watchlist_items

Creates, updates, deletes, gets or lists a watchlist_items resource.

Overview

Name	watchlist_items
Type	Resource
Id	azure.security_insight.watchlist_items

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
created	string (date-time)	The time the watchlist item was created.
createdBy	object	Describes a user that created the watchlist item.
entityMapping	object	key-value pairs for a watchlist item entity mapping.
etag	string	Etag of the azure resource.
isDeleted	boolean	A flag that indicates if the watchlist item is deleted or not.
itemsKeyValue	object	key-value pairs for a watchlist item. Required.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tenantId	string	The tenantId to which the watchlist item belongs to.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
updated	string (date-time)	The last time the watchlist item was updated.
updatedBy	object	Describes a user that updated the watchlist item.
watchlistItemId	string	The id (a Guid) of the watchlist item.
watchlistItemType	string	The type of the watchlist item.

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
created	string (date-time)	The time the watchlist item was created.
createdBy	object	Describes a user that created the watchlist item.
entityMapping	object	key-value pairs for a watchlist item entity mapping.
etag	string	Etag of the azure resource.
isDeleted	boolean	A flag that indicates if the watchlist item is deleted or not.
itemsKeyValue	object	key-value pairs for a watchlist item. Required.
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tenantId	string	The tenantId to which the watchlist item belongs to.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
updated	string (date-time)	The last time the watchlist item was updated.
updatedBy	object	Describes a user that updated the watchlist item.
watchlistItemId	string	The id (a Guid) of the watchlist item.
watchlistItemType	string	The type of the watchlist item.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, workspace_name, watchlist_alias, watchlist_item_id, subscription_id		Get a watchlist item.
list	select	resource_group_name, workspace_name, watchlist_alias, subscription_id	$skipToken	Get all watchlist Items.
create_or_update	insert	resource_group_name, workspace_name, watchlist_alias, watchlist_item_id, subscription_id		Create or update a watchlist item.
create_or_update	replace	resource_group_name, workspace_name, watchlist_alias, watchlist_item_id, subscription_id		Create or update a watchlist item.
delete	delete	resource_group_name, workspace_name, watchlist_alias, watchlist_item_id, subscription_id		Delete a watchlist item.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
watchlist_alias	string	The watchlist alias. Required.
watchlist_item_id	string	The watchlist item id (GUID). Required.
workspace_name	string	The name of the monitor workspace. Required.
$skipToken	string	Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. Default value is None.

SELECT examples

get

Get a watchlist item.

SELECT
id,
name,
created,
createdBy,
entityMapping,
etag,
isDeleted,
itemsKeyValue,
systemData,
tenantId,
type,
updated,
updatedBy,
watchlistItemId,
watchlistItemType
FROM azure.security_insight.watchlist_items
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND watchlist_alias = '{{ watchlist_alias }}' -- required
AND watchlist_item_id = '{{ watchlist_item_id }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list

Get all watchlist Items.

SELECT
id,
name,
created,
createdBy,
entityMapping,
etag,
isDeleted,
itemsKeyValue,
systemData,
tenantId,
type,
updated,
updatedBy,
watchlistItemId,
watchlistItemType
FROM azure.security_insight.watchlist_items
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND watchlist_alias = '{{ watchlist_alias }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
AND $skipToken = '{{ $skipToken }}'
;

INSERT examples

create_or_update

Create or update a watchlist item.

INSERT INTO azure.security_insight.watchlist_items (
properties,
etag,
resource_group_name,
workspace_name,
watchlist_alias,
watchlist_item_id,
subscription_id
)
SELECT 
'{{ properties }}',
'{{ etag }}',
'{{ resource_group_name }}',
'{{ workspace_name }}',
'{{ watchlist_alias }}',
'{{ watchlist_item_id }}',
'{{ subscription_id }}'
RETURNING
id,
name,
etag,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: watchlist_items
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the watchlist_items resource.
  - name: workspace_name
    value: "{{ workspace_name }}"
    description: Required parameter for the watchlist_items resource.
  - name: watchlist_alias
    value: "{{ watchlist_alias }}"
    description: Required parameter for the watchlist_items resource.
  - name: watchlist_item_id
    value: "{{ watchlist_item_id }}"
    description: Required parameter for the watchlist_items resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the watchlist_items resource.
  - name: properties
    description: |
      Watchlist Item properties.
    value:
      watchlistItemType: "{{ watchlistItemType }}"
      watchlistItemId: "{{ watchlistItemId }}"
      tenantId: "{{ tenantId }}"
      isDeleted: {{ isDeleted }}
      created: "{{ created }}"
      updated: "{{ updated }}"
      createdBy:
        email: "{{ email }}"
        name: "{{ name }}"
        objectId: "{{ objectId }}"
      updatedBy:
        email: "{{ email }}"
        name: "{{ name }}"
        objectId: "{{ objectId }}"
      itemsKeyValue: "{{ itemsKeyValue }}"
      entityMapping: "{{ entityMapping }}"
  - name: etag
    value: "{{ etag }}"
    description: |
      Etag of the azure resource.

REPLACE examples

create_or_update

Create or update a watchlist item.

REPLACE azure.security_insight.watchlist_items
SET 
properties = '{{ properties }}',
etag = '{{ etag }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND watchlist_alias = '{{ watchlist_alias }}' --required
AND watchlist_item_id = '{{ watchlist_item_id }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
etag,
properties,
systemData,
type;

DELETE examples

delete

Delete a watchlist item.

DELETE FROM azure.security_insight.watchlist_items
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND watchlist_alias = '{{ watchlist_alias }}' --required
AND watchlist_item_id = '{{ watchlist_item_id }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;