watchlists

Creates, updates, deletes, gets or lists a watchlists resource.

Overview

Name	watchlists
Type	Resource
Id	azure.security_insight.watchlists

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
contentType	string	The content type of the raw content. Example : text/csv or text/tsv.
created	string (date-time)	The time the watchlist was created.
createdBy	object	Describes a user that created the watchlist.
defaultDuration	string	The default duration of a watchlist (in ISO 8601 duration format).
description	string	A description of the watchlist.
displayName	string	The display name of the watchlist. Required.
etag	string	Etag of the azure resource.
isDeleted	boolean	A flag that indicates if the watchlist is deleted or not.
itemsSearchKey	string	The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address. Required.
labels	array	List of labels relevant to this watchlist.
numberOfLinesToSkip	integer	The number of lines in a csv/tsv content to skip before the header.
provider	string	The provider of the watchlist. Required.
provisioningState	string	Describes provisioning state. Known values are: "Accepted", "InProgress", "Succeeded", "Failed", and "Canceled". (Accepted, InProgress, Succeeded, Failed, Canceled)
rawContent	string	The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint.
source	string	The filename of the watchlist, called 'source'.
sourceType	string	The sourceType of the watchlist. Known values are: "Local" and "AzureStorage". (Local, AzureStorage)
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tenantId	string	The tenantId where the watchlist belongs to.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
updated	string (date-time)	The last time the watchlist was updated.
updatedBy	object	Describes a user that updated the watchlist.
uploadStatus	string	The status of the Watchlist upload : New, InProgress or Complete. Note
watchlistAlias	string	The alias of the watchlist.
watchlistId	string	The id (a Guid) of the watchlist.
watchlistType	string	The type of the watchlist.

list

Name	Datatype	Description
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}.
name	string	The name of the resource.
contentType	string	The content type of the raw content. Example : text/csv or text/tsv.
created	string (date-time)	The time the watchlist was created.
createdBy	object	Describes a user that created the watchlist.
defaultDuration	string	The default duration of a watchlist (in ISO 8601 duration format).
description	string	A description of the watchlist.
displayName	string	The display name of the watchlist. Required.
etag	string	Etag of the azure resource.
isDeleted	boolean	A flag that indicates if the watchlist is deleted or not.
itemsSearchKey	string	The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address. Required.
labels	array	List of labels relevant to this watchlist.
numberOfLinesToSkip	integer	The number of lines in a csv/tsv content to skip before the header.
provider	string	The provider of the watchlist. Required.
provisioningState	string	Describes provisioning state. Known values are: "Accepted", "InProgress", "Succeeded", "Failed", and "Canceled". (Accepted, InProgress, Succeeded, Failed, Canceled)
rawContent	string	The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint.
source	string	The filename of the watchlist, called 'source'.
sourceType	string	The sourceType of the watchlist. Known values are: "Local" and "AzureStorage". (Local, AzureStorage)
systemData	object	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tenantId	string	The tenantId where the watchlist belongs to.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts".
updated	string (date-time)	The last time the watchlist was updated.
updatedBy	object	Describes a user that updated the watchlist.
uploadStatus	string	The status of the Watchlist upload : New, InProgress or Complete. Note
watchlistAlias	string	The alias of the watchlist.
watchlistId	string	The id (a Guid) of the watchlist.
watchlistType	string	The type of the watchlist.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, workspace_name, watchlist_alias, subscription_id		Get a watchlist, without its watchlist items.
list	select	resource_group_name, workspace_name, subscription_id	$skipToken	Get all watchlists, without watchlist items.
create_or_update	insert	resource_group_name, workspace_name, watchlist_alias, subscription_id		Create or update a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with rawContent and contentType properties.
create_or_update	replace	resource_group_name, workspace_name, watchlist_alias, subscription_id		Create or update a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with rawContent and contentType properties.
delete	delete	resource_group_name, workspace_name, watchlist_alias, subscription_id		Delete a watchlist.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string
watchlist_alias	string	The watchlist alias. Required.
workspace_name	string	The name of the monitor workspace. Required.
$skipToken	string	Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional. Default value is None.

