Hi,
There is an error in the documentation for the creation of Microsoft Sentinel watchlists via the Azure CLI. When uploading content from a local file, the --source-type parameter is required (one of the required parameters). The accepted value are "Local file" or "Remote storage" as described in the documentation. However, when providing "Local storage" as a value for the --source-type parameter, I get the following error:
(400) There is an issue with deserializing : Error converting 'Local file' for path 'properties.sourceType'.
Code: 400
Message: There is an issue with deserializing : Error converting 'Local file' for path 'properties.sourceType'.
Azure CLI command being used:
az sentinel watchlist create --name watchlist --resource-group RG --workspace-name LAW --display-name watchlist --provider Microsoft --items-search-key "Asset Name" --source-type "Local file" --source watchlist.csv --raw-content watchlist.csv
After investigating this with the API, I have noticed that the same values are mentioned as being accepted in the documentation. However, in practice, "local" is actually accepted by the API instead of "Local file"
Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.
Hi,
There is an error in the documentation for the creation of Microsoft Sentinel watchlists via the Azure CLI. When uploading content from a local file, the --source-type parameter is required (one of the required parameters). The accepted value are "Local file" or "Remote storage" as described in the documentation. However, when providing "Local storage" as a value for the --source-type parameter, I get the following error:
Azure CLI command being used:
az sentinel watchlist create --name watchlist --resource-group RG --workspace-name LAW --display-name watchlist --provider Microsoft --items-search-key "Asset Name" --source-type "Local file" --source watchlist.csv --raw-content watchlist.csvAfter investigating this with the API, I have noticed that the same values are mentioned as being accepted in the documentation. However, in practice, "local" is actually accepted by the API instead of "Local file"
When "Local file" is provided:
When "Local" is provided:
Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.