DAdatadog
Security Monitoring

Get recently updated entity context

Get the entities with the most recent updates in the Cloud SIEM entity context store. Entities are ranked by the time of their most recent revision in the requested time range, and the top limit entities are returned in that order. This endpoint is not paginated.

get/api/v2/security_monitoring/entity_context/recently_updated

Request

Query parameters

querystring

A free-text query (for example, an email address or principal ID) used to filter the entities returned.

entity_type'siem_entity_identity'

The type of entity to retrieve. Only siem_entity_identity is currently supported.

Example:siem_entity_identity

The type of entity to retrieve. Only siem_entity_identity is currently supported. Defaults to siem_entity_identity.

fromstring
Example:now-7d

The start of the time range to query, as an RFC3339 timestamp or a relative time (for example, now-7d). Defaults to now-7d.

tostring
Example:now

The end of the time range to query, as an RFC3339 timestamp or a relative time (for example, now). Defaults to now. Entities are ranked by their most recent revision within [from, to].

limitinteger

The number of entities to return. Must be between 1 and 100.

revisions'latest' | 'all'

Which revisions to return for each entity: latest returns only the latest revision of each entity as of to, and all returns every revision in the requested time range.

Example:latest

Response

OK

Example response

{
  "data": [
    {
      "attributes": {
        "revisions": [
          {
            "attributes": {
              "accounts": [
                "linked-account-123"
              ],
              "display_name": "Test User",
              "email": "user@example.com",
              "principal_id": "user@example.com"
            },
            "first_seen_at": "2026-04-01T00:00:00Z",
            "last_seen_at": "2026-05-01T00:00:00Z"
          }
        ]
      },
      "id": "user@example.com",
      "type": "siem_entity_identity"
    }
  ]
}

Changes

Changes to this operation have not been checked yet.