Microsoft Sentinel Watchlist Item

Terraform Providers Azure
1

Hi,
I am trying to import our watchlists to terraform (creating config files), and from what I understood for every item in our watchlist we would need the following block:

resource "azurerm_sentinel_watchlist_item" "example" {
  name         = "0aac6fa5-223e-49cf-9bfd-3554dc9d2b76"
  watchlist_id = azurerm_sentinel_watchlist.example.id
  properties = {
    k1 = "v1"
    k2 = "v2"
  }

But if we have a watchlist with 10k items (list of IPs as an example) we would need this block for each one of the 10k IPs? is that correct? there is any other way to add items to watchlist? maybe from csv or any other way via terraform?

Thank you

1 Like
2

You can use storage account to upload watchlist item. Create watchlists - Microsoft Sentinel | Microsoft Learn