az sentinel watchlist

Note

This reference is part of the sentinel extension for the Azure CLI (version 2.37.0 or higher). The extension will automatically install the first time you run an az sentinel watchlist command. Learn more about extensions.

Manage watchlist with sentinel.

Commands

Name	Description	Type	Status
az sentinel watchlist create	Create a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with either rawContent or a valid SAR URI and contentType properties. The rawContent is mainly used for small watchlist (content size below 3.8 MB). The SAS URI enables the creation of large watchlist, where the content size can go up to 500 MB. The status of processing such large file can be polled through the URL returned in Azure-AsyncOperation header.	Extension	Experimental
az sentinel watchlist delete	Delete a watchlist.	Extension	Experimental
az sentinel watchlist list	Get all watchlists, without watchlist items.	Extension	Experimental
az sentinel watchlist show	Get a watchlist, without its watchlist items.	Extension	Experimental
az sentinel watchlist update	Update a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with either rawContent or a valid SAR URI and contentType properties. The rawContent is mainly used for small watchlist (content size below 3.8 MB). The SAS URI enables the creation of large watchlist, where the content size can go up to 500 MB. The status of processing such large file can be polled through the URL returned in Azure-AsyncOperation header.	Extension	Experimental

az sentinel watchlist create

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Create a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with either rawContent or a valid SAR URI and contentType properties. The rawContent is mainly used for small watchlist (content size below 3.8 MB). The SAS URI enables the creation of large watchlist, where the content size can go up to 500 MB. The status of processing such large file can be polled through the URL returned in Azure-AsyncOperation header.

az sentinel watchlist create --name --watchlist-alias
                             --resource-group
                             --workspace-name
                             [--content-type]
                             [--created]
                             [--created-by]
                             [--default-duration]
                             [--description]
                             [--display-name]
                             [--etag]
                             [--is-deleted {0, 1, f, false, n, no, t, true, y, yes}]
                             [--items-search-key]
                             [--labels]
                             [--provider]
                             [--raw-content]
                             [--skip-num]
                             [--source]
                             [--source-type {Local file, Remote storage}]
                             [--tenant-id]
                             [--updated]
                             [--updated-by]
                             [--upload-status]
                             [--watchlist-id]
                             [--watchlist-type]

Required Parameters

--name --watchlist-alias -n

Watchlist Alias.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--workspace-name -w

Experimental

The name of the workspace.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--content-type

The content type of the raw content. Example : text/csv or text/tsv.

Property	Value
Parameter group:	Properties Arguments

--created

The time the watchlist was created.

Property	Value
Parameter group:	Properties Arguments

--created-by

Describes a user that created the watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--default-duration

The default duration of a watchlist (in ISO 8601 duration format).

Property	Value
Parameter group:	Properties Arguments

--description

A description of the watchlist.

Property	Value
Parameter group:	Properties Arguments

--display-name

The display name of the watchlist.

Property	Value
Parameter group:	Properties Arguments

--etag

Etag of the azure resource.

Property	Value
Parameter group:	Watchlist Arguments

--is-deleted

A flag that indicates if the watchlist is deleted or not.

Property	Value
Parameter group:	Properties Arguments
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--items-search-key

The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.

Property	Value
Parameter group:	Properties Arguments

--labels

List of labels relevant to this watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--provider

The provider of the watchlist.

Property	Value
Parameter group:	Properties Arguments

--raw-content

The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint.

Property	Value
Parameter group:	Properties Arguments

--skip-num

The number of lines in a csv/tsv content to skip before the header.

Property	Value
Parameter group:	Properties Arguments

--source

The filename of the watchlist, called 'source'.

Property	Value
Parameter group:	Properties Arguments

--source-type

The sourceType of the watchlist.

Property	Value
Parameter group:	Properties Arguments
Accepted values:	Local file, Remote storage

--tenant-id

The tenantId where the watchlist belongs to.

Property	Value
Parameter group:	Properties Arguments

--updated

The last time the watchlist was updated.

Property	Value
Parameter group:	Properties Arguments

--updated-by

Describes a user that updated the watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--upload-status

The status of the Watchlist upload : New, InProgress or Complete. Pls note : When a Watchlist upload status is equal to InProgress, the Watchlist cannot be deleted.

Property	Value
Parameter group:	Properties Arguments

--watchlist-id

The id (a Guid) of the watchlist.

Property	Value
Parameter group:	Properties Arguments

--watchlist-type

The type of the watchlist.

Property	Value
Parameter group:	Properties Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az sentinel watchlist delete

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Delete a watchlist.

az sentinel watchlist delete [--ids]
                             [--name --watchlist-alias]
                             [--resource-group]
                             [--subscription]
                             [--workspace-name]
                             [--yes]

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--name --watchlist-alias -n

Watchlist Alias.

Property	Value
Parameter group:	Resource Id Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

--workspace-name -w

Experimental

The name of the workspace.

Property	Value
Parameter group:	Resource Id Arguments

--yes -y

Do not prompt for confirmation.

