GET /accounts/{account_id}/cloudforce-one/events/indicators/aggregate
Aggregate threat indicators by one or more columns (e.g., indicatorType, value) across datasets. Returns top-N groups ordered by count.
Servers
- https://api.cloudflare.com/client/v4
Path parameters
| Name | Type | Required | Description |
|---|---|---|---|
account_id |
String | Yes |
Account ID. |
Query parameters
| Name | Type | Required | Description |
|---|---|---|---|
datasetIds[] |
Array | No |
Dataset ID(s) to filter by. Can be a single dataset ID or comma-separated list. If not provided, aggregates across all accessible datasets |
createdBefore |
String | No |
Filter indicators created before this date (ISO 8601 format, e.g., '2024-12-31') |
createdAfter |
String | No |
Filter indicators created after this date (ISO 8601 format, e.g., '2024-01-01') |
aggregateBy |
String | Yes |
Column(s) to aggregate by - single column or comma-separated list (e.g., 'indicatorType', 'value', 'indicatorType,value') |
limit |
Number | No |
Maximum number of aggregation results to return (1-100) Default value: 10 |
tagUuid |
String | No |
Scope to indicators associated with this tag/actor UUID. Combine with measure=relationships for 'top indicator for an actor'. |
eventDateBefore |
String | No |
For measure=relationships: only count event links whose eventDate is on/before this date (ISO 8601). |
measure |
String | No |
What to count per group: 'indicators' (catalog rows, default) or 'relationships' (linked events per indicator). Use 'relationships' for 'top indicator by event activity'. Valid values:
Default value: "indicators" |
eventDateAfter |
String | No |
For measure=relationships: only count event links whose eventDate is on/after this date (ISO 8601). Use to bound 'top indicator' to recent activity. |
How to start integrating
- Add HTTP Task to your workflow definition.
- Search for the API you want to integrate with and click on the name.
- This loads the API reference documentation and prepares the Http request settings.
- Click Test request to test run your request to the API and see the API's response.