Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Azure Native
  3. API Docs
  4. securityinsights
  5. getWatchlist
This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.
Azure Native v3.0.1 published on Monday, Apr 7, 2025 by Pulumi
pulumi/pulumi-azure-native

azure-native.securityinsights.getWatchlist

Explore with Pulumi AI

This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.
Azure Native v3.0.1 published on Monday, Apr 7, 2025 by Pulumi
pulumi/pulumi-azure-native

Get a watchlist, without its watchlist items.

Uses Azure REST API version 2024-09-01.

Other available API versions: 2023-02-01, 2023-03-01-preview, 2023-04-01-preview, 2023-05-01-preview, 2023-06-01-preview, 2023-07-01-preview, 2023-08-01-preview, 2023-09-01-preview, 2023-10-01-preview, 2023-11-01, 2023-12-01-preview, 2024-01-01-preview, 2024-03-01, 2024-04-01-preview, 2024-10-01-preview, 2025-01-01-preview, 2025-03-01. These can be accessed by generating a local SDK package using the CLI command pulumi package add azure-native securityinsights [ApiVersion]. See the version guide for details.

Using getWatchlist

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getWatchlist(args: GetWatchlistArgs, opts?: InvokeOptions): Promise<GetWatchlistResult>
function getWatchlistOutput(args: GetWatchlistOutputArgs, opts?: InvokeOptions): Output<GetWatchlistResult>
Copy
def get_watchlist(resource_group_name: Optional[str] = None,
                  watchlist_alias: Optional[str] = None,
                  workspace_name: Optional[str] = None,
                  opts: Optional[InvokeOptions] = None) -> GetWatchlistResult
def get_watchlist_output(resource_group_name: Optional[pulumi.Input[str]] = None,
                  watchlist_alias: Optional[pulumi.Input[str]] = None,
                  workspace_name: Optional[pulumi.Input[str]] = None,
                  opts: Optional[InvokeOptions] = None) -> Output[GetWatchlistResult]
Copy
func LookupWatchlist(ctx *Context, args *LookupWatchlistArgs, opts ...InvokeOption) (*LookupWatchlistResult, error)
func LookupWatchlistOutput(ctx *Context, args *LookupWatchlistOutputArgs, opts ...InvokeOption) LookupWatchlistResultOutput
Copy

> Note: This function is named LookupWatchlist in the Go SDK.

public static class GetWatchlist 
{
    public static Task<GetWatchlistResult> InvokeAsync(GetWatchlistArgs args, InvokeOptions? opts = null)
    public static Output<GetWatchlistResult> Invoke(GetWatchlistInvokeArgs args, InvokeOptions? opts = null)
}
Copy
public static CompletableFuture<GetWatchlistResult> getWatchlist(GetWatchlistArgs args, InvokeOptions options)
public static Output<GetWatchlistResult> getWatchlist(GetWatchlistArgs args, InvokeOptions options)
Copy
fn::invoke:
  function: azure-native:securityinsights:getWatchlist
  arguments:
    # arguments dictionary
Copy

The following arguments are supported:

ResourceGroupName
This property is required.
Changes to this property will trigger replacement.
string
The name of the resource group. The name is case insensitive.
WatchlistAlias
This property is required.
Changes to this property will trigger replacement.
string
The watchlist alias
WorkspaceName
This property is required.
Changes to this property will trigger replacement.
string
The name of the workspace.
ResourceGroupName
This property is required.
Changes to this property will trigger replacement.
string
The name of the resource group. The name is case insensitive.
WatchlistAlias
This property is required.
Changes to this property will trigger replacement.
string
The watchlist alias
WorkspaceName
This property is required.
Changes to this property will trigger replacement.
string
The name of the workspace.
resourceGroupName
This property is required.
Changes to this property will trigger replacement.
String
The name of the resource group. The name is case insensitive.
watchlistAlias
This property is required.
Changes to this property will trigger replacement.
String
The watchlist alias
workspaceName
This property is required.
Changes to this property will trigger replacement.
String
The name of the workspace.
resourceGroupName
This property is required.
Changes to this property will trigger replacement.
string
The name of the resource group. The name is case insensitive.
watchlistAlias
This property is required.
Changes to this property will trigger replacement.
string
The watchlist alias
workspaceName
This property is required.
Changes to this property will trigger replacement.
string
The name of the workspace.
resource_group_name
This property is required.
Changes to this property will trigger replacement.
str
The name of the resource group. The name is case insensitive.
watchlist_alias
This property is required.
Changes to this property will trigger replacement.
str
The watchlist alias
workspace_name
This property is required.
Changes to this property will trigger replacement.
str
The name of the workspace.
resourceGroupName
This property is required.
Changes to this property will trigger replacement.
String
The name of the resource group. The name is case insensitive.
watchlistAlias
This property is required.
Changes to this property will trigger replacement.
String
The watchlist alias
workspaceName
This property is required.
Changes to this property will trigger replacement.
String
The name of the workspace.

