual quota limit is refreshed.

formatdate-time

quarter_anniversary_date: optional string

Quarter anniversary date is when quota limit is refreshed each quarter.

formatdate-time

quota: optional number

Tokens for the quarter.

remaining: optional number

Tokens remaining for the quarter.

RequestConstants object { priority, status, tlp }

priority: optional array of "routine" or "high" or "urgent"

One of the following:

"routine"

"high"

"urgent"

status: optional array of "open" or "accepted" or "reported" or 3 more

One of the following:

"open"

"accepted"

"reported"

"approved"

"completed"

"declined"

tlp: optional array of "clear" or "amber" or "amber-strict" or 2 more

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

RequestTypes = array of string

RequestDeleteResponse object { errors, messages, success }

errors: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

messages: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

success: true

Whether the API call was successful.

RequestTypesResponse = string

Request Types.

Cloudforce OneRequestsMessage

List Request Messages

POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/message

Create a New Request Message

POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/new

Update a Request Message

PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}

Delete a Request Message

DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}

ModelsExpand Collapse

Message object { id, author, content, 3 more }

id: number

Message ID.

author: string

Author of message.

content: string

Content of message.

is_follow_on_request: boolean

Whether the message is a follow-on request.

updated: string

Defines the message last updated time.

formatdate-time

created: optional string

Defines the message creation time.

formatdate-time

MessageDeleteResponse object { errors, messages, success }

errors: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

messages: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

success: true

Whether the API call was successful.

Cloudforce OneRequestsPriority

Get a Priority Intelligence Requirement

GET/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}

Create a New Priority Intelligence Requirement

POST/accounts/{account_id}/cloudforce-one/requests/priority/new

Update a Priority Intelligence Requirement

PUT/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}

Delete a Priority Intelligence Requirement

DELETE/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}

Get Priority Intelligence Requirement Quota

GET/accounts/{account_id}/cloudforce-one/requests/priority/quota

ModelsExpand Collapse

Label = string

Priority object { id, created, labels, 4 more }

id: string

UUID.

maxLength36

created: string

Priority creation time.

formatdate-time

labels: array of Label

List of labels.

priority: number

Priority.

requirement: string

Requirement.

tlp: "clear" or "amber" or "amber-strict" or 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

updated: string

Priority last updated time.

formatdate-time

PriorityEdit object { labels, priority, requirement, tlp }

labels: array of Label

List of labels.

priority: number

Priority.

requirement: string

Requirement.

tlp: "clear" or "amber" or "amber-strict" or 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

PriorityDeleteResponse object { errors, messages, success }

errors: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

messages: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

success: true

Whether the API call was successful.

Cloudforce OneRequestsAssets

Get a Request Asset

GET/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}

List Request Assets

POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset

Update a Request Asset

PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}

Delete a Request Asset

DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}

ModelsExpand Collapse

AssetGetResponse object { id, name, created, 2 more }

id: number

Asset ID.

Asset name.

created: optional string

Defines the asset creation time.

formatdate-time

description: optional string

Asset description.

file_type: optional string

Asset file type.

AssetCreateResponse object { id, name, created, 2 more }

id: number

Asset ID.

Asset name.

created: optional string

Defines the asset creation time.

formatdate-time

description: optional string

Asset description.

file_type: optional string

Asset file type.

AssetUpdateResponse object { id, name, created, 2 more }

id: number

Asset ID.

Asset name.

created: optional string

Defines the asset creation time.

formatdate-time

description: optional string

Asset description.

file_type: optional string

Asset file type.

AssetDeleteResponse object { errors, messages, success }

errors: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

messages: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

success: true

Whether the API call was successful.

