Watchlist Items - Create Or Update

Reference

Service:: Sentinel

API Version:: 2024-03-01

Create or update a watchlist item.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}/watchlistItems/{watchlistItemId}?api-version=2024-03-01

URI Parameters

Name	In	Required	Type	Description
resourceGroupName	path	True	string	The name of the resource group. The name is case insensitive.
subscriptionId	path	True	string	The ID of the target subscription.
watchlistAlias	path	True	string	The watchlist alias
watchlistItemId	path	True	string	The watchlist item id (GUID)
workspaceName	path	True	string	The name of the workspace. Regex pattern: `^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$`
api-version	query	True	string	The API version to use for this operation.

Request Body

Name	Required	Type	Description
properties.itemsKeyValue	True	object	key-value pairs for a watchlist item
etag		string	Etag of the azure resource
properties.created		string	The time the watchlist item was created
properties.createdBy		UserInfo	Describes a user that created the watchlist item
properties.entityMapping		object	key-value pairs for a watchlist item entity mapping
properties.isDeleted		boolean	A flag that indicates if the watchlist item is deleted or not
properties.tenantId		string	The tenantId to which the watchlist item belongs to
properties.updated		string	The last time the watchlist item was updated
properties.updatedBy		UserInfo	Describes a user that updated the watchlist item
properties.watchlistItemId		string	The id (a Guid) of the watchlist item
properties.watchlistItemType		string	The type of the watchlist item

Responses

Name	Type	Description
200 OK	WatchlistItem	OK
201 Created	WatchlistItem	Created
Other Status Codes	CloudError	Error response describing why the operation failed.

Security

azure_auth

Azure Active Directory OAuth2 Flow

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Create or update a watchlist item.

Sample Request

HTTP

PUT https://management.azure.com/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/watchlists/highValueAsset/watchlistItems/82ba292c-dc97-4dfc-969d-d4dd9e666842?api-version=2024-03-01

{
  "etag": "0300bf09-0000-0000-0000-5c37296e0000",
  "properties": {
    "itemsKeyValue": {
      "Gateway subnet": "10.0.255.224/27",
      "Web Tier": "10.0.1.0/24",
      "Business tier": "10.0.2.0/24",
      "Data tier": "10.0.2.0/24",
      "Private DMZ in": "10.0.0.0/27",
      "Public DMZ out": "10.0.0.96/27"
    }
  }
}

Sample Response

Status code:: 200

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/Watchlists/highValueAsset/WatchlistItems/82ba292c-dc97-4dfc-969d-d4dd9e666842",
  "etag": "0300bf09-0000-0000-0000-5c37296e0000",
  "type": "Microsoft.SecurityInsights/Watchlists/WatchlistItems",
  "properties": {
    "watchlistItemType": "watchlist-item",
    "watchlistItemId": "82ba292c-dc97-4dfc-969d-d4dd9e666842",
    "tenantId": "4008512e-1d30-48b2-9ee2-d3612ed9d3ea",
    "isDeleted": false,
    "created": "2020-11-15T04:58:56.0748363+00:00",
    "updated": "2020-11-16T16:05:20+00:00",
    "createdBy": {
      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
      "email": "john@contoso.com",
      "name": "john doe"
    },
    "updatedBy": {
      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
      "email": "john@contoso.com",
      "name": "john doe"
    },
    "itemsKeyValue": {
      "Gateway subnet": "10.0.255.224/27",
      "Web Tier": "10.0.1.0/24",
      "Business tier": "10.0.2.0/24",
      "Data tier": "10.0.2.0/24",
      "Private DMZ in": "10.0.0.0/27",
      "Public DMZ out": "10.0.0.96/27"
    }
  }
}

Status code:: 201

{
  "id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/Watchlists/highValueAsset/WatchlistItems/82ba292c-dc97-4dfc-969d-d4dd9e666842",
  "etag": "0300bf09-0000-0000-0000-5c37296e0000",
  "type": "Microsoft.SecurityInsights/Watchlists/WatchlistItems",
  "properties": {
    "watchlistItemType": "watchlist-item",
    "watchlistItemId": "82ba292c-dc97-4dfc-969d-d4dd9e666842",
    "tenantId": "4008512e-1d30-48b2-9ee2-d3612ed9d3ea",
    "isDeleted": false,
    "created": "2020-11-15T04:58:56.0748363+00:00",
    "updated": "2020-11-16T16:05:20+00:00",
    "createdBy": {
      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
      "email": "john@contoso.com",
      "name": "john doe"
    },
    "updatedBy": {
      "objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
      "email": "john@contoso.com",
      "name": "john doe"
    },
    "itemsKeyValue": {
      "Gateway subnet": "10.0.255.224/27",
      "Web Tier": "10.0.1.0/24",
      "Business tier": "10.0.2.0/24",
      "Data tier": "10.0.2.0/24",
      "Private DMZ in": "10.0.0.0/27",
      "Public DMZ out": "10.0.0.96/27"
    }
  }
}

Definitions

Name	Description
CloudError	Error response structure.
CloudErrorBody	Error details.
createdByType	The type of identity that created the resource.
systemData	Metadata pertaining to creation and last modification of the resource.
UserInfo	User information that made some action
WatchlistItem	Represents a Watchlist Item in Azure Security Insights.

CloudError

Error response structure.

Name	Type	Description
error	CloudErrorBody	Error data

CloudErrorBody

Error details.

Name	Type	Description
code	string	An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
message	string	A message describing the error, intended to be suitable for display in a user interface.

createdByType

The type of identity that created the resource.

Name	Type	Description
Application	string
Key	string
ManagedIdentity	string
User	string

systemData

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.

UserInfo

User information that made some action

Name	Type	Description
email	string	The email of the user.
name	string	The name of the user.
objectId	string	The object id of the user.

WatchlistItem

Represents a Watchlist Item in Azure Security Insights.

Name	Type	Description
etag	string	Etag of the azure resource
id	string	Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}
name	string	The name of the resource
properties.created	string	The time the watchlist item was created
properties.createdBy	UserInfo	Describes a user that created the watchlist item
properties.entityMapping	object	key-value pairs for a watchlist item entity mapping
properties.isDeleted	boolean	A flag that indicates if the watchlist item is deleted or not
properties.itemsKeyValue	object	key-value pairs for a watchlist item
properties.tenantId	string	The tenantId to which the watchlist item belongs to
properties.updated	string	The last time the watchlist item was updated
properties.updatedBy	UserInfo	Describes a user that updated the watchlist item
properties.watchlistItemId	string	The id (a Guid) of the watchlist item
properties.watchlistItemType	string	The type of the watchlist item
systemData	systemData	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

Watchlist Items - Create Or Update

URI Parameters

Request Body

Responses

Security

azure_auth

Scopes

Examples

Create or update a watchlist item.

Sample Request

Sample Response

Definitions

CloudError

CloudErrorBody

createdByType

systemData

UserInfo

WatchlistItem

Additional resources