Cloudforce One

Cloudforce OneBinary Storage

Retrieves a file from Binary Storage

GET/accounts/{account_id}/cloudforce-one/binary/{hash}

Posts a file to Binary Storage

POST/accounts/{account_id}/cloudforce-one/binary

ModelsExpand Collapse

BinaryStorageCreateResponse object { content_type, md5, sha1, sha256 }

content_type: string

md5: string

sha1: string

sha256: string

Cloudforce OneRequests

List Requests

POST/accounts/{account_id}/cloudforce-one/requests

Get a Request

GET/accounts/{account_id}/cloudforce-one/requests/{request_id}

Create a New Request.

POST/accounts/{account_id}/cloudforce-one/requests/new

Update a Request

PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}

Delete a Request

DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}

Get Request Quota

GET/accounts/{account_id}/cloudforce-one/requests/quota

Get Request Types

GET/accounts/{account_id}/cloudforce-one/requests/types

Get Request Priority, Status, and TLP constants

GET/accounts/{account_id}/cloudforce-one/requests/constants

ModelsExpand Collapse

Item object { id, content, created, 10 more }

id: string

UUID.

maxLength36

content: string

Request content.

created: string

formatdate-time

priority: string

formatdate-time

request: string

Requested information from request.

summary: string

Brief description of the request.

tlp: "clear" or "amber" or "amber-strict" or 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

updated: string

formatdate-time

completed: optional string

formatdate-time

message_tokens: optional number

Tokens for the request messages.

readable_id: optional string

Readable Request ID.

status: optional "open" or "accepted" or "reported" or 3 more

Request Status.

One of the following:

"open"

"accepted"

"reported"

"approved"

"completed"

"declined"

tokens: optional number

Tokens for the request.

ListItem object { id, created, priority, 9 more }

id: string

UUID.

maxLength36

created: string

Request creation time.

formatdate-time

priority: "routine" or "high" or "urgent"

One of the following:

"routine"

"high"

"urgent"

request: string

Requested information from request.

summary: string

Brief description of the request.

tlp: "clear" or "amber" or "amber-strict" or 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

updated: string

Request last updated time.

formatdate-time

completed: optional string

Request completion time.

formatdate-time

message_tokens: optional number

Tokens for the request messages.

readable_id: optional string

Readable Request ID.

status: optional "open" or "accepted" or "reported" or 3 more

Request Status.

One of the following:

"open"

"accepted"

"reported"

"approved"

"completed"

"declined"

tokens: optional number

Tokens for the request.

Quota object { anniversary_date, quarter_anniversary_date, quota, remaining }

anniversary_date: optional string

Anniversary date is when annual quota limit is refreshed.

formatdate-time

quarter_anniversary_date: optional string

Quarter anniversary date is when quota limit is refreshed each quarter.

formatdate-time

quota: optional number

Tokens for the quarter.

remaining: optional number

Tokens remaining for the quarter.

RequestConstants object { priority, status, tlp }

priority: optional array of "routine" or "high" or "urgent"

One of the following:

"routine"

"high"

"urgent"

status: optional array of "open" or "accepted" or "reported" or 3 more

One of the following:

"open"

"accepted"

"reported"

"approved"

"completed"

"declined"

tlp: optional array of "clear" or "amber" or "amber-strict" or 2 more

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

RequestTypes = array of string

RequestDeleteResponse object { errors, messages, success }

errors: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

messages: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

success: true

Whether the API call was successful.

RequestTypesResponse = string

Request Types.

Cloudforce OneRequestsMessage

List Request Messages

POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/message

Create a New Request Message

POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/new

Update a Request Message

PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}

Delete a Request Message

DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}/message/{message_id}

ModelsExpand Collapse

Message object { id, author, content, 3 more }

id: number

Message ID.

author: string

Author of message.

content: string

Content of message.

is_follow_on_request: boolean

Whether the message is a follow-on request.

updated: string

Defines the message last updated time.

formatdate-time

created: optional string

Defines the message creation time.

formatdate-time

MessageDeleteResponse object { errors, messages, success }

errors: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

messages: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

success: true

Whether the API call was successful.

Cloudforce OneRequestsPriority

Get a Priority Intelligence Requirement

GET/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}

Create a New Priority Intelligence Requirement

POST/accounts/{account_id}/cloudforce-one/requests/priority/new

Update a Priority Intelligence Requirement

PUT/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}

Delete a Priority Intelligence Requirement

DELETE/accounts/{account_id}/cloudforce-one/requests/priority/{priority_id}

Get Priority Intelligence Requirement Quota

GET/accounts/{account_id}/cloudforce-one/requests/priority/quota

ModelsExpand Collapse

Label = string

Priority object { id, created, labels, 4 more }

id: string

UUID.

maxLength36

created: string

Priority creation time.

formatdate-time

labels: array of Label

List of labels.

priority: number

Priority.

requirement: string

Requirement.

tlp: "clear" or "amber" or "amber-strict" or 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

updated: string

Priority last updated time.

formatdate-time

PriorityEdit object { labels, priority, requirement, tlp }

labels: array of Label

List of labels.

priority: number

Priority.

requirement: string

Requirement.

tlp: "clear" or "amber" or "amber-strict" or 2 more

The CISA defined Traffic Light Protocol (TLP).

One of the following:

"clear"

"amber"

"amber-strict"

"green"

"red"

PriorityDeleteResponse object { errors, messages, success }

errors: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

messages: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

success: true

Whether the API call was successful.

Cloudforce OneRequestsAssets

Get a Request Asset

GET/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}

List Request Assets

POST/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset

Update a Request Asset

PUT/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}

Delete a Request Asset

DELETE/accounts/{account_id}/cloudforce-one/requests/{request_id}/asset/{asset_id}

ModelsExpand Collapse

AssetGetResponse object { id, name, created, 2 more }

id: number

Asset ID.

Asset name.

created: optional string

Defines the asset creation time.

formatdate-time

description: optional string

Asset description.

file_type: optional string

Asset file type.

AssetCreateResponse object { id, name, created, 2 more }

id: number

Asset ID.

Asset name.

created: optional string

Defines the asset creation time.

formatdate-time

description: optional string

Asset description.

file_type: optional string

Asset file type.

AssetUpdateResponse object { id, name, created, 2 more }

id: number

Asset ID.

Asset name.

created: optional string

Defines the asset creation time.

formatdate-time

description: optional string

Asset description.

file_type: optional string

Asset file type.

