watchlist_items

Creates, updates, deletes, gets or lists a watchlist_items resource.

Overview

Name	watchlist_items
Type	Resource
Id	azure.sentinel.watchlist_items

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
etag	string	Etag of the azure resource
properties	object	Watchlist Item properties

list

Name	Datatype	Description
etag	string	Etag of the azure resource
properties	object	Watchlist Item properties

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	subscriptionId, resourceGroupName, workspaceName, watchlistAlias, watchlistItemId		Get a watchlist item.
list	select	subscriptionId, resourceGroupName, workspaceName, watchlistAlias	$skipToken	Get all watchlist Items.
create_or_update	insert	subscriptionId, resourceGroupName, workspaceName, watchlistAlias, watchlistItemId		Create or update a watchlist item.
delete	delete	subscriptionId, resourceGroupName, workspaceName, watchlistAlias, watchlistItemId		Delete a watchlist item.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
resourceGroupName	string	The name of the resource group. The name is case insensitive.
subscriptionId	string	The ID of the target subscription.
watchlistAlias	string	The watchlist alias
watchlistItemId	string	The watchlist item id (GUID)
workspaceName	string	The name of the workspace.
$skipToken	string	Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.

SELECT examples

get

Get a watchlist item.

SELECT
etag,
properties
FROM azure.sentinel.watchlist_items
WHERE subscriptionId = '{{ subscriptionId }}' -- required
AND resourceGroupName = '{{ resourceGroupName }}' -- required
AND workspaceName = '{{ workspaceName }}' -- required
AND watchlistAlias = '{{ watchlistAlias }}' -- required
AND watchlistItemId = '{{ watchlistItemId }}' -- required
;

list

Get all watchlist Items.

SELECT
etag,
properties
FROM azure.sentinel.watchlist_items
WHERE subscriptionId = '{{ subscriptionId }}' -- required
AND resourceGroupName = '{{ resourceGroupName }}' -- required
AND workspaceName = '{{ workspaceName }}' -- required
AND watchlistAlias = '{{ watchlistAlias }}' -- required
AND $skipToken = '{{ $skipToken }}'
;

INSERT examples

create_or_update

Create or update a watchlist item.

INSERT INTO azure.sentinel.watchlist_items (
data__etag,
data__properties,
subscriptionId,
resourceGroupName,
workspaceName,
watchlistAlias,
watchlistItemId
)
SELECT 
'{{ etag }}',
'{{ properties }}',
'{{ subscriptionId }}',
'{{ resourceGroupName }}',
'{{ workspaceName }}',
'{{ watchlistAlias }}',
'{{ watchlistItemId }}'
RETURNING
etag,
properties
;

Manifest

# Description fields are for documentation purposes
- name: watchlist_items
  props:
    - name: subscriptionId
      value: string
      description: Required parameter for the watchlist_items resource.
    - name: resourceGroupName
      value: string
      description: Required parameter for the watchlist_items resource.
    - name: workspaceName
      value: string
      description: Required parameter for the watchlist_items resource.
    - name: watchlistAlias
      value: string
      description: Required parameter for the watchlist_items resource.
    - name: watchlistItemId
      value: string
      description: Required parameter for the watchlist_items resource.
    - name: etag
      value: string
      description: |
        Etag of the azure resource
    - name: properties
      value: object
      description: |
        Watchlist Item properties

DELETE examples

delete

Delete a watchlist item.

DELETE FROM azure.sentinel.watchlist_items
WHERE subscriptionId = '{{ subscriptionId }}' --required
AND resourceGroupName = '{{ resourceGroupName }}' --required
AND workspaceName = '{{ workspaceName }}' --required
AND watchlistAlias = '{{ watchlistAlias }}' --required
AND watchlistItemId = '{{ watchlistItemId }}' --required
;