Skip to main content
Get a list of watchlist items.
External DocumentationTo learn more, visit the Microsoft Sentinel documentation.

​
Basic Parameters

ParameterDescription
Resource Group NameThe name of the resource group. The name is case insensitive.
Subscription IDThe ID of the target subscription.
Watchlist AliasThe watchlist alias.
Workspace NameThe name of the workspace.

​
Advanced Parameters

ParameterDescription
Skip TokenSpecifies a starting point to show results from, this token is received in case that the previous request returned a partial result.

​
Example Output

{
	"value": [
		{
			"id": "/subscriptions/d0cfe6b2-9ac0-4464-9919-dccaee2e48c0/resourceGroups/myRg/providers/Microsoft.OperationalInsights/workspaces/myWorkspace/providers/Microsoft.SecurityInsights/Watchlists/highValueAsset/WatchlistItems/fd37d325-7090-47fe-851a-5b5a00c3f576",
			"name": "fd37d325-7090-47fe-851a-5b5a00c3f576",
			"etag": "\"f2089bfa-0000-0d00-0000-601c58b42021\"",
			"type": "Microsoft.SecurityInsights/Watchlists/WatchlistItems",
			"properties": {
				"watchlistItemType": "watchlist-item",
				"watchlistItemId": "fd37d325-7090-47fe-851a-5b5a00c3f576",
				"tenantId": "3f8901fe-63d9-4875-9ad5-9fb3b8105797",
				"isDeleted": false,
				"created": "2021-02-04T12:27:32.3783333-08:00",
				"updated": "2021-02-04T12:27:32.3783333-08:00",
				"createdBy": {
					"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
					"email": "john@contoso.com",
					"name": "john doe"
				},
				"updatedBy": {
					"objectId": "2046feea-040d-4a46-9e2b-91c2941bfa70",
					"email": "john@contoso.com",
					"name": "john doe"
				},
				"itemsKeyValue": {
					"Header-1": "v1_1",
					"Header-2": "v1_2",
					"Header-3": "v1_3",
					"Header-4": "v1_4",
					"Header-5": "v1_5"
				},
				"entityMapping": {}
			}
		}
	]
}

​
Workflow Library Example

List Watchlist Items with Microsoft Sentinel and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop
⌘I