---
title: "List datasets"
method: GET
path: "/api/v2/security_monitoring/datasets"
tags: ["Security Monitoring"]
---

# List datasets

`GET /api/v2/security_monitoring/datasets`

List all Cloud SIEM datasets available to the organization, including both
customer-defined datasets and Datadog out-of-the-box datasets.

## Query parameters

- `page[size]` integer
- `page[number]` integer
- `sort` string
- `filter[query]` string

## Response `200`

OK

- SecurityMonitoringDatasetsListResponse — Response containing a paginated list of Cloud SIEM datasets.
  - `data` SecurityMonitoringDatasetData[], required — A list of dataset data items.
    - `attributes` SecurityMonitoringDatasetAttributesResponse, required — The attributes of a Cloud SIEM dataset.
      - `createdAt` string, required — The creation timestamp of the dataset, in ISO 8601 format.
      - `createdByHandle` string, required — The Datadog handle of the user who created the dataset.
      - `createdByName` string, required — The display name of the user who created the dataset.
      - `definition` SecurityMonitoringDatasetDefinition, required — The definition of the dataset. The shape depends on the value of `data_source`. Use `reference_table` or `managed_resource` for a referential dataset, or one of the event platform sources (for example `logs`, `audit`, `events`, `spans`, `rum`) for an event platform dataset.
        - `columns` SecurityMonitoringDatasetColumn[] — For event platform datasets, the list of columns exposed by the dataset.
          - `column` string, required — The name of the column.
          - `type` string, required — The type of the column value.
        - `data_source` string, required — The data source backing this dataset definition.
        - `indexes` string[] — For event platform datasets, the list of indexes to query.
        - `name` string, required — The unique name of the dataset. Must start with a lowercase letter and contain only lowercase letters, digits, and underscores (max 255 characters).
        - `query_filter` string — For referential datasets, an optional filter expression applied to the table.
        - `search` SecurityMonitoringDatasetSearch — The search clause applied to an event platform dataset.
          - `query` string, required — The search query expression.
        - `storage` string — Storage tier the dataset reads from. Applies to event platform datasets.
        - `table_name` string — For referential datasets, the name of the underlying table.
        - `time_window` SecurityMonitoringDatasetTimeWindow — An optional time window that overrides the default query time range.
          - `from` integer — Inclusive start of the time window, in milliseconds since the Unix epoch.
          - `to` integer — Exclusive end of the time window, in milliseconds since the Unix epoch.
      - `description` string, required — The description of the dataset.
      - `id` string, required — The UUID of the dataset.
      - `isDefault` boolean, required — Whether the dataset is an out-of-the-box dataset provided by Datadog.
      - `isDeprecated` boolean, required — Whether the dataset is marked as deprecated.
      - `modifiedAt` string, required — The timestamp of the last modification of the dataset, in ISO 8601 format.
      - `name` string, required — The unique name of the dataset.
      - `updatedByHandle` string, nullable, required — The Datadog handle of the user who last updated the dataset.
      - `updatedByName` string, nullable, required — The display name of the user who last updated the dataset.
      - `version` integer, required — The current version of the dataset.
    - `id` string, required — The UUID of the dataset.
    - `type` 'dataset', required — The type of resource for a dataset response.
  - `meta` SecurityMonitoringDatasetsListMeta, required — Metadata returned with a list of datasets.
    - `totalCount` integer, required — The total number of datasets matching the request, across all pages.

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)