@@ -48629,6 +48629,263 @@ components:
4862948629 type: string
4863048630 x-enum-varnames:
4863148631 - SECRET_RULE
48632+ SecurityEntityConfigRisks:
48633+ description: Configuration risks associated with the entity
48634+ properties:
48635+ hasIdentityRisk:
48636+ description: Whether the entity has identity risks
48637+ example: false
48638+ type: boolean
48639+ hasMisconfiguration:
48640+ description: Whether the entity has misconfigurations
48641+ example: true
48642+ type: boolean
48643+ hasPrivilegedRole:
48644+ description: Whether the entity has privileged roles
48645+ example: true
48646+ type: boolean
48647+ isPrivileged:
48648+ description: Whether the entity has privileged access
48649+ example: false
48650+ type: boolean
48651+ isProduction:
48652+ description: Whether the entity is in a production environment
48653+ example: true
48654+ type: boolean
48655+ isPubliclyAccessible:
48656+ description: Whether the entity is publicly accessible
48657+ example: true
48658+ type: boolean
48659+ required:
48660+ - hasMisconfiguration
48661+ - hasIdentityRisk
48662+ - isPubliclyAccessible
48663+ - isProduction
48664+ - hasPrivilegedRole
48665+ - isPrivileged
48666+ type: object
48667+ SecurityEntityMetadata:
48668+ description: Metadata about the entity from cloud providers
48669+ properties:
48670+ accountID:
48671+ description: Cloud account ID (AWS)
48672+ example: '123456789012'
48673+ type: string
48674+ environments:
48675+ description: Environment tags associated with the entity
48676+ example:
48677+ - production
48678+ - us-east-1
48679+ items:
48680+ type: string
48681+ type: array
48682+ mitreTactics:
48683+ description: MITRE ATT&CK tactics detected
48684+ example:
48685+ - Credential Access
48686+ - Privilege Escalation
48687+ items:
48688+ type: string
48689+ type: array
48690+ mitreTechniques:
48691+ description: MITRE ATT&CK techniques detected
48692+ example:
48693+ - T1078
48694+ - T1098
48695+ items:
48696+ type: string
48697+ type: array
48698+ projectID:
48699+ description: Cloud project ID (GCP)
48700+ example: my-gcp-project
48701+ type: string
48702+ services:
48703+ description: Services associated with the entity
48704+ example:
48705+ - api-gateway
48706+ - lambda
48707+ items:
48708+ type: string
48709+ type: array
48710+ sources:
48711+ description: Data sources that detected this entity
48712+ example:
48713+ - cloudtrail
48714+ - cloud-security-posture-management
48715+ items:
48716+ type: string
48717+ type: array
48718+ subscriptionID:
48719+ description: Cloud subscription ID (Azure)
48720+ example: a1b2c3d4-e5f6-7890-abcd-ef1234567890
48721+ type: string
48722+ required:
48723+ - sources
48724+ - environments
48725+ - services
48726+ - mitreTactics
48727+ - mitreTechniques
48728+ type: object
48729+ SecurityEntityRiskScore:
48730+ description: An entity risk score containing security risk assessment information
48731+ properties:
48732+ attributes:
48733+ $ref: '#/components/schemas/SecurityEntityRiskScoreAttributes'
48734+ id:
48735+ description: Unique identifier for the entity
48736+ example: arn:aws:iam::123456789012:user/john.doe
48737+ type: string
48738+ type:
48739+ $ref: '#/components/schemas/SecurityEntityRiskScoreType'
48740+ required:
48741+ - id
48742+ - type
48743+ - attributes
48744+ type: object
48745+ SecurityEntityRiskScoreAttributes:
48746+ description: Attributes of an entity risk score
48747+ properties:
48748+ configRisks:
48749+ $ref: '#/components/schemas/SecurityEntityConfigRisks'
48750+ entityID:
48751+ description: Unique identifier for the entity
48752+ example: arn:aws:iam::123456789012:user/john.doe
48753+ type: string
48754+ entityMetadata:
48755+ $ref: '#/components/schemas/SecurityEntityMetadata'
48756+ entityName:
48757+ description: Human-readable name of the entity
48758+ example: john.doe