Cloudforce OneThreat Events

Filter and list events

GET/accounts/{account_id}/cloudforce-one/events

Reads an event

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/{event_id}

Creates a new event

POST/accounts/{account_id}/cloudforce-one/events/create

Updates an event

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}

Creates bulk events

POST/accounts/{account_id}/cloudforce-one/events/create/bulk

Creates bulk DOS event with relationships and indicators

Deprecated

POST/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships

ModelsExpand Collapse

ThreatEventListResponse = array of object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventGetResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventCreateResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventEditResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventBulkCreateResponse object { createdEventsCount, createdTagsCount, errorCount, 4 more }

Detailed result of bulk event creation with auto-tag management

createdEventsCount: number

Number of events created

createdTagsCount: number

Number of new tags created in SoT

errorCount: number

Number of errors encountered

queuedIndicatorsCount: number

Number of indicators queued for async processing

createBulkEventsRequestId: optional string

Correlation ID for async indicator processing

formatuuid

createdEvents: optional array of object { eventIndex, shardId, uuid }

Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true

eventIndex: number

Original index in the input data array

shardId: string

Dataset ID of the shard where the event was created

uuid: string

UUID of the created event

formatuuid

errors: optional array of object { error, eventIndex }

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

ThreatEventBulkCreateRelationshipsResponse object { createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more }

Result of bulk relationship creation operation

createdEventsCount: number

Number of events created

createdIndicatorsCount: number

Number of indicators created

createdRelationshipsCount: number

Number of relationships created

errorCount: number

Number of errors encountered

errors: optional array of object { error, eventIndex }

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

Cloudforce OneThreat EventsAggregate

Aggregate events by single or multiple columns with optional date filtering

GET/accounts/{account_id}/cloudforce-one/events/aggregate

ModelsExpand Collapse

AggregateListResponse object { aggregateBy, aggregations, total, dateRange }

aggregateBy: string

Column(s) that were aggregated by

aggregations: array of object { count, date }

Array of aggregation results with dynamic fields based on aggregateBy columns

Number of events for this aggregation

date: optional string

Date (if groupByDate is true)

total: number

Total number of events in the aggregation

dateRange: optional object { endDate, startDate }

Date range used for filtering

endDate: optional string

startDate: optional string

Cloudforce OneThreat EventsGraphql

GraphQL endpoint for event aggregation

POST/accounts/{account_id}/cloudforce-one/events/graphql

ModelsExpand Collapse

GraphqlCreateResponse object { data, errors }

data: optional unknown

errors: optional array of unknown

Cloudforce OneThreat EventsGraph

Query graph neighborhood from R2 Data Catalog

GET/accounts/{account_id}/cloudforce-one/events/graph

ModelsExpand Collapse

GraphListResponse object { edges, node, nodes }

edges: array of object { id, relationshipType, source, 5 more }

id: string

Deterministic composite edge id (sourcetarget:relationshipType)

relationshipType: string

source: string

Compact id of the source node (type:uuid)

sourceId: string

sourceType: string

target: string

Compact id of the target node (type:uuid)

targetId: string

targetType: string

node: map[unknown]

Focal node object (legacy single-seed). Null when unavailable.

nodes: array of map[unknown]

Cloudforce OneThreat EventsQueries

List all saved event queries

GET/accounts/{account_id}/cloudforce-one/events/queries

Create a saved event query

POST/accounts/{account_id}/cloudforce-one/events/queries/create

Read a saved event query

GET/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Update a saved event query

PATCH/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Delete a saved event query

DELETE/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

ModelsExpand Collapse

QueryListResponse = array of object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id: optional number

Intel Indicator Feed ID (numeric)

rule_list_id: optional string

WAF rules list ID for blocking

rule_scope: optional string

Scope for the rule

QueryCreateResponse object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id: optional number

Intel Indicator Feed ID (numeric)

rule_list_id: optional string

WAF rules list ID for blocking

rule_scope: optional string

Scope for the rule

QueryGetResponse object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id: optional number

Intel Indicator Feed ID (numeric)

rule_list_id: optional string

WAF rules list ID for blocking

rule_scope: optional string

Scope for the rule

QueryEditResponse object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id: optional number

Intel Indicator Feed ID (numeric)

rule_list_id: optional string

WAF rules list ID for blocking

rule_scope: optional string

Scope for the rule

Cloudforce OneThreat EventsRelationships

Filter and list events related to specific event

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships

ModelsExpand Collapse

RelationshipListResponse = array of object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

