Skip to content
Cloudflare API
Start here
API Reference
Cloudforce One
Threat Events
Tags

Creates a new tag

client.cloudforceOne.threatEvents.tags.create(TagCreateParams { account_id, value, activeDuration, 18 more } params, RequestOptionsoptions?): TagCreateResponse { uuid, value, activeDuration, 20 more }
POST/accounts/{account_id}/cloudforce-one/events/tags/create

Creates a new tag to be used accross threat events.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY
Accepted Permissions (at least one required)
Cloudforce One WriteCloudforce One Read
ParametersExpand Collapse
params: TagCreateParams { account_id, value, activeDuration, 18 more }
account_id: string

Path param: Account ID.

value: string

Body param

activeDuration?: string

Body param

actorCategory?: string

Body param: Actor variety. Allowed values: Activist, Competitor, Customer, Crime Syndicate, Former Employee, Nation State, Organized Crime, Nation State Affiliated, Terrorist, Unaffiliated.

aliases?: Array<Alias>

Body param: Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "green" | "white" | null
One of the following:
"red"
"amber"
"green"
"white"
aliasGroupNames?: Array<string>

Body param

aliasGroupNamesInternal?: Array<string>

Body param

analyticPriority?: number

Body param

attributionConfidence?: string

Body param

attributionConfidenceScore?: number

Body param

maximum10
minimum1
attributionOrganization?: string

Body param

categoryUuid?: string

Body param

dateOfDiscovery?: string

Body param: Date the actor was discovered (ISO YYYY-MM-DD).

internalAliases?: Array<InternalAlias>

Body param: Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "green" | "white" | null
One of the following:
"red"
"amber"
"green"
"white"
internalDescription?: string

Body param

motive?: string

Body param: Actor motive. Allowed values: Convenience, Fear, Fun, Financial, Grudge, Ideology, Espionage.

opsecLevel?: string

Body param

originCountryISO?: string

Body param

priority?: number

Body param

sophisticationLevel?: string

Body param

ReturnsExpand Collapse
TagCreateResponse { uuid, value, activeDuration, 20 more }
uuid: string
value: string
activeDuration?: string
actorCategory?: string
aliases?: Array<Alias>

Structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: stripped from responses to non-CFONE accounts.

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "green" | "white" | null
One of the following:
"red"
"amber"
"green"
"white"
aliasGroupNames?: Array<string>
aliasGroupNamesInternal?: Array<string>
analyticPriority?: number
attributionConfidence?: string
attributionConfidenceScore?: number
maximum10
minimum1
attributionOrganization?: string
categoryName?: string
categoryUuid?: string
dateOfDiscovery?: string
internalAliases?: Array<InternalAlias>

Internal structured aliases ({ value, confidence 1-10, tlp }). CFONE-only: never returned to non-CFONE accounts.

value: string
confidence?: number | null
maximum10
minimum1
tlp?: "red" | "amber" | "green" | "white" | null
One of the following:
"red"
"amber"
"green"
"white"
internalDescription?: string
motive?: string
opsecLevel?: string
originCountryISO?: string
originCountryISOAlpha3?: string
priority?: number
sophisticationLevel?: string

Creates a new tag

import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const tag = await client.cloudforceOne.threatEvents.tags.create({
  account_id: 'account_id',
  value: 'APT28',
});

console.log(tag.uuid);
{
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "value": "APT28",
  "activeDuration": "activeDuration",
  "actorCategory": "actorCategory",
  "aliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "aliasGroupNames": [
    "string"
  ],
  "aliasGroupNamesInternal": [
    "string"
  ],
  "analyticPriority": 0,
  "attributionConfidence": "attributionConfidence",
  "attributionConfidenceScore": 7,
  "attributionOrganization": "attributionOrganization",
  "categoryName": "Nation State",
  "categoryUuid": "12345678-1234-1234-1234-1234567890ab",
  "dateOfDiscovery": "2024-01-15",
  "externalReferenceLinks": [
    "string"
  ],
  "internalAliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "internalDescription": "internalDescription",
  "motive": "motive",
  "opsecLevel": "opsecLevel",
  "originCountryISO": "originCountryISO",
  "originCountryISOAlpha3": "IRN",
  "priority": 0,
  "sophisticationLevel": "sophisticationLevel"
}
Returns Examples
{
  "uuid": "12345678-1234-1234-1234-1234567890ab",
  "value": "APT28",
  "activeDuration": "activeDuration",
  "actorCategory": "actorCategory",
  "aliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "aliasGroupNames": [
    "string"
  ],
  "aliasGroupNamesInternal": [
    "string"
  ],
  "analyticPriority": 0,
  "attributionConfidence": "attributionConfidence",
  "attributionConfidenceScore": 7,
  "attributionOrganization": "attributionOrganization",
  "categoryName": "Nation State",
  "categoryUuid": "12345678-1234-1234-1234-1234567890ab",
  "dateOfDiscovery": "2024-01-15",
  "externalReferenceLinks": [
    "string"
  ],
  "internalAliases": [
    {
      "value": "Fancy Bear",
      "confidence": 8,
      "tlp": "amber"
    }
  ],
  "internalDescription": "internalDescription",
  "motive": "motive",
  "opsecLevel": "opsecLevel",
  "originCountryISO": "originCountryISO",
  "originCountryISOAlpha3": "IRN",
  "priority": 0,
  "sophisticationLevel": "sophisticationLevel"
}