48759+ type: string
48760+ entityProviders:
48761+ description: Cloud providers associated with the entity
48762+ example:
48763+ - aws
48764+ items:
48765+ type: string
48766+ type: array
48767+ entityRoles:
48768+ description: Roles associated with the entity
48769+ example:
48770+ - Admin
48771+ - Developer
48772+ items:
48773+ type: string
48774+ type: array
48775+ entityType:
48776+ description: Type of the entity (e.g., aws_iam_user, aws_ec2_instance)
48777+ example: aws_iam_user
48778+ type: string
48779+ firstDetected:
48780+ description: Timestamp when the entity was first detected (Unix milliseconds)
48781+ example: 1704067200000
48782+ format: int64
48783+ type: integer
48784+ lastActivityTitle:
48785+ description: Title of the most recent signal detected for this entity
48786+ example: Suspicious API call detected
48787+ type: string
48788+ lastDetected:
48789+ description: Timestamp when the entity was last detected (Unix milliseconds)
48790+ example: 1705276800000
48791+ format: int64
48792+ type: integer
48793+ riskScore:
48794+ description: Current risk score for the entity
48795+ example: 85.5
48796+ format: double
48797+ type: number
48798+ riskScoreEvolution:
48799+ description: Change in risk score compared to previous period
48800+ example: 12.3
48801+ format: double
48802+ type: number
48803+ severity:
48804+ $ref: '#/components/schemas/SecurityEntityRiskScoreAttributesSeverity'
48805+ signalsDetected:
48806+ description: Number of security signals detected for this entity
48807+ example: 15
48808+ format: int64
48809+ type: integer
48810+ required:
48811+ - entityID
48812+ - entityType
48813+ - entityProviders
48814+ - riskScore
48815+ - riskScoreEvolution
48816+ - severity
48817+ - firstDetected
48818+ - lastDetected
48819+ - lastActivityTitle
48820+ - signalsDetected
48821+ - configRisks
48822+ - entityMetadata
48823+ type: object
48824+ SecurityEntityRiskScoreAttributesSeverity:
48825+ description: Severity level based on risk score
48826+ enum:
48827+ - critical
48828+ - high
48829+ - medium
48830+ - low
48831+ - info
48832+ example: critical
48833+ type: string
48834+ x-enum-varnames:
48835+ - CRITICAL
48836+ - HIGH
48837+ - MEDIUM
48838+ - LOW
48839+ - INFO
48840+ SecurityEntityRiskScoreType:
48841+ description: Resource type
48842+ enum:
48843+ - security_entity_risk_score
48844+ example: security_entity_risk_score
48845+ type: string
48846+ x-enum-varnames:
48847+ - SECURITY_ENTITY_RISK_SCORE
48848+ SecurityEntityRiskScoresMeta:
48849+ description: Metadata for pagination
48850+ properties:
48851+ pageNumber:
48852+ description: Current page number (1-indexed)
48853+ example: 1
48854+ format: int64
48855+ type: integer
48856+ pageSize:
48857+ description: Number of items per page
48858+ example: 10
48859+ format: int64
48860+ type: integer
48861+ queryId:
48862+ description: Query ID for pagination consistency
48863+ example: abc123def456
48864+ type: string
48865+ totalRowCount:
48866+ description: Total number of entities matching the query
48867+ example: 150
48868+ format: int64
48869+ type: integer
48870+ required:
48871+ - queryId
48872+ - totalRowCount
48873+ - pageSize
48874+ - pageNumber
48875+ type: object
48876+ SecurityEntityRiskScoresResponse:
48877+ description: Response containing a list of entity risk scores
48878+ properties:
48879+ data:
48880+ items:
48881+ $ref: '#/components/schemas/SecurityEntityRiskScore'
48882+ type: array
48883+ meta:
48884+ $ref: '#/components/schemas/SecurityEntityRiskScoresMeta'
48885+ required:
48886+ - data
48887+ - meta
48888+ type: object
4863248889 SecurityFilter:
4863348890 description: The security filter's properties.
4863448891 properties:
@@ -83558,6 +83815,124 @@ paths:
8355883815 x-codegen-request-body-name: body
8355983816 x-unstable: '**Note**: This endpoint is in public beta.