AssetDeleteResponse object { errors, messages, success }

errors: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

messages: array of object { code, message, documentation_url, source }

code: number

minimum1000

message: string

documentation_url: optional string

source: optional object { pointer }

pointer: optional string

success: true

Whether the API call was successful.

Cloudforce OneScans

Cloudforce OneScansResults

Get the Latest Scan Result

GET/accounts/{account_id}/cloudforce-one/scans/results/{config_id}

ModelsExpand Collapse

ScanResult object { number, proto, status }

number: optional number

proto: optional string

status: optional string

ResultGetResponse object { "1.1.1.1" }

"1.1.1.1": array of ScanResult { number, proto, status }

number: optional number

proto: optional string

status: optional string

Cloudforce OneScansConfig

List Scan Configs

GET/accounts/{account_id}/cloudforce-one/scans/config

Create a new Scan Config

POST/accounts/{account_id}/cloudforce-one/scans/config

Update an existing Scan Config

PATCH/accounts/{account_id}/cloudforce-one/scans/config/{config_id}

Delete a Scan Config

DELETE/accounts/{account_id}/cloudforce-one/scans/config/{config_id}

ModelsExpand Collapse

ConfigListResponse object { id, account_id, frequency, 2 more }

id: string

Defines the Config ID.

account_id: string

frequency: number

Defines the number of days between each scan (0 = One-off scan).

ips: array of string

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: array of string

Defines a list of ports to scan. Valid values are:“default”, “all”, or a comma-separated list of ports or range of ports (e.g. [“1-80”, “443”]). “default” scans the 100 most commonly open ports.

ConfigCreateResponse object { id, account_id, frequency, 2 more }

id: string

Defines the Config ID.

account_id: string

frequency: number

Defines the number of days between each scan (0 = One-off scan).

ips: array of string

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: array of string

ConfigEditResponse object { id, account_id, frequency, 2 more }

id: string

Defines the Config ID.

account_id: string

frequency: number

Defines the number of days between each scan (0 = One-off scan).

ips: array of string

Defines a list of IP addresses or CIDR blocks to scan. The maximum number of total IP addresses allowed is 5000.

ports: array of string

ConfigDeleteResponse = unknown

Cloudforce OneThreat Events

List events

GET/accounts/{account_id}/cloudforce-one/events

Get an event (legacy)

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/{event_id}

Create an event

POST/accounts/{account_id}/cloudforce-one/events/create

Update an event

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}

Create events in bulk

POST/accounts/{account_id}/cloudforce-one/events/create/bulk

Create events with relationships in bulk (legacy)

Deprecated

POST/accounts/{account_id}/cloudforce-one/events/create/bulk/relationships

ModelsExpand Collapse

ThreatEventListResponse = array of object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventGetResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventCreateResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventEditResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

ThreatEventBulkCreateResponse object { createdEventsCount, createdTagsCount, errorCount, 4 more }

Detailed result of bulk event creation with auto-tag management

createdEventsCount: number

Number of events created

createdTagsCount: number

Number of new tags created in SoT

errorCount: number

Number of errors encountered

queuedIndicatorsCount: number

Number of indicators queued for async processing

createBulkEventsRequestId: optional string

Correlation ID for async indicator processing

formatuuid

createdEvents: optional array of object { eventIndex, shardId, uuid }

Array of created events with UUIDs and shard locations. Only present when includeCreatedEvents=true

eventIndex: number

Original index in the input data array

shardId: string

Dataset ID of the shard where the event was created

uuid: string

UUID of the created event

formatuuid

errors: optional array of object { error, eventIndex }

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

ThreatEventBulkCreateRelationshipsResponse object { createdEventsCount, createdIndicatorsCount, createdRelationshipsCount, 2 more }

Result of bulk relationship creation operation

createdEventsCount: number

Number of events created

createdIndicatorsCount: number

Number of indicators created

createdRelationshipsCount: number

Number of relationships created

errorCount: number

Number of errors encountered

errors: optional array of object { error, eventIndex }

Array of error details

error: string

Error message

eventIndex: number

Index of the event that caused the error

Cloudforce OneThreat EventsAggregate

Aggregate events

GET/accounts/{account_id}/cloudforce-one/events/aggregate

ModelsExpand Collapse

AggregateListResponse object { aggregateBy, aggregations, total, dateRange }

aggregateBy: string

Column(s) that were aggregated by

aggregations: array of object { count, date }

Array of aggregation results with dynamic fields based on aggregateBy columns

Number of events for this aggregation

date: optional string

Date (if groupByDate is true)

total: number

Total number of events in the aggregation

dateRange: optional object { endDate, startDate }

Date range used for filtering

endDate: optional string

startDate: optional string

Cloudforce OneThreat EventsGraphql

Run a GraphQL aggregation over events

POST/accounts/{account_id}/cloudforce-one/events/graphql

ModelsExpand Collapse

GraphqlCreateResponse object { data, errors }

data: optional unknown

errors: optional array of unknown

Cloudforce OneThreat EventsGraph

Query graph neighborhood from R2 Data Catalog

GET/accounts/{account_id}/cloudforce-one/events/graph

ModelsExpand Collapse

GraphListResponse object { edges, node, nodes }

edges: array of object { id, relationshipType, source, 5 more }

id: string

Deterministic composite edge id (source→target:relationshipType)

relationshipType: string

source: string

Compact id of the source node (type:uuid)

sourceId: string

sourceType: string

target: string

Compact id of the target node (type:uuid)

targetId: string

targetType: string

node: map[unknown]

Focal node object (legacy single-seed). Null when unavailable.

nodes: array of map[unknown]

Cloudforce OneThreat EventsQueries

List saved event queries

GET/accounts/{account_id}/cloudforce-one/events/queries

Create a saved event query

POST/accounts/{account_id}/cloudforce-one/events/queries/create

Get a saved event query

GET/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Update a saved event query

PATCH/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Delete a saved event query

DELETE/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

ModelsExpand Collapse

QueryListResponse = array of object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

Deprecatedalert_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: string

Creation timestamp

Name of the saved query

query_json: string

JSON string containing the query parameters

Deprecatedrule_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

Deprecatedcustom_threat_feed_id: optional number

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id: optional string

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope: optional string

Deprecated: saved-query alerting and rules were removed. Always null.

QueryCreateResponse object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

Deprecatedalert_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: string

Creation timestamp

Name of the saved query

query_json: string

JSON string containing the query parameters

Deprecatedrule_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

Deprecatedcustom_threat_feed_id: optional number

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id: optional string

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope: optional string

Deprecated: saved-query alerting and rules were removed. Always null.

QueryGetResponse object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

Deprecatedalert_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: string

Creation timestamp

Name of the saved query

query_json: string

JSON string containing the query parameters

Deprecatedrule_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

Deprecatedcustom_threat_feed_id: optional number

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id: optional string

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope: optional string

Deprecated: saved-query alerting and rules were removed. Always null.

QueryEditResponse object { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

Deprecatedalert_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

Deprecatedalert_rollup_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

created_at: string

Creation timestamp

Name of the saved query

query_json: string

JSON string containing the query parameters

Deprecatedrule_enabled: boolean

Deprecated: saved-query alerting and rules were removed. Always false.

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

Deprecatedcustom_threat_feed_id: optional number

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_list_id: optional string

Deprecated: saved-query alerting and rules were removed. Always null.

Deprecatedrule_scope: optional string

Deprecated: saved-query alerting and rules were removed. Always null.

Cloudforce OneThreat EventsRelationships

List related events (legacy)

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/relationships

ModelsExpand Collapse

RelationshipListResponse = array of object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

Cloudforce OneThreat EventsIndicators

List indicators

GET/accounts/{account_id}/cloudforce-one/events/indicators

ModelsExpand Collapse

IndicatorListResponse object { properties, type }

properties: object { completeness, indicators, pagination }

completeness: object { properties, type }

properties: object { complete, failedDatasets, failedShards, warnings }

complete: object { type }

type: string

failedDatasets: object { items, type }

items: object { type }

type: string

failedShards: object { items, type }

items: object { properties, type }

properties: object { datasetId, shardId }

datasetId: object { type }

type: string

shardId: object { type }

type: string

warnings: object { items, type }

items: object { type }

type: string

indicators: object { items, type }

items: object { createdAt, indicatorType, sources, 8 more }

createdAt: string

formatdate-time

indicatorType: string

sources: array of object { resourceId, resourceType, system, title }

RSS article sources from which this indicator was extracted.

resourceId: string

formatuuid

resourceType: "article"

system: "threat-signals"

title: string

Threat Signals article title; null for historical provenance without a stored title.

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

relatedEventsHasMore: optional boolean

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags: optional array of object { categoryId, categoryName, uuid, value }

categoryId: optional string

The UUID of the tag category, or null when the tag is uncategorized.

categoryName: optional string

uuid: optional string

value: optional string

tlp: optional string

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

type: string

pagination: object { properties, type }

properties: object { count, cursor, has_more, 4 more }

type: string

cursor: object { description, nullable, type }

description: string

nullable: boolean

type: string

has_more: object { description, type }

description: string

type: string

page: object { type }

type: string

per_page: object { type }

type: string

total_count: object { description, nullable, type }

description: string

nullable: boolean

type: string

total_count_is_exact: object { description, type }

description: string

type: string

Cloudforce OneThreat EventsIndicatorsAggregate

Aggregate indicators by column(s)

GET/accounts/{account_id}/cloudforce-one/events/indicators/aggregate

ModelsExpand Collapse

AggregateListResponse object { aggregateBy, aggregations, failedDatasets, total }

aggregateBy: string

Column(s) that were aggregated by

aggregations: array of object { count }

Array of aggregation results with dynamic fields based on aggregateBy columns

Number of indicators for this aggregation

failedDatasets: number

Number of datasets whose aggregation failed and were excluded from the result

total: number

Total count in the aggregation: indicator rows when measure=indicators, or linked-event rows when measure=relationships

Cloudforce OneThreat EventsIndicatorsTypes

List indicator types

GET/accounts/{account_id}/cloudforce-one/events/indicator-types

ModelsExpand Collapse

TypeListResponse object { items, type }

items: object { type }

type: string

Cloudforce OneThreat EventsIndicatorsBy Dataset

List indicators in a dataset (legacy)

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators

Get an indicator

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/{indicator_id}

ModelsExpand Collapse

ByDatasetListResponse object { indicators, pagination }

indicators: array of object { createdAt, indicatorType, sources, 8 more }

createdAt: string

formatdate-time

indicatorType: string

sources: array of object { resourceId, resourceType, system, title }

RSS article sources from which this indicator was extracted.

resourceId: string

formatuuid

resourceType: "article"

system: "threat-signals"

title: string

Threat Signals article title; null for historical provenance without a stored title.

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

relatedEventsHasMore: optional boolean

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags: optional array of object { categoryId, categoryName, uuid, value }

categoryId: optional string

The UUID of the tag category, or null when the tag is uncategorized.

categoryName: optional string

uuid: optional string

value: optional string

tlp: optional string

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

ByDatasetGetResponse object { createdAt, indicatorType, updatedAt, 7 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

relatedEventsHasMore: optional boolean

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags: optional array of object { categoryId, categoryName, uuid, value }

categoryId: optional string

The UUID of the tag category, or null when the tag is uncategorized.

categoryName: optional string

uuid: optional string

value: optional string

tlp: optional string

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

Cloudforce OneThreat EventsIndicatorsBy DatasetTags

List tags on a dataset's indicators

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/indicators/tags

ModelsExpand Collapse

TagListResponse = array of unknown

Array of mirror tag rows

Cloudforce OneThreat EventsAttackers

List attackers

GET/accounts/{account_id}/cloudforce-one/events/attackers

ModelsExpand Collapse

AttackerListResponse object { items, type }

items: object { type }

type: string

Cloudforce OneThreat EventsCategories

List event categories used in datasets

GET/accounts/{account_id}/cloudforce-one/events/categories

Get an event category (legacy)

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Create an event category

POST/accounts/{account_id}/cloudforce-one/events/categories/create

Update an event category (legacy)

Deprecated

PATCH/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

Delete an event category (legacy)

Deprecated

DELETE/accounts/{account_id}/cloudforce-one/events/categories/{category_id}

ModelsExpand Collapse

CategoryListResponse = array of object { killChain, name, uuid, 3 more }

killChain: number

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryGetResponse object { killChain, name, uuid, 3 more }

killChain: number

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryCreateResponse object { killChain, name, uuid, 3 more }

killChain: number

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryEditResponse object { killChain, name, uuid, 3 more }

killChain: number

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

CategoryDeleteResponse object { uuid }

uuid: string

Cloudforce OneThreat EventsCategoriesCatalog

List all event categories

GET/accounts/{account_id}/cloudforce-one/events/categories/catalog

ModelsExpand Collapse

CatalogListResponse = array of object { killChain, name, uuid, 3 more }

killChain: number

uuid: string

mitreAttack: optional array of string

mitreCapec: optional array of string

shortname: optional string

Cloudforce OneThreat EventsCountries

List countries

GET/accounts/{account_id}/cloudforce-one/events/countries

ModelsExpand Collapse

CountryListResponse = array of object { result, success }

result: array of object { alpha2, alpha3, name }

alpha2: string

alpha3: string

success: string

Cloudforce OneThreat EventsCrons

Cloudforce OneThreat EventsDatasets

List datasets

GET/accounts/{account_id}/cloudforce-one/events/dataset

Get a dataset

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Create a dataset

POST/accounts/{account_id}/cloudforce-one/events/dataset/create

Update a dataset

PATCH/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Delete a dataset

DELETE/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}

Get raw data for an event (legacy)

