{"command":{"effect":"read","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Lists events, with filters passed as query parameters. `datasetId` accepts dataset UUIDs or one scope value used alone: `all` (or `*`) and `operational` select the intelligence datasets you can read, and `analytics` selects the analytics datasets you can read. A scope value covers at most 50 datasets. Without `datasetId`, the default Cloudforce One Threat Events dataset is used. To send filters in a JSON body instead, use `threat-intel events search`.","properties":{"path":{"type":"object","properties":{"account_id":{"description":"Account ID.","type":"string"}},"required":["account_id"],"additionalProperties":false},"query":{"type":"object","properties":{"cursor":{"description":"Cursor for pagination. When provided, filters are embedded in the cursor so you only need to pass cursor and pageSize. Returned in the previous response's result_info.cursor field. Use cursor-based pagination for deep pagination (beyond 100,000 records) or for optimal performance.","type":"string","examples":["eyJ2ZXJzaW9uIjoxLCJwb3NpdGlvbiI6eyJkYXRlIjoiMjAyNC0wMS0xMlQxMDowMDowMFoiLCJ1dWlkIjoiYWJjMTIzIn19"]},"search":{"type":"array","items":{"anyOf":[{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["attacker","attackerCountry","category","createdAt","date","event","indicator","indicatorType","mitreAttack","mitreCapec","tags","targetCountry","targetIndustry","tlp","uuid"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte","like","contains","startsWith","endsWith","find"]},"value":{"type":"string","maxLength":512,"minLength":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["attacker","attackerCountry","category","createdAt","date","event","indicator","indicatorType","mitreAttack","mitreCapec","tags","targetCountry","targetIndustry","tlp","uuid"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"maxLength":512,"minLength":1,"type":"string"},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["killChain"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte"]},"value":{"anyOf":[{"type":"number"},{"pattern":"^-?(?:\\d+\\.?\\d*|\\.\\d+)$","type":"string"}]}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["killChain"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"anyOf":[{"type":"number"},{"pattern":"^-?(?:\\d+\\.?\\d*|\\.\\d+)$","type":"string"}]},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["hasChildren"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte"]},"value":{"anyOf":[{"type":"boolean"},{"enum":["true"],"type":"string"},{"enum":["false"],"type":"string"},{"enum":[1],"type":"number"},{"enum":[0],"type":"number"},{"enum":["1"],"type":"string"},{"enum":["0"],"type":"string"}]}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["hasChildren"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"anyOf":[{"type":"boolean"},{"enum":["true"],"type":"string"},{"enum":["false"],"type":"string"},{"enum":[1],"type":"number"},{"enum":[0],"type":"number"},{"enum":["1"],"type":"string"},{"enum":["0"],"type":"string"}]},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"}]},"default":[],"maxItems":10},"searchBranches":{"description":"JSON-encoded. OR branches of structured search filters. Filters within a branch are AND'd, branches are OR'd, and the result is AND'd with `search`: `AND(search) AND OR(AND(branch 1), ...)`. Max 8 branches of 1-10 conditions each. Not supported for analytics datasets, and `indicator` filters are not yet supported inside branches. Cursor pages carry the original branches, so do not resend them with `cursor`.","type":"array","items":{"items":{"anyOf":[{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["attacker","attackerCountry","category","createdAt","date","event","indicator","indicatorType","mitreAttack","mitreCapec","tags","targetCountry","targetIndustry","tlp","uuid"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte","like","contains","startsWith","endsWith","find"]},"value":{"type":"string","maxLength":512,"minLength":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["attacker","attackerCountry","category","createdAt","date","event","indicator","indicatorType","mitreAttack","mitreCapec","tags","targetCountry","targetIndustry","tlp","uuid"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"maxLength":512,"minLength":1,"type":"string"},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["killChain"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte"]},"value":{"anyOf":[{"type":"number"},{"pattern":"^-?(?:\\d+\\.?\\d*|\\.\\d+)$","type":"string"}]}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["killChain"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"anyOf":[{"type":"number"},{"pattern":"^-?(?:\\d+\\.?\\d*|\\.\\d+)$","type":"string"}]},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["hasChildren"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte"]},"value":{"anyOf":[{"type":"boolean"},{"enum":["true"],"type":"string"},{"enum":["false"],"type":"string"},{"enum":[1],"type":"number"},{"enum":[0],"type":"number"},{"enum":["1"],"type":"string"},{"enum":["0"],"type":"string"}]}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["hasChildren"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"anyOf":[{"type":"boolean"},{"enum":["true"],"type":"string"},{"enum":["false"],"type":"string"},{"enum":[1],"type":"number"},{"enum":[0],"type":"number"},{"enum":["1"],"type":"string"},{"enum":["0"],"type":"string"}]},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"}]},"maxItems":10,"minItems":1,"type":"array"},"maxItems":8,"minItems":1},"page":{"description":"Page number (1-indexed) for offset-based pagination. Limited to offset of 100,000 records. For deep pagination, use cursor-based pagination instead.","type":"number"},"pageSize":{"description":"Number of results per page. Maximum 25,000.","type":"number"},"orderBy":{"type":"string"},"order":{"type":"string","enum":["asc","desc"]},"datasetId":{"description":"Dataset UUIDs to query, or one standalone scope value: 'all'/'*' or 'operational' for readable intelligence datasets (isAnalytics=false), or 'analytics' for readable analytics datasets (isAnalytics=true). Scope values query at most 50 datasets. If not provided, uses the default dataset.","type":"array","items":{"type":"string"}},"forceRefresh":{"type":"boolean"},"format":{"type":"string","enum":["json","stix2","taxii"]},"cache":{"description":"Cache strategy. 'from-graph' serves results from the graph-node KV cache when all requested UUIDs are cached; falls back to normal path on partial/zero hit.","type":"string","enum":["from-graph"]}},"required":[],"additionalProperties":false}},"required":["path"],"additionalProperties":false},"name":"List events","id":"cloudflare.get_eventlistget","example":{"path":{"account_id":"example"}},"maxRequests":1,"summary":false}}