monitoring_entity_contexts

Creates, updates, deletes, gets or lists a monitoring_entity_contexts resource.

Overview

Name	monitoring_entity_contexts
Type	Resource
Id	datadog.security.monitoring_entity_contexts

Fields

The following fields are returned by SELECT queries:

get_single_entity_context

Name	Datatype	Description
id	string	The unique identifier of the entity. (example: user@example.com)
attributes	object	The attributes of an entity context entry, grouping all the historical revisions of the entity.
type	string	The type of the entity. Reflects the underlying entity kind from the entity context store (for example, siem_entity_identity for identities). Defaults to entity when the kind is unknown. (default: entity, example: siem_entity_identity)

get_entity_context

Name	Datatype	Description
id	string	The unique identifier of the entity. (example: user@example.com)
attributes	object	The attributes of an entity context entry, grouping all the historical revisions of the entity.
type	string	The type of the entity. Reflects the underlying entity kind from the entity context store (for example, siem_entity_identity for identities). Defaults to entity when the kind is unknown. (default: entity, example: siem_entity_identity)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_single_entity_context	select	id	from, to, as_of	Get a single entity from the Cloud SIEM entity context store by its identifier, returning the historical<br />revisions of the entity in the requested time range. The endpoint can either return revisions across an<br />interval (from / to) or the snapshot of the entity at a single point in time (as_of); the two modes<br />are mutually exclusive.
get_entity_context	select		query, from, to, as_of, limit, page_token	Search the Cloud SIEM entity context store for entities that match a query, and return the historical<br />revisions of each entity in the requested time range. The endpoint can either return revisions across an<br />interval (from / to) or the snapshot of each entity at a single point in time (as_of); the two modes<br />are mutually exclusive.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
id	string	The unique identifier of the entity to retrieve.
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.
as_of	string	A point in time at which to query the entity revisions, as an RFC3339 timestamp, a Unix timestamp (in seconds), or a relative time (for example, now-1d). When set, from and to are ignored. Cannot be combined with custom from / to values. (example: now-1d)
from	string	The start of the time range to query, as an RFC3339 timestamp or a relative time (for example, now-7d). Defaults to now-7d. Ignored when as_of is set.
limit	integer (int64)	The maximum number of entities to return.
page_token	string	An opaque token used to fetch the next page of results, as returned in meta.page.next_token of a previous response.
query	string	A free-text query (for example, an email address or principal ID) used to filter the entities returned. (example: user@example.com)
to	string	The end of the time range to query, as an RFC3339 timestamp or a relative time (for example, now). Defaults to now. Ignored when as_of is set.

SELECT examples

get_single_entity_context

Get a single entity from the Cloud SIEM entity context store by its identifier, returning the historical<br />revisions of the entity in the requested time range. The endpoint can either return revisions across an<br />interval (from / to) or the snapshot of the entity at a single point in time (as_of); the two modes<br />are mutually exclusive.

SELECT
id,
attributes,
type
FROM datadog.security.monitoring_entity_contexts
WHERE id = '{{ id }}' -- required
AND from = '{{ from }}'
AND to = '{{ to }}'
AND as_of = '{{ as_of }}'
;

get_entity_context

Search the Cloud SIEM entity context store for entities that match a query, and return the historical<br />revisions of each entity in the requested time range. The endpoint can either return revisions across an<br />interval (from / to) or the snapshot of each entity at a single point in time (as_of); the two modes<br />are mutually exclusive.

SELECT
id,
attributes,
type
FROM datadog.security.monitoring_entity_contexts
WHERE query = '{{ query }}'
AND from = '{{ from }}'
AND to = '{{ to }}'
AND as_of = '{{ as_of }}'
AND limit = '{{ limit }}'
AND page_token = '{{ page_token }}'
;