getWatchlist Result

The following output properties are available:

AzureApiVersion string
The Azure API version of the resource.
DisplayName string
The display name of the watchlist
Id string
Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
ItemsSearchKey string
The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
Name string
The name of the resource
Provider string
The provider of the watchlist
ProvisioningState string
Describes provisioning state
SystemData Pulumi.AzureNative.SecurityInsights.Outputs.SystemDataResponse
Azure Resource Manager metadata containing createdBy and modifiedBy information.
Type string
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
ContentType string
The content type of the raw content. Example : text/csv or text/tsv
Created string
The time the watchlist was created
CreatedBy Pulumi.AzureNative.SecurityInsights.Outputs.WatchlistUserInfoResponse
Describes a user that created the watchlist
DefaultDuration string
The default duration of a watchlist (in ISO 8601 duration format)
Description string
A description of the watchlist
Etag string
Etag of the azure resource
IsDeleted bool
A flag that indicates if the watchlist is deleted or not
Labels List<string>
List of labels relevant to this watchlist
NumberOfLinesToSkip int
The number of lines in a csv/tsv content to skip before the header
RawContent string
The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint
Source string
The filename of the watchlist, called 'source'
SourceType string
The sourceType of the watchlist
TenantId string
The tenantId where the watchlist belongs to
Updated string
The last time the watchlist was updated
UpdatedBy Pulumi.AzureNative.SecurityInsights.Outputs.WatchlistUserInfoResponse
Describes a user that updated the watchlist
UploadStatus string
The status of the Watchlist upload : New, InProgress or Complete. Note : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted
WatchlistAlias string
The alias of the watchlist
WatchlistId string
The id (a Guid) of the watchlist
WatchlistType string
The type of the watchlist
AzureApiVersion string
The Azure API version of the resource.
DisplayName string
The display name of the watchlist
Id string
Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
ItemsSearchKey string
The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
Name string
The name of the resource
Provider string
The provider of the watchlist
ProvisioningState string
Describes provisioning state
SystemData SystemDataResponse
Azure Resource Manager metadata containing createdBy and modifiedBy information.
Type string
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
ContentType string
The content type of the raw content. Example : text/csv or text/tsv
Created string
The time the watchlist was created
CreatedBy WatchlistUserInfoResponse
Describes a user that created the watchlist
DefaultDuration string
The default duration of a watchlist (in ISO 8601 duration format)
Description string
A description of the watchlist
Etag string
Etag of the azure resource
IsDeleted bool
A flag that indicates if the watchlist is deleted or not
Labels []string
List of labels relevant to this watchlist
NumberOfLinesToSkip int
The number of lines in a csv/tsv content to skip before the header
RawContent string
The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint
Source string
The filename of the watchlist, called 'source'
SourceType string
The sourceType of the watchlist
TenantId string
The tenantId where the watchlist belongs to
Updated string
The last time the watchlist was updated
UpdatedBy WatchlistUserInfoResponse
Describes a user that updated the watchlist
UploadStatus string
The status of the Watchlist upload : New, InProgress or Complete. Note : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted
WatchlistAlias string
The alias of the watchlist
WatchlistId string
The id (a Guid) of the watchlist
WatchlistType string
The type of the watchlist
azureApiVersion String
The Azure API version of the resource.
displayName String
The display name of the watchlist
id String
Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
itemsSearchKey String
The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
name String
The name of the resource
provider String
The provider of the watchlist
provisioningState String
Describes provisioning state
systemData SystemDataResponse
Azure Resource Manager metadata containing createdBy and modifiedBy information.
type String
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
contentType String
The content type of the raw content. Example : text/csv or text/tsv
created String
The time the watchlist was created
createdBy WatchlistUserInfoResponse
Describes a user that created the watchlist
defaultDuration String
The default duration of a watchlist (in ISO 8601 duration format)
description String
A description of the watchlist
etag String
Etag of the azure resource
isDeleted Boolean
A flag that indicates if the watchlist is deleted or not
labels List<String>
List of labels relevant to this watchlist
numberOfLinesToSkip Integer
The number of lines in a csv/tsv content to skip before the header
rawContent String
The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint
source String
The filename of the watchlist, called 'source'
sourceType String
The sourceType of the watchlist
tenantId String
The tenantId where the watchlist belongs to
updated String
The last time the watchlist was updated
updatedBy WatchlistUserInfoResponse
Describes a user that updated the watchlist
uploadStatus String
The status of the Watchlist upload : New, InProgress or Complete. Note : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted
watchlistAlias String
