pulumi-azure-native-kotlin/com.pulumi.azurenative.securityinsights.kotlin/WatchlistArgs

WatchlistArgs

data class WatchlistArgs(val contentType: Output<String>? = null, val created: Output<String>? = null, val createdBy: Output<WatchlistUserInfoArgs>? = null, val defaultDuration: Output<String>? = null, val description: Output<String>? = null, val displayName: Output<String>? = null, val isDeleted: Output<Boolean>? = null, val itemsSearchKey: Output<String>? = null, val labels: Output<List<String>>? = null, val numberOfLinesToSkip: Output<Int>? = null, val provider: Output<String>? = null, val rawContent: Output<String>? = null, val resourceGroupName: Output<String>? = null, val source: Output<String>? = null, val sourceType: Output<Either<String, SourceType>>? = null, val tenantId: Output<String>? = null, val updated: Output<String>? = null, val updatedBy: Output<WatchlistUserInfoArgs>? = null, val uploadStatus: Output<String>? = null, val watchlistAlias: Output<String>? = null, val watchlistId: Output<String>? = null, val watchlistType: Output<String>? = null, val workspaceName: Output<String>? = null) : ConvertibleToJava<WatchlistArgs>

Represents a Watchlist in Azure Security Insights. Uses Azure REST API version 2024-09-01. In version 2.x of the Azure Native provider, it used API version 2023-02-01. Other available API versions: 2023-02-01, 2023-03-01-preview, 2023-04-01-preview, 2023-05-01-preview, 2023-06-01-preview, 2023-07-01-preview, 2023-08-01-preview, 2023-09-01-preview, 2023-10-01-preview, 2023-11-01, 2023-12-01-preview, 2024-01-01-preview, 2024-03-01, 2024-04-01-preview, 2024-10-01-preview, 2025-01-01-preview, 2025-03-01. These can be accessed by generating a local SDK package using the CLI command pulumi package add azure-native securityinsights [ApiVersion]. See the ../../../version-guide/#accessing-any-api-version-via-local-packages for details.

Example Usage

Create or update a watchlist and bulk creates watchlist items.

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;
return await Deployment.RunAsync(() =>
{
    var watchlist = new AzureNative.SecurityInsights.Watchlist("watchlist", new()
    {
        ContentType = "text/csv",
        Description = "Watchlist from CSV content",
        DisplayName = "High Value Assets Watchlist",
        ItemsSearchKey = "header1",
        NumberOfLinesToSkip = 1,
        Provider = "Microsoft",
        RawContent = @"This line will be skipped
header1,header2
value1,value2",
        ResourceGroupName = "myRg",
        Source = "watchlist.csv",
        SourceType = AzureNative.SecurityInsights.SourceType.Local,
        WatchlistAlias = "highValueAsset",
        WorkspaceName = "myWorkspace",
    });
});

package main
import (
	securityinsights "github.com/pulumi/pulumi-azure-native-sdk/securityinsights/v2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securityinsights.NewWatchlist(ctx, "watchlist", &securityinsights.WatchlistArgs{
			ContentType:         pulumi.String("text/csv"),
			Description:         pulumi.String("Watchlist from CSV content"),
			DisplayName:         pulumi.String("High Value Assets Watchlist"),
			ItemsSearchKey:      pulumi.String("header1"),
			NumberOfLinesToSkip: pulumi.Int(1),
			Provider:            pulumi.String("Microsoft"),
			RawContent:          pulumi.String("This line will be skipped\nheader1,header2\nvalue1,value2"),
			ResourceGroupName:   pulumi.String("myRg"),
			Source:              pulumi.String("watchlist.csv"),
			SourceType:          pulumi.String(securityinsights.SourceTypeLocal),
			WatchlistAlias:      pulumi.String("highValueAsset"),
			WorkspaceName:       pulumi.String("myWorkspace"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.securityinsights.Watchlist;
import com.pulumi.azurenative.securityinsights.WatchlistArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var watchlist = new Watchlist("watchlist", WatchlistArgs.builder()
            .contentType("text/csv")
            .description("Watchlist from CSV content")
            .displayName("High Value Assets Watchlist")
            .itemsSearchKey("header1")
            .numberOfLinesToSkip(1)
            .provider("Microsoft")
            .rawContent("""
This line will be skipped
header1,header2
value1,value2            """)
            .resourceGroupName("myRg")
            .source("watchlist.csv")
            .sourceType("Local")
            .watchlistAlias("highValueAsset")
            .workspaceName("myWorkspace")
            .build());
    }
}

Create or update a watchlist.

