diff --git a/Watchlists/Azure-Public-IPs/azuredeploy.json b/Watchlists/Azure-Public-IPs/azuredeploy.json index f363f0eb6d1..accea60cb6a 100644 --- a/Watchlists/Azure-Public-IPs/azuredeploy.json +++ b/Watchlists/Azure-Public-IPs/azuredeploy.json @@ -15,7 +15,6 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", "kind": "", "properties": { - "watchlistAlias": "AzurePublicIPsList", "displayName": "AzurePublicIPsList", "source": "AzurePublicIPsList.csv", "description": "Azure Public IPs list for reducing internet facing traffic alerts from MSFT IP Addresses", diff --git a/Watchlists/NOBELIUM-TI/azuredeploy.json b/Watchlists/NOBELIUM-TI/azuredeploy.json index c80bec21fb8..06759c0b476 100644 --- a/Watchlists/NOBELIUM-TI/azuredeploy.json +++ b/Watchlists/NOBELIUM-TI/azuredeploy.json @@ -21,7 +21,6 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", "kind": "", "properties": { - "watchlistAlias": "NOBELIUMTI", "displayName": "NOBELIUMTI", "source": "NOBELIUMTI.csv", "description": "[parameters('watchlistdescription')]", diff --git a/Watchlists/Templates/WatchlistTemplate.json b/Watchlists/Templates/WatchlistTemplate.json index 4d8724bdb68..6f2c843665b 100644 --- a/Watchlists/Templates/WatchlistTemplate.json +++ b/Watchlists/Templates/WatchlistTemplate.json @@ -21,7 +21,6 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/Watchlists", "kind": "", "properties": { - "watchlistAlias": "ReferenceTemplate", "displayName": "ReferenceTemplate", "source": "ReferenceTable.csv", "description": "[parameters('watchlistdescription')]", diff --git a/Watchlists/Templates/Watchlists Template Guidance.md b/Watchlists/Templates/Watchlists Template Guidance.md index 67423a14024..a62d80064f6 100644 --- a/Watchlists/Templates/Watchlists Template Guidance.md +++ b/Watchlists/Templates/Watchlists Template Guidance.md @@ -8,12 +8,10 @@ Download the json template and rename it to as "WatchlistUseCaseName.json" (no s ### Specifics -The Watchlist template contains a few items that are required for it to work: +The Watchlist template contains a two items that are required for it to work: Workspace Name: The workspace name is required so that ARM knows the workspace that Azure Sentinel is using. This is used for deploying the content and function to the workspace. -Watchlist Alias: Name for the Watchlist in both Azure Sentinel and in the workspace when calling it via function. This should reflect what the Watchlist is for. - SearchKey Value: Title of a column that will be used for performing lookups and joins with other tables. It is recommended to choose the a column that will be the most used for joins and lookups. ### How to fill the template