v1

latestOpenAPI 3.0.02026-07-141,4077,1665.2 MB

Security Monitoring

Create a dataset

Create a new Cloud SIEM dataset. A dataset bundles a data source, a set of indexes, and a search query that can be referenced from detection rules.

post/api/v2/security_monitoring/datasets

Request body

Example request

{
  "data": {
    "attributes": {
      "definition": {
        "columns": [
          {
            "column": "message",
            "type": "string"
          }
        ],
        "data_source": "logs",
        "name": "sample_dataset",
        "query_filter": "status = 'active'",
        "search": {
          "query": "*"
        },
        "storage": "hot",
        "table_name": "my_reference_table",
        "time_window": {
          "from": 1700000000000,
          "to": 1700003600000
        }
      },
      "description": "A sample dataset used for detection rules.",
      "version": 1
    },
    "type": "datasetCreate"
  }
}

Response

Created

Example response

{
  "data": {
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "type": "dataset"
  }
}