How to create and deploy a watchlist template with solution package?

Question

Hello there,
We are using a watchlist to display a data into workbook.

Can anyone help like how to create a template of watchlist and how to deploy that template with Microsoft solution package?

Answer 1

I have a partial answer - you can create a Watchlist template in JSON - see examples from other Solutions: https://github.com/Azure/Azure-Sentinel/tree/c6dce9c3aa4d4b4d02423ac4eb5a6b677a39e432/Solutions/SOC-Process-Framework/Watchlists

The Folder structure doesn't list Watchlist, but you can create it just like you do for Workbooks or Parsers (or any other resource) https://github.com/Azure/Azure-Sentinel/tree/master/Solutions#guide-to-building-microsoft-sentinel-solutions

The Solution Package Tool, shows entries for Watchlists, so you can use this as a guide: https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V2/README.md

I hope this helps, please "accept" the answer if it does?