Skip to content

Commit ab3844e

Browse files
committed
Updated based on feedback.
1 parent 69a0ce6 commit ab3844e

File tree

2 files changed

+2
-1
lines changed

2 files changed

+2
-1
lines changed

articles/sentinel/watchlists-create.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ Upload a watchlist file from a local folder or from your Azure Storage account.
2424

2525
Local file uploads are currently limited to files of up to 3.8 MB in size. A file that's over 3.8 MB in size and up to 500 MB is considered a [large watchlist](#create-a-large-watchlist-from-file-in-azure-storage-preview). Upload the file to an Azure Storage account. Before you create a watchlist, review the [limitations of watchlists](watchlists.md#watchlist-limitations).
2626

27-
Watchlist data is retained for 28 days.
27+
Data in the Log Analytics Watchlist table is retained for 28 days.
2828

2929
> [!IMPORTANT]
3030
> The features for watchlist templates and the ability to create a watchlist from a file in Azure Storage are currently in **PREVIEW**. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.

articles/sentinel/watchlists.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ We recommend reviewing the following limitations before creating watchlists:
4646
| **Watchlist name and alias length** | Watchlist names and aliases must be between 3 and 64 characters. First and last characters must be alphanumeric; spaces, hyphens, and underscores allowed between. |
4747
| **Intended use** | Use watchlists only for reference data. Watchlists aren't designed for large data volumes. |
4848
| **Maximum active watchlist items** | You can have a maximum of 10 million active watchlist items across all watchlists in a workspace. Deleted items don't count. For larger volumes, use [custom logs](/azure/azure-monitor/agents/data-sources-custom-logs). |
49+
| **Data retention**| Data in the Log Analytics Watchlist table is retained for 28 days.|
4950
| **Refresh interval** | Watchlists refresh every 12 days, updating the `TimeGenerated` field. |
5051
| **Cross-workspace management** | Managing watchlists across workspaces using Azure Lighthouse isn't supported. |
5152
| **Local file upload size** | Local file uploads are limited to files of up to 3.8 MB. |

0 commit comments

Comments
 (0)