{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Lists events, with filters sent in a JSON request body. Accepts the same filters as `threat-intel events list` and suits long or complex `search` filters. `datasetId` accepts dataset UUIDs or one scope value used alone: `all` (or `*`) and `operational` select the intelligence datasets you can read, and `analytics` selects the analytics datasets you can read. A scope value covers at most 50 datasets. Without `datasetId`, the default Cloudforce One Threat Events dataset is used.","properties":{"path":{"type":"object","properties":{"account_id":{"description":"Account ID.","type":"string"}},"required":["account_id"],"additionalProperties":false},"query":{"type":"object","properties":{"forceRefresh":{"type":"boolean"},"format":{"description":"Output format for event data. 'json' returns the default format, 'stix2' returns STIX 2.1 Sighting SROs with linked Indicator SDOs, Observed Data SDOs, and SCOs, 'taxii' returns a TAXII 2.1 Envelope with Content-Type application/taxii+json;version=2.1.","type":"string","enum":["json","stix2","taxii"],"examples":["json"]},"cache":{"description":"Cache strategy. 'from-graph' serves results from the graph-node KV cache when all requested UUIDs are cached; falls back to normal path on partial/zero hit.","type":"string","enum":["from-graph"]}},"required":[],"additionalProperties":false},"body":{"type":"object","properties":{"cursor":{"description":"Cursor for pagination. When provided, filters are embedded in the cursor so you only need to pass cursor and pageSize.","type":"string","examples":["eyJ2ZXJzaW9uIjoxLCJwb3NpdGlvbiI6eyJkYXRlIjoiMjAyNC0wMS0xMlQxMDowMDowMFoiLCJ1dWlkIjoiYWJjMTIzIn19"]},"datasetId":{"description":"Dataset UUIDs to query, or one standalone scope value: 'all'/'*' or 'operational' for readable intelligence datasets (isAnalytics=false), or 'analytics' for readable analytics datasets (isAnalytics=true). Scope values query at most 50 datasets. If not provided, uses the default dataset.","type":"array","items":{"type":"string","examples":["7632a037-fdef-4899-9b12-148470aae772"]}},"order":{"type":"string","enum":["asc","desc"]},"orderBy":{"type":"string","examples":["created"]},"page":{"type":"number","examples":[1]},"pageSize":{"type":"number","examples":[100]},"search":{"description":"Structured search as a JSON array of {field, op, value} objects. Use the 'in' operator with an array value to bulk-check up to 100 values. Multiple conditions are AND'd together. Max 10 conditions per request.","type":"array","items":{"anyOf":[{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["attacker","attackerCountry","category","createdAt","date","event","indicator","indicatorType","mitreAttack","mitreCapec","tags","targetCountry","targetIndustry","tlp","uuid"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte","like","contains","startsWith","endsWith","find"]},"value":{"type":"string","maxLength":512,"minLength":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["attacker","attackerCountry","category","createdAt","date","event","indicator","indicatorType","mitreAttack","mitreCapec","tags","targetCountry","targetIndustry","tlp","uuid"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"maxLength":512,"minLength":1,"type":"string"},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["killChain"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte"]},"value":{"anyOf":[{"type":"number"},{"pattern":"^-?(?:\\d+\\.?\\d*|\\.\\d+)$","type":"string"}]}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["killChain"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"anyOf":[{"type":"number"},{"pattern":"^-?(?:\\d+\\.?\\d*|\\.\\d+)$","type":"string"}]},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["hasChildren"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte"]},"value":{"anyOf":[{"type":"boolean"},{"enum":["true"],"type":"string"},{"enum":["false"],"type":"string"},{"enum":[1],"type":"number"},{"enum":[0],"type":"number"},{"enum":["1"],"type":"string"},{"enum":["0"],"type":"string"}]}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["hasChildren"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"anyOf":[{"type":"boolean"},{"enum":["true"],"type":"string"},{"enum":["false"],"type":"string"},{"enum":[1],"type":"number"},{"enum":[0],"type":"number"},{"enum":["1"],"type":"string"},{"enum":["0"],"type":"string"}]},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"}]},"default":[],"maxItems":10},"searchBranches":{"description":"OR branches of structured search filters. Filters within a branch are AND'd, branches are OR'd, and the result is AND'd with `search`: `AND(search) AND OR(AND(branch 1), ...)`. Max 8 branches of 1-10 conditions each. Not supported for analytics datasets, and `indicator` filters are not yet supported inside branches. Cursor pages carry the original branches, so do not resend them with `cursor`.","type":"array","items":{"items":{"anyOf":[{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["attacker","attackerCountry","category","createdAt","date","event","indicator","indicatorType","mitreAttack","mitreCapec","tags","targetCountry","targetIndustry","tlp","uuid"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte","like","contains","startsWith","endsWith","find"]},"value":{"type":"string","maxLength":512,"minLength":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["attacker","attackerCountry","category","createdAt","date","event","indicator","indicatorType","mitreAttack","mitreCapec","tags","targetCountry","targetIndustry","tlp","uuid"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"maxLength":512,"minLength":1,"type":"string"},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["killChain"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte"]},"value":{"anyOf":[{"type":"number"},{"pattern":"^-?(?:\\d+\\.?\\d*|\\.\\d+)$","type":"string"}]}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["killChain"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"anyOf":[{"type":"number"},{"pattern":"^-?(?:\\d+\\.?\\d*|\\.\\d+)$","type":"string"}]},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["hasChildren"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte"]},"value":{"anyOf":[{"type":"boolean"},{"enum":["true"],"type":"string"},{"enum":["false"],"type":"string"},{"enum":[1],"type":"number"},{"enum":[0],"type":"number"},{"enum":["1"],"type":"string"},{"enum":["0"],"type":"string"}]}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["hasChildren"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"anyOf":[{"type":"boolean"},{"enum":["true"],"type":"string"},{"enum":["false"],"type":"string"},{"enum":[1],"type":"number"},{"enum":[0],"type":"number"},{"enum":["1"],"type":"string"},{"enum":["0"],"type":"string"}]},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"}]},"maxItems":10,"minItems":1,"type":"array"},"maxItems":8,"minItems":1}}}},"required":["path"],"additionalProperties":false},"name":"Search events","id":"cloudflare.post_eventlist","example":{"path":{"account_id":"example"}},"maxRequests":1,"summary":false}}