Skip to content

Commit 1a3a5c8

Browse files
committed
Finish draft of bulk update
1 parent a585799 commit 1a3a5c8

File tree

2 files changed

+12
-6
lines changed

2 files changed

+12
-6
lines changed
93.3 KB
Loading

articles/sentinel/watchlists-manage.md

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -43,20 +43,26 @@ Edit a watchlist to edit or add an item to the watchlist.
4343

4444
## Bulk update a watchlist
4545

46-
- Appends and dedups
47-
- Doesn't delete
48-
- Search needs to be the same
49-
- Can't have blank fields in search key it will error out
46+
When you have many items to add to a watchlist, use bulk update. A bulk update of a watchlist appends items to the existing watchlist. Then, it de-duplicates the items in the watchlist where the search key values match.
47+
48+
If you've deleted an item from your watchlist file and upload it, bulk update won't delete the item in the existing watchlist. Delete the watchlist item individually. Or, when you have a lot of deletions, delete and recreate the watchlist.
49+
50+
The updated watchlist file you upload must contain the search key field used by the watchlist with no blank values.
51+
52+
To bulk update a watchlist,
5053

5154
1. In the Azure portal, go to **Microsoft Sentinel** and select the appropriate workspace.
5255
1. Under **Configuration**, select **Watchlist**.
5356
1. Select the watchlist you want to edit.
5457
1. On the details pane, select **Update watchlist** > **Bulk update**.
5558

56-
:::image type="content" source="./media/watchlists-manage/sentinel-watchlist-bulk-update.png" alt-text="Screen shot of the bulk update option on the bottom of the details pane." lightbox="./media/watchlists-manage/sentinel-watchlist-bulk-update.png":::
59+
:::image type="content" source="./media/watchlists-manage/sentinel-watchlist-bulk-update.png" alt-text="Screenshot of the bulk update option on the bottom of the details pane." lightbox="./media/watchlists-manage/sentinel-watchlist-bulk-update.png":::
60+
61+
1. Under **Upload file**, drag and drop or browse to the file to upload.
5762

58-
1.
63+
:::image type="content" source="./media/watchlists-manage/sentinel-watchlist-bulk-update-source.png" alt-text="Screenshot of the watchlist wizard source page where you select the file to upload and the search key field is disabled.":::
5964

65+
1. Select **Next: Review and Create** > **Create**.
6066

6167
## Next steps
6268

0 commit comments

Comments
 (0)