The alias of the watchlist
watchlistId String
The id (a Guid) of the watchlist
watchlistType String
The type of the watchlist
azureApiVersion string
The Azure API version of the resource.
displayName string
The display name of the watchlist
id string
Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
itemsSearchKey string
The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
name string
The name of the resource
provider string
The provider of the watchlist
provisioningState string
Describes provisioning state
systemData SystemDataResponse
Azure Resource Manager metadata containing createdBy and modifiedBy information.
type string
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
contentType string
The content type of the raw content. Example : text/csv or text/tsv
created string
The time the watchlist was created
createdBy WatchlistUserInfoResponse
Describes a user that created the watchlist
defaultDuration string
The default duration of a watchlist (in ISO 8601 duration format)
description string
A description of the watchlist
etag string
Etag of the azure resource
isDeleted boolean
A flag that indicates if the watchlist is deleted or not
labels string[]
List of labels relevant to this watchlist
numberOfLinesToSkip number
The number of lines in a csv/tsv content to skip before the header
rawContent string
The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint
source string
The filename of the watchlist, called 'source'
sourceType string
The sourceType of the watchlist
tenantId string
The tenantId where the watchlist belongs to
updated string
The last time the watchlist was updated
updatedBy WatchlistUserInfoResponse
Describes a user that updated the watchlist
uploadStatus string
The status of the Watchlist upload : New, InProgress or Complete. Note : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted
watchlistAlias string
The alias of the watchlist
watchlistId string
The id (a Guid) of the watchlist
watchlistType string
The type of the watchlist
azure_api_version str
The Azure API version of the resource.
display_name str
The display name of the watchlist
id str
Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
items_search_key str
The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
name str
The name of the resource
provider str
The provider of the watchlist
provisioning_state str
Describes provisioning state
system_data SystemDataResponse
Azure Resource Manager metadata containing createdBy and modifiedBy information.
type str
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
content_type str
The content type of the raw content. Example : text/csv or text/tsv
created str
The time the watchlist was created
created_by WatchlistUserInfoResponse
Describes a user that created the watchlist
default_duration str
The default duration of a watchlist (in ISO 8601 duration format)
description str
A description of the watchlist
etag str
Etag of the azure resource
is_deleted bool
A flag that indicates if the watchlist is deleted or not
labels Sequence[str]
List of labels relevant to this watchlist
number_of_lines_to_skip int
The number of lines in a csv/tsv content to skip before the header
raw_content str
The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint
source str
The filename of the watchlist, called 'source'
source_type str
The sourceType of the watchlist
tenant_id str
The tenantId where the watchlist belongs to
updated str
The last time the watchlist was updated
updated_by WatchlistUserInfoResponse
Describes a user that updated the watchlist
upload_status str
The status of the Watchlist upload : New, InProgress or Complete. Note : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted
watchlist_alias str
The alias of the watchlist
watchlist_id str
The id (a Guid) of the watchlist
watchlist_type str
The type of the watchlist
azureApiVersion String
The Azure API version of the resource.
displayName String
The display name of the watchlist
id String
Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
itemsSearchKey String
The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
name String
The name of the resource
provider String
The provider of the watchlist
provisioningState String
Describes provisioning state
systemData Property Map
Azure Resource Manager metadata containing createdBy and modifiedBy information.
type String
The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
contentType String
The content type of the raw content. Example : text/csv or text/tsv
created String
The time the watchlist was created
createdBy Property Map
Describes a user that created the watchlist
defaultDuration String
The default duration of a watchlist (in ISO 8601 duration format)
description String
A description of the watchlist
etag String
Etag of the azure resource
isDeleted Boolean
A flag that indicates if the watchlist is deleted or not
labels List<String>
List of labels relevant to this watchlist
numberOfLinesToSkip Number
The number of lines in a csv/tsv content to skip before the header
rawContent String
The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint
source String
The filename of the watchlist, called 'source'
sourceType String
The sourceType of the watchlist
tenantId String
The tenantId where the watchlist belongs to
updated String
The last time the watchlist was updated
updatedBy Property Map
Describes a user that updated the watchlist
uploadStatus String
The status of the Watchlist upload : New, InProgress or Complete. Note : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted
watchlistAlias String
The alias of the watchlist
watchlistId String
The id (a Guid) of the watchlist
watchlistType String
The type of the watchlist

