Create a new Cloud SIEM dataset. A dataset bundles a data source, a set of
indexes, and a search query that can be referenced from detection rules.
This endpoint requires
any
of the following permissions:
security_monitoring_rules_write
security_monitoring_dataset_write
OAuth apps require the security_monitoring_rules_write authorization scope to access this endpoint.
The attributes of a dataset create or update request.
definition [required]
object
The definition of the dataset. The shape depends on the value of data_source.
Use reference_table or managed_resource for a referential dataset, or one of the
event platform sources (for example logs, audit, events, spans, rum) for
an event platform dataset.
columns
[object]
For event platform datasets, the list of columns exposed by the dataset.
column [required]
string
The name of the column.
type [required]
string
The type of the column value.
data_source [required]
string
The data source backing this dataset definition.
indexes
[string]
For event platform datasets, the list of indexes to query.
name [required]
string
The unique name of the dataset. Must start with a lowercase letter and contain only lowercase letters, digits, and underscores (max 255 characters).
query_filter
string
For referential datasets, an optional filter expression applied to the table.
search
object
The search clause applied to an event platform dataset.
query [required]
string
The search query expression.
storage
string
Storage tier the dataset reads from. Applies to event platform datasets.
table_name
string
For referential datasets, the name of the underlying table.
time_window
object
An optional time window that overrides the default query time range.
from
int64
Inclusive start of the time window, in milliseconds since the Unix epoch.
to
int64
Exclusive end of the time window, in milliseconds since the Unix epoch.
description
string
The description of the dataset. Maximum 255 characters.
version
int64
The expected current version of the dataset for optimistic concurrency control on updates.
If the dataset's current version does not match, the request is rejected with a 409 Conflict.
type [required]
enum
The type of resource for a dataset create request.
Allowed enum values: datasetCreate
{"data":{"attributes":{"definition":{"columns":[{"column":"message","type":"string"}],"data_source":"logs","indexes":[],"name":"sample_dataset","query_filter":"status = 'active'","search":{"query":"*"},"storage":"hot","table_name":"my_reference_table","time_window":{"from":1700000000000,"to":1700003600000}},"description":"A sample dataset used for detection rules.","version":1},"type":"datasetCreate"}}
