az sentinel watchlist
Note
This reference is part of the sentinel extension for the Azure CLI (version 2.37.0 or higher). The extension will automatically install the first time you run an az sentinel watchlist command. Learn more about extensions.
Manage watchlist with sentinel.
Commands
| Name | Description | Type | Status |
|---|---|---|---|
| az sentinel watchlist create |
Create a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with either rawContent or a valid SAR URI and contentType properties. The rawContent is mainly used for small watchlist (content size below 3.8 MB). The SAS URI enables the creation of large watchlist, where the content size can go up to 500 MB. The status of processing such large file can be polled through the URL returned in Azure-AsyncOperation header. |
Extension | Experimental |
| az sentinel watchlist delete |
Delete a watchlist. |
Extension | Experimental |
| az sentinel watchlist list |
Get all watchlists, without watchlist items. |
Extension | Experimental |
| az sentinel watchlist show |
Get a watchlist, without its watchlist items. |
Extension | Experimental |
| az sentinel watchlist update |
Update a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with either rawContent or a valid SAR URI and contentType properties. The rawContent is mainly used for small watchlist (content size below 3.8 MB). The SAS URI enables the creation of large watchlist, where the content size can go up to 500 MB. The status of processing such large file can be polled through the URL returned in Azure-AsyncOperation header. |
Extension | Experimental |
az sentinel watchlist create
This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Create a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with either rawContent or a valid SAR URI and contentType properties. The rawContent is mainly used for small watchlist (content size below 3.8 MB). The SAS URI enables the creation of large watchlist, where the content size can go up to 500 MB. The status of processing such large file can be polled through the URL returned in Azure-AsyncOperation header.
az sentinel watchlist create --name
--resource-group
--workspace-name
[--content-type]
[--created]
[--created-by]
[--default-duration]
[--description]
[--display-name]
[--etag]
[--is-deleted {0, 1, f, false, n, no, t, true, y, yes}]
[--items-search-key]
[--labels]
[--provider]
[--raw-content]
[--skip-num]
[--source]
[--source-type {Local file, Remote storage}]
[--tenant-id]
[--updated]
[--updated-by]
[--upload-status]
[--watchlist-id]
[--watchlist-type]Required Parameters
Watchlist Alias.
Name of resource group. You can configure the default group using az configure --defaults group=<name>.
The name of the workspace.
Optional Parameters
The content type of the raw content. Example : text/csv or text/tsv.
The time the watchlist was created.
Describes a user that created the watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
The default duration of a watchlist (in ISO 8601 duration format).
A description of the watchlist.
The display name of the watchlist.
Etag of the azure resource.
A flag that indicates if the watchlist is deleted or not.
The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
List of labels relevant to this watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
The provider of the watchlist.
The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint.
The number of lines in a csv/tsv content to skip before the header.
The filename of the watchlist, called 'source'.
The sourceType of the watchlist.
The tenantId where the watchlist belongs to.
The last time the watchlist was updated.
Describes a user that updated the watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
The status of the Watchlist upload : New, InProgress or Complete. Pls note : When a Watchlist upload status is equal to InProgress, the Watchlist cannot be deleted.
The id (a Guid) of the watchlist.
The type of the watchlist.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.
Increase logging verbosity. Use --debug for full debug logs.
az sentinel watchlist delete
This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Delete a watchlist.
az sentinel watchlist delete [--ids]
[--name]
[--resource-group]
[--subscription]
[--workspace-name]
[--yes]Optional Parameters
One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.
Watchlist Alias.
Name of resource group. You can configure the default group using az configure --defaults group=<name>.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.
The name of the workspace.
Do not prompt for confirmation.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.
Increase logging verbosity. Use --debug for full debug logs.
az sentinel watchlist list
This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Get all watchlists, without watchlist items.
az sentinel watchlist list --resource-group
--workspace-name
[--skip-token]Required Parameters
Name of resource group. You can configure the default group using az configure --defaults group=<name>.
The name of the workspace.