Cloudforce OneThreat EventsIndicators

Lists indicators across multiple datasets

GET/accounts/{account_id}/cloudforce-one/events/indicators

ModelsExpand Collapse

IndicatorListResponse object { properties, type }

properties: object { completeness, indicators, pagination }

completeness: object { properties, type }

properties: object { complete, failedDatasets, failedShards, warnings }

complete: object { type }

type: string

failedDatasets: object { items, type }

items: object { type }

type: string

failedShards: object { items, type }

items: object { properties, type }

properties: object { datasetId, shardId }

datasetId: object { type }

type: string

shardId: object { type }

type: string

warnings: object { items, type }

items: object { type }

type: string

indicators: object { items, type }

items: object { createdAt, indicatorType, updatedAt, 5 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags: optional array of object { categoryName, uuid, value }

categoryName: optional string

uuid: optional string

value: optional string

type: string

pagination: object { properties, type }

properties: object { count, cursor, has_more, 4 more }

type: string

cursor: object { description, nullable, type }

description: string

nullable: boolean

type: string

has_more: object { description, type }

description: string

type: string

page: object { type }

type: string

per_page: object { type }

type: string

total_count: object { description, nullable, type }

description: string

nullable: boolean

type: string

total_count_is_exact: object { description, type }

description: string

type: string

Cloudforce OneThreat EventsIndicatorsAggregate

Aggregate indicators by column(s)

GET/accounts/{account_id}/cloudforce-one/events/indicators/aggregate

ModelsExpand Collapse

AggregateListResponse object { aggregateBy, aggregations, failedDatasets, total }

aggregateBy: string

Column(s) that were aggregated by

aggregations: array of object { count }

Array of aggregation results with dynamic fields based on aggregateBy columns

Number of indicators for this aggregation

failedDatasets: number

Number of datasets whose aggregation failed and were excluded from the result

total: number

Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships

Cloudforce OneThreat EventsIndicatorsTypes

Lists indicator types across multiple datasets

GET/accounts/{account_id}/cloudforce-one/events/indicator-types

ModelsExpand Collapse

TypeListResponse object { items, type }

items: object { type }

type: string

Cloudforce OneThreat EventsIndicatorsBy Dataset

Lists indicators

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators

Reads an indicator

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}

ModelsExpand Collapse

ByDatasetListResponse object { indicators, pagination }

indicators: array of object { createdAt, indicatorType, updatedAt, 5 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags: optional array of object { categoryName, uuid, value }

categoryName: optional string

uuid: optional string

value: optional string

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

ByDatasetGetResponse object { createdAt, indicatorType, updatedAt, 5 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags: optional array of object { categoryName, uuid, value }

categoryName: optional string

uuid: optional string

value: optional string

Cloudforce OneThreat EventsIndicatorsBy DatasetTags

List mirrored tags for an indicator dataset

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags

ModelsExpand Collapse

TagListResponse = array of unknown

Array of mirror tag rows

Cloudforce OneThreat EventsAttackers

Lists attackers across multiple datasets

GET/accounts/{account_id}/cloudforce-one/events/attackers

ModelsExpand Collapse

AttackerListResponse object { items, type }

items: object { type }

type: string

Cloudforce OneThreat EventsCategories

Lists categories across multiple datasets

GET/accounts/{account_id}/cloudforce-one/events/categories

Reads a category

GET/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Creates a new category

POST/accounts/{account_id}/cloudforce-one/events/categories/create

Updates a category

PATCH/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Deletes a category

DELETE/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

ModelsExpand Collapse

CategoryListResponse = array of object { killChain, name, uuid, 3 more }

killChain: number

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryGetResponse object { killChain, name, uuid, 3 more }

killChain: number

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryCreateResponse object { killChain, name, uuid, 3 more }

killChain: number

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryEditResponse object { killChain, name, uuid, 3 more }

killChain: number

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryDeleteResponse object { uuid }

uuid: string

Cloudforce OneThreat EventsCategoriesCatalog

Lists categories

GET/accounts/{account_id}/cloudforce-one/events/categories/catalog

ModelsExpand Collapse

CatalogListResponse = array of object { killChain, name, uuid, 3 more }

killChain: number

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

Cloudforce OneThreat EventsCountries

Retrieves countries information for all countries

GET/accounts/{account_id}/cloudforce-one/events/countries

ModelsExpand Collapse

CountryListResponse = array of object { result, success }

result: array of object { alpha2, alpha3, name }

alpha2: string

alpha3: string

success: string

Cloudforce OneThreat EventsCrons

Cloudforce OneThreat EventsDatasets

Lists all datasets in an account

GET/accounts/{account_id}/cloudforce-one/events/dataset

Reads a dataset

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Creates a dataset

POST/accounts/{account_id}/cloudforce-one/events/dataset/create

Updates an existing dataset

PATCH/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Delete a dataset

DELETE/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Reads raw data for an event by UUID

