For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/fr/api/latest/security-monitoring/get-a-single-entity-context.md. A documentation index is available at /llms.txt.
homeAccueildocsDocumentationapiAPI
Language
Datadog site

Get a single entity context

WARNINGNote: This endpoint is in Preview and is subject to change. If you have any feedback, contact Datadog support.
GEThttps://api.datadoghq.com/api/v2/security_monitoring/entity_context/{id}https://api.us3.datadoghq.com/api/v2/security_monitoring/entity_context/{id}https://api.us5.datadoghq.com/api/v2/security_monitoring/entity_context/{id}https://api.datadoghq.eu/api/v2/security_monitoring/entity_context/{id}https://api.ap1.datadoghq.com/api/v2/security_monitoring/entity_context/{id}https://api.ap2.datadoghq.com/api/v2/security_monitoring/entity_context/{id}https://api.uk1.datadoghq.com/api/v2/security_monitoring/entity_context/{id}https://api.ddog-gov.com/api/v2/security_monitoring/entity_context/{id}https://api.us2.ddog-gov.com/api/v2/security_monitoring/entity_context/{id}

Présentation

Get a single entity from the Cloud SIEM entity context store by its identifier, returning the historical revisions of the entity in the requested time range. The endpoint can either return revisions across an interval (from / to) or the snapshot of the entity at a single point in time (as_of); the two modes are mutually exclusive.

This endpoint requires the siem_entities_read permission.

OAuth apps require the siem_entities_read authorization scope to access this endpoint.

Arguments

Paramètres du chemin

Name
Type
Description
id [required]
string

The unique identifier of the entity to retrieve.

Chaînes de requête

Name
Type
Description
entity_type
enum

The type of entity to retrieve. Only siem_entity_identity is currently supported. Defaults to siem_entity_identity.

Default: siem_entity_identity
Allowed enum values: siem_entity_identity
from
string

The start of the time range to query, as an RFC3339 timestamp or a relative time (for example, now-7d). Defaults to now-7d. Ignored when as_of is set.

Default: now-7d
to
string

The end of the time range to query, as an RFC3339 timestamp or a relative time (for example, now). Defaults to now. Ignored when as_of is set.

Default: now
as_of
string

A point in time at which to query the entity revisions, as an RFC3339 timestamp, a Unix timestamp (in seconds), or a relative time (for example, now-1d). When set, from and to are ignored. Cannot be combined with custom from / to values.

Réponse

OK

Response from the single entity context endpoint, containing the matching entity.

Champ
Type
Description
data [required]
object

A single entity returned by the entity context endpoint.

Exemple de code

Get a single entity context
# Path parameters
export id="user@example.com"

# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security_monitoring/entity_context/${id}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Path parameters
export id="user@example.com"

# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security_monitoring/entity_context/${id}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Path parameters
export id="user@example.com"

# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security_monitoring/entity_context/${id}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Path parameters
export id="user@example.com"

# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security_monitoring/entity_context/${id}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Path parameters
export id="user@example.com"

# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security_monitoring/entity_context/${id}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Path parameters
export id="user@example.com"

# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security_monitoring/entity_context/${id}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Path parameters
export id="user@example.com"

# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security_monitoring/entity_context/${id}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Path parameters
export id="user@example.com"

# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security_monitoring/entity_context/${id}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Path parameters
export id="user@example.com"

# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/security_monitoring/entity_context/${id}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"