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;
return await Deployment.RunAsync(() =>
{
    var watchlist = new AzureNative.SecurityInsights.Watchlist("watchlist", new()
    {
        Description = "Watchlist from CSV content",
        DisplayName = "High Value Assets Watchlist",
        ItemsSearchKey = "header1",
        Provider = "Microsoft",
        ResourceGroupName = "myRg",
        Source = "watchlist.csv",
        SourceType = AzureNative.SecurityInsights.SourceType.Local,
        WatchlistAlias = "highValueAsset",
        WorkspaceName = "myWorkspace",
    });
});

package main
import (
	securityinsights "github.com/pulumi/pulumi-azure-native-sdk/securityinsights/v2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := securityinsights.NewWatchlist(ctx, "watchlist", &securityinsights.WatchlistArgs{
			Description:       pulumi.String("Watchlist from CSV content"),
			DisplayName:       pulumi.String("High Value Assets Watchlist"),
			ItemsSearchKey:    pulumi.String("header1"),
			Provider:          pulumi.String("Microsoft"),
			ResourceGroupName: pulumi.String("myRg"),
			Source:            pulumi.String("watchlist.csv"),
			SourceType:        pulumi.String(securityinsights.SourceTypeLocal),
			WatchlistAlias:    pulumi.String("highValueAsset"),
			WorkspaceName:     pulumi.String("myWorkspace"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.securityinsights.Watchlist;
import com.pulumi.azurenative.securityinsights.WatchlistArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var watchlist = new Watchlist("watchlist", WatchlistArgs.builder()
            .description("Watchlist from CSV content")
            .displayName("High Value Assets Watchlist")
            .itemsSearchKey("header1")
            .provider("Microsoft")
            .resourceGroupName("myRg")
            .source("watchlist.csv")
            .sourceType("Local")
            .watchlistAlias("highValueAsset")
            .workspaceName("myWorkspace")
            .build());
    }
}

Import

An existing resource can be imported using its type token, name, and identifier, e.g.

$ pulumi import azure-native:securityinsights:Watchlist highValueAsset /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}

Constructors

WatchlistArgs

constructor(contentType: Output<String>? = null, created: Output<String>? = null, createdBy: Output<WatchlistUserInfoArgs>? = null, defaultDuration: Output<String>? = null, description: Output<String>? = null, displayName: Output<String>? = null, isDeleted: Output<Boolean>? = null, itemsSearchKey: Output<String>? = null, labels: Output<List<String>>? = null, numberOfLinesToSkip: Output<Int>? = null, provider: Output<String>? = null, rawContent: Output<String>? = null, resourceGroupName: Output<String>? = null, source: Output<String>? = null, sourceType: Output<Either<String, SourceType>>? = null, tenantId: Output<String>? = null, updated: Output<String>? = null, updatedBy: Output<WatchlistUserInfoArgs>? = null, uploadStatus: Output<String>? = null, watchlistAlias: Output<String>? = null, watchlistId: Output<String>? = null, watchlistType: Output<String>? = null, workspaceName: Output<String>? = null)

Properties

contentType

val contentType: Output<String>? = null

The content type of the raw content. Example : text/csv or text/tsv

created

val created: Output<String>? = null

The time the watchlist was created

createdBy

val createdBy: Output<WatchlistUserInfoArgs>? = null

Describes a user that created the watchlist

defaultDuration

val defaultDuration: Output<String>? = null

The default duration of a watchlist (in ISO 8601 duration format)

description

val description: Output<String>? = null

A description of the watchlist

displayName

val displayName: Output<String>? = null

The display name of the watchlist

isDeleted

val isDeleted: Output<Boolean>? = null

A flag that indicates if the watchlist is deleted or not

itemsSearchKey

val itemsSearchKey: Output<String>? = null

The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.

labels

val labels: Output<List<String>>? = null

List of labels relevant to this watchlist

numberOfLinesToSkip

val numberOfLinesToSkip: Output<Int>? = null

The number of lines in a csv/tsv content to skip before the header

provider

val provider: Output<String>? = null

The provider of the watchlist

rawContent

val rawContent: Output<String>? = null

The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint

resourceGroupName

val resourceGroupName: Output<String>? = null

The name of the resource group. The name is case insensitive.

source

val source: Output<String>? = null

The filename of the watchlist, called 'source'

sourceType

val sourceType: Output<Either<String, SourceType>>? = null

The sourceType of the watchlist

tenantId

val tenantId: Output<String>? = null

The tenantId where the watchlist belongs to

updated

val updated: Output<String>? = null

The last time the watchlist was updated

updatedBy

val updatedBy: Output<WatchlistUserInfoArgs>? = null

Describes a user that updated the watchlist

uploadStatus

val uploadStatus: Output<String>? = null

The status of the Watchlist upload : New, InProgress or Complete. Note : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted

watchlistAlias

val watchlistAlias: Output<String>? = null

The alias of the watchlist

watchlistId

val watchlistId: Output<String>? = null

The id (a Guid) of the watchlist

watchlistType

val watchlistType: Output<String>? = null

The type of the watchlist

workspaceName

val workspaceName: Output<String>? = null

The name of the workspace.

Functions

toJava

open override fun toJava(): WatchlistArgs