security_entity_risk_scores

Creates, updates, deletes, gets or lists a security_entity_risk_scores resource.

Overview

Name	security_entity_risk_scores
Type	Resource
Id	datadog.security.security_entity_risk_scores

Fields

The following fields are returned by SELECT queries:

get_entity_risk_score

Name	Datatype	Description
id	string	Unique identifier for the entity (example: arn:aws:iam::123456789012:user/john.doe)
attributes	object	Attributes of an entity risk score.
type	string	Resource type. (SecurityEntityRiskScore) (example: SecurityEntityRiskScore)

list_entity_risk_scores

Name	Datatype	Description
id	string	Unique identifier for the entity (example: arn:aws:iam::123456789012:user/john.doe)
attributes	object	Attributes of an entity risk score.
type	string	Resource type. (SecurityEntityRiskScore) (example: SecurityEntityRiskScore)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_entity_risk_score	select	entity_id		Get the risk score for a specific entity by its ID. Returns security risk assessment including risk score, severity, detected signals, misconfigurations, and identity risks.
list_entity_risk_scores	select		from, to, page[size], page[number], page[query_id], filter[sort], filter[query], entity_type	Get a list of entity risk scores for your organization. Entity risk scores provide security risk assessment for entities like cloud resources, identities, or services based on detected signals, misconfigurations, and identity risks.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
entity_id	string	The URL-encoded unique identifier for the entity.
site	string	The Datadog site (region) for your organization, for example datadoghq.com, us3.datadoghq.com, us5.datadoghq.com, ap1.datadoghq.com, ap2.datadoghq.com, datadoghq.eu, ddog-gov.com. Resolved from the DD_SITE environment variable when set. Optional: defaults to datadoghq.com, or the value of the DD_SITE environment variable when set; a WHERE value overrides both.
entity_type	array	Filter by entity type(s). Can specify multiple values. (wire: entityType)
filter[query]	string	Supports filtering by entity attributes, risk scores, severity, and more. Example: severity:critical AND entityType:aws_iam_user
filter[sort]	string	Sort order for results. Format: field:direction where direction is asc or desc. Supported fields: riskScore, lastDetected, firstDetected, entityName, signalsDetected.
from	integer (int64)	Start time for the query in Unix timestamp (milliseconds). Defaults to 2 weeks ago.
page[number]	integer (int64)	Page number to return (1-indexed).
page[query_id]	string	Query ID for pagination consistency. (wire: page[queryId])
page[size]	integer (int64)	Size of the page to return. Maximum is 1000.
to	integer (int64)	End time for the query in Unix timestamp (milliseconds). Defaults to now.

SELECT examples

get_entity_risk_score

Get the risk score for a specific entity by its ID. Returns security risk assessment including risk score, severity, detected signals, misconfigurations, and identity risks.

SELECT
id,
attributes,
type
FROM datadog.security.security_entity_risk_scores
WHERE entity_id = '{{ entity_id }}' -- required
;

list_entity_risk_scores

Get a list of entity risk scores for your organization. Entity risk scores provide security risk assessment for entities like cloud resources, identities, or services based on detected signals, misconfigurations, and identity risks.

SELECT
id,
attributes,
type
FROM datadog.security.security_entity_risk_scores
WHERE from = '{{ from }}'
AND to = '{{ to }}'
AND page[size] = '{{ page[size] }}'
AND page[number] = '{{ page[number] }}'
AND page[query_id] = '{{ page[query_id] }}'
AND filter[sort] = '{{ filter[sort] }}'
AND filter[query] = '{{ filter[query] }}'
AND entity_type = '{{ entity_type }}'
;