Get the entities with the most recent updates in the Cloud SIEM entity context store. Entities are ranked
by the time of their most recent revision in the requested time range, and the top limit entities are
returned in that order. This endpoint is not paginated.
This endpoint requires the siem_entities_read permission.
OAuth apps require the siem_entities_read authorization scope to access this endpoint.
引数
クエリ文字列
名前
タイプ
説明
query
string
A free-text query (for example, an email address or principal ID) used to filter the entities returned.
entity_type
enum
The type of entity to retrieve. Only siem_entity_identity is currently supported.
Defaults to siem_entity_identity. Allowed enum values: siem_entity_identity
from
string
The start of the time range to query, as an RFC3339 timestamp or a relative time (for example, now-7d).
Defaults to now-7d.
to
string
The end of the time range to query, as an RFC3339 timestamp or a relative time (for example, now).
Defaults to now. Entities are ranked by their most recent revision within [from, to].
limit
integer
The number of entities to return. Must be between 1 and 100.
revisions
enum
Which revisions to return for each entity: latest returns only the latest revision of each entity as of to,
and all returns every revision in the requested time range. Allowed enum values: latest, all
Response from the recently updated entities endpoint, containing the entities with the most recent updates in the requested time range, ordered from most to least recently updated.
Expand All
フィールド
タイプ
説明
data [required]
[object]
The list of entities with the most recent updates, ordered from most to least recently updated.
attributes [required]
object
The attributes of an entity context entry, grouping all the historical revisions of the entity.
revisions [required]
[object]
The historical revisions of the entity, ordered chronologically.
attributes [required]
object
The set of attributes recorded for the entity at this revision. The keys depend on the kind of entity.
first_seen_at [required]
date-time
The first time the entity was observed at this revision.
last_seen_at [required]
date-time
The last time the entity was observed at this revision.
id [required]
string
The unique identifier of the entity.
type [required]
string
The type of the entity. Reflects the underlying entity kind from the entity context store
(for example, siem_entity_identity for identities). Defaults to entity when the kind is unknown.
