@@ -31464,9 +31464,10 @@ components:
3146431464 additionalProperties: {}
3146531465 description: The set of attributes recorded for the entity at this revision. The keys depend on the kind of entity.
3146631466 example:
31467+ accounts:
31468+ - linked-account-123
3146731469 display_name: Test User
31468- emails:
31469- - user@example.com
31470+ email: user@example.com
3147031471 principal_id: user@example.com
3147131472 type: object
3147231473 EntityData:
@@ -88286,6 +88287,14 @@ components:
8828688287 type: string
8828788288 x-enum-varnames:
8828888289 - AGGREGATED_DNS
88290+ SingleEntityContextResponse:
88291+ description: Response from the single entity context endpoint, containing the matching entity.
88292+ properties:
88293+ data:
88294+ $ref: "#/components/schemas/EntityContextEntity"
88295+ required:
88296+ - data
88297+ type: object
8828988298 SlackIntegrationMetadata:
8829088299 description: Incident integration metadata for the Slack integration.
8829188300 properties:
@@ -166474,9 +166483,10 @@ paths:
166474166483 - attributes:
166475166484 revisions:
166476166485 - attributes:
166486+ accounts:
166487+ - linked-account-123
166477166488 display_name: Test User
166478- emails:
166479- - user@example.com
166489+ email: user@example.com
166480166490 principal_id: user@example.com
166481166491 first_seen_at: "2026-04-01T00:00:00Z"
166482166492 last_seen_at: "2026-05-01T00:00:00Z"
@@ -166507,7 +166517,98 @@ paths:
166507166517 permissions:
166508166518 - siem_entities_read
166509166519 x-unstable: |-
166510- **Note**: This endpoint is in preview and is subject to change.
166520+ **Note**: This endpoint is in Preview and is subject to change.
166521+ If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
166522+ /api/v2/security_monitoring/entity_context/{id}:
166523+ get:
166524+ description: |-
166525+ Get a single entity from the Cloud SIEM entity context store by its identifier, returning the historical
166526+ revisions of the entity in the requested time range. The endpoint can either return revisions across an
166527+ interval (`from` / `to`) or the snapshot of the entity at a single point in time (`as_of`); the two modes
166528+ are mutually exclusive.
166529+ operationId: GetSingleEntityContext
166530+ parameters:
166531+ - description: The unique identifier of the entity to retrieve.
166532+ in: path
166533+ name: id
166534+ required: true
166535+ schema:
166536+ example: user@example.com
166537+ type: string
166538+ - description: |-
166539+ The start of the time range to query, as an RFC3339 timestamp or a relative time (for example, `now-7d`).
166540+ Defaults to `now-7d`. Ignored when `as_of` is set.
166541+ in: query
166542+ name: from
166543+ required: false
166544+ schema:
166545+ default: now-7d
166546+ example: now-7d
166547+ type: string
166548+ - description: |-
166549+ The end of the time range to query, as an RFC3339 timestamp or a relative time (for example, `now`).
166550+ Defaults to `now`. Ignored when `as_of` is set.
166551+ in: query
166552+ name: to
166553+ required: false
166554+ schema:
166555+ default: now
166556+ example: now
166557+ type: string
166558+ - description: |-
166559+ A point in time at which to query the entity revisions, as an RFC3339 timestamp, a Unix timestamp
166560+ (in seconds), or a relative time (for example, `now-1d`). When set, `from` and `to` are ignored.
166561+ Cannot be combined with custom `from` / `to` values.
166562+ example: now-1d
166563+ in: query
166564+ name: as_of
166565+ required: false
166566+ schema:
166567+ type: string
166568+ responses:
166569+ "200":
166570+ content:
166571+ application/json:
166572+ examples:
166573+ default:
166574+ value:
166575+ data:
166576+ attributes:
166577+ revisions:
166578+ - attributes:
166579+ accounts:
166580+ - linked-account-123
166581+ display_name: Test User
166582+ email: user@example.com
166583+ principal_id: user@example.com
166584+ first_seen_at: "2026-04-01T00:00:00Z"
166585+ last_seen_at: "2026-05-01T00:00:00Z"
166586+ id: user@example.com
166587+ type: siem_entity_identity
166588+ schema:
166589+ $ref: "#/components/schemas/SingleEntityContextResponse"
166590+ description: OK
166591+ "400":
166592+ $ref: "#/components/responses/BadRequestResponse"
166593+ "403":
166594+ $ref: "#/components/responses/NotAuthorizedResponse"
166595+ "404":
166596+ $ref: "#/components/responses/NotFoundResponse"
166597+ "429":
166598+ $ref: "#/components/responses/TooManyRequestsResponse"
166599+ security:
166600+ - apiKeyAuth: []
166601+ appKeyAuth: []
166602+ - AuthZ:
166603+ - siem_entities_read
166604+ summary: Get a single entity context
166605+ tags: ["Security Monitoring"]
166606+ x-permission:
166607+ operator: OR
166608+ permissions:
166609+ - siem_entities_read
166610+ x-unstable: |-
166611+ **Note**: This endpoint is in Preview and is subject to change.
166511166612 If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).
166512166613 /api/v2/security_monitoring/rules:
166513166614 get:
0 commit comments