GET/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}

ModelsExpand Collapse

DatasetListResponse = array of object { indicatorWriteMode, isAnalytics, isPublic, 3 more }

indicatorWriteMode: "read_only" or "create_only" or "full"

Effective indicator mutation capability after account/dataset authorization and dataset storage capability are applied. API Gateway method permissions are separate and must also allow the requested operation.

One of the following:

"read_only"

"create_only"

"full"

isAnalytics: boolean

isPublic: boolean

uuid: string

deletedAt: optional string

DatasetGetResponse object { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

uuid: string

DatasetCreateResponse object { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

uuid: string

DatasetEditResponse object { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

uuid: string

DatasetDeleteResponse object { name, uuid }

uuid: string

DatasetRawResponse object { id, accountId, created, 3 more }

id: number

accountId: number

created: string

data: string

source: string

tlp: string

Cloudforce OneThreat EventsDatasetsHealth

Cloudforce OneThreat EventsDatasetsEvents

Reads an event

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}

ModelsExpand Collapse

EventGetResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

Cloudforce OneThreat EventsRaw

Reads data for a raw event

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

Updates a raw event

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

ModelsExpand Collapse

RawGetResponse object { id, accountId, created, 3 more }

id: string

accountId: number

created: string

data: unknown

source: string

tlp: string

RawEditResponse object { id, data }

id: string

data: unknown

Cloudforce OneThreat EventsRelate

Removes an event reference

DELETE/accounts/{account_id}/cloudforce-one/events/relate/{event_id}

ModelsExpand Collapse

RelateDeleteResponse object { success }

success: boolean

Cloudforce OneThreat EventsTags

Lists all tags (SoT)

GET/accounts/{account_id}/cloudforce-one/events/tags

Creates a new tag

POST/accounts/{account_id}/cloudforce-one/events/tags/create

Updates a tag (SoT)

PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

Deletes a tag (SoT)

DELETE/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

ModelsExpand Collapse

TagListResponse object { pagination, tags }

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

tags: array of object { uuid, value, activeDuration, 25 more }

uuid: string

value: string

activeDuration: optional string

actorCategory: optional string

actorCategoryConfidence: optional number

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "green" or "white"

One of the following:

"red"

"amber"

"green"

"white"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

analyticPriority: optional number

attributionConfidence: optional string

attributionConfidenceScore: optional number

maximum10

minimum1

attributionOrganization: optional string

categoryName: optional string

categoryUuid: optional string

dateOfDiscovery: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

internalAliases: optional array of object { value, confidence, tlp }

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "green" or "white"

One of the following:

"red"

"amber"

"green"

"white"

internalDescription: optional string

motive: optional string

motiveConfidence: optional number

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

opsecLevel: optional string

originCountryConfidence: optional number

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

originCountryISO: optional string

originCountryISOAlpha3: optional string

originCountryTlp: optional "red" or "amber" or "green" or "white"

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:

"red"

"amber"

"green"

"white"

priority: optional number

sophisticationLevel: optional string

TagCreateResponse object { uuid, value, activeDuration, 25 more }

uuid: string

value: string

activeDuration: optional string

actorCategory: optional string

actorCategoryConfidence: optional number

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "green" or "white"

One of the following:

"red"

"amber"

"green"

"white"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

analyticPriority: optional number

attributionConfidence: optional string

attributionConfidenceScore: optional number

maximum10

minimum1

attributionOrganization: optional string

categoryName: optional string

categoryUuid: optional string

dateOfDiscovery: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

internalAliases: optional array of object { value, confidence, tlp }

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "green" or "white"

One of the following:

"red"

"amber"

"green"

"white"

internalDescription: optional string

motive: optional string

motiveConfidence: optional number

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

opsecLevel: optional string

originCountryConfidence: optional number

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

originCountryISO: optional string

originCountryISOAlpha3: optional string

originCountryTlp: optional "red" or "amber" or "green" or "white"

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:

"red"

"amber"

"green"

"white"

priority: optional number

sophisticationLevel: optional string

TagEditResponse object { uuid, value, activeDuration, 25 more }

uuid: string

value: string

activeDuration: optional string

actorCategory: optional string

actorCategoryConfidence: optional number

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "green" or "white"

One of the following:

"red"

"amber"

"green"

"white"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

analyticPriority: optional number

attributionConfidence: optional string

attributionConfidenceScore: optional number

maximum10

minimum1

attributionOrganization: optional string

categoryName: optional string

categoryUuid: optional string

dateOfDiscovery: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

internalAliases: optional array of object { value, confidence, tlp }

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "green" or "white"

One of the following:

"red"

"amber"

"green"

"white"

internalDescription: optional string

motive: optional string

motiveConfidence: optional number

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

opsecLevel: optional string

originCountryConfidence: optional number

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

originCountryISO: optional string

originCountryISOAlpha3: optional string

originCountryTlp: optional "red" or "amber" or "green" or "white"

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:

"red"

"amber"

"green"

"white"

priority: optional number

sophisticationLevel: optional string

TagDeleteResponse object { uuid }

uuid: string

Cloudforce OneThreat EventsTagsCategories

Lists all tag categories (SoT)

GET/accounts/{account_id}/cloudforce-one/events/tags/categories

Creates a new tag category (SoT)

POST/accounts/{account_id}/cloudforce-one/events/tags/categories/create

Updates a tag category (SoT)

PATCH/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

Deletes a tag category (SoT)

DELETE/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

ModelsExpand Collapse

CategoryListResponse object { categories }

categories: array of object { name, uuid, createdAt, 2 more }

uuid: string

createdAt: optional string

description: optional string

updatedAt: optional string

CategoryCreateResponse object { name, uuid, createdAt, 2 more }

uuid: string

createdAt: optional string

description: optional string

updatedAt: optional string

CategoryEditResponse object { name, uuid, createdAt, 2 more }

uuid: string

createdAt: optional string

description: optional string

updatedAt: optional string

CategoryDeleteResponse object { uuid }

uuid: string

Cloudforce OneThreat EventsTagsIndicators

List indicators related to a tag

GET/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators

ModelsExpand Collapse

IndicatorListResponse object { indicators, pagination }

indicators: array of object { createdAt, indicatorType, updatedAt, 5 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags: optional array of object { categoryName, uuid, value }

categoryName: optional string

uuid: optional string

value: optional string

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

Cloudforce OneThreat EventsTagsIndicatorsBy Dataset

List indicators related to a tag within a dataset (deprecated)

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators

ModelsExpand Collapse

ByDatasetListResponse object { indicators, pagination }

indicators: array of object { createdAt, indicatorType, updatedAt, 5 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

tags: optional array of object { categoryName, uuid, value }

categoryName: optional string

uuid: optional string

value: optional string

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

Cloudforce OneThreat EventsEvent Tags

Adds a tag to an event

POST/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create

Removes a tag from an event

DELETE/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}

ModelsExpand Collapse

EventTagCreateResponse object { success }

success: boolean

EventTagDeleteResponse object { success }

success: boolean

Cloudforce OneThreat EventsTarget Industries

Lists target industries across multiple datasets

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries

ModelsExpand Collapse

TargetIndustryListResponse object { items, type }

items: object { type }

type: string

Cloudforce OneThreat EventsTarget IndustriesBy Dataset

Lists all target industries for a specific dataset

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries

ModelsExpand Collapse

ByDatasetListResponse object { items, type }

items: object { type }

type: string

Cloudforce OneThreat EventsTarget IndustriesCatalog

Lists all target industries from industry map catalog

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog

ModelsExpand Collapse

CatalogListResponse object { items, type }

items: object { type }

type: string