---
title: "Get entity context"
method: GET
path: "/api/v2/security_monitoring/entity_context"
tags: ["Security Monitoring"]
---

# Get entity context

`GET /api/v2/security_monitoring/entity_context`

Search the Cloud SIEM entity context store for entities that match a query, and return the historical
revisions of each entity in the requested time range. The endpoint can either return revisions across an
interval (`from` / `to`) or the snapshot of each entity at a single point in time (`as_of`); the two modes
are mutually exclusive.

## Query parameters

- `query` string
- `from` string
- `to` string
- `as_of` string
- `limit` integer
- `page_token` string

## Response `200`

OK

- EntityContextResponse — Response from the entity context endpoint, containing the matching entities and pagination metadata.
  - `data` EntityContextEntity[], required — The list of entities matching the query.
    - `attributes` EntityContextEntityAttributes, required — The attributes of an entity context entry, grouping all the historical revisions of the entity.
      - `revisions` EntityContextRevision[], required — The historical revisions of the entity, ordered chronologically.
        - `attributes` EntityContextRevisionAttributes, required — The set of attributes recorded for the entity at this revision. The keys depend on the kind of entity.
        - `first_seen_at` string, date-time, required — The first time the entity was observed at this revision.
        - `last_seen_at` string, date-time, required — The last time the entity was observed at this revision.
    - `id` string, required — The unique identifier of the entity.
    - `type` string, required — The type of the entity. Reflects the underlying entity kind from the entity context store (for example, `siem_entity_identity` for identities). Defaults to `entity` when the kind is unknown.
  - `meta` EntityContextResponseMeta, required — Metadata returned alongside the entity context response.
    - `page` EntityContextPage, required — Pagination metadata for the entity context response.
      - `next_token` string, required — An opaque token to pass as `page_token` in a subsequent request to retrieve the next page of results. Empty when there are no more results.
    - `total_count` integer, required — The total number of entities matching the query, irrespective of pagination.

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)