---
title: "Update a dataset"
method: PATCH
path: "/api/v2/security_monitoring/datasets/{dataset_id}"
tags: ["Security Monitoring"]
---

# Update a dataset

`PATCH /api/v2/security_monitoring/datasets/{dataset_id}`

Update an existing Cloud SIEM dataset. The current version of the dataset can be
provided to detect concurrent modifications.

## Path parameters

- `dataset_id` string, required

## Request body

- SecurityMonitoringDatasetUpdateRequest — Request body for updating a Cloud SIEM dataset.
  - `data` SecurityMonitoringDatasetUpdateData, required — The data wrapper of a dataset update request.
    - `attributes` SecurityMonitoringDatasetAttributesRequest, required — The attributes of a dataset create or update request.
      - `definition` SecurityMonitoringDatasetDefinition, required — The definition of the dataset. The shape depends on the value of `data_source`. Use `reference_table` or `managed_resource` for a referential dataset, or one of the event platform sources (for example `logs`, `audit`, `events`, `spans`, `rum`) for an event platform dataset.
        - `columns` SecurityMonitoringDatasetColumn[] — For event platform datasets, the list of columns exposed by the dataset.
          - `column` string, required — The name of the column.
          - `type` string, required — The type of the column value.
        - `data_source` string, required — The data source backing this dataset definition.
        - `indexes` string[] — For event platform datasets, the list of indexes to query.
        - `name` string, required — The unique name of the dataset. Must start with a lowercase letter and contain only lowercase letters, digits, and underscores (max 255 characters).
        - `query_filter` string — For referential datasets, an optional filter expression applied to the table.
        - `search` SecurityMonitoringDatasetSearch — The search clause applied to an event platform dataset.
          - `query` string, required — The search query expression.
        - `storage` string — Storage tier the dataset reads from. Applies to event platform datasets.
        - `table_name` string — For referential datasets, the name of the underlying table.
        - `time_window` SecurityMonitoringDatasetTimeWindow — An optional time window that overrides the default query time range.
          - `from` integer — Inclusive start of the time window, in milliseconds since the Unix epoch.
          - `to` integer — Exclusive end of the time window, in milliseconds since the Unix epoch.
      - `description` string — The description of the dataset. Maximum 255 characters.
      - `version` integer — The expected current version of the dataset for optimistic concurrency control on updates. If the dataset's current version does not match, the request is rejected with a 409 Conflict.
    - `type` 'datasetUpdate', required — The type of resource for a dataset update request.

## Response `204`

No Content

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `404` — Not Found
- `409` — Conflict
- `429` — Too many requests

---

[API](https://skmtc.dev/datadog/apis/api-v2.md) · [All operations](https://skmtc.dev/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)