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/raw/{dataset_id}/{event_id}

ModelsExpand Collapse

DatasetListResponse = array of object { indicatorWriteMode, isAnalytics, isPublic, 3 more }

indicatorWriteMode: "read_only" or "create_only" or "full"

Effective indicator mutation capability after account/dataset authorization and dataset storage capability are applied. API Gateway method permissions are separate and must also allow the requested operation.

One of the following:

"read_only"

"create_only"

"full"

isAnalytics: boolean

isPublic: boolean

uuid: string

deletedAt: optional string

DatasetGetResponse object { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

uuid: string

DatasetCreateResponse object { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

uuid: string

DatasetEditResponse object { isAnalytics, isPublic, name, uuid }

isAnalytics: boolean

isPublic: boolean

uuid: string

DatasetDeleteResponse object { name, uuid }

uuid: string

DatasetRawResponse object { id, accountId, created, 3 more }

id: number

accountId: number

created: string

data: string

source: string

tlp: string

Cloudforce OneThreat EventsDatasetsHealth

Cloudforce OneThreat EventsDatasetsEvents

Get an event

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/events/{event_id}

ModelsExpand Collapse

EventGetResponse object { attacker, attackerCountry, attackerCountryAlpha3, 26 more }

attacker: string

attackerCountry: string

attackerCountryAlpha3: string

category: string

datasetId: string

date: string

event: string

hasChildren: boolean

indicator: string

indicatorType: string

indicatorTypeId: number

killChain: number

mitreAttack: array of string

mitreCapec: array of string

numReferenced: number

numReferences: number

rawId: string

referenced: array of string

referencedIds: array of number

references: array of string

referencesIds: array of number

tags: array of string

targetCountry: string

targetCountryAlpha3: string

targetIndustry: string

tlp: string

uuid: string

insight: optional string

releasabilityId: optional string

Cloudforce OneThreat EventsRaw

Get raw event data by raw ID (legacy)

GET/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

Update raw event data by raw ID (legacy)

PATCH/accounts/{account_id}/cloudforce-one/events/{event_id}/raw/{raw_id}

ModelsExpand Collapse

RawGetResponse object { id, accountId, created, 3 more }

id: string

accountId: number

created: string

data: unknown

source: string

tlp: string

RawEditResponse object { id, data }

id: string

data: unknown

Cloudforce OneThreat EventsRelate

Remove event references (legacy)

DELETE/accounts/{account_id}/cloudforce-one/events/relate/{event_id}

ModelsExpand Collapse

RelateDeleteResponse object { success }

success: boolean

Cloudforce OneThreat EventsTags

List tags

GET/accounts/{account_id}/cloudforce-one/events/tags

Create a tag

POST/accounts/{account_id}/cloudforce-one/events/tags/create

Update a tag

PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

Delete a tag

DELETE/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

ModelsExpand Collapse

TagListResponse object { pagination, tags }

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

tags: array of object { uuid, value, activeDuration, 34 more }

uuid: string

value: string

activeDuration: optional string

activeDuration_annotated: optional object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory: optional string

actorCategory_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

attributionOrganization: optional string

attributionOrganization_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName: optional string

categoryUuid: optional string

confidence: optional number

Overall tag confidence (1-10).

maximum10

minimum1

createdAt: optional string

dateOfDiscovery: optional string

description: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

externalReferences_annotated: optional array of object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases: optional array of object { value, confidence, tlp }

Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription: optional string

lastSeen: optional string

motive: optional string

motive_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel: optional string

opsecLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO: optional string

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority: optional number

priority_annotated: optional object { value, tlp }

value: number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties: optional map[unknown]

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel: optional string

sophisticationLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp: optional "red" or "amber" or "amber-strict" or 4 more

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt: optional string

version: optional number

TagCreateResponse object { uuid, value, activeDuration, 34 more }

uuid: string

value: string

activeDuration: optional string

activeDuration_annotated: optional object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory: optional string

actorCategory_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

attributionOrganization: optional string

attributionOrganization_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName: optional string

categoryUuid: optional string

confidence: optional number

Overall tag confidence (1-10).

maximum10

minimum1

createdAt: optional string

dateOfDiscovery: optional string

description: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

externalReferences_annotated: optional array of object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases: optional array of object { value, confidence, tlp }

Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription: optional string

lastSeen: optional string

motive: optional string

motive_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel: optional string

opsecLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO: optional string

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority: optional number

priority_annotated: optional object { value, tlp }

value: number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties: optional map[unknown]

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel: optional string

sophisticationLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp: optional "red" or "amber" or "amber-strict" or 4 more

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt: optional string

version: optional number

TagEditResponse object { uuid, value, activeDuration, 34 more }

uuid: string

value: string

activeDuration: optional string

activeDuration_annotated: optional object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

actorCategory: optional string

actorCategory_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliases: optional array of object { value, confidence, tlp }

Structured aliases ({ value, confidence 1-10, tlp }). Public: returned to all accounts with per-entry TLP filtering (entries with tlp: purple are removed for non-CFONE accounts).

