You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/watchlists-manage.md
+12-6Lines changed: 12 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -43,20 +43,26 @@ Edit a watchlist to edit or add an item to the watchlist.
43
43
44
44
## Bulk update a watchlist
45
45
46
-
- Appends and dedups
47
-
- Doesn't delete
48
-
- Search needs to be the same
49
-
- Can't have blank fields in search key it will error out
46
+
When you have many items to add to a watchlist, use bulk update. A bulk update of a watchlist appends items to the existing watchlist. Then, it de-duplicates the items in the watchlist where the search key values match.
47
+
48
+
If you've deleted an item from your watchlist file and upload it, bulk update won't delete the item in the existing watchlist. Delete the watchlist item individually. Or, when you have a lot of deletions, delete and recreate the watchlist.
49
+
50
+
The updated watchlist file you upload must contain the search key field used by the watchlist with no blank values.
51
+
52
+
To bulk update a watchlist,
50
53
51
54
1. In the Azure portal, go to **Microsoft Sentinel** and select the appropriate workspace.
52
55
1. Under **Configuration**, select **Watchlist**.
53
56
1. Select the watchlist you want to edit.
54
57
1. On the details pane, select **Update watchlist** > **Bulk update**.
55
58
56
-
:::image type="content" source="./media/watchlists-manage/sentinel-watchlist-bulk-update.png" alt-text="Screen shot of the bulk update option on the bottom of the details pane." lightbox="./media/watchlists-manage/sentinel-watchlist-bulk-update.png":::
59
+
:::image type="content" source="./media/watchlists-manage/sentinel-watchlist-bulk-update.png" alt-text="Screenshot of the bulk update option on the bottom of the details pane." lightbox="./media/watchlists-manage/sentinel-watchlist-bulk-update.png":::
60
+
61
+
1. Under **Upload file**, drag and drop or browse to the file to upload.
57
62
58
-
1.
63
+
:::image type="content" source="./media/watchlists-manage/sentinel-watchlist-bulk-update-source.png" alt-text="Screenshot of the watchlist wizard source page where you select the file to upload and the search key field is disabled.":::
59
64
65
+
1. Select **Next: Review and Create** > **Create**.
0 commit comments