---
title: "Get a quick list of security signals"
method: GET
path: "/api/v2/security_monitoring/signals"
tags: ["Security Monitoring"]
---

# Get a quick list of security signals

`GET /api/v2/security_monitoring/signals`

The list endpoint returns security signals that match a search query.
Both this endpoint and the POST endpoint can be used interchangeably when listing
security signals.

## Query parameters

- `filter[query]` string
- `filter[from]` string, date-time
- `filter[to]` string, date-time
- `sort` 'timestamp' | '-timestamp' — The sort parameters used for querying security signals.
- `page[cursor]` string
- `page[limit]` integer

## Response `200`

OK

- SecurityMonitoringSignalsListResponse — The response object with all security signals matching the request and pagination information.
  - `data` SecurityMonitoringSignal[] — An array of security signals matching the request.
    - `attributes` SecurityMonitoringSignalAttributes — The object containing all signal attributes and their associated values.
      - `custom` object — A JSON object of attributes in the security signal.
      - `message` string — The message in the security signal defined by the rule that generated the signal.
      - `tags` string[] — An array of tags associated with the security signal.
      - `timestamp` string, date-time — The timestamp of the security signal.
    - `id` string — The unique ID of the security signal.
    - `type` 'signal' — The type of event.
  - `links` SecurityMonitoringSignalsListResponseLinks — Links attributes.
    - `next` string — The link for the next set of results. **Note**: The request can also be made using the POST endpoint.
  - `meta` SecurityMonitoringSignalsListResponseMeta — Meta attributes.
    - `page` SecurityMonitoringSignalsListResponseMetaPage — Paging attributes.
      - `after` string — The cursor used to get the next results, if any. To make the next request, use the same parameters with the addition of the `page[cursor]`.

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/versions/da68bf029e4c/schema)