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

aliasGroupNames: optional array of string

aliasGroupNamesInternal: optional array of string

attributionOrganization: optional string

attributionOrganization_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

categoryName: optional string

categoryUuid: optional string

confidence: optional number

Overall tag confidence (1-10).

maximum10

minimum1

createdAt: optional string

dateOfDiscovery: optional string

description: optional string

externalReferenceLinks: optional array of string

externalReferences: optional array of object { url, description }

Structured external references ({ url, description }). Public: returned to all accounts.

url: string

description: optional string

externalReferences_annotated: optional array of object { value, tlp }

value: string

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalAliases: optional array of object { value, confidence, tlp }

Owner-private structured aliases ({ value, confidence 1-10, tlp }). Returned to the owning account and omitted from shared-catalog non-owner responses.

value: string

confidence: optional number

maximum10

minimum1

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

internalDescription: optional string

lastSeen: optional string

motive: optional string

motive_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

opsecLevel: optional string

opsecLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

originCountryISO: optional string

ISO country code (alpha-2 or alpha-3). Normalized to uppercase on read. Null when stored value is blank/whitespace.

originCountryISO_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

priority: optional number

priority_annotated: optional object { value, tlp }

value: number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

properties: optional map[unknown]

Parsed custom field values. Null when the tag has no custom fields.

sophisticationLevel: optional string

sophisticationLevel_annotated: optional object { value, confidence, tlp }

value: string

confidence: optional number

tlp: optional "red" or "amber" or "amber-strict" or 4 more

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

tlp: optional "red" or "amber" or "amber-strict" or 4 more

Tag-level TLP handling marking.

One of the following:

"red"

"amber"

"amber-strict"

"green"

"clear"

"purple"

"amber+strict"

updatedAt: optional string

version: optional number

TagDeleteResponse object { uuid }

uuid: string

Cloudforce OneThreat EventsTagsCategories

List tag categories

GET/accounts/{account_id}/cloudforce-one/events/tags/categories

Create a tag category

POST/accounts/{account_id}/cloudforce-one/events/tags/categories/create

Update a tag category (legacy)

Deprecated

PATCH/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

Delete a tag category (legacy)

Deprecated

DELETE/accounts/{account_id}/cloudforce-one/events/tags/categories/{category_uuid}

ModelsExpand Collapse

CategoryListResponse object { categories }

categories: array of object { name, uuid, createdAt, 3 more }

uuid: string

createdAt: optional string

description: optional string

schema: optional array of object { key, kind, allowedValues, 11 more }

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string

kind: "string" or "number" or "enum" or 3 more

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowedValues: optional array of string

annotations: optional object { confidence, tlp }

confidence: optional boolean

tlp: optional boolean

deprecated: optional boolean

Marks a field as unavailable for new values while retaining its definition for historical values.

deprecatedValues: optional array of string

Enum values unavailable for new writes but retained in allowedValues for historical display.

element: optional unknown

enforcement: optional "error" or "warn" or "off"

One of the following:

"error"

"warn"

"off"

format: optional "date" or "url" or "duration" or "country"

One of the following:

"date"

"url"

"duration"

"country"

label: optional string

maxLength128

minLength1

maxLength: optional number

exclusiveMinimum

minimum0

numberConstraint: optional object { integer, max, min }

integer: optional boolean

max: optional number

min: optional number

properties: optional map[unknown]

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required: optional boolean

updatedAt: optional string

CategoryCreateResponse object { name, uuid, createdAt, 3 more }

uuid: string

createdAt: optional string

description: optional string

schema: optional array of object { key, kind, allowedValues, 11 more }

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string

kind: "string" or "number" or "enum" or 3 more

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowedValues: optional array of string

annotations: optional object { confidence, tlp }

confidence: optional boolean

tlp: optional boolean

deprecated: optional boolean

Marks a field as unavailable for new values while retaining its definition for historical values.

deprecatedValues: optional array of string

Enum values unavailable for new writes but retained in allowedValues for historical display.

element: optional unknown

enforcement: optional "error" or "warn" or "off"

One of the following:

"error"

"warn"

"off"

format: optional "date" or "url" or "duration" or "country"

One of the following:

"date"

"url"

"duration"

"country"

label: optional string

maxLength128

minLength1

maxLength: optional number

exclusiveMinimum

minimum0

numberConstraint: optional object { integer, max, min }

integer: optional boolean

max: optional number

min: optional number

properties: optional map[unknown]

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required: optional boolean

updatedAt: optional string

CategoryEditResponse object { name, uuid, createdAt, 3 more }

uuid: string

createdAt: optional string

description: optional string

schema: optional array of object { key, kind, allowedValues, 11 more }

Parsed FieldDefinition[] defining custom fields for this category, or null if none.

key: string

kind: "string" or "number" or "enum" or 3 more

One of the following:

"string"

"number"

"enum"

"date"

"array"

"object"

allowedValues: optional array of string

annotations: optional object { confidence, tlp }

confidence: optional boolean

tlp: optional boolean

deprecated: optional boolean

Marks a field as unavailable for new values while retaining its definition for historical values.

deprecatedValues: optional array of string

Enum values unavailable for new writes but retained in allowedValues for historical display.

element: optional unknown

enforcement: optional "error" or "warn" or "off"

One of the following:

"error"

"warn"

"off"

format: optional "date" or "url" or "duration" or "country"

One of the following:

"date"

"url"

"duration"

"country"

label: optional string

maxLength128

minLength1

maxLength: optional number

exclusiveMinimum

minimum0

numberConstraint: optional object { integer, max, min }

integer: optional boolean

max: optional number

min: optional number

properties: optional map[unknown]

Map of property key to FieldDefinition for object fields. Required when kind is ‘object’. See FieldDefinition (recursive).

required: optional boolean

updatedAt: optional string

CategoryDeleteResponse object { uuid }

uuid: string

Cloudforce OneThreat EventsTagsIndicators

List a tag's indicators

GET/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}/indicators

ModelsExpand Collapse

IndicatorListResponse object { indicators, pagination }

indicators: array of object { createdAt, indicatorType, updatedAt, 7 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

relatedEventsHasMore: optional boolean

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags: optional array of object { categoryId, categoryName, uuid, value }

categoryId: optional string

The UUID of the tag category, or null when the tag is uncategorized.

categoryName: optional string

uuid: optional string

value: optional string

tlp: optional string

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

Cloudforce OneThreat EventsTagsIndicatorsBy Dataset

List indicators related to a tag within a dataset (deprecated)

Deprecated

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/tags/{tag_uuid}/indicators

ModelsExpand Collapse

ByDatasetListResponse object { indicators, pagination }

indicators: array of object { createdAt, indicatorType, updatedAt, 7 more }

createdAt: string

formatdate-time

indicatorType: string

updatedAt: string

formatdate-time

uuid: string

value: string

datasetId: optional string

The dataset ID this indicator belongs to. Included in list responses.

relatedEvents: optional array of object { datasetId, eventId, eventDate }

Related events, capped by relatedEventsLimit (default 2). Check relatedEventsHasMore to detect a capped list; pass relatedEventsLimit=-1 to retrieve all of them.

datasetId: string

eventId: string

eventDate: optional string

ISO 8601 date of the related event. Null for legacy relationships created before event-date tracking was added.

