Forum Discussion
Solved
Sentinel Watchlist stuck in queued state for days...
Dear Members, I recently read https://cryptsus.com/blog/enrich-geolocation-sentinel-siem.html how on how to do geolocation of IPv4 addresses in Sentinel efficiently. The Azure API with the 100 a...
- Hi there,
I spoke with Microsoft support who cleared the queued watchlists in a few different workspaces. They confirmed that there was no option for me to do this from the Azure Portal and if it happens again to just contact them to fix.
Bit of an odd one.
How big is the Watchlist - certain limit apply? https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/large-watchlist-using-sas-key-is-in-public-preview/ba-p/3242370#:~:text=How%20to%20create%20a%20large%20watchlist%20To%20create,Microsoft%20Sentinel%20to%20securely%20retrieve%20the%20watchlist%20data.
It's about 180 MB.
- Unfortunately all of the watchlists are still sitting in queued state 😞
- Hello there!
I happen to have a couple of lists stuck in queued for the last few days because I incorrectly referenced a blob endpoint. May I ask if you have been able to delete or stop your queued watchlists?
Thanks- Hello,
Unfortunately it seems that while they are in queued state, they can't be updated and neither can they be removed. So I'm stuck with them for the time being.
I used a SAS URL to create the watchlist, and as far as I could test, they were guaranteed to be good.