Azure Sentinel Watchlist
This page shows how to write Terraform and Azure Resource Manager for Sentinel Watchlist and write them securely.
azurerm_sentinel_watchlist (Terraform)
The Watchlist in Sentinel can be configured in Terraform with the resource name azurerm_sentinel_watchlist
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
An example could not be found in GitHub.
Parameters
The following arguments are supported:
name
- (Required) The name which should be used for this Sentinel Watchlist. Changing this forces a new Sentinel Watchlist to be created.log_analytics_workspace_id
- (Required) The ID of the Log Analytics Workspace where this Sentinel Watchlist resides in. Changing this forces a new Sentinel Watchlist to be created.display_name
- (Required) The display name of this Sentinel Watchlist. Changing this forces a new Sentinel Watchlist to be created.
default_duration
- (Optional) The default duration in ISO8601 duration form of this Sentinel Watchlist. Changing this forces a new Sentinel Watchlist to be created.description
- (Optional) The description of this Sentinel Watchlist. Changing this forces a new Sentinel Watchlist to be created.labels
- (Optional) Specifies a list of labels related to this Sentinel Watchlist. Changing this forces a new Sentinel Watchlist to be created.
In addition to the Arguments listed above - the following Attributes are exported:
id
- The ID of the Sentinel Watchlist.
Explanation in Terraform Registry
Manages a Sentinel Watchlist.
Microsoft.OperationalInsights/workspaces (Azure Resource Manager)
The workspaces in Microsoft.OperationalInsights can be configured in Azure Resource Manager with the resource name Microsoft.OperationalInsights/workspaces
. The following sections describe how to use the resource and its parameters.
Example Usage from GitHub
{
"contentVersion": "1.0.0.0",
"parameters": {
"workbookDisplayName": {
"type": "string",
{
"contentVersion": "1.0.0.0",
"parameters": {
"workbookDisplayName": {
"type": "string",
{
"contentVersion": "1.0.0.0",
"parameters": {
"workbookDisplayName": {
"type": "string",
{
"contentVersion": "1.0.0.0",
"parameters": {
"workbookDisplayName": {
"type": "string",
{
"contentVersion": "1.0.0.0",
"parameters": {
"workbookSourceId": {
"type": "string",
{
"contentVersion": "1.0.0.0",
"parameters": {
"workbookDisplayName": {
"type": "string",
{
"contentVersion": "1.0.0.0",
"parameters": {
"workbookDisplayName": {
"type": "string",
{
"contentVersion": "1.0.0.0",
"parameters": {
"workbookDisplayName": {
"type": "string",
{
"contentVersion": "1.0.0.0",
"parameters": {
"workbookDisplayName": {
"type": "string",
{
"contentVersion": "1.0.0.0",
"parameters": {
"workbookDisplayName": {
"type": "string",
Parameters
apiVersion
required - stringeTag
optional - stringThe ETag of the workspace.
location
required - stringThe geo-location where the resource lives
name
required - stringThe name of the workspace.
properties
requiredfeatures
optionaladditionalProperties
optional - objectUnmatched properties from the message are deserialized this collection
clusterResourceId
optional - stringDedicated LA cluster resourceId that is linked to the workspaces.
disableLocalAuth
optional - booleanDisable Non-AAD based Auth.
enableDataExport
optional - booleanFlag that indicate if data should be exported.
enableLogAccessUsingOnlyResourcePermissions
optional - booleanFlag that indicate which permission to use - resource or workspace or both.
immediatePurgeDataOn30Days
optional - booleanFlag that describes if we want to remove the data after 30 days.
forceCmkForQuery
optional - booleanIndicates whether customer managed storage is mandatory for query management.
provisioningState
optional - stringThe provisioning state of the workspace.
publicNetworkAccessForIngestion
optional - stringThe network access type for accessing Log Analytics ingestion.
publicNetworkAccessForQuery
optional - stringThe network access type for accessing Log Analytics query.
retentionInDays
optional - integerThe workspace data retention in days. Allowed values are per pricing plan. See pricing tiers documentation for details.
sku
optionalcapacityReservationLevel
optional - integerThe capacity reservation level in GB for this workspace, when CapacityReservation sku is selected.
name
required - stringThe name of the SKU.
workspaceCapping
optionaldailyQuotaGb
optional - numberThe workspace daily quota for ingestion.
tags
optional - stringResource tags.
type
required - string