Azure / Azure/azure-cli

Invalid property value for properties.sourceType - Creation of Microsoft Sentinel Watchlist with Azure CLI

Open
#26,332 16 comments 2 reactions 0 assignees View on GitHub
act-codegen-extensibility-squad customer-reported Docs SecurityInsights Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

Hi,

There is an error in the documentation for the creation of Microsoft Sentinel watchlists via the Azure CLI. When uploading content from a local file, the --source-type parameter is required (one of the required parameters). The accepted value are "Local file" or "Remote storage" as described in the documentation. However, when providing "Local storage" as a value for the --source-type parameter, I get the following error:

```
(400) There is an issue with deserializing : Error converting 'Local file' for path 'properties.sourceType'.
Code: 400
Message: There is an issue with deserializing : Error converting 'Local file' for path 'properties.sourceType'.
```

Azure CLI command being used:
`az sentinel watchlist create --name watchlist --resource-group RG --workspace-name LAW --display-name watchlist --provider Microsoft --items-search-key "Asset Name" --source-type "Local file" --source watchlist.csv --raw-content watchlist.csv`

After investigating this with the API, I have noticed that the same values are mentioned as being accepted in the [documentation](https://learn.microsoft.com/en-us/rest/api/securityinsights/preview/watchlists/create-or-update?tabs=HTTP). However, in practice, "local" is actually accepted by the API instead of "Local file"

- When "Local file" is provided:
![image](https://user-images.githubusercontent.com/61277439/236211944-50d0c550-2cd7-4c58-8978-95cc26472d9f.png)

- When "Local" is provided:
![image](https://user-images.githubusercontent.com/61277439/236212468-3c74c531-ea51-4e60-843a-e738d562035b.png)

---
#### Document Details

⚠ *Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.*

* ID: 5f6030e2-3933-24e5-ffbb-214a85e8a420
* Version Independent ID: 7c799022-da60-4422-9066-715a69ac11b5
* Content: [az sentinel watchlist](https://learn.microsoft.com/en-us/cli/azure/sentinel/watchlist?view=azure-cli-latest)
* Content Source: [latest/docs-ref-autogen/sentinel/watchlist.yml](https://github.com/MicrosoftDocs/azure-docs-cli/blob/main/latest/docs-ref-autogen/sentinel/watchlist.yml)
* GitHub Login: @rloutlaw
* Microsoft Alias: **routlaw**

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.