---
title: "Create a dataset"
method: POST
path: "/api/v2/security_monitoring/datasets"
tags: ["Security Monitoring"]
---

# Create a dataset

`POST /api/v2/security_monitoring/datasets`

Create a new Cloud SIEM dataset. A dataset bundles a data source, a set of
indexes, and a search query that can be referenced from detection rules.

## Request body

- SecurityMonitoringDatasetCreateRequest — Request body for creating a Cloud SIEM dataset.
  - `data` SecurityMonitoringDatasetCreateData, required — The data wrapper of a dataset create request.
    - `attributes` SecurityMonitoringDatasetAttributesRequest, required — The attributes of a dataset create or update request.
      - `definition` SecurityMonitoringDatasetDefinition, required — The definition of the dataset. The shape depends on the value of `data_source`. Use `reference_table` or `managed_resource` for a referential dataset, or one of the event platform sources (for example `logs`, `audit`, `events`, `spans`, `rum`) for an event platform dataset.
        - `columns` SecurityMonitoringDatasetColumn[] — For event platform datasets, the list of columns exposed by the dataset.
          - `column` string, required — The name of the column.
          - `type` string, required — The type of the column value.
        - `data_source` string, required — The data source backing this dataset definition.
        - `indexes` string[] — For event platform datasets, the list of indexes to query.
        - `name` string, required — The unique name of the dataset. Must start with a lowercase letter and contain only lowercase letters, digits, and underscores (max 255 characters).
        - `query_filter` string — For referential datasets, an optional filter expression applied to the table.
        - `search` SecurityMonitoringDatasetSearch — The search clause applied to an event platform dataset.
          - `query` string, required — The search query expression.
        - `storage` string — Storage tier the dataset reads from. Applies to event platform datasets.
        - `table_name` string — For referential datasets, the name of the underlying table.
        - `time_window` SecurityMonitoringDatasetTimeWindow — An optional time window that overrides the default query time range.
          - `from` integer — Inclusive start of the time window, in milliseconds since the Unix epoch.
          - `to` integer — Exclusive end of the time window, in milliseconds since the Unix epoch.
      - `description` string — The description of the dataset. Maximum 255 characters.
      - `version` integer — The expected current version of the dataset for optimistic concurrency control on updates. If the dataset's current version does not match, the request is rejected with a 409 Conflict.
    - `type` 'datasetCreate', required — The type of resource for a dataset create request.

## Response `201`

Created

- SecurityMonitoringDatasetCreateResponse — Response returned after creating a dataset.
  - `data` SecurityMonitoringDatasetCreateResponseData, required — The data wrapper of a dataset create response.
    - `id` string, required — The UUID of the newly created dataset.
    - `type` 'dataset', required — The type of resource for a dataset response.

## Other responses

- `400` — Bad Request
- `403` — Forbidden
- `409` — Conflict
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)