{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Creates an event. Without `datasetId`, the event is created in the default Cloudforce One Threat Events dataset. To create a dataset, use `threat-intel datasets create`.","properties":{"path":{"type":"object","properties":{"account_id":{"description":"Account ID.","type":"string"}},"required":["account_id"],"additionalProperties":false},"body":{"type":"object","properties":{"accountId":{"type":"number","examples":[123456]},"attacker":{"type":["string","null"],"examples":["Flying Yeti"]},"attackerCountry":{"type":"string","examples":["CN"]},"category":{"type":"string","examples":["Domain Resolution"]},"datasetId":{"type":"string","examples":["durableObjectName"]},"date":{"type":"string","format":"date-time","examples":["2022-04-01T00:00:00Z"]},"event":{"type":"string","examples":["An attacker registered the domain domain.com"]},"indicator":{"type":"string","examples":["domain.com"]},"indicatorType":{"type":"string","examples":["domain"]},"indicators":{"description":"Array of indicators for this event. Supports multiple indicators per event for complex scenarios.","type":"array","items":{"properties":{"indicatorType":{"description":"The type of indicator (e.g., DOMAIN, IP, JA3, HASH)","type":"string","examples":["domain"]},"value":{"description":"The indicator value (e.g., domain name, IP address, hash)","type":"string","examples":["malicious.com"]}},"required":["value","indicatorType"],"type":"object"}},"insight":{"type":"string","examples":["This domain was likely registered for phishing purposes"]},"raw":{"type":"object","properties":{"data":{"type":["object","null"],"additionalProperties":true},"source":{"type":"string","examples":["example.com"]},"tlp":{"type":"string","examples":["amber"]}},"required":["data"]},"source":{"description":"Controlled provenance for an event and its indicators derived from a Threat Signals article.","type":"object","additionalProperties":false,"properties":{"resourceId":{"type":"string","format":"uuid"},"resourceType":{"type":"string","enum":["article"]},"system":{"type":"string","enum":["threat-signals"]},"title":{"description":"Threat Signals article title; null for historical provenance without a stored title.","type":["string","null"]}},"required":["system","resourceType","resourceId"]},"tags":{"type":"array","items":{"type":"string","examples":["malware"]}},"targetCountry":{"type":"string","examples":["US"]},"targetIndustry":{"type":"string","examples":["Agriculture"]},"tlp":{"type":"string","examples":["amber"]}},"required":["date","category","event","tlp","raw"]}},"required":["path"],"additionalProperties":false},"name":"Create an event","id":"cloudflare.post_eventcreate","example":{"path":{"account_id":"example"}},"maxRequests":1,"summary":false}}