{"command":{"effect":"read","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Lists indicators across datasets, newest first. `datasetIds` accepts dataset UUIDs or one scope value used alone: `all` (or `*`) and `operational` select the intelligence datasets you can read, and `analytics` selects the analytics datasets you can read. Without `datasetIds`, the default dataset is used.","properties":{"path":{"type":"object","properties":{"account_id":{"description":"Account ID.","type":"string"}},"required":["account_id"],"additionalProperties":false},"query":{"type":"object","properties":{"datasetIds":{"description":"Dataset UUIDs to query, or one standalone scope value: 'all'/'*' or 'operational' for readable intelligence datasets (isAnalytics=false), or 'analytics' for readable analytics datasets (isAnalytics=true). If not provided, uses the default dataset.","type":"array","items":{"type":"string"}},"page":{"type":"number"},"pageSize":{"type":"number"},"search":{"description":"Structured search as a JSON array of {field, op, value} objects. Searchable fields: value, indicatorType, uuid. Supports operators: equals, not, contains, startsWith, endsWith, gt, lt, gte, lte, like, in, find. Use the 'in' operator with an array value to bulk-check up to 100 indicators in a single request, e.g. search=[{\"field\":\"value\",\"op\":\"in\",\"value\":[\"evil.com\",\"bad.org\"]}]. Multiple conditions are AND'd together. Max 10 conditions per request.","type":"array","items":{"properties":{"field":{"description":"The indicator field to search on. Allowed: value, indicatorType, uuid.","type":"string","enum":["value","indicatorType","uuid"],"examples":["value"]},"op":{"description":"Search operator. Use 'in' for bulk lookup of up to 100 values at once, e.g. {field:'value', op:'in', value:['evil.com','bad.org']}.","type":"string","enum":["equals","not","gt","gte","lt","lte","like","contains","startsWith","endsWith","in","find"],"examples":["contains"]},"value":{"description":"Search value. String for most operators. Array of strings for 'in' operator (max 100 items).","anyOf":[{"type":"string","examples":["malicious"]},{"items":{"type":"string"},"type":"array"}]}},"required":["field","op","value"],"type":"object"}},"name":{"description":"Filter indicators by value using substring match (LIKE). Legacy alternative to structured search.","type":"string"},"indicatorType":{"type":"string"},"relatedEvents":{"description":"Filter by related event IDs","type":"array","items":{"type":"string"}},"tags":{"description":"Filter by tag values or UUIDs. Indicators must have at least one of the specified tags (OR logic). Supports both tag UUID and tag value.","type":"array","items":{"type":"string"}},"tagSearch":{"description":"Structured tag-metadata filter as a JSON array of {field, op, value} objects. Operates against the per-dataset IndicatorTag mirror so you can find indicators by tag attributes (origin country, motive, sophistication, priority, etc.) without a separate Tags lookup. Common dashboard usage: drill from a country into indicators, e.g. tagSearch=[{\"field\":\"originCountryISO\",\"op\":\"in\",\"value\":[\"IR\",\"CN\"]}]. Country values may be passed as alpha-2, alpha-3, name, or alias (e.g. \"iran\"). Operators: equals, not, gt/gte/lt/lte (numeric only), contains/like/find/startsWith/endsWith (string only), in. AND-joined across entries; combined with `tags`, a matching tag must satisfy both. Max 10 entries per request, max 100 values per 'in'. Performance notes: `originCountryISO` uses its B-tree index for equals/not/in. `priority` uses its B-tree index for numeric comparisons. Other string columns (`actorCategory`, `motive`, etc.) are case-insensitive and unindexed; current catalog size makes this a non-issue. `endsWith` and `aliasGroupNames` contains/like are leading-wildcard scans and slow on large result sets. `aliasGroupNames` matches on the JSON-encoded text, so substrings can cross alias boundaries (\"apt28\" also