How to create and deploy a watchlist template with solution package?

Bharvi Bhut 181 Reputation points
2023-03-07T09:11:42.86+00:00

Hello there,
We are using a watchlist to display a data into workbook.

Can anyone help like how to create a template of watchlist and how to deploy that template with Microsoft solution package?

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
989 questions
0 comments
Accepted answer
  1. Clive Watson 5,716 Reputation points MVP
    2023-03-07T09:20:42.9266667+00:00

    I have a partial answer - you can create a Watchlist template in JSON - see examples from other Solutions: https://github.com/Azure/Azure-Sentinel/tree/c6dce9c3aa4d4b4d02423ac4eb5a6b677a39e432/Solutions/SOC-Process-Framework/Watchlists

    The Folder structure doesn't list Watchlist, but you can create it just like you do for Workbooks or Parsers (or any other resource) https://github.com/Azure/Azure-Sentinel/tree/master/Solutions#guide-to-building-microsoft-sentinel-solutions

    The Solution Package Tool, shows entries for Watchlists, so you can use this as a guide: https://github.com/Azure/Azure-Sentinel/blob/master/Tools/Create-Azure-Sentinel-Solution/V2/README.md

    I hope this helps, please "accept" the answer if it does?

    1 person found this answer helpful.
    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest