Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Azure Native
  3. API Docs
  4. securityinsights
  5. getWatchlist
This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.
Azure Native v3.2.0 published on Monday, Apr 14, 2025 by Pulumi
pulumi/pulumi-azure-native

azure-native.securityinsights.getWatchlist

Explore with Pulumi AI

azure-native logo
This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.
Azure Native v3.2.0 published on Monday, Apr 14, 2025 by Pulumi
pulumi/pulumi-azure-native

    Get a watchlist, without its watchlist items.

    Uses Azure REST API version 2024-09-01.

    Other available API versions: 2023-02-01, 2023-03-01-preview, 2023-04-01-preview, 2023-05-01-preview, 2023-06-01-preview, 2023-07-01-preview, 2023-08-01-preview, 2023-09-01-preview, 2023-10-01-preview, 2023-11-01, 2023-12-01-preview, 2024-01-01-preview, 2024-03-01, 2024-04-01-preview, 2024-10-01-preview, 2025-01-01-preview, 2025-03-01. These can be accessed by generating a local SDK package using the CLI command pulumi package add azure-native securityinsights [ApiVersion]. See the version guide for details.

    Using getWatchlist

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getWatchlist(args: GetWatchlistArgs, opts?: InvokeOptions): Promise<GetWatchlistResult>
function getWatchlistOutput(args: GetWatchlistOutputArgs, opts?: InvokeOptions): Output<GetWatchlistResult>
    def get_watchlist(resource_group_name: Optional[str] = None,
                  watchlist_alias: Optional[str] = None,
                  workspace_name: Optional[str] = None,
                  opts: Optional[InvokeOptions] = None) -> GetWatchlistResult
def get_watchlist_output(resource_group_name: Optional[pulumi.Input[str]] = None,
                  watchlist_alias: Optional[pulumi.Input[str]] = None,
                  workspace_name: Optional[pulumi.Input[str]] = None,
                  opts: Optional[InvokeOptions] = None) -> Output[GetWatchlistResult]
    func LookupWatchlist(ctx *Context, args *LookupWatchlistArgs, opts ...InvokeOption) (*LookupWatchlistResult, error)
func LookupWatchlistOutput(ctx *Context, args *LookupWatchlistOutputArgs, opts ...InvokeOption) LookupWatchlistResultOutput

    > Note: This function is named LookupWatchlist in the Go SDK.

    public static class GetWatchlist 
{
    public static Task<GetWatchlistResult> InvokeAsync(GetWatchlistArgs args, InvokeOptions? opts = null)
    public static Output<GetWatchlistResult> Invoke(GetWatchlistInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetWatchlistResult> getWatchlist(GetWatchlistArgs args, InvokeOptions options)
public static Output<GetWatchlistResult> getWatchlist(GetWatchlistArgs args, InvokeOptions options)

    fn::invoke:
  function: azure-native:securityinsights:getWatchlist
  arguments:
    # arguments dictionary

    The following arguments are supported:

    ResourceGroupName string
    The name of the resource group. The name is case insensitive.
    WatchlistAlias string
    The watchlist alias
    WorkspaceName string
    The name of the workspace.
    ResourceGroupName string
    The name of the resource group. The name is case insensitive.
    WatchlistAlias string
    The watchlist alias
    WorkspaceName string
    The name of the workspace.
    resourceGroupName String
    The name of the resource group. The name is case insensitive.
    watchlistAlias String
    The watchlist alias
    workspaceName String
    The name of the workspace.
    resourceGroupName string
    The name of the resource group. The name is case insensitive.
    watchlistAlias string
    The watchlist alias
    workspaceName string
    The name of the workspace.
    resource_group_name str
    The name of the resource group. The name is case insensitive.
    watchlist_alias str
    The watchlist alias
    workspace_name str
    The name of the workspace.
    resourceGroupName String
    The name of the resource group. The name is case insensitive.
    watchlistAlias String
    The watchlist alias
    workspaceName String
    The name of the workspace.

    getWatchlist Result

    The following output properties are available:

