Skip to main content
Delete a watchlist item by its ID.
External DocumentationTo learn more, visit the Microsoft Sentinel documentation.

​
Parameters

ParameterDescription
Resource Group NameThe name of the resource group. The name is case insensitive.
Subscription IDThe ID of the target subscription.
Watchlist AliasThe watchlist alias.
Watchlist Item IDThe ID of the watchlist item.
Workspace NameThe name of the workspace.

​
Example Output

{
	"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/Watchlists/highValueAsset/WatchlistItems/fd37d325-7090-47fe-851a-5b5a00c3f576",
	"name": "fd37d325-7090-47fe-851a-5b5a00c3f576",
	"etag": "\"f2089bfa-0000-0d00-0000-601c58b42021\"",
	"type": "Microsoft.SecurityInsights/Watchlists/WatchlistItems",
	"properties": {
		"watchlistItemType": "watchlist-item",
		"watchlistItemId": "fd37d325-7090-47fe-851a-5b5a00c3f576",
		"tenantId": "3f8901fe-63d9-4875-9ad5-9fb3b8105797",
		"isDeleted": false,
		"created": "2021-02-04T12:27:32.3783333-08:00",
		"updated": "2021-02-04T12:27:32.3783333-08:00",
		"createdBy": {
			"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
			"email": "john@contoso.com",
			"name": "john doe"
		},
		"updatedBy": {
			"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
			"email": "john@contoso.com",
			"name": "john doe"
		},
		"itemsKeyValue": {
			"Header-1": "v1_1",
			"Header-2": "v1_2",
			"Header-3": "v1_3",
			"Header-4": "v1_4",
			"Header-5": "v1_5"
		},
		"entityMapping": {}
	}
}

​
Workflow Library Example

Delete Watchlist Item with Microsoft Sentinel and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop
⌘I