Skip to content

Commit f63f51a

Browse files
committed
Update screenshots for create watchlist
1 parent 832a22d commit f63f51a

9 files changed

+7
-7
lines changed
-130 KB
Loading
197 KB
Loading
Binary file not shown.
32.5 KB
Loading
19.5 KB
Loading
78.5 KB
Loading
36.7 KB
Loading
83.8 KB
Loading

articles/sentinel/watchlists-create.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ Watchlists in Microsoft Sentinel allow you to correlate data from a data source
1313

1414
Upload a watchlist file from a local folder or from your Azure Storage account. To create a watchlist file, you have the option to download one of the watchlist templates from Microsoft Sentinel to populate with your data. Then upload that file when you create the watchlist in Microsoft Sentinel.
1515

16-
The features for watchlist templates and the ability to create a watchlist from a file in Azure Storage are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
17-
1816
Local file uploads are currently limited to files of up to 3.8 MB in size. If you have large watchlist file that's up to 500 MB in size, upload the file to your Azure Storage account. Before you create a watchlist, review the [limitations of watchlists](watchlists.md).
1917

18+
The features for watchlist templates and the ability to create a watchlist from a file in Azure Storage are currently in **PREVIEW**. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
19+
2020
## Upload a watchlist from a local folder
2121

2222
You have two ways to upload a CSV file from your local machine to create a watchlist.
@@ -36,7 +36,7 @@ If you didn't use a watchlist template to create your file,
3636

3737
1. On the **General** page, provide the name, description, and alias for the watchlist.
3838

39-
:::image type="content" source="./media/watchlists-create/sentinel-watchlist-general.png" alt-text="Screenshot of watchlist general tab in the watchlists wizard.":::
39+
:::image type="content" source="./media/watchlists-create/sentinel-watchlist-general-country.png" alt-text="Screenshot of watchlist general tab in the watchlists wizard.":::
4040

4141
1. Select **Next: Source**.
4242
1. Use the information in the following table to upload your watchlist data.
@@ -60,8 +60,6 @@ If you didn't use a watchlist template to create your file,
6060

6161
A notification appears once the watchlist is created.
6262

63-
:::image type="content" source="./media/watchlists-create/sentinel-watchlist-complete.png" alt-text="Screenshot of the watchlist successful creation notification." lightbox="./media/watchlists-create/sentinel-watchlist-complete.png":::
64-
6563
It might take several minutes for the watchlist to be created and the new data to be available in queries.
6664

6765
### Upload watchlist created from a template (Preview)
@@ -158,7 +156,7 @@ Create a shared access signature URL for Microsoft Sentinel to retrieve the watc
158156
1. Review the information, verify that it's correct, wait for the **Validation passed** message.
159157
1. Select **Create**.
160158

161-
It might take up to an hour for a large watchlist to be created and the new data to be available in queries.
159+
It might an hour or more for a large watchlist to be created and the new data to be available in queries.
162160

163161
## View watchlist status
164162

@@ -171,7 +169,9 @@ View the status by selecting the watchlist in your workspace.
171169

172170
:::image type="content" source="./media/watchlists-create/view-status-uploading.png" alt-text="Screenshot that shows the upload status on the watchlist." lightbox="./media/watchlists-create/view-status-uploading.png":::
173171

174-
1. If the status is **Succeeded**, select **View in Log Analytics** to use the watchlist in a query. It might take several minutes for the watchlist to show in Log Analytics.
172+
1. When the status is **Succeeded**, select **View in Log Analytics** to use the watchlist in a query. It might take several minutes for the watchlist to show in Log Analytics.
173+
174+
:::image type="content" source="media/watchlists-create/large-watchlist-status-view-in-log.png" alt-text="Screenshot of ":::
175175

176176
## Download watchlist template (preview)
177177

0 commit comments

Comments
 (0)