Share via

az sentinel watchlist

  • Reference

Note

This reference is part of the sentinel extension for the Azure CLI (version 2.37.0 or higher). The extension will automatically install the first time you run an az sentinel watchlist command. Learn more about extensions.

Manage watchlist with sentinel.

Commands

Name Description Type Status
az sentinel watchlist create

Create a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with either rawContent or a valid SAR URI and contentType properties. The rawContent is mainly used for small watchlist (content size below 3.8 MB). The SAS URI enables the creation of large watchlist, where the content size can go up to 500 MB. The status of processing such large file can be polled through the URL returned in Azure-AsyncOperation header.

 Extension Experimental
az sentinel watchlist delete

Delete a watchlist.

 Extension Experimental
az sentinel watchlist list

Get all watchlists, without watchlist items.

 Extension Experimental
az sentinel watchlist show

Get a watchlist, without its watchlist items.

 Extension Experimental
az sentinel watchlist update

Update a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with either rawContent or a valid SAR URI and contentType properties. The rawContent is mainly used for small watchlist (content size below 3.8 MB). The SAS URI enables the creation of large watchlist, where the content size can go up to 500 MB. The status of processing such large file can be polled through the URL returned in Azure-AsyncOperation header.

 Extension Experimental

az sentinel watchlist create

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Create a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with either rawContent or a valid SAR URI and contentType properties. The rawContent is mainly used for small watchlist (content size below 3.8 MB). The SAS URI enables the creation of large watchlist, where the content size can go up to 500 MB. The status of processing such large file can be polled through the URL returned in Azure-AsyncOperation header.

az sentinel watchlist create --name
                             --resource-group
                             --workspace-name
                             [--content-type]
                             [--created]
                             [--created-by]
                             [--default-duration]
                             [--description]
                             [--display-name]
                             [--etag]
                             [--is-deleted {0, 1, f, false, n, no, t, true, y, yes}]
                             [--items-search-key]
                             [--labels]
                             [--provider]
                             [--raw-content]
                             [--skip-num]
                             [--source]
                             [--source-type {Local file, Remote storage}]
                             [--tenant-id]
                             [--updated]
                             [--updated-by]
                             [--upload-status]
                             [--watchlist-id]
                             [--watchlist-type]

Required Parameters

--name --watchlist-alias -n

Watchlist Alias.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--workspace-name -w
Experimental

The name of the workspace.

Optional Parameters

--content-type

The content type of the raw content. Example : text/csv or text/tsv.

--created

The time the watchlist was created.

--created-by

Describes a user that created the watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--default-duration

The default duration of a watchlist (in ISO 8601 duration format).

--description

A description of the watchlist.

--display-name

The display name of the watchlist.

--etag

Etag of the azure resource.

--is-deleted

A flag that indicates if the watchlist is deleted or not.

Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--items-search-key

The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.

--labels

List of labels relevant to this watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--provider

The provider of the watchlist.

--raw-content

The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint.

--skip-num

The number of lines in a csv/tsv content to skip before the header.

--source

The filename of the watchlist, called 'source'.

--source-type

The sourceType of the watchlist.

Accepted values: Local file, Remote storage
--tenant-id

The tenantId where the watchlist belongs to.

--updated

The last time the watchlist was updated.

--updated-by

Describes a user that updated the watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--upload-status

The status of the Watchlist upload : New, InProgress or Complete. Pls note : When a Watchlist upload status is equal to InProgress, the Watchlist cannot be deleted.

--watchlist-id

The id (a Guid) of the watchlist.

--watchlist-type

The type of the watchlist.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az sentinel watchlist delete

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Delete a watchlist.

az sentinel watchlist delete [--ids]
                             [--name]
                             [--resource-group]
                             [--subscription]
                             [--workspace-name]
                             [--yes]

Optional Parameters

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

--name --watchlist-alias -n

Watchlist Alias.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--workspace-name -w
Experimental

The name of the workspace.

--yes -y

Do not prompt for confirmation.

Default value: False
Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az sentinel watchlist list

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Get all watchlists, without watchlist items.

az sentinel watchlist list --resource-group
                           --workspace-name
                           [--skip-token]

Required Parameters

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--workspace-name -w
Experimental

The name of the workspace.

Optional Parameters

--skip-token

Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az sentinel watchlist show

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Get a watchlist, without its watchlist items.

az sentinel watchlist show [--ids]
                           [--name]
                           [--resource-group]
                           [--subscription]
                           [--workspace-name]

Optional Parameters

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

--name --watchlist-alias -n

Watchlist Alias.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--workspace-name -w
Experimental

The name of the workspace.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az sentinel watchlist update

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Update a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with either rawContent or a valid SAR URI and contentType properties. The rawContent is mainly used for small watchlist (content size below 3.8 MB). The SAS URI enables the creation of large watchlist, where the content size can go up to 500 MB. The status of processing such large file can be polled through the URL returned in Azure-AsyncOperation header.

az sentinel watchlist update [--add]
                             [--content-type]
                             [--created]
                             [--created-by]
                             [--default-duration]
                             [--description]
                             [--display-name]
                             [--etag]
                             [--force-string {0, 1, f, false, n, no, t, true, y, yes}]
                             [--ids]
                             [--is-deleted {0, 1, f, false, n, no, t, true, y, yes}]
                             [--items-search-key]
                             [--labels]
                             [--name]
                             [--provider]
                             [--raw-content]
                             [--remove]
                             [--resource-group]
                             [--set]
                             [--skip-num]
                             [--source]
                             [--source-type {Local file, Remote storage}]
                             [--subscription]
                             [--tenant-id]
                             [--updated]
                             [--updated-by]
                             [--upload-status]
                             [--watchlist-id]
                             [--watchlist-type]
                             [--workspace-name]

Optional Parameters

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

--content-type

The content type of the raw content. Example : text/csv or text/tsv.

--created

The time the watchlist was created.

--created-by

Describes a user that created the watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--default-duration

The default duration of a watchlist (in ISO 8601 duration format).

--description

A description of the watchlist.

--display-name

The display name of the watchlist.

--etag

Etag of the azure resource.

--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

--is-deleted

A flag that indicates if the watchlist is deleted or not.

Accepted values: 0, 1, f, false, n, no, t, true, y, yes
--items-search-key

The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.

--labels

List of labels relevant to this watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--name --watchlist-alias -n

Watchlist Alias.

--provider

The provider of the watchlist.

--raw-content

The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint.

--remove

Remove a property or an element from a list. Example: --remove property.list <indexToRemove> OR --remove propertyToRemove.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=<value>.

--skip-num

The number of lines in a csv/tsv content to skip before the header.

--source

The filename of the watchlist, called 'source'.

--source-type

The sourceType of the watchlist.

Accepted values: Local file, Remote storage
--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--tenant-id

The tenantId where the watchlist belongs to.

--updated

The last time the watchlist was updated.

--updated-by

Describes a user that updated the watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

--upload-status

The status of the Watchlist upload : New, InProgress or Complete. Pls note : When a Watchlist upload status is equal to InProgress, the Watchlist cannot be deleted.

--watchlist-id

The id (a Guid) of the watchlist.

--watchlist-type

The type of the watchlist.

--workspace-name -w
Experimental

The name of the workspace.

Global Parameters
--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc
Default value: json
--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.