---
title: "Get entities related to a signal"
method: GET
path: "/api/v2/security_monitoring/signals/{signal_id}/entities"
tags: ["Security Monitoring"]
---

# Get entities related to a signal

`GET /api/v2/security_monitoring/signals/{signal_id}/entities`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/signals/{signal_id}/entities`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_signals_read`

Get the list of entities related to a security signal, captured at the signal's timestamp.

## Path parameters

- `signal_id` string, required

## Query parameters

- `limit` integer

## Response `200`

OK

- SignalEntitiesResponse: Response containing entities related to a security signal.
  - `data` SignalEntitiesData, required: Entities related to a security signal.
    - `attributes` SignalEntitiesAttributes, required: Attributes containing the entities related to the signal.
      - `identities` SignalEntityIdentity[], required: The identity entities related to the signal. Each item is a free-form object describing an identity (for example, a user or principal).
    - `id` string, required: The signal ID the entities are associated with.
    - `type` 'entities', required: The type of the resource. The value should always be `entities`.

## Other responses

- `400`: Bad Request
- `403`: Not Authorized
- `404`: Not Found
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)