matches \"apt280\" when both appear in the same tag's alias list).","type":"array","items":{"properties":{"field":{"description":"Tag mirror field to filter on. Allowed: value, categoryId, actorCategory, aliasGroupNames, attributionConfidence, attributionOrganization, motive, opsecLevel, originCountryISO, sophisticationLevel, priority, analyticPriority. Filters operate against the per-dataset IndicatorTag mirror (which is kept in sync with the Tags SoT by the tag-propagation workflow).","type":"string","enum":["value","categoryId","actorCategory","aliasGroupNames","attributionConfidence","attributionOrganization","motive","opsecLevel","originCountryISO","sophisticationLevel","priority","analyticPriority"],"examples":["originCountryISO"]},"op":{"description":"Search operator. Use 'in' for bulk OR within a single field, e.g. {field:\"originCountryISO\", op:\"in\", value:[\"IR\",\"CN\"]}.","type":"string","enum":["equals","not","gt","gte","lt","lte","like","contains","startsWith","endsWith","in","find"],"examples":["in"]},"value":{"description":"Search value. String or number for most operators. Array for 'in' (max 100 items). Country values may be passed as alpha-2, alpha-3, name, or common alias (e.g. \"iran\", \"IR\", \"IRN\") and are normalized to alpha-2 server-side.","anyOf":[{"type":"string","examples":["IR"]},{"type":"number","examples":[5]},{"items":{"anyOf":[{"type":"string"},{"type":"number"}]},"type":"array"}]}},"required":["field","op"],"type":"object"}},"createdAfter":{"description":"Filter indicators created on or after this date. Must use ISO 8601 format (e.g., '2024-01-15T00:00:00Z').","type":"string","format":"date-time"},"createdBefore":{"description":"Filter indicators created on or before this date. Must use ISO 8601 format (e.g., '2024-12-31T23:59:59Z').","type":"string","format":"date-time"},"relatedEventsLimit":{"description":"Limit the number of related events returned per indicator. Default: 2. Set to 0 for none, -1 for all events. For JSON responses, when the limit hides events, the indicator carries `relatedEventsHasMore: true` and the response includes an advisory message — the cap is never applied silently. STIX and TAXII representations do not include related-event data.","type":"number","examples":[2]},"includeTags":{"description":"Whether to include full tag details for each indicator. Defaults to true.","type":"boolean"},"includeTotalCount":{"description":"Whether to compute total count via COUNT(*). Defaults to false for performance. total_count is null unless this is true and the complete fan-out succeeds.","type":"boolean"},"format":{"description":"Output format for indicator data. 'json' returns the default format, 'stix2' returns STIX 2.1 Indicator SDOs, 'taxii' returns a TAXII 2.1 Envelope with Content-Type application/taxii+json;version=2.1.","type":"string","enum":["json","stix2","taxii"],"examples":["json"]},"cache":{"description":"Cache strategy. 'from-graph' serves results from the graph-node KV cache when all requested UUIDs are cached; falls back to normal path on partial/zero hit. Cannot be combined with `cursor`.","type":"string","enum":["from-graph"]},"cursor":{"description":"Opaque cursor from a previous response's `pagination.cursor`. When provided, all filters, datasetIds, page, `pageSize`, `includeTags` and `relatedEventsLimit` come from the cursor — do not resend them. Sending any filter, `page`, `pageSize`, `includeTags`, `relatedEventsLimit`, `includeTotalCount=true`, or `cache=from-graph` alongside a cursor yields a 400 `CursorFilterConflictError`. A cursor issued for a different entity, an unsupported version, or a dataset that has since been reconfigured as analytics-only yields a 400 `InvalidCursorError`.","type":"string"}},"required":[],"additionalProperties":false}},"required":["path"],"additionalProperties":false},"name":"List indicators","id":"cloudflare.get_indicatorlist","example":{"path":{"account_id":"example"}},"maxRequests":1,"summary":false}}