    AzureApiVersion string
    The Azure API version of the resource.
    DisplayName string
    The display name of the watchlist
    Id string
    Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
    ItemsSearchKey string
    The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
    Name string
    The name of the resource
    Provider string
    The provider of the watchlist
    ProvisioningState string
    Describes provisioning state
    SystemData Pulumi.AzureNative.SecurityInsights.Outputs.SystemDataResponse
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    Type string
    The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
    ContentType string
    The content type of the raw content. Example : text/csv or text/tsv
    Created string
    The time the watchlist was created
    CreatedBy Pulumi.AzureNative.SecurityInsights.Outputs.WatchlistUserInfoResponse
    Describes a user that created the watchlist
    DefaultDuration string
    The default duration of a watchlist (in ISO 8601 duration format)
    Description string
    A description of the watchlist
    Etag string
    Etag of the azure resource
    IsDeleted bool
    A flag that indicates if the watchlist is deleted or not
    Labels List<string>
    List of labels relevant to this watchlist
    NumberOfLinesToSkip int
    The number of lines in a csv/tsv content to skip before the header
    RawContent string
    The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint
    Source string
    The filename of the watchlist, called 'source'
    SourceType string
    The sourceType of the watchlist
    TenantId string
    The tenantId where the watchlist belongs to
    Updated string
    The last time the watchlist was updated
    UpdatedBy Pulumi.AzureNative.SecurityInsights.Outputs.WatchlistUserInfoResponse
    Describes a user that updated the watchlist
    UploadStatus string
    The status of the Watchlist upload : New, InProgress or Complete. Note : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted
    WatchlistAlias string
    The alias of the watchlist
    WatchlistId string
    The id (a Guid) of the watchlist
    WatchlistType string
    The type of the watchlist
    AzureApiVersion string
    The Azure API version of the resource.
    DisplayName string
    The display name of the watchlist
    Id string
    Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
    ItemsSearchKey string
    The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
    Name string
    The name of the resource
    Provider string
    The provider of the watchlist
    ProvisioningState string
    Describes provisioning state
    SystemData SystemDataResponse
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    Type string
    The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
    ContentType string
    The content type of the raw content. Example : text/csv or text/tsv
    Created string
    The time the watchlist was created
    CreatedBy WatchlistUserInfoResponse
    Describes a user that created the watchlist
    DefaultDuration string
    The default duration of a watchlist (in ISO 8601 duration format)
    Description string
    A description of the watchlist
    Etag string
    Etag of the azure resource
    IsDeleted bool
    A flag that indicates if the watchlist is deleted or not
    Labels []string
    List of labels relevant to this watchlist
    NumberOfLinesToSkip int
    The number of lines in a csv/tsv content to skip before the header
    RawContent string
    The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint
    Source string
    The filename of the watchlist, called 'source'
    SourceType string
    The sourceType of the watchlist
    TenantId string
    The tenantId where the watchlist belongs to
    Updated string
    The last time the watchlist was updated
    UpdatedBy WatchlistUserInfoResponse
    Describes a user that updated the watchlist
    UploadStatus string
    The status of the Watchlist upload : New, InProgress or Complete. Note : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted
    WatchlistAlias string
    The alias of the watchlist
    WatchlistId string
    The id (a Guid) of the watchlist
    WatchlistType string
    The type of the watchlist
    azureApiVersion String
    The Azure API version of the resource.
    displayName String
    The display name of the watchlist
    id String
    Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
    itemsSearchKey String
    The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
    name String
    The name of the resource
    provider String
    The provider of the watchlist
    provisioningState String
    Describes provisioning state
    systemData SystemDataResponse
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    type String
    The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
    contentType String
    The content type of the raw content. Example : text/csv or text/tsv
    created String
    The time the watchlist was created
    createdBy WatchlistUserInfoResponse
    Describes a user that created the watchlist
    defaultDuration String
    The default duration of a watchlist (in ISO 8601 duration format)
    description String
    A description of the watchlist
    etag String
    Etag of the azure resource
    isDeleted Boolean
    A flag that indicates if the watchlist is deleted or not
    labels List<String>
    List of labels relevant to this watchlist
    numberOfLinesToSkip Integer
    The number of lines in a csv/tsv content to skip before the header
    rawContent String
    The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint
    source String
    The filename of the watchlist, called 'source'
    sourceType String
    The sourceType of the watchlist
    tenantId String
    The tenantId where the watchlist belongs to
    updated String
    The last time the watchlist was updated
    updatedBy WatchlistUserInfoResponse
    Describes a user that updated the watchlist
    uploadStatus String
    The status of the Watchlist upload : New, InProgress or Complete. Note : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted
    watchlistAlias String
    The alias of the watchlist
    watchlistId String
    The id (a Guid) of the watchlist
    watchlistType String
    The type of the watchlist
    azureApiVersion string
