There is a command group 'az_sentinel_watchlist'. This group of commands could 'manage watchlist with sentinel'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_sentinel_watchlist_create'.The syntax is: az sentinel watchlist create --name
                             --resource-group
                             --workspace-name
                             [--content-type]
                             [--created]
                             [--created-by]
                             [--default-duration]
                             [--description]
                             [--display-name]
                             [--etag]
                             [--is-deleted {0, 1, f, false, n, no, t, true, y, yes}]
                             [--items-search-key]
                             [--labels]
                             [--provider]
                             [--raw-content]
                             [--skip-num]
                             [--source]
                             [--source-type {local file, remote storage}]
                             [--tenant-id]
                             [--updated]
                             [--updated-by]
                             [--upload-status]
                             [--watchlist-id]
                             [--watchlist-type]. The parameter '--name --watchlist-alias -n' is required. It is used to watchlist alias.. The parameter '--resource-group -g' is required. It is used to name of resource group. you can configure the default group using `az configure --defaults group=<name>`.. The parameter '--workspace-name -w' is required. It is used to the name of the workspace.. The parameter '--content-type' is optional. the content type of the raw content. example : text/csv or text/tsv.. The parameter '--created' is optional. the time the watchlist was created.. The parameter '--created-by' is optional. describes a user that created the watchlist  support shorthand-syntax, json-file and yaml-file. try "??" to show more.. The parameter '--default-duration' is optional. the default duration of a watchlist (in iso 8601 duration format).. The parameter '--description' is optional. a description of the watchlist.. The parameter '--display-name' is optional. the display name of the watchlist.. The parameter '--etag' is optional. etag of the azure resource.. The parameter '--is-deleted' is optional. a flag that indicates if the watchlist is deleted or not.. The parameter '--items-search-key' is optional. the search key is used to optimize query performance when using watchlists for joins with other data. for example, enable a column with ip addresses to be the designated searchkey field, then use this field as the key field when joining to other event data by ip address.. The parameter '--labels' is optional. list of labels relevant to this watchlist  support shorthand-syntax, json-file and yaml-file. try "??" to show more.. The parameter '--provider' is optional. the provider of the watchlist.. The parameter '--raw-content' is optional. the raw content that represents to watchlist items to create. in case of csv/tsv content type, it's the content of the file that will parsed by the endpoint.. The parameter '--skip-num' is optional. the number of lines in a csv/tsv content to skip before the header.. The parameter '--