API Reference

Cloudforce One

Threat Events

Tags

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Updates a tag (SoT)

client.CloudforceOne.ThreatEvents.Tags.Edit(ctx, tagUUID, params) (*ThreatEventTagEditResponse, error)

PATCH/accounts/{account_id}/cloudforce-one/events/tags/{tag_uuid}

Updates a Source-of-Truth tag by UUID.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

Accepted Permissions (at least one required)

Cloudforce One Write

ParametersExpand Collapse

tagUUID string

Tag UUID.

params ThreatEventTagEditParams

AccountID param.Field[string]

Path param: Account ID.

ActiveDuration param.Field[string]Optional

Body param

ActorCategory param.Field[string]Optional

Body param: Actor variety. Allowed values: Activist, Competitor, Customer, Crime Syndicate, Former Employee, Nation State, Organized Crime, Nation State Affiliated, Terrorist, Unaffiliated.

ActorCategoryConfidence param.Field[int64]Optional

Body param: Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

Aliases param.Field[[]ThreatEventTagEditParamsAlias]Optional

Body param: Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

Value string

Confidence int64Optional

maximum10

minimum1

TLP ThreatEventTagEditParamsAliasesTLPOptional

One of the following:

const ThreatEventTagEditParamsAliasesTLPRed ThreatEventTagEditParamsAliasesTLP = "red"

const ThreatEventTagEditParamsAliasesTLPAmber ThreatEventTagEditParamsAliasesTLP = "amber"

const ThreatEventTagEditParamsAliasesTLPGreen ThreatEventTagEditParamsAliasesTLP = "green"

const ThreatEventTagEditParamsAliasesTLPWhite ThreatEventTagEditParamsAliasesTLP = "white"

AliasGroupNames param.Field[[]string]Optional

Body param

AliasGroupNamesInternal param.Field[[]string]Optional

Body param

AnalyticPriority param.Field[float64]Optional

Body param

AttributionConfidence param.Field[string]Optional

Body param

AttributionConfidenceScore param.Field[int64]Optional

Body param

maximum10

minimum1

AttributionOrganization param.Field[string]Optional

Body param

CategoryUUID param.Field[string]Optional

Body param

DateOfDiscovery param.Field[string]Optional

Body param: Date the actor was discovered (ISO YYYY-MM-DD).

ExternalReferenceLinks param.Field[[]string]Optional

Body param

ExternalReferences param.Field[[]ThreatEventTagEditParamsExternalReference]Optional

Body param: Structured external references ({ url, description }). Public: returned to all accounts.

URL string

Description stringOptional

InternalAliases param.Field[[]ThreatEventTagEditParamsInternalAlias]Optional

Body param: Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

Value string

Confidence int64Optional

maximum10

minimum1

TLP ThreatEventTagEditParamsInternalAliasesTLPOptional

One of the following:

const ThreatEventTagEditParamsInternalAliasesTLPRed ThreatEventTagEditParamsInternalAliasesTLP = "red"

const ThreatEventTagEditParamsInternalAliasesTLPAmber ThreatEventTagEditParamsInternalAliasesTLP = "amber"

const ThreatEventTagEditParamsInternalAliasesTLPGreen ThreatEventTagEditParamsInternalAliasesTLP = "green"

const ThreatEventTagEditParamsInternalAliasesTLPWhite ThreatEventTagEditParamsInternalAliasesTLP = "white"

InternalDescription param.Field[string]Optional

Body param

Motive param.Field[string]Optional

Body param: Actor motive. Allowed values: Convenience, Fear, Fun, Financial, Grudge, Ideology, Espionage.

MotiveConfidence param.Field[int64]Optional

Body param: Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

OpsecLevel param.Field[string]Optional

Body param

OriginCountryConfidence param.Field[int64]Optional

Body param: Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

OriginCountryISO param.Field[string]Optional

Body param

OriginCountryTLP param.Field[ThreatEventTagEditParamsOriginCountryTLP]Optional

Body param: TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

const ThreatEventTagEditParamsOriginCountryTLPRed ThreatEventTagEditParamsOriginCountryTLP = "red"

const ThreatEventTagEditParamsOriginCountryTLPAmber ThreatEventTagEditParamsOriginCountryTLP = "amber"

const ThreatEventTagEditParamsOriginCountryTLPGreen ThreatEventTagEditParamsOriginCountryTLP = "green"

const ThreatEventTagEditParamsOriginCountryTLPWhite ThreatEventTagEditParamsOriginCountryTLP = "white"

Priority param.Field[float64]Optional

Body param

SophisticationLevel param.Field[string]Optional

Body param

Value param.Field[string]Optional

Body param

ReturnsExpand Collapse

type ThreatEventTagEditResponse struct{…}

UUID string

Value string

ActiveDuration stringOptional

ActorCategory stringOptional

ActorCategoryConfidence int64Optional

Confidence (1-10) in the actor variety (actorCategory). CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

Aliases []ThreatEventTagEditResponseAliasOptional

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

Value string

Confidence int64Optional

maximum10

minimum1

TLP ThreatEventTagEditResponseAliasesTLPOptional

One of the following:

const ThreatEventTagEditResponseAliasesTLPRed ThreatEventTagEditResponseAliasesTLP = "red"

const ThreatEventTagEditResponseAliasesTLPAmber ThreatEventTagEditResponseAliasesTLP = "amber"

const ThreatEventTagEditResponseAliasesTLPGreen ThreatEventTagEditResponseAliasesTLP = "green"

const ThreatEventTagEditResponseAliasesTLPWhite ThreatEventTagEditResponseAliasesTLP = "white"

AliasGroupNames []stringOptional

AliasGroupNamesInternal []stringOptional

AnalyticPriority float64Optional

AttributionConfidence stringOptional

AttributionConfidenceScore int64Optional

maximum10

minimum1

AttributionOrganization stringOptional

CategoryName stringOptional

CategoryUUID stringOptional

DateOfDiscovery stringOptional

ExternalReferenceLinks []stringOptional

ExternalReferences []ThreatEventTagEditResponseExternalReferenceOptional

Structured external references ({ url, description }). Public: returned to all accounts.

URL string

Description stringOptional

InternalAliases []ThreatEventTagEditResponseInternalAliasOptional

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

Value string

Confidence int64Optional

maximum10

minimum1

TLP ThreatEventTagEditResponseInternalAliasesTLPOptional

One of the following:

const ThreatEventTagEditResponseInternalAliasesTLPRed ThreatEventTagEditResponseInternalAliasesTLP = "red"

const ThreatEventTagEditResponseInternalAliasesTLPAmber ThreatEventTagEditResponseInternalAliasesTLP = "amber"

const ThreatEventTagEditResponseInternalAliasesTLPGreen ThreatEventTagEditResponseInternalAliasesTLP = "green"

const ThreatEventTagEditResponseInternalAliasesTLPWhite ThreatEventTagEditResponseInternalAliasesTLP = "white"

InternalDescription stringOptional

Motive stringOptional

MotiveConfidence int64Optional

Confidence (1-10) in the actor motive. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

OpsecLevel stringOptional

OriginCountryConfidence int64Optional

Confidence (1-10) in the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

maximum10

minimum1

OriginCountryISO stringOptional

OriginCountryISOAlpha3 stringOptional

OriginCountryTLP ThreatEventTagEditResponseOriginCountryTLPOptional

TLP marking for the origin-country attribution. CFONE-only: stripped from responses to non-CFONE accounts.

One of the following:

const ThreatEventTagEditResponseOriginCountryTLPRed ThreatEventTagEditResponseOriginCountryTLP = "red"

const ThreatEventTagEditResponseOriginCountryTLPAmber ThreatEventTagEditResponseOriginCountryTLP = "amber"

const ThreatEventTagEditResponseOriginCountryTLPGreen ThreatEventTagEditResponseOriginCountryTLP = "green"

const ThreatEventTagEditResponseOriginCountryTLPWhite ThreatEventTagEditResponseOriginCountryTLP = "white"

Priority float64Optional

SophisticationLevel stringOptional

Updates a tag (SoT)

Go

HTTP

TypeScript

Python

Go

Terraform

package main

import (
  "context"
  "fmt"

  "github.com/cloudflare/cloudflare-go"
  "github.com/cloudflare/cloudflare-go/cloudforce_one"
  "github.com/cloudflare/cloudflare-go/option"
)

func main() {
  client := cloudflare.NewClient(
    option.WithAPIToken("Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY"),
  )
  response, err := client.CloudforceOne.ThreatEvents.Tags.Edit(
    context.TODO(),
    "tag_uuid",
    cloudforce_one.ThreatEventTagEditParams{
      AccountID: cloudflare.F("account_id"),
    },
  )
  if err != nil {
    panic(err.Error())
  }
  fmt.Printf("%+v\n", response.UUID)
}

200 example

{
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "value": "APT28",
  "activeDuration": "activeDuration",
  "actorCategory": "actorCategory",
  "actorCategoryConfidence": 7,
  "aliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "aliasGroupNames": [
    "string"
  ],
  "aliasGroupNamesInternal": [
    "string"
  ],
  "analyticPriority": 0,
  "attributionConfidence": "attributionConfidence",
  "attributionConfidenceScore": 7,
  "attributionOrganization": "attributionOrganization",
  "categoryName": "Nation State",
  "categoryUuid": "12345678-1234-1234-1234-1234567890ab",
  "dateOfDiscovery": "2024-01-15",
  "externalReferenceLinks": [
    "string"
  ],
  "externalReferences": [
    {
      "url": "https://example.com/report",
      "description": "Vendor threat report"
    }
  ],
  "internalAliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "internalDescription": "internalDescription",
  "motive": "motive",
  "motiveConfidence": 7,
  "opsecLevel": "opsecLevel",
  "originCountryConfidence": 7,
  "originCountryISO": "originCountryISO",
  "originCountryISOAlpha3": "IRN",
  "originCountryTlp": "amber",
  "priority": 0,
  "sophisticationLevel": "sophisticationLevel"
}

Returns Examples

200 example

{
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "value": "APT28",
  "activeDuration": "activeDuration",
  "actorCategory": "actorCategory",
  "actorCategoryConfidence": 7,
  "aliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "aliasGroupNames": [
    "string"
  ],
  "aliasGroupNamesInternal": [
    "string"
  ],
  "analyticPriority": 0,
  "attributionConfidence": "attributionConfidence",
  "attributionConfidenceScore": 7,
  "attributionOrganization": "attributionOrganization",
  "categoryName": "Nation State",
  "categoryUuid": "12345678-1234-1234-1234-1234567890ab",
  "dateOfDiscovery": "2024-01-15",
  "externalReferenceLinks": [
    "string"
  ],
  "externalReferences": [
    {
      "url": "https://example.com/report",
      "description": "Vendor threat report"
    }
  ],
  "internalAliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "internalDescription": "internalDescription",
  "motive": "motive",
  "motiveConfidence": 7,
  "opsecLevel": "opsecLevel",
  "originCountryConfidence": 7,
  "originCountryISO": "originCountryISO",
  "originCountryISOAlpha3": "IRN",
  "originCountryTlp": "amber",
  "priority": 0,
  "sophisticationLevel": "sophisticationLevel"
}