---
title: "Get entities related to a signal"
method: GET
path: "/api/v2/security_monitoring/signals/{signal_id}/entities"
tags: ["Security Monitoring"]
---

# Get entities related to a signal

`GET /api/v2/security_monitoring/signals/{signal_id}/entities`

Get the list of entities related to a security signal, captured at the signal's timestamp.

## Path parameters

- `signal_id` string, required

## Query parameters

- `limit` integer

## Response `200`

OK

- SignalEntitiesResponse — Response containing entities related to a security signal.
  - `data` SignalEntitiesData, required — Entities related to a security signal.
    - `attributes` SignalEntitiesAttributes, required — Attributes containing the entities related to the signal.
      - `identities` SignalEntityIdentity[], required — The identity entities related to the signal. Each item is a free-form object describing an identity (for example, a user or principal).
    - `id` string, required — The signal ID the entities are associated with.
    - `type` 'entities', required — The type of the resource. The value should always be `entities`.

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `404` — Not Found
- `429` — Too many requests

---

[API](https://skmtc.dev/datadog/apis/api-v2.md) · [All operations](https://skmtc.dev/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)