SELECT examples

get

Get a watchlist, without its watchlist items.

SELECT
id,
name,
contentType,
created,
createdBy,
defaultDuration,
description,
displayName,
etag,
isDeleted,
itemsSearchKey,
labels,
numberOfLinesToSkip,
provider,
provisioningState,
rawContent,
source,
sourceType,
systemData,
tenantId,
type,
updated,
updatedBy,
uploadStatus,
watchlistAlias,
watchlistId,
watchlistType
FROM azure.security_insight.watchlists
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND watchlist_alias = '{{ watchlist_alias }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list

Get all watchlists, without watchlist items.

SELECT
id,
name,
contentType,
created,
createdBy,
defaultDuration,
description,
displayName,
etag,
isDeleted,
itemsSearchKey,
labels,
numberOfLinesToSkip,
provider,
provisioningState,
rawContent,
source,
sourceType,
systemData,
tenantId,
type,
updated,
updatedBy,
uploadStatus,
watchlistAlias,
watchlistId,
watchlistType
FROM azure.security_insight.watchlists
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND workspace_name = '{{ workspace_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
AND $skipToken = '{{ $skipToken }}'
;

INSERT examples

create_or_update

Create or update a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with rawContent and contentType properties.

INSERT INTO azure.security_insight.watchlists (
properties,
etag,
resource_group_name,
workspace_name,
watchlist_alias,
subscription_id
)
SELECT 
'{{ properties }}',
'{{ etag }}',
'{{ resource_group_name }}',
'{{ workspace_name }}',
'{{ watchlist_alias }}',
'{{ subscription_id }}'
RETURNING
id,
name,
etag,
properties,
systemData,
type
;

Manifest

# Description fields are for documentation purposes
- name: watchlists
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the watchlists resource.
  - name: workspace_name
    value: "{{ workspace_name }}"
    description: Required parameter for the watchlists resource.
  - name: watchlist_alias
    value: "{{ watchlist_alias }}"
    description: Required parameter for the watchlists resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the watchlists resource.
  - name: properties
    description: |
      Watchlist properties.
    value:
      watchlistId: "{{ watchlistId }}"
      displayName: "{{ displayName }}"
      provider: "{{ provider }}"
      source: "{{ source }}"
      sourceType: "{{ sourceType }}"
      created: "{{ created }}"
      updated: "{{ updated }}"
      createdBy:
        email: "{{ email }}"
        name: "{{ name }}"
        objectId: "{{ objectId }}"
      updatedBy:
        email: "{{ email }}"
        name: "{{ name }}"
        objectId: "{{ objectId }}"
      description: "{{ description }}"
      watchlistType: "{{ watchlistType }}"
      watchlistAlias: "{{ watchlistAlias }}"
      isDeleted: {{ isDeleted }}
      labels:
        - "{{ labels }}"
      defaultDuration: "{{ defaultDuration }}"
      tenantId: "{{ tenantId }}"
      numberOfLinesToSkip: {{ numberOfLinesToSkip }}
      rawContent: "{{ rawContent }}"
      itemsSearchKey: "{{ itemsSearchKey }}"
      contentType: "{{ contentType }}"
      uploadStatus: "{{ uploadStatus }}"
      provisioningState: "{{ provisioningState }}"
  - name: etag
    value: "{{ etag }}"
    description: |
      Etag of the azure resource.

REPLACE examples

create_or_update

Create or update a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with rawContent and contentType properties.

REPLACE azure.security_insight.watchlists
SET 
properties = '{{ properties }}',
etag = '{{ etag }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND watchlist_alias = '{{ watchlist_alias }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
etag,
properties,
systemData,
type;

DELETE examples

delete

Delete a watchlist.

DELETE FROM azure.security_insight.watchlists
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND workspace_name = '{{ workspace_name }}' --required
AND watchlist_alias = '{{ watchlist_alias }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;