    The Azure API version of the resource.
    displayName string
    The display name of the watchlist
    id string
    Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
    itemsSearchKey string
    The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
    name string
    The name of the resource
    provider string
    The provider of the watchlist
    provisioningState string
    Describes provisioning state
    systemData SystemDataResponse
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    type string
    The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
    contentType string
    The content type of the raw content. Example : text/csv or text/tsv
    created string
    The time the watchlist was created
    createdBy WatchlistUserInfoResponse
    Describes a user that created the watchlist
    defaultDuration string
    The default duration of a watchlist (in ISO 8601 duration format)
    description string
    A description of the watchlist
    etag string
    Etag of the azure resource
    isDeleted boolean
    A flag that indicates if the watchlist is deleted or not
    labels string[]
    List of labels relevant to this watchlist
    numberOfLinesToSkip number
    The number of lines in a csv/tsv content to skip before the header
    rawContent string
    The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint
    source string
    The filename of the watchlist, called 'source'
    sourceType string
    The sourceType of the watchlist
    tenantId string
    The tenantId where the watchlist belongs to
    updated string
    The last time the watchlist was updated
    updatedBy WatchlistUserInfoResponse
    Describes a user that updated the watchlist
    uploadStatus string
    The status of the Watchlist upload : New, InProgress or Complete. Note : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted
    watchlistAlias string
    The alias of the watchlist
    watchlistId string
    The id (a Guid) of the watchlist
    watchlistType string
    The type of the watchlist
    azure_api_version str
    The Azure API version of the resource.
    display_name str
    The display name of the watchlist
    id str
    Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
    items_search_key str
    The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
    name str
    The name of the resource
    provider str
    The provider of the watchlist
    provisioning_state str
    Describes provisioning state
    system_data SystemDataResponse
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    type str
    The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
    content_type str
    The content type of the raw content. Example : text/csv or text/tsv
    created str
    The time the watchlist was created
    created_by WatchlistUserInfoResponse
    Describes a user that created the watchlist
    default_duration str
    The default duration of a watchlist (in ISO 8601 duration format)
    description str
    A description of the watchlist
    etag str
    Etag of the azure resource
    is_deleted bool
    A flag that indicates if the watchlist is deleted or not
    labels Sequence[str]
    List of labels relevant to this watchlist
    number_of_lines_to_skip int
    The number of lines in a csv/tsv content to skip before the header
    raw_content str
    The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint
    source str
    The filename of the watchlist, called 'source'
    source_type str
    The sourceType of the watchlist
    tenant_id str
    The tenantId where the watchlist belongs to
    updated str
    The last time the watchlist was updated
    updated_by WatchlistUserInfoResponse
    Describes a user that updated the watchlist
    upload_status str
    The status of the Watchlist upload : New, InProgress or Complete. Note : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted
    watchlist_alias str
    The alias of the watchlist
    watchlist_id str
    The id (a Guid) of the watchlist
    watchlist_type str
    The type of the watchlist
    azureApiVersion String
    The Azure API version of the resource.
    displayName String
    The display name of the watchlist
    id String
    Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
    itemsSearchKey String
    The search key is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field as the key field when joining to other event data by IP address.
    name String
    The name of the resource
    provider String
    The provider of the watchlist
    provisioningState String
    Describes provisioning state
    systemData Property Map
    Azure Resource Manager metadata containing createdBy and modifiedBy information.
    type String
    The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"
    contentType String
    The content type of the raw content. Example : text/csv or text/tsv
    created String
    The time the watchlist was created
    createdBy Property Map
    Describes a user that created the watchlist
    defaultDuration String
    The default duration of a watchlist (in ISO 8601 duration format)
    description String
    A description of the watchlist
    etag String
    Etag of the azure resource
    isDeleted Boolean
    A flag that indicates if the watchlist is deleted or not
    labels List<String>
    List of labels relevant to this watchlist
    numberOfLinesToSkip Number
    The number of lines in a csv/tsv content to skip before the header
    rawContent String
    The raw content that represents to watchlist items to create. In case of csv/tsv content type, it's the content of the file that will parsed by the endpoint
    source String
    The filename of the watchlist, called 'source'
    sourceType String
    The sourceType of the watchlist
    tenantId String
    The tenantId where the watchlist belongs to
    updated String
    The last time the watchlist was updated
    updatedBy Property Map
    Describes a user that updated the watchlist
    uploadStatus String
    The status of the Watchlist upload : New, InProgress or Complete. Note : When a Watchlist upload status is InProgress, the Watchlist cannot be deleted
    watchlistAlias String
    The alias of the watchlist
    watchlistId String
    The id (a Guid) of the watchlist
    watchlistType String
    The type of the watchlist