relatedEventsHasMore: optional boolean

True when this indicator appears in more events than relatedEvents contains because relatedEventsLimit capped the list. Pass relatedEventsLimit=-1 to retrieve every related event.

tags: optional array of object { categoryId, categoryName, uuid, value }

categoryId: optional string

The UUID of the tag category, or null when the tag is uncategorized.

categoryName: optional string

uuid: optional string

value: optional string

tlp: optional string

Traffic Light Protocol designation. UPPERCASE. Possible values: CLEAR, GREEN, AMBER, AMBER-STRICT, RED, PURPLE. Null when not set.

pagination: object { page, pageSize, totalCount, totalPages }

page: number

pageSize: number

totalCount: number

totalPages: number

Cloudforce OneThreat EventsEvent Tags

Add tags to an event (legacy)

POST/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}/create

Remove tags from an event (legacy)

DELETE/accounts/{account_id}/cloudforce-one/events/event_tag/{event_id}

ModelsExpand Collapse

EventTagCreateResponse object { success }

success: boolean

EventTagDeleteResponse object { success }

success: boolean

Cloudforce OneThreat EventsTarget Industries

List target industries used in datasets

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries

ModelsExpand Collapse

TargetIndustryListResponse object { items, type }

items: object { type }

type: string

Cloudforce OneThreat EventsTarget IndustriesBy Dataset

List target industries in a dataset (legacy)

GET/accounts/{account_id}/cloudforce-one/events/dataset/{dataset_id}/targetIndustries

ModelsExpand Collapse

ByDatasetListResponse object { items, type }

items: object { type }

type: string

Cloudforce OneThreat EventsTarget IndustriesCatalog

List all target industries

GET/accounts/{account_id}/cloudforce-one/events/targetIndustries/catalog

ModelsExpand Collapse

CatalogListResponse object { items, type }

items: object { type }

type: string

Cloudforce OneThreat EventsInsights

Cloudforce OneThreat Signals

Threat Signals API for managing threat intelligence feeds, articles, indicators, and AI skills in Cloudforce One.

Prerequisites

API token — requests must use an API token with Cloudforce One permissions; write operations (creating, editing, or deleting feeds, skills, and tags) require write access.
Plan limits — access on the Free plan is limited; feed quotas and managed default skills apply.

Cloudforce OneThreat SignalsSearch

Search Threat Signals articles using AI Search

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/search

ModelsExpand Collapse

SearchSearchResponse object { count, results }

Number of unique article candidates returned in this response. Equal to results.length.

minimum0

results: array of object { article_id, dataset_id, event_id, 3 more }

article_id: string

formatuuid

dataset_id: string

formatuuid

event_id: string

formatuuid

feed_id: string

formatuuid

score: number

text: string

Cloudforce OneThreat SignalsCategories

List Threat Signals feed categories

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/categories

ModelsExpand Collapse

CategoryListResponse object { categories }

categories: array of object { id, description, name }

id: string

Wire value accepted by the feed category_id field.

formatuuid

description: string

Plain-language description of the category.

Human-readable display label.

Cloudforce OneThreat SignalsFeeds

List Threat Signals feeds

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds

Create Threat Signals feed

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds

Update Threat Signals feed

PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}

Delete Threat Signals feed

DELETE/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}

Trigger Threat Signals feed poll

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/poll

ModelsExpand Collapse

FeedListResponse object { count, custom_feed_count, custom_feed_limit, 4 more }

Number of feeds on this page.

custom_feed_count: number

The current count of custom feeds for the account.

minimum0

custom_feed_limit: number

The resolved custom feed limit for the account.

minimum0

feeds: array of object { id, category_id, category_name, 12 more }

id: string

formatuuid

category_id: string

Feed category identifier. Null when unset.

category_name: string

Display name of the feed category. Null when unset or unresolvable.

created_at: string

curated_feed_id: string

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: string

enabled: boolean

last_polled_at: string

poll_interval_s: number

source_type: string

custom for a feed added by URL, curated for a curated catalog feed.

status: string

Polling health: active, or error after a failed poll.

subscribed_at: string

title: string

updated_at: string

url: string

page: number

per_page: number

total_count: number

FeedCreateResponse object { id, category_id, category_name, 12 more }

id: string

formatuuid

category_id: string

Feed category identifier. Null when unset.

category_name: string

Display name of the feed category. Null when unset or unresolvable.

created_at: string

curated_feed_id: string

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: string

enabled: boolean

last_polled_at: string

poll_interval_s: number

source_type: string

custom for a feed added by URL, curated for a curated catalog feed.

status: string

Polling health: active, or error after a failed poll.

subscribed_at: string

title: string

updated_at: string

url: string

FeedEditResponse object { id, category_id, category_name, 12 more }

id: string

formatuuid

category_id: string

Feed category identifier. Null when unset.

category_name: string

Display name of the feed category. Null when unset or unresolvable.

created_at: string

curated_feed_id: string

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: string

enabled: boolean

last_polled_at: string

poll_interval_s: number

source_type: string

custom for a feed added by URL, curated for a curated catalog feed.

status: string

Polling health: active, or error after a failed poll.

subscribed_at: string

title: string

updated_at: string

url: string

FeedDeleteResponse object { id, category_id, category_name, 12 more }

id: string

formatuuid

category_id: string

Feed category identifier. Null when unset.

category_name: string

Display name of the feed category. Null when unset or unresolvable.

created_at: string

curated_feed_id: string

Curated catalog feed this subscription was created from. Null for custom feeds.

display_name: string

enabled: boolean

last_polled_at: string

poll_interval_s: number

source_type: string

custom for a feed added by URL, curated for a curated catalog feed.

status: string

Polling health: active, or error after a failed poll.

subscribed_at: string

title: string

updated_at: string

url: string

FeedPollResponse object { errors, feeds, triggered }

errors: number

feeds: array of object { feed_id, status, workflow_id, feed_enabled }

feed_id: string

formatuuid

status: "workflow_created" or "error"

One of the following:

"workflow_created"

"error"

workflow_id: string

feed_enabled: optional boolean

triggered: number

Cloudforce OneThreat SignalsFeedsRaw

Get Threat Signals feed XML

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/raw

ModelsExpand Collapse

RawGetResponse = string

Cloudforce OneThreat SignalsFeedsSkills

Get Threat Signals feed skills

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/skills

Set Threat Signals feed skills

PUT/accounts/{account_id}/cloudforce-one/v2/threat-signals/feeds/{feed_id}/skills