8356083817
83818+ If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
83819+ /api/v2/security-entities/risk-scores:
83820+ get:
83821+ description: Get a list of entity risk scores for your organization. Entity
83822+ risk scores provide security risk assessment for entities like cloud resources,
83823+ identities, or services based on detected signals, misconfigurations, and
83824+ identity risks.
83825+ operationId: ListEntityRiskScores
83826+ parameters:
83827+ - description: Start time for the query in Unix timestamp (milliseconds). Defaults
83828+ to 2 weeks ago.
83829+ in: query
83830+ name: from
83831+ required: false
83832+ schema:
83833+ example: 1704067200000
83834+ format: int64
83835+ type: integer
83836+ - description: End time for the query in Unix timestamp (milliseconds). Defaults
83837+ to now.
83838+ in: query
83839+ name: to
83840+ required: false
83841+ schema:
83842+ example: 1705276800000
83843+ format: int64
83844+ type: integer
83845+ - description: Size of the page to return. Maximum is 1000.
83846+ in: query
83847+ name: page[size]
83848+ required: false
83849+ schema:
83850+ default: 10
83851+ example: 10
83852+ type: integer
83853+ - description: Page number to return (1-indexed).
83854+ in: query
83855+ name: page[number]
83856+ required: false
83857+ schema:
83858+ default: 1
83859+ example: 1
83860+ type: integer
83861+ - description: Query ID for pagination consistency.
83862+ in: query
83863+ name: page[queryId]
83864+ required: false
83865+ schema:
83866+ example: abc123def456
83867+ type: string
83868+ - description: 'Sort order for results. Format: `field:direction` where direction
83869+ is `asc` or `desc`.
83870+
83871+ Supported fields: `riskScore`, `lastDetected`, `firstDetected`, `entityName`,
83872+ `signalsDetected`.'
83873+ in: query
83874+ name: filter[sort]
83875+ required: false
83876+ schema:
83877+ example: riskScore:desc
83878+ type: string
83879+ - description: 'Supports filtering by entity attributes, risk scores, severity,
83880+ and more.
83881+
83882+ Example: `severity:critical AND entityType:aws_iam_user`'
83883+ in: query
83884+ name: filter[query]
83885+ required: false
83886+ schema:
83887+ example: severity:critical
83888+ type: string
83889+ - description: Filter by entity type(s). Can specify multiple values.
83890+ explode: true
83891+ in: query
83892+ name: entityType
83893+ required: false
83894+ schema:
83895+ example:
83896+ - aws_iam_user
83897+ - aws_ec2_instance
83898+ items:
83899+ example: aws_iam_user
83900+ type: string
83901+ type: array
83902+ style: form
83903+ responses:
83904+ '200':
83905+ content:
83906+ application/json:
83907+ schema:
83908+ $ref: '#/components/schemas/SecurityEntityRiskScoresResponse'
83909+ description: OK
83910+ '400':
83911+ content:
83912+ application/json:
83913+ schema:
83914+ $ref: '#/components/schemas/JSONAPIErrorResponse'
83915+ description: Bad Request
83916+ '401':
83917+ content:
83918+ application/json:
83919+ schema:
83920+ $ref: '#/components/schemas/JSONAPIErrorResponse'
83921+ description: Unauthorized
83922+ '403':
83923+ content:
83924+ application/json:
83925+ schema:
83926+ $ref: '#/components/schemas/JSONAPIErrorResponse'
83927+ description: Forbidden
83928+ '429':
83929+ $ref: '#/components/responses/TooManyRequestsResponse'
83930+ summary: List Entity Risk Scores
83931+ tags:
83932+ - Entity Risk Scores
83933+ x-unstable: '**Note**: This endpoint is in public beta and it''s subject to
83934+ change.
83935+
8356183936 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).'
8356283937 /api/v2/security/cloud_workload/policy/download:
8356383938 get:
@@ -92576,6 +92951,8 @@ tags:
9257692951
9257792952 end times, prevent all alerting related to specified Datadog tags.'
9257892953 name: Downtimes
92954+ - description: Retrieves security risk scores for entities in your organization.
92955+ name: Entity Risk Scores
9257992956- description: View and manage issues within Error Tracking. See the [Error Tracking
9258092957 page](https://docs.datadoghq.com/error_tracking/) for more information.
9258192958 name: Error Tracking
0 commit comments