    Supporting Types

    SystemDataResponse

    CreatedAt string
    The timestamp of resource creation (UTC).
    CreatedBy string
    The identity that created the resource.
    CreatedByType string
    The type of identity that created the resource.
    LastModifiedAt string
    The timestamp of resource last modification (UTC)
    LastModifiedBy string
    The identity that last modified the resource.
    LastModifiedByType string
    The type of identity that last modified the resource.
    CreatedAt string
    The timestamp of resource creation (UTC).
    CreatedBy string
    The identity that created the resource.
    CreatedByType string
    The type of identity that created the resource.
    LastModifiedAt string
    The timestamp of resource last modification (UTC)
    LastModifiedBy string
    The identity that last modified the resource.
    LastModifiedByType string
    The type of identity that last modified the resource.
    createdAt String
    The timestamp of resource creation (UTC).
    createdBy String
    The identity that created the resource.
    createdByType String
    The type of identity that created the resource.
    lastModifiedAt String
    The timestamp of resource last modification (UTC)
    lastModifiedBy String
    The identity that last modified the resource.
    lastModifiedByType String
    The type of identity that last modified the resource.
    createdAt string
    The timestamp of resource creation (UTC).
    createdBy string
    The identity that created the resource.
    createdByType string
    The type of identity that created the resource.
    lastModifiedAt string
    The timestamp of resource last modification (UTC)
    lastModifiedBy string
    The identity that last modified the resource.
    lastModifiedByType string
    The type of identity that last modified the resource.
    created_at str
    The timestamp of resource creation (UTC).
    created_by str
    The identity that created the resource.
    created_by_type str
    The type of identity that created the resource.
    last_modified_at str
    The timestamp of resource last modification (UTC)
    last_modified_by str
    The identity that last modified the resource.
    last_modified_by_type str
    The type of identity that last modified the resource.
    createdAt String
    The timestamp of resource creation (UTC).
    createdBy String
    The identity that created the resource.
    createdByType String
    The type of identity that created the resource.
    lastModifiedAt String
    The timestamp of resource last modification (UTC)
    lastModifiedBy String
    The identity that last modified the resource.
    lastModifiedByType String
    The type of identity that last modified the resource.

    WatchlistUserInfoResponse

    Email string
    The email of the user.
    Name string
    The name of the user.
    ObjectId string
    The object id of the user.
    Email string
    The email of the user.
    Name string
    The name of the user.
    ObjectId string
    The object id of the user.
    email String
    The email of the user.
    name String
    The name of the user.
    objectId String
    The object id of the user.
    email string
    The email of the user.
    name string
    The name of the user.
    objectId string
    The object id of the user.
    email str
    The email of the user.
    name str
    The name of the user.
    object_id str
    The object id of the user.
    email String
    The email of the user.
    name String
    The name of the user.
    objectId String
    The object id of the user.

    Package Details

    Repository
    Azure Native pulumi/pulumi-azure-native
    License
    Apache-2.0
    azure-native logo
    This is the latest version of Azure Native. Use the Azure Native v2 docs if using the v2 version of this package.
    Azure Native v3.2.0 published on Monday, Apr 14, 2025 by Pulumi
    pulumi/pulumi-azure-native