Optional Parameters
Skiptoken is only used if a previous operation returned a partial result. If a previous response contains a nextLink element, the value of the nextLink element will include a skiptoken parameter that specifies a starting point to use for subsequent calls. Optional.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.
Increase logging verbosity. Use --debug for full debug logs.
az sentinel watchlist show
This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Get a watchlist, without its watchlist items.
az sentinel watchlist show [--ids]
[--name]
[--resource-group]
[--subscription]
[--workspace-name]Optional Parameters
One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.
Watchlist Alias.
Name of resource group. You can configure the default group using az configure --defaults group=<name>.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.
The name of the workspace.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.
Increase logging verbosity. Use --debug for full debug logs.
az sentinel watchlist update
This command is experimental and under development. Reference and support levels: https://aka.ms/CLI_refstatus
Update a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with either rawContent or a valid SAR URI and contentType properties. The rawContent is mainly used for small watchlist (content size below 3.8 MB). The SAS URI enables the creation of large watchlist, where the content size can go up to 500 MB. The status of processing such large file can be polled through the URL returned in Azure-AsyncOperation header.
az sentinel watchlist update [--add]
[--content-type]
[--created]
[--created-by]
[--default-duration]
[--description]
[--display-name]
[--etag]
[--force-string {0, 1, f, false, n, no, t, true, y, yes}]
[--ids]
[--is-deleted {0, 1, f, false, n, no, t, true, y, yes}]
[--items-search-key]
[--labels]
[--name]
[--provider]
[--raw-content]
[--remove]
[--resource-group]
[--set]
[--skip-num]
[--source]
[--source-type {Local file, Remote storage}]
[--subscription]
[--tenant-id]
[--updated]
[--updated-by]
[--upload-status]
[--watchlist-id]
[--watchlist-type]
[--workspace-name]Optional Parameters
Add an object to a list of objects by specifying a path and key value pairs. Example: --add property.listProperty <key=value, string or JSON string>.
The content type of the raw content. Example : text/csv or text/tsv.
The time the watchlist was created.
Describes a user that created the watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
The default duration of a watchlist (in ISO 8601 duration format).
A description of the watchlist.
The display name of the watchlist.
Etag of the azure resource.
When using 'set' or 'add', preserve string literals instead of attempting to convert to JSON.
One or more resource IDs (space-delimited). It should be a complete resource ID containing all information of 'Resource Id' arguments. You should provide either --ids or other 'Resource Id' arguments.
A flag that indicates if the watchlist is deleted or not.
The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
List of labels relevant to this watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
Watchlist Alias.
The provider of the watchlist.
The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint.
Remove a property or an element from a list. Example: --remove property.list OR --remove propertyToRemove.
Name of resource group. You can configure the default group using az configure --defaults group=<name>.
Update an object by specifying a property path and value to set. Example: --set property1.property2=.
The number of lines in a csv/tsv content to skip before the header.
The filename of the watchlist, called 'source'.
The sourceType of the watchlist.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.
The tenantId where the watchlist belongs to.
The last time the watchlist was updated.
Describes a user that updated the watchlist Support shorthand-syntax, json-file and yaml-file. Try "??" to show more.
The status of the Watchlist upload : New, InProgress or Complete. Pls note : When a Watchlist upload status is equal to InProgress, the Watchlist cannot be deleted.
The id (a Guid) of the watchlist.
The type of the watchlist.
The name of the workspace.
Global Parameters
Increase logging verbosity to show all debug logs.
Show this help message and exit.
Only show errors, suppressing warnings.
Output format.
JMESPath query string. See http://jmespath.org/ for more information and examples.
Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.
Increase logging verbosity. Use --debug for full debug logs.
Feedback
Kommer snart: I hele 2024 udfaser vi GitHub-problemer som feedbackmekanisme for indhold og erstatter det med et nyt feedbacksystem. Du kan få flere oplysninger under: https://aka.ms/ContentUserFeedback.
Indsend og få vist feedback om