ModelsExpand Collapse

SkillGetResponse object { feed_id, skills }

feed_id: string

formatuuid

skills: array of object { id, config, created_at, 7 more }

id: string

config: string

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

output_schema: string

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" or "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

SkillUpdateResponse object { feed_id, skills }

feed_id: string

formatuuid

skills: array of object { position, skill_id }

position: number

Zero-based pipeline position.

skill_id: string

Cloudforce OneThreat SignalsArticles

List Threat Signals articles

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles

Bulk update Threat Signals article read status

PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles

Get Threat Signals article

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}

Update Threat Signals article read status

PATCH/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}

ModelsExpand Collapse

ArticleListResponse object { articles, has_more, next_cursor, 2 more }

articles: array of object { id, dataset_id, event_id, 12 more }

id: string

formatuuid

dataset_id: string

Threat Events dataset identifier for the article redirect. Null when the account feeds dataset mapping is unavailable.

event_id: string

Threat Events event identifier associated with this article for a UI redirect. Null when no event has been linked.

feed_display_name: string

feed_id: string

formatuuid

fetched_at: string

link: string

published_at: string

read: boolean

read_at: string

relevance: object { band, pir_id, pirs }

Beta. The article’s relevance to the account’s active Priority Intelligence Requirements. Null when the article has not been scored against them, including when the account has no active PIRs, or has not been scored against the requested pir_id.

band: "low" or "medium" or "high"

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:

"low"

"medium"

"high"

pir_id: string

Beta. The pir_id requested from the article list, or otherwise the account’s most relevant active PIR for this article.

formatuuid

pirs: array of object { band, pir_id }

Beta. Every active PIR the article was scored against, most relevant first. Draft and deleted PIRs are excluded.

band: "low" or "medium" or "high"

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:

"low"

"medium"

"high"

pir_id: string

formatuuid

severity: "informational" or "low" or "medium" or 2 more

Beta. Intrinsic article severity band, from informational to critical, independent of any organisation or Priority Intelligence Requirement. Null when the account has no active Priority Intelligence Requirements, scoring has not completed, or a historic article has not entered an automatic rescore window.

One of the following:

"informational"

"low"

"medium"

"high"

"critical"

summary: string

Persisted enrichment summary. Null until enrichment produces a summary.

tags: array of object { applied_by, categoryId, uuid, value }

applied_by: "ai" or "analyst" or "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string

formatuuid

uuid: string

formatuuid

value: string

title: string

has_more: boolean

next_cursor: string

total_count: number

total_count_is_exact: boolean

ArticleBulkEditResponse object { updated_count }

updated_count: number

ArticleGetResponse object { id, bullet_points, content_r2_key, 18 more }

id: string

formatuuid

bullet_points: object { impact, what_happened, who_affected }

impact: string

what_happened: string

who_affected: string

content_r2_key: string

feed_display_name: string

feed_id: string

formatuuid

fetched_at: string

indicator_extraction_status: "in_progress" or "complete" or "failed" or "unknown"

Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded.

One of the following:

"in_progress"

"complete"

"failed"

"unknown"

link: string

metadata: map[unknown]

published_at: string

read: boolean

read_at: string

relevance: object { band, pir_id, pirs }

band: "low" or "medium" or "high"

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:

"low"

"medium"

"high"

pir_id: string

Beta. The pir_id requested from the article list, or otherwise the account’s most relevant active PIR for this article.

formatuuid

pirs: array of object { band, pir_id }

Beta. Every active PIR the article was scored against, most relevant first. Draft and deleted PIRs are excluded.

band: "low" or "medium" or "high"

Beta. How relevant the article is to a Priority Intelligence Requirement: high, medium, or low. Cloudflare may change the scores behind each band as relevance scoring is calibrated.

One of the following:

"low"

"medium"

"high"

pir_id: string

formatuuid

severity: "informational" or "low" or "medium" or 2 more

One of the following:

"informational"

"low"

"medium"

"high"

"critical"

source_count: number

summary: string

Persisted enrichment summary. Null until enrichment produces a summary.

summary_r2_key: string

tags: array of object { applied_by, categoryId, uuid, value }

applied_by: "ai" or "analyst" or "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string

formatuuid

uuid: string

formatuuid

value: string

title: string

skill_version: optional string

tag_skill_version: optional string

ArticleEditResponse object { id, bullet_points, content_r2_key, 17 more }

id: string

formatuuid

bullet_points: object { impact, what_happened, who_affected }

impact: string

what_happened: string

who_affected: string

content_r2_key: string

feed_display_name: string

feed_id: string

formatuuid

fetched_at: string

indicator_extraction_status: "in_progress" or "complete" or "failed" or "unknown"

Progress of the article’s indicator extraction and IOC contextualization run. complete and failed are terminal; unknown means no run has been recorded.

One of the following:

"in_progress"

"complete"

"failed"

"unknown"

link: string

metadata: map[unknown]

published_at: string

read: boolean

read_at: string

severity: "informational" or "low" or "medium" or 2 more

One of the following:

"informational"

"low"

"medium"

"high"

"critical"

source_count: number

summary: string

Persisted enrichment summary. Null until enrichment produces a summary.

summary_r2_key: string

tags: array of object { applied_by, categoryId, uuid, value }

applied_by: "ai" or "analyst" or "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string

formatuuid

uuid: string

formatuuid

value: string

title: string

skill_version: optional string

tag_skill_version: optional string

Cloudforce OneThreat SignalsArticlesContent

Get Threat Signals article content

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/content

ModelsExpand Collapse

ContentGetResponse = string

Cloudforce OneThreat SignalsArticlesTags

Add tag to Threat Signals article

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tags

Remove tag from Threat Signals article

DELETE/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tags/{tag_id}

Generate Threat Signals article AI tags

POST/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/tag

ModelsExpand Collapse

TagCreateResponse object { applied_by, categoryId, uuid, value }

applied_by: "ai" or "analyst" or "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string

formatuuid

uuid: string

formatuuid

value: string

TagDeleteResponse object { applied_by, categoryId, uuid, value }

applied_by: "ai" or "analyst" or "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string

formatuuid

uuid: string

formatuuid

value: string

TagGenerateResponse object { tag_skill_version, tags }

tag_skill_version: string

tags: array of object { applied_by, categoryId, uuid, value }

Final hydrated assignment set; may be empty when no applicable tags are selected.

applied_by: "ai" or "analyst" or "system"

One of the following:

"ai"

"analyst"

"system"

categoryId: string

formatuuid

uuid: string

formatuuid

value: string

Cloudforce OneThreat SignalsArticlesSkill Outputs

Get Threat Signals article skill output

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/articles/{article_id}/skills/{skill_id}/output

ModelsExpand Collapse

SkillOutputGetResponse object { article_id, custom_output, custom_output_parse_status, 4 more }

article_id: string

Article UUID that received the skill output.

formatuuid

custom_output: string or number or boolean or 2 more

Untrusted model output: parsed JSON when the stored completion text is valid JSON, otherwise raw text. Consumers must safely render or escape it.

