watchlist_items

Creates, updates, deletes, gets or lists a watchlist_items resource.

Overview

Name	watchlist_items
Type	Resource
Id	azure.sentinel.watchlist_items

Fields

vw_watchlist_items

Name	Datatype	Description
created	text	field from the properties object
created_by	text	field from the properties object
entity_mapping	text	field from the properties object
etag	text	Etag of the azure resource
is_deleted	text	field from the properties object
items_key_value	text	field from the properties object
resourceGroupName	text	field from the properties object
subscriptionId	text	field from the properties object
tenant_id	text	field from the properties object
updated	text	field from the properties object
updated_by	text	field from the properties object
watchlistAlias	text	field from the properties object
watchlistItemId	text	field from the properties object
watchlist_item_id	text	field from the properties object
watchlist_item_type	text	field from the properties object
workspaceName	text	field from the properties object

watchlist_items

Name	Datatype	Description
etag	string	Etag of the azure resource
properties	object	Describes watchlist item properties

Methods

Name	Accessible by	Required Params	Description
get	SELECT	resourceGroupName, subscriptionId, watchlistAlias, watchlistItemId, workspaceName	Get a watchlist item.
list	SELECT	resourceGroupName, subscriptionId, watchlistAlias, workspaceName	Get all watchlist Items.
create_or_update	INSERT	resourceGroupName, subscriptionId, watchlistAlias, watchlistItemId, workspaceName	Create or update a watchlist item.
delete	DELETE	resourceGroupName, subscriptionId, watchlistAlias, watchlistItemId, workspaceName	Delete a watchlist item.

SELECT examples

Get all watchlist Items.

vw_watchlist_items

SELECT
created,
created_by,
entity_mapping,
etag,
is_deleted,
items_key_value,
resourceGroupName,
subscriptionId,
tenant_id,
updated,
updated_by,
watchlistAlias,
watchlistItemId,
watchlist_item_id,
watchlist_item_type,
workspaceName
FROM azure.sentinel.vw_watchlist_items
WHERE resourceGroupName = '{{ resourceGroupName }}'
AND subscriptionId = '{{ subscriptionId }}'
AND watchlistAlias = '{{ watchlistAlias }}'
AND workspaceName = '{{ workspaceName }}';

watchlist_items

SELECT
etag,
properties
FROM azure.sentinel.watchlist_items
WHERE resourceGroupName = '{{ resourceGroupName }}'
AND subscriptionId = '{{ subscriptionId }}'
AND watchlistAlias = '{{ watchlistAlias }}'
AND workspaceName = '{{ workspaceName }}';

INSERT example

Use the following StackQL query and manifest file to create a new watchlist_items resource.

All Properties

/*+ create */
INSERT INTO azure.sentinel.watchlist_items (
resourceGroupName,
subscriptionId,
watchlistAlias,
watchlistItemId,
workspaceName,
etag,
properties
)
SELECT 
'{{ resourceGroupName }}',
'{{ subscriptionId }}',
'{{ watchlistAlias }}',
'{{ watchlistItemId }}',
'{{ workspaceName }}',
'{{ etag }}',
'{{ properties }}'
;

Manifest

- name: your_resource_model_name
  props:
    - name: etag
      value: string
    - name: properties
      value:
        - name: watchlistItemType
          value: string
        - name: watchlistItemId
          value: string
        - name: tenantId
          value: string
        - name: isDeleted
          value: boolean
        - name: created
          value: string
        - name: updated
          value: string
        - name: createdBy
          value:
            - name: email
              value: string
            - name: name
              value: string
            - name: objectId
              value: string
        - name: itemsKeyValue
          value: object
        - name: entityMapping
          value: object

DELETE example

Deletes the specified watchlist_items resource.

/*+ delete */
DELETE FROM azure.sentinel.watchlist_items
WHERE resourceGroupName = '{{ resourceGroupName }}'
AND subscriptionId = '{{ subscriptionId }}'
AND watchlistAlias = '{{ watchlistAlias }}'
AND watchlistItemId = '{{ watchlistItemId }}'
AND workspaceName = '{{ workspaceName }}';