{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Creates a new PIR for the account. The cfone.priority_intelligence_requirement_limit entitlement sets how many PIRs can be active; drafts do not count, but the account can hold at most five times that many PIRs in total. An active PIR requires a query.","properties":{"path":{"type":"object","properties":{"account_id":{"type":"string","minLength":1}},"required":["account_id"],"additionalProperties":false},"body":{"type":"object","properties":{"dataset_scope":{"description":"`default`: every event dataset the account can read: Cloudforce One intelligence, datasets shared with the account, and the account's own datasets, such as Threat Signals. `datasets`: explicit dataset IDs. Analytics datasets are not matched. An active PIR can cover at most 50 datasets. Access is rechecked whenever the PIR is matched.","oneOf":[{"additionalProperties":false,"properties":{"type":{"type":"string","enum":["default"]}},"required":["type"],"type":"object"},{"additionalProperties":false,"properties":{"dataset_ids":{"type":"array","items":{"format":"uuid","type":"string"},"maxItems":50,"minItems":1},"type":{"type":"string","enum":["datasets"]}},"required":["type","dataset_ids"],"type":"object"}]},"digest_interval_hours":{"description":"Hours between digests: 6, 12, or 24. Used only when `notification_mode` is `digest`.","type":"integer","default":24,"enum":[6,12,24]},"intent":{"type":"object","additionalProperties":false,"properties":{"clauses":{"type":"array","items":{"additionalProperties":false,"properties":{"actors":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20},"attacker_countries":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20},"categories":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20},"cves":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20},"keywords":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":5},"target_countries":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20},"target_industries":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20},"techniques":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20}},"required":["actors","attacker_countries","target_countries","target_industries","categories","techniques","cves","keywords"],"type":"object"},"maxItems":8,"minItems":1},"indicators":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20},"unsupported_terms":{"type":"array","items":{"maxLength":200,"minLength":1,"type":"string"},"maxItems":20}},"required":["clauses","indicators","unsupported_terms"]},"labels":{"type":"array","items":{"maxLength":100,"type":"string"},"default":[],"maxItems":50},"model":{"type":"string","maxLength":200,"minLength":1},"notification_mode":{"description":"`none` or `digest`. Notifications are opt-in. `immediate` is reserved and currently rejected.","type":"string","default":"none","enum":["none","immediate","digest"]},"priority":{"type":"integer","default":0,"minimum":0},"query":{"additionalProperties":false,"properties":{"branches":{"description":"Event List `searchBranches`: filters within a branch are ANDed, branches are ORed.","type":"array","items":{"items":{"anyOf":[{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["attacker","attackerCountry","category","createdAt","date","event","indicator","indicatorType","mitreAttack","mitreCapec","tags","targetCountry","targetIndustry","tlp","uuid"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte","like","contains","startsWith","endsWith","find"]},"value":{"type":"string","maxLength":512,"minLength":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["attacker","attackerCountry","category","createdAt","date","event","indicator","indicatorType","mitreAttack","mitreCapec","tags","targetCountry","targetIndustry","tlp","uuid"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"maxLength":512,"minLength":1,"type":"string"},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["killChain"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte"]},"value":{"anyOf":[{"type":"number"},{"pattern":"^-?(?:\\d+\\.?\\d*|\\.\\d+)$","type":"string"}]}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["killChain"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"anyOf":[{"type":"number"},{"pattern":"^-?(?:\\d+\\.?\\d*|\\.\\d+)$","type":"string"}]},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["hasChildren"]},"op":{"type":"string","enum":["equals","not","gt","gte","lt","lte"]},"value":{"anyOf":[{"type":"boolean"},{"enum":["true"],"type":"string"},{"enum":["false"],"type":"string"},{"enum":[1],"type":"number"},{"enum":[0],"type":"number"},{"enum":["1"],"type":"string"},{"enum":["0"],"type":"string"}]}},"required":["field","op","value"],"type":"object"},{"additionalProperties":false,"properties":{"field":{"type":"string","enum":["hasChildren"]},"op":{"type":"string","enum":["in"]},"value":{"type":"array","items":{"anyOf":[{"type":"boolean"},{"enum":["true"],"type":"string"},{"enum":["false"],"type":"string"},{"enum":[1],"type":"number"},{"enum":[0],"type":"number"},{"enum":["1"],"type":"string"},{"enum":["0"],"type":"string"}]},"maxItems":100,"minItems":1}},"required":["field","op","value"],"type":"object"}]},"maxItems":10,"minItems":1,"type":"array"},"maxItems":8,"minItems":1},"version":{"description":"Ignored. Accepted so a PIR read from the API can be sent back unchanged.","type":"integer"}},"required":["branches"],"type":"object"},"query_source":{"type":"string","enum":["generated","edited"]},"requirement":{"type":"string","maxLength":4000,"minLength":1},"status":{"description":"`draft`: not monitored. `active`: monitored, unless `pause_reason` is set. Setting `active` on a PIR with a `pause_reason` resumes it. Moving a PIR back to `draft` and activating it again starts matching afresh with a 30-day backfill.","type":"string","default":"draft","enum":["draft","active"]},"title":{"type":"string","maxLength":200,"minLength":1},"tlp":{"type":"string","default":"amber"}},"required":["requirement"]}},"required":["path"],"additionalProperties":false},"name":"Create a priority intelligence requirement","id":"cloudflare.post_pircreate","example":{"path":{"account_id":"example"}},"maxRequests":1,"summary":false}}