Property	Value
Default value:	False

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az sentinel watchlist list

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Get all watchlists, without watchlist items.

az sentinel watchlist list --resource-group
                           --workspace-name
                           [--skip-token]

Required Parameters

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

--workspace-name -w

Experimental

The name of the workspace.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--skip-token

Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az sentinel watchlist show

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Get a watchlist, without its watchlist items.

az sentinel watchlist show [--ids]
                           [--name --watchlist-alias]
                           [--resource-group]
                           [--subscription]
                           [--workspace-name]

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--name --watchlist-alias -n

Watchlist Alias.

Property	Value
Parameter group:	Resource Id Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

--workspace-name -w

Experimental

The name of the workspace.

Property	Value
Parameter group:	Resource Id Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az sentinel watchlist update

Experimental

This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus

Update a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with either rawContent or a valid SAR URI and contentType properties. The rawContent is mainly used for small watchlist (content size below 3.8 MB). The SAS URI enables the creation of large watchlist, where the content size can go up to 500 MB. The status of processing such large file can be polled through the URL returned in Azure-AsyncOperation header.

az sentinel watchlist update [--add]
                             [--content-type]
                             [--created]
                             [--created-by]
                             [--default-duration]
                             [--description]
                             [--display-name]
                             [--etag]
                             [--force-string {0, 1, f, false, n, no, t, true, y, yes}]
                             [--ids]
                             [--is-deleted {0, 1, f, false, n, no, t, true, y, yes}]
                             [--items-search-key]
                             [--labels]
                             [--name --watchlist-alias]
                             [--provider]
                             [--raw-content]
                             [--remove]
                             [--resource-group]
                             [--set]
                             [--skip-num]
                             [--source]
                             [--source-type {Local file, Remote storage}]
                             [--subscription]
                             [--tenant-id]
                             [--updated]
                             [--updated-by]
                             [--upload-status]
                             [--watchlist-id]
                             [--watchlist-type]
                             [--workspace-name]

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--add

Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.

Property	Value
Parameter group:	Generic Update Arguments

--content-type

The content type of the raw content. Example : text/csv or text/tsv.

Property	Value
Parameter group:	Properties Arguments

--created

The time the watchlist was created.

Property	Value
Parameter group:	Properties Arguments

--created-by

Describes a user that created the watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--default-duration

The default duration of a watchlist (in ISO 8601 duration format).

Property	Value
Parameter group:	Properties Arguments

--description

A description of the watchlist.

Property	Value
Parameter group:	Properties Arguments

--display-name

The display name of the watchlist.

Property	Value
Parameter group:	Properties Arguments

--etag

Etag of the azure resource.

Property	Value
Parameter group:	Watchlist Arguments

--force-string

When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.

Property	Value
Parameter group:	Generic Update Arguments
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--ids

One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.

Property	Value
Parameter group:	Resource Id Arguments

--is-deleted

A flag that indicates if the watchlist is deleted or not.

Property	Value
Parameter group:	Properties Arguments
Accepted values:	0, 1, f, false, n, no, t, true, y, yes

--items-search-key

The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.

Property	Value
Parameter group:	Properties Arguments

--labels

List of labels relevant to this watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--name --watchlist-alias -n

Watchlist Alias.

Property	Value
Parameter group:	Resource Id Arguments

--provider

The provider of the watchlist.

Property	Value
Parameter group:	Properties Arguments

--raw-content

The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint.

Property	Value
Parameter group:	Properties Arguments

--remove

Remove a property or an element from a list. Example: --remove property.list <indexToRemove> OR --remove propertyToRemove.

Property	Value
Parameter group:	Generic Update Arguments

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Property	Value
Parameter group:	Resource Id Arguments

--set

Update an object by specifying a property path and value to set. Example: --set property1.property2=<value>.

Property	Value
Parameter group:	Generic Update Arguments

--skip-num

The number of lines in a csv/tsv content to skip before the header.

Property	Value
Parameter group:	Properties Arguments

--source

The filename of the watchlist, called 'source'.

Property	Value
Parameter group:	Properties Arguments

--source-type

The sourceType of the watchlist.

Property	Value
Parameter group:	Properties Arguments
Accepted values:	Local file, Remote storage

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

Property	Value
Parameter group:	Resource Id Arguments

--tenant-id

The tenantId where the watchlist belongs to.

Property	Value
Parameter group:	Properties Arguments

--updated

The last time the watchlist was updated.

Property	Value
Parameter group:	Properties Arguments

--updated-by

Describes a user that updated the watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.

Property	Value
Parameter group:	Properties Arguments

--upload-status

The status of the Watchlist upload : New, InProgress or Complete. Pls note : When a Watchlist upload status is equal to InProgress, the Watchlist cannot be deleted.

Property	Value
Parameter group:	Properties Arguments

--watchlist-id

The id (a Guid) of the watchlist.

Property	Value
Parameter group:	Properties Arguments

--watchlist-type

The type of the watchlist.

Property	Value
Parameter group:	Properties Arguments

--workspace-name -w

Experimental

The name of the workspace.

Property	Value
Parameter group:	Resource Id Arguments

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False