What does the 'DefaultDuration' field mean in the Watchlist table

Question

When I create a watchlist via the API I have the option to configure this value. Also if I look up the Watchlist table in Sentinel I can see this DefaultDuration field.
All my watchlists (created via the GUI) have 1D 3H configured as DefaultDuration.

Does anybody know what this field mean? I looked up the Watchlist table documentation but it only says this is a default duration value inherited by the items. But it is not clear to me what this value actually affects and how my watchlist will act if I define a different value during creation. Any ideas?

Answer 1

Hi, when I last asked Microsoft this was the answer (~16mths ago):

Q: Do watchlists expire or remain forever?

Watchlists - List - REST API (Azure Sentinel) | Microsoft Docs has a properties.defaultDuration (which seems to be 1day 3hrs) but what is it there for / actually do?

Answer:

This is a future capability, currently not active

If this answer helps, please Accept.