---
title: "Create a dataset"
method: POST
path: "/api/v2/security_monitoring/datasets"
tags: ["Security Monitoring"]
---

# Create a dataset

`POST /api/v2/security_monitoring/datasets`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/datasets`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_rules_write`

Create a new Cloud SIEM dataset. A dataset bundles a data source, a set of
indexes, and a search query that can be referenced from detection rules.

## Request body

- SecurityMonitoringDatasetCreateRequest: Request body for creating a Cloud SIEM dataset.
  - `data` SecurityMonitoringDatasetCreateData, required: The data wrapper of a dataset create request.
    - `attributes` SecurityMonitoringDatasetAttributesRequest, required: The attributes of a dataset create or update request.
      - `definition` SecurityMonitoringDatasetDefinition, required: The definition of the dataset. The shape depends on the value of `data_source`. Use `reference_table` or `managed_resource` for a referential dataset, or one of the event platform sources (for example `logs`, `audit`, `events`, `spans`, `rum`) for an event platform dataset.
        - `columns` SecurityMonitoringDatasetColumn[]: For event platform datasets, the list of columns exposed by the dataset.
          - `column` string, required: The name of the column.
          - `type` string, required: The type of the column value.
        - `data_source` string, required: The data source backing this dataset definition.
        - `indexes` string[]: For event platform datasets, the list of indexes to query.
        - `name` string, required: The unique name of the dataset. Must start with a lowercase letter and contain only lowercase letters, digits, and underscores (max 255 characters).
        - `query_filter` string: For referential datasets, an optional filter expression applied to the table.
        - `search` SecurityMonitoringDatasetSearch: The search clause applied to an event platform dataset.
          - `query` string, required: The search query expression.
        - `storage` string: Storage tier the dataset reads from. Applies to event platform datasets.
        - `table_name` string: For referential datasets, the name of the underlying table.
        - `time_window` SecurityMonitoringDatasetTimeWindow: An optional time window that overrides the default query time range.
          - `from` integer: Inclusive start of the time window, in milliseconds since the Unix epoch.
          - `to` integer: Exclusive end of the time window, in milliseconds since the Unix epoch.
      - `description` string: The description of the dataset. Maximum 255 characters.
      - `version` integer: The expected current version of the dataset for optimistic concurrency control on updates. If the dataset's current version does not match, the request is rejected with a 409 Conflict.
    - `type` 'datasetCreate', required: The type of resource for a dataset create request.

## Response `201`

Created

- SecurityMonitoringDatasetCreateResponse: Response returned after creating a dataset.
  - `data` SecurityMonitoringDatasetCreateResponseData, required: The data wrapper of a dataset create response.
    - `id` string, required: The UUID of the newly created dataset.
    - `type` 'dataset', required: The type of resource for a dataset response.

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `409`: Conflict
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)