Share via


SecurityInsightsWatchlistCollection.CreateOrUpdateAsync Method

Definition

Create or update a Watchlist and its Watchlist Items (bulk creation, e.g. through text/csv content type). To create a Watchlist and its Items, we should call this endpoint with either rawContent or a valid SAR URI and contentType properties. The rawContent is mainly used for small watchlist (content size below 3.8 MB). The SAS URI enables the creation of large watchlist, where the content size can go up to 500 MB. The status of processing such large file can be polled through the URL returned in Azure-AsyncOperation header.

  • Request Path: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/watchlists/{watchlistAlias}
  • Operation Id: Watchlists_CreateOrUpdate
  • Default Api Version: 2024-01-01-preview
  • Resource: SecurityInsightsWatchlistResource
public virtual System.Threading.Tasks.Task<Azure.ResourceManager.ArmOperation<Azure.ResourceManager.SecurityInsights.SecurityInsightsWatchlistResource>> CreateOrUpdateAsync (Azure.WaitUntil waitUntil, string watchlistAlias, Azure.ResourceManager.SecurityInsights.SecurityInsightsWatchlistData data, System.Threading.CancellationToken cancellationToken = default);
abstract member CreateOrUpdateAsync : Azure.WaitUntil * string * Azure.ResourceManager.SecurityInsights.SecurityInsightsWatchlistData * System.Threading.CancellationToken -> System.Threading.Tasks.Task<Azure.ResourceManager.ArmOperation<Azure.ResourceManager.SecurityInsights.SecurityInsightsWatchlistResource>>
override this.CreateOrUpdateAsync : Azure.WaitUntil * string * Azure.ResourceManager.SecurityInsights.SecurityInsightsWatchlistData * System.Threading.CancellationToken -> System.Threading.Tasks.Task<Azure.ResourceManager.ArmOperation<Azure.ResourceManager.SecurityInsights.SecurityInsightsWatchlistResource>>
Public Overridable Function CreateOrUpdateAsync (waitUntil As WaitUntil, watchlistAlias As String, data As SecurityInsightsWatchlistData, Optional cancellationToken As CancellationToken = Nothing) As Task(Of ArmOperation(Of SecurityInsightsWatchlistResource))

Parameters

waitUntil
WaitUntil

Completed if the method should wait to return until the long-running operation has completed on the service; Started if it should return after starting the operation. For more information on long-running operations, please see Azure.Core Long-Running Operation samples.

watchlistAlias
String

Watchlist Alias.

data
SecurityInsightsWatchlistData

The watchlist.

cancellationToken
CancellationToken

The cancellation token to use.

Returns

Exceptions

watchlistAlias is an empty string, and was expected to be non-empty.

watchlistAlias or data is null.

Applies to