---
title: "List datasets"
method: GET
path: "/api/v2/security_monitoring/datasets"
tags: ["Security Monitoring"]
---

# List datasets

`GET /api/v2/security_monitoring/datasets`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/datasets`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_rules_read`

List all Cloud SIEM datasets available to the organization, including both
customer-defined datasets and Datadog out-of-the-box datasets.

## Query parameters

- `page[size]` integer
- `page[number]` integer
- `sort` string
- `filter[query]` string

## Response `200`

OK

- SecurityMonitoringDatasetsListResponse: Response containing a paginated list of Cloud SIEM datasets.
  - `data` SecurityMonitoringDatasetData[], required: A list of dataset data items.
    - `attributes` SecurityMonitoringDatasetAttributesResponse, required: The attributes of a Cloud SIEM dataset.
      - `createdAt` string, required: The creation timestamp of the dataset, in ISO 8601 format.
      - `createdByHandle` string, required: The Datadog handle of the user who created the dataset.
      - `createdByName` string, required: The display name of the user who created the dataset.
      - `definition` SecurityMonitoringDatasetDefinition, required: The definition of the dataset. The shape depends on the value of `data_source`. Use `reference_table` or `managed_resource` for a referential dataset, or one of the event platform sources (for example `logs`, `audit`, `events`, `spans`, `rum`) for an event platform dataset.
        - `columns` SecurityMonitoringDatasetColumn[]: For event platform datasets, the list of columns exposed by the dataset.
          - `column` string, required: The name of the column.
          - `type` string, required: The type of the column value.
        - `data_source` string, required: The data source backing this dataset definition.
        - `indexes` string[]: For event platform datasets, the list of indexes to query.
        - `name` string, required: The unique name of the dataset. Must start with a lowercase letter and contain only lowercase letters, digits, and underscores (max 255 characters).
        - `query_filter` string: For referential datasets, an optional filter expression applied to the table.
        - `search` SecurityMonitoringDatasetSearch: The search clause applied to an event platform dataset.
          - `query` string, required: The search query expression.
        - `storage` string: Storage tier the dataset reads from. Applies to event platform datasets.
        - `table_name` string: For referential datasets, the name of the underlying table.
        - `time_window` SecurityMonitoringDatasetTimeWindow: An optional time window that overrides the default query time range.
          - `from` integer: Inclusive start of the time window, in milliseconds since the Unix epoch.
          - `to` integer: Exclusive end of the time window, in milliseconds since the Unix epoch.
      - `description` string, required: The description of the dataset.
      - `id` string, required: The UUID of the dataset.
      - `isDefault` boolean, required: Whether the dataset is an out-of-the-box dataset provided by Datadog.
      - `isDeprecated` boolean, required: Whether the dataset is marked as deprecated.
      - `modifiedAt` string, required: The timestamp of the last modification of the dataset, in ISO 8601 format.
      - `name` string, required: The unique name of the dataset.
      - `updatedByHandle` string, nullable, required: The Datadog handle of the user who last updated the dataset.
      - `updatedByName` string, nullable, required: The display name of the user who last updated the dataset.
      - `version` integer, required: The current version of the dataset.
    - `id` string, required: The UUID of the dataset.
    - `type` 'dataset', required: The type of resource for a dataset response.
  - `meta` SecurityMonitoringDatasetsListMeta, required: Metadata returned with a list of datasets.
    - `totalCount` integer, required: The total number of datasets matching the request, across all pages.

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)