Blog Post

Microsoft Sentinel Blog
6 MIN READ

New watchlist actions available for watchlist automation using Microsoft Sentinel SOAR

BenjiSec's avatar
BenjiSec
Icon for Microsoft rankMicrosoft
Apr 29, 2022
Thanks to Chi_Nguyen and Patrick_Goudjo_Ako for help on creating and fine-tuning playbook actions and blog!   Watchlists in Microsoft Sentinel allow you to correlate data from a data source you p...
Updated May 04, 2022
Version 2.0
BenjiSec's avatar
Icon for Microsoft rankMicrosoft
Joined April 29, 2019
View Profile
Microsoft Sentinel Blog

Microsoft Sentinel is a cloud-native SIEM, enriched with AI and automation to provide expansive visibility across your digital environment.

When evaluating various solutions, your peers value hearing from people like you who’ve used the product. Review Microsoft Sentinel by filling out a Gartner Peer Insights survey and receive a $25 USD gift card (for customers only). Here are the Privacy/Guideline links: Microsoft Privacy Statement, Gartner’s Community Guidelines & Gartner Peer Insights Review Guide.

Raphiki's avatar
Raphiki
Copper Contributor
Nov 02, 2022

Hi Guys,

 

First, a big thank you! We are so close to have first class SOAR playbooks with these new actions/triggers 🙂

 

You might need to review the "Delete a watchlist" action.

It's not actually waiting for the watchilst to be completely deleted from the backend, it seems to just send the delete command.

We get a 409 error in our use case when we delete then recreate the same watchlist:

 

"StatusCode": "Conflict",
"ReasonPhrase": "Conflict",
"Content": "{\"error\":{\"code\":\"409\",\"message\":\"Cannot upload watchlist 'Dev-Jordan-Watchlist-1'. Delete is currently in progress.\"}}",
"Headers": {
"Pragma": [
"no-cache"

 

Could you change the behaviour to wait the deletion flag from the backend before ending this "Delete a watchlist" action ?

 

Thanks BenjiSec Chi Nguyen Patrick_Goudjo_Ako!