One of the following:

string

number

boolean

map[unknown]

array of string or number or boolean or map[unknown]

One of the following:

string

number

boolean

map[unknown]

custom_output_parse_status: "parsed" or "invalid_json"

Whether custom_output was parsed from the stored completion text.

One of the following:

"parsed"

"invalid_json"

custom_output_validation_status: "valid" or "invalid_json" or "schema_invalid" or "unknown"

Non-blocking validation classification for untrusted model output. unknown is retained only for historical rows.

One of the following:

"valid"

"invalid_json"

"schema_invalid"

"unknown"

custom_skill_version: string

Custom Skill version that produced the output. Null when historical metadata is unavailable.

output_schema: string

JSON-encoded output schema. Null when historical skill metadata is unavailable.

skill_id: string

Custom Skill UUID that produced the output.

Cloudforce OneThreat SignalsIndicators

List Threat Signals article indicators

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/indicators

ModelsExpand Collapse

IndicatorListResponse object { indicators, pagination }

indicators: array of object { id, article_id, article_title, 5 more }

id: string

formatuuid

article_id: string

formatuuid

article_title: string

dataset_id: string

Threat Events dataset identifier for navigating from this indicator. Null when the account feeds dataset mapping is unavailable.

feed_display_name: string

feed_id: string

formatuuid

type: string

value: string

pagination: object { count, cursor, has_more, 4 more }

minimum0

cursor: string

has_more: boolean

page: number

Ordinal of this cursor page; not a total-results offset.

minimum1

per_page: number

maximum100

minimum1

total_count: number

minimum0

total_count_is_exact: boolean

ModelsExpand Collapse

SkillListResponse object { count, custom_skills_available, page, 3 more }

Number of skills on this page.

custom_skills_available: boolean

Whether Custom Skills are available to the account. False for Free Threat Signals accounts, which receive managed default skills only.

page: number

per_page: number

skills: array of object { id, config, created_at, 7 more }

id: string

config: string

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

output_schema: string

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" or "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

total_count: number

SkillCreateResponse object { id, config, created_at, 7 more }

id: string

config: string

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

output_schema: string

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" or "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

SkillGetResponse object { id, config, created_at, 7 more }

id: string

config: string

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

output_schema: string

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" or "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

SkillEditResponse object { id, config, created_at, 7 more }

id: string

config: string

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

output_schema: string

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" or "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

SkillDeleteResponse object { id, config, created_at, 7 more }

id: string

config: string

JSON-encoded skill configuration. Always null for default skills.

created_at: string

is_active: number

1 when active, 0 when inactive.

output_schema: string

JSON-encoded JSON Schema the skill output must satisfy.

prompt: string

source: "default" or "custom"

default for Cloudforce One managed skills (read-only), custom for account skills.

One of the following:

"default"

"custom"

type: string

updated_at: string

Cloudforce OneThreat SignalsSkillsTag Categories

Get Threat Signals skill tag categories

GET/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}/tag-categories

Replace Threat Signals skill tag categories

PUT/accounts/{account_id}/cloudforce-one/v2/threat-signals/skills/{skill_id}/tag-categories

ModelsExpand Collapse

TagCategoryGetResponse object { category_uuids, skill_id }

category_uuids: array of string

skill_id: "default-tagging-skill"

TagCategoryUpdateResponse object { category_uuids, skill_id }

category_uuids: array of string

skill_id: "default-tagging-skill"

Sunbelt Computer Software

PL/B Language Development and Support

Cloudforce One

Cloudforce OneBinary Storage

ModelsExpand Collapse

Cloudforce OneRequests

ModelsExpand Collapse

Cloudforce OneRequestsMessage

ModelsExpand Collapse

Cloudforce OneRequestsPriority

ModelsExpand Collapse

Cloudforce OneRequestsAssets

ModelsExpand Collapse

Cloudforce OneScans

Cloudforce OneScansResults

ModelsExpand Collapse

Cloudforce OneScansConfig

ModelsExpand Collapse

Cloudforce OneThreat Events

ModelsExpand Collapse

Cloudforce OneThreat EventsAggregate

ModelsExpand Collapse

Cloudforce OneThreat EventsGraphql

ModelsExpand Collapse

Cloudforce OneThreat EventsGraph

ModelsExpand Collapse

Cloudforce OneThreat EventsQueries

ModelsExpand Collapse

Cloudforce OneThreat EventsRelationships

ModelsExpand Collapse

Cloudforce OneThreat EventsIndicators

ModelsExpand Collapse

Cloudforce OneThreat EventsIndicatorsAggregate

ModelsExpand Collapse

Cloudforce OneThreat EventsIndicatorsTypes

ModelsExpand Collapse

Cloudforce OneThreat EventsIndicatorsBy Dataset

ModelsExpand Collapse

Cloudforce OneThreat EventsIndicatorsBy DatasetTags

ModelsExpand Collapse

Cloudforce OneThreat EventsAttackers

ModelsExpand Collapse

Cloudforce OneThreat EventsCategories

ModelsExpand Collapse

Cloudforce OneThreat EventsCategoriesCatalog

ModelsExpand Collapse

Cloudforce OneThreat EventsCountries

ModelsExpand Collapse

Cloudforce OneThreat EventsCrons

Cloudforce OneThreat EventsDatasets

ModelsExpand Collapse

Cloudforce OneThreat EventsDatasetsHealth

Cloudforce OneThreat EventsDatasetsEvents

ModelsExpand Collapse

Cloudforce OneThreat EventsRaw

ModelsExpand Collapse

Cloudforce OneThreat EventsRelate

ModelsExpand Collapse

Cloudforce OneThreat EventsTags

ModelsExpand Collapse

Cloudforce OneThreat EventsTagsCategories

ModelsExpand Collapse

Cloudforce OneThreat EventsTagsIndicators

ModelsExpand Collapse

Cloudforce OneThreat EventsTagsIndicatorsBy Dataset

ModelsExpand Collapse

Cloudforce OneThreat EventsEvent Tags

ModelsExpand Collapse

Cloudforce OneThreat EventsTarget Industries

ModelsExpand Collapse