API Reference

Cloudforce One

Threat Events

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Queries

List all saved event queries

client.cloudforceOne.threatEvents.queries.list(QueryListParams { account_id } params, RequestOptionsoptions?): QueryListResponse { id, account_id, alert_enabled, 10 more }

GET/accounts/{account_id}/cloudforce-one/events/queries

Create a saved event query

client.cloudforceOne.threatEvents.queries.create(QueryCreateParams { account_id, alert_enabled, alert_rollup_enabled, 4 more } params, RequestOptionsoptions?): QueryCreateResponse { id, account_id, alert_enabled, 10 more }

POST/accounts/{account_id}/cloudforce-one/events/queries/create

Read a saved event query

client.cloudforceOne.threatEvents.queries.get(numberqueryID, QueryGetParams { account_id } params, RequestOptionsoptions?): QueryGetResponse { id, account_id, alert_enabled, 10 more }

GET/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Update a saved event query

client.cloudforceOne.threatEvents.queries.edit(numberqueryID, QueryEditParams { account_id, alert_enabled, alert_rollup_enabled, 4 more } params, RequestOptionsoptions?): QueryEditResponse { id, account_id, alert_enabled, 10 more }

PATCH/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

Delete a saved event query

client.cloudforceOne.threatEvents.queries.delete(numberqueryID, QueryDeleteParams { account_id } params, RequestOptionsoptions?): void

DELETE/accounts/{account_id}/cloudforce-one/events/queries/{query_id}

ModelsExpand Collapse

QueryListResponse = Array<QueryListResponseItem>

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

QueryCreateResponse { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

QueryGetResponse { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

QueryEditResponse { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule