You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/watchlists-create.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,10 +13,10 @@ Watchlists in Microsoft Sentinel allow you to correlate data from a data source
13
13
14
14
Upload a watchlist file from a local folder or from your Azure Storage account. To create a watchlist file, you have the option to download one of the watchlist templates from Microsoft Sentinel to populate with your data. Then upload that file when you create the watchlist in Microsoft Sentinel.
15
15
16
-
The features for watchlist templates and the ability to create a watchlist from a file in Azure Storage are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
17
-
18
16
Local file uploads are currently limited to files of up to 3.8 MB in size. If you have large watchlist file that's up to 500 MB in size, upload the file to your Azure Storage account. Before you create a watchlist, review the [limitations of watchlists](watchlists.md).
19
17
18
+
The features for watchlist templates and the ability to create a watchlist from a file in Azure Storage are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
19
+
20
20
## Upload a watchlist from a local folder
21
21
22
22
You have two ways to upload a CSV file from your local machine to create a watchlist.
@@ -36,7 +36,7 @@ If you didn't use a watchlist template to create your file,
36
36
37
37
1. On the **General** page, provide the name, description, and alias for the watchlist.
38
38
39
-
:::image type="content" source="./media/watchlists-create/sentinel-watchlist-general.png" alt-text="Screenshot of watchlist general tab in the watchlists wizard.":::
39
+
:::image type="content" source="./media/watchlists-create/sentinel-watchlist-general-country.png" alt-text="Screenshot of watchlist general tab in the watchlists wizard.":::
40
40
41
41
1. Select **Next: Source**.
42
42
1. Use the information in the following table to upload your watchlist data.
@@ -60,8 +60,6 @@ If you didn't use a watchlist template to create your file,
60
60
61
61
A notification appears once the watchlist is created.
62
62
63
-
:::image type="content" source="./media/watchlists-create/sentinel-watchlist-complete.png" alt-text="Screenshot of the watchlist successful creation notification." lightbox="./media/watchlists-create/sentinel-watchlist-complete.png":::
64
-
65
63
It might take several minutes for the watchlist to be created and the new data to be available in queries.
66
64
67
65
### Upload watchlist created from a template (Preview)
@@ -158,7 +156,7 @@ Create a shared access signature URL for Microsoft Sentinel to retrieve the watc
158
156
1. Review the information, verify that it's correct, wait for the **Validation passed** message.
159
157
1. Select **Create**.
160
158
161
-
It might take up to an hour for a large watchlist to be created and the new data to be available in queries.
159
+
It might an hour or more for a large watchlist to be created and the new data to be available in queries.
162
160
163
161
## View watchlist status
164
162
@@ -171,7 +169,9 @@ View the status by selecting the watchlist in your workspace.
171
169
172
170
:::image type="content" source="./media/watchlists-create/view-status-uploading.png" alt-text="Screenshot that shows the upload status on the watchlist." lightbox="./media/watchlists-create/view-status-uploading.png":::
173
171
174
-
1. If the status is **Succeeded**, select **View in Log Analytics** to use the watchlist in a query. It might take several minutes for the watchlist to show in Log Analytics.
172
+
1. When the status is **Succeeded**, select **View in Log Analytics** to use the watchlist in a query. It might take several minutes for the watchlist to show in Log Analytics.
173
+
174
+
:::image type="content" source="media/watchlists-create/large-watchlist-status-view-in-log.png" alt-text="Screenshot of ":::
0 commit comments