DAdatadog
Entity Risk Scores

List Entity Risk Scores

Get a list of entity risk scores for your organization. Entity risk scores provide security risk assessment for entities like cloud resources, identities, or services based on detected signals, misconfigurations, and identity risks.

get/api/v2/security-entities/risk-scores

Request

  • Base URL
    https://api.datadoghq.com
  • URL
    https://api.datadoghq.com/api/v2/security-entities/risk-scores
  • Auth
    API key in header DD-API-KEY and API key in header DD-APPLICATION-KEY

Query parameters

frominteger
Example:1704067200000

Start time for the query in Unix timestamp (milliseconds). Defaults to 2 weeks ago.

tointeger
Example:1705276800000

End time for the query in Unix timestamp (milliseconds). Defaults to now.

page[size]integer
Example:10

Size of the page to return. Maximum is 1000.

page[number]integer
Example:1

Page number to return (1-indexed).

page[queryId]string
Example:abc123def456

Query ID for pagination consistency.

filter[sort]string
Example:riskScore:desc

Sort order for results. Format: field:direction where direction is asc or desc. Supported fields: riskScore, lastDetected, firstDetected, entityName, signalsDetected.

filter[query]string
Example:severity:critical

Supports filtering by entity attributes, risk scores, severity, and more. Example: severity:critical AND entityType:aws_iam_user

entityTypestring[]

Filter by entity type(s). Can specify multiple values.

[
  "aws_iam_user",
  "aws_ec2_instance"
]

Response

OK

Example response

{
  "data": [
    {
      "attributes": {
        "accountIds": [
          "222233334444",
          "3333333555555"
        ],
        "configRisks": {
          "hasMisconfiguration": true,
          "hasPrivilegedRole": true,
          "isProduction": true,
          "isPubliclyAccessible": true
        },
        "entityMetadata": {
          "accountID": "123456789012",
          "environments": [
            "production",
            "us-east-1"
          ],
          "mitreTactics": [
            "Credential Access",
            "Privilege Escalation"
          ],
          "mitreTechniques": [
            "T1078",
            "T1098"
          ],
          "projectID": "my-gcp-project",
          "services": [
            "api-gateway",
            "lambda"
          ],
          "sources": [
            "cloudtrail",
            "cloud-security-posture-management"
          ],
          "subscriptionID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
        },
        "entityName": "john.doe",
        "entityProviders": [
          "AWS"
        ],
        "entityRoles": [],
        "entitySubTypes": [
          "Root"
        ],
        "entityType": "aws_iam_user",
        "entityTypes": [
          "Root",
          "User Name"
        ],
        "firstDetected": 1778876604661,
        "lastActivityTitle": "Suspicious API call detected",
        "lastDetected": 1780064607093,
        "riskScore": 85,
        "riskScoreEvolution": 12,
        "severity": "critical",
        "signalsDetected": 15
      },
      "id": "arn:aws:iam::123456789012:user/john.doe",
      "type": "SecurityEntityRiskScore"
    }
  ],
  "meta": {
    "pageNumber": 1,
    "pageSize": 10,
    "queryId": "abc123def456",
    "totalRowCount": 150
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.