Supporting Types

SystemDataResponse

CreatedAt string
The timestamp of resource creation (UTC).
CreatedBy string
The identity that created the resource.
CreatedByType string
The type of identity that created the resource.
LastModifiedAt string
The timestamp of resource last modification (UTC)
LastModifiedBy string
The identity that last modified the resource.
LastModifiedByType string
The type of identity that last modified the resource.
CreatedAt string
The timestamp of resource creation (UTC).
CreatedBy string
The identity that created the resource.
CreatedByType string
The type of identity that created the resource.
LastModifiedAt string
The timestamp of resource last modification (UTC)
LastModifiedBy string
The identity that last modified the resource.
LastModifiedByType string
The type of identity that last modified the resource.
createdAt String
The timestamp of resource creation (UTC).
createdBy String
The identity that created the resource.
createdByType String
The type of identity that created the resource.
lastModifiedAt String
The timestamp of resource last modification (UTC)
lastModifiedBy String
The identity that last modified the resource.
lastModifiedByType String
The type of identity that last modified the resource.
createdAt string
The timestamp of resource creation (UTC).
createdBy string
The identity that created the resource.
createdByType string
The type of identity that created the resource.
lastModifiedAt string
The timestamp of resource last modification (UTC)
lastModifiedBy string
The identity that last modified the resource.
lastModifiedByType string
The type of identity that last modified the resource.
created_at str
The timestamp of resource creation (UTC).
created_by str
The identity that created the resource.
created_by_type str
The type of identity that created the resource.
last_modified_at str
The timestamp of resource last modification (UTC)
last_modified_by str
The identity that last modified the resource.
last_modified_by_type str
The type of identity that last modified the resource.
createdAt String
The timestamp of resource creation (UTC).
createdBy String
The identity that created the resource.
createdByType String
The type of identity that created the resource.
lastModifiedAt String
The timestamp of resource last modification (UTC)
lastModifiedBy String
The identity that last modified the resource.
lastModifiedByType String
The type of identity that last modified the resource.

WatchlistUserInfoResponse

Email This property is required. string
The email of the user.
Name This property is required. string
The name of the user.
ObjectId string
The object id of the user.
Email This property is required. string
The email of the user.
Name This property is required. string
The name of the user.
ObjectId string
The object id of the user.
email This property is required. String
The email of the user.
name This property is required. String
The name of the user.
objectId String
The object id of the user.
email This property is required. string
The email of the user.
name This property is required. string
The name of the user.
objectId string
The object id of the user.
email This property is required. str
The email of the user.
name This property is required. str
The name of the user.
object_id str
The object id of the user.
email This property is required. String
The email of the user.
name This property is required. String
The name of the user.
objectId String
The object id of the user.

Package Details

Repository
Azure Native pulumi/pulumi-azure-native
License
Apache-2.0
This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.
Azure Native v3.0.1 published on Monday, Apr 7, 2025 by Pulumi
pulumi/pulumi-azure-native