v1

latestOpenAPI 3.0.02026-07-141,4077,1665.2 MB

Entity Risk Scores

List Entity Risk Scores

Get a list of entity risk scores for your organization. Entity risk scores provide security risk assessment for entities like cloud resources, identities, or services based on detected signals, misconfigurations, and identity risks.

get/api/v2/security-entities/risk-scores

Query parameters

frominteger

Example:1704067200000

Start time for the query in Unix timestamp (milliseconds). Defaults to 2 weeks ago.

tointeger

Example:1705276800000

End time for the query in Unix timestamp (milliseconds). Defaults to now.

page[size]integer

Example:10

Size of the page to return. Maximum is 1000.

page[number]integer

Example:1

Page number to return (1-indexed).

page[queryId]string

Example:abc123def456

Query ID for pagination consistency.

filter[sort]string

Example:riskScore:desc

Sort order for results. Format: field:direction where direction is asc or desc. Supported fields: riskScore, lastDetected, firstDetected, entityName, signalsDetected.

filter[query]string

Example:severity:critical

Supports filtering by entity attributes, risk scores, severity, and more. Example: severity:critical AND entityType:aws_iam_user

entityTypestring[]

Filter by entity type(s). Can specify multiple values.

[
  "aws_iam_user",
  "aws_ec2_instance"
]

Response

Example response

{
  "data": [
    {
      "attributes": {
        "accountIds": [
          "222233334444",
          "3333333555555"
        ],
        "configRisks": {
          "hasMisconfiguration": true,
          "hasPrivilegedRole": true,
          "isProduction": true,
          "isPubliclyAccessible": true
        },
        "entityMetadata": {
          "accountID": "123456789012",
          "environments": [
            "production",
            "us-east-1"
          ],
          "mitreTactics": [
            "Credential Access",
            "Privilege Escalation"
          ],
          "mitreTechniques": [
            "T1078",
            "T1098"
          ],
          "projectID": "my-gcp-project",
          "services": [
            "api-gateway",
            "lambda"
          ],
          "sources": [
            "cloudtrail",
            "cloud-security-posture-management"
          ],
          "subscriptionID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
        },
        "entityName": "john.doe",
        "entityProviders": [
          "AWS"
        ],
        "entityRoles": [],
        "entitySubTypes": [
          "Root"
        ],
        "entityType": "aws_iam_user",
        "entityTypes": [
          "Root",
          "User Name"
        ],
        "firstDetected": 1778876604661,
        "lastActivityTitle": "Suspicious API call detected",
        "lastDetected": 1780064607093,
        "riskScore": 85,
        "riskScoreEvolution": 12,
        "severity": "critical",
        "signalsDetected": 15
      },
      "id": "arn:aws:iam::123456789012:user/john.doe",
      "type": "SecurityEntityRiskScore"
    }
  ],
  "meta": {
    "pageNumber": 1,
    "pageSize": 10,
    "queryId": "abc123def456",
    "totalRowCount": 150
  }
}