Create a saved event query

client.cloudforceOne.threatEvents.queries.create(, ?): QueryCreateResponse { id, account_id, alert_enabled, 10 more }

POST/accounts/{account_id}/cloudforce-one/events/queries/create

Create a new saved event query for the account

Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token.

Example:Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

Accepted Permissions (at least one required)

Cloudforce One WriteCloudforce One Read

ParametersExpand Collapse

params: QueryCreateParams { account_id, alert_enabled, alert_rollup_enabled, 4 more }

account_id: string

Path param: Account ID.

alert_enabled: boolean

Body param: Enable alerts for this query

alert_rollup_enabled: boolean

Body param: Enable alert rollup for this query

name: string

Body param: Unique name for the saved query

query_json: string

Body param: JSON string containing the query parameters

rule_enabled: boolean

Body param: Enable rule for this query

rule_scope?: string

Body param: Scope for the rule

ReturnsExpand Collapse

QueryCreateResponse { id, account_id, alert_enabled, 10 more }

id: number

Unique identifier for the saved query

account_id: number

Account ID

alert_enabled: boolean

Whether alerts are enabled

alert_rollup_enabled: boolean

Whether alert rollup is enabled

created_at: string

Creation timestamp

name: string

Name of the saved query

query_json: string

JSON string containing the query parameters

rule_enabled: boolean

Whether rule is enabled

updated_at: string

Last update timestamp

user_email: string

Email of the user who created the query

custom_threat_feed_id?: number | null

Intel Indicator Feed ID (numeric)

rule_list_id?: string

WAF rules list ID for blocking

rule_scope?: string

Scope for the rule

Create a saved event query

import Cloudflare from 'cloudflare';

const client = new Cloudflare({
  apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted
});

const query = await client.cloudforceOne.threatEvents.queries.create({
  account_id: 'account_id',
  alert_enabled: true,
  alert_rollup_enabled: true,
  name: 'name',
  query_json: 'query_json',
  rule_enabled: true,
});

console.log(query.id);

{
  "id": 0,
  "account_id": 0,
  "alert_enabled": true,
  "alert_rollup_enabled": true,
  "created_at": "created_at",
  "name": "name",
  "query_json": "query_json",
  "rule_enabled": true,
  "updated_at": "updated_at",
  "user_email": "user_email",
  "custom_threat_feed_id": 0,
  "rule_list_id": "rule_list_id",
  "rule_scope": "rule_scope"
}

Returns Examples

{
  "id": 0,
  "account_id": 0,
  "alert_enabled": true,
  "alert_rollup_enabled": true,
  "created_at": "created_at",
  "name": "name",
  "query_json": "query_json",
  "rule_enabled": true,
  "updated_at": "updated_at",
  "user_email": "user_email",
  "custom_threat_feed_id": 0,
  "rule_list_id": "rule_list_id",
  "rule_scope": "rule_scope"
}