Aggregate events by single or multiple columns with optional date filtering

client.cloudforceOne.threatEvents.aggregate.list(, ?): AggregateListResponse { aggregateBy, aggregations, total, dateRange }

GET/accounts/{account_id}/cloudforce-one/events/aggregate

Aggregate threat events by one or more columns (e.g., attacker, targetIndustry) with optional date filtering and daily grouping. Supports multi-dimensional aggregation for cross-analysis.

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

Accepted Permissions (at least one required)

Cloudforce One WriteCloudforce One Read

ParametersExpand Collapse

params: AggregateListParams { account_id, aggregateBy, datasetId, 4 more }

account_id: string

Path param: Account ID.

aggregateBy: string

Query param: Column(s) to aggregate by - single column or comma-separated list (e.g., ‘attacker’, ‘targetIndustry’, ‘attacker,targetIndustry’)

datasetId?: Array<string>

Query param: Dataset ID(s) to filter by. Can be a single dataset ID, comma-separated list, or array. If not provided, uses default dataset

endDate?: string

Query param: End date for filtering (ISO 8601 format, e.g., ‘2024-12-31’)

groupByDate?: boolean

Query param: Whether to group results by date (daily aggregation)

limit?: number

Query param: Maximum number of results to return

startDate?: string

Query param: Start date for filtering (ISO 8601 format, e.g., ‘2024-01-01’)

ReturnsExpand Collapse

AggregateListResponse { aggregateBy, aggregations, total, dateRange }

aggregateBy: string

Column(s) that were aggregated by

aggregations: Array<Aggregation>

Array of aggregation results with dynamic fields based on aggregateBy columns

count: number

Number of events for this aggregation

date?: string

Date (if groupByDate is true)

total: number

Total number of events in the aggregation

dateRange?: DateRange { endDate, startDate }

Date range used for filtering

endDate?: string

startDate?: string

Aggregate events by single or multiple columns with optional date filtering

import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const aggregates = await client.cloudforceOne.threatEvents.aggregate.list({
  account_id: 'account_id',
  aggregateBy: 'aggregateBy',
});

console.log(aggregates.aggregateBy);

{
  "aggregateBy": "aggregateBy",
  "aggregations": [
    {
      "count": 0,
      "date": "date"
    }
  ],
  "total": 0,
  "dateRange": {
    "endDate": "endDate",
    "startDate": "startDate"
  }
}

Returns Examples

{
  "aggregateBy": "aggregateBy",
  "aggregations": [
    {
      "count": 0,
      "date": "date"
    }
  ],
  "total": 0,
  "dateRange": {
    "endDate": "endDate",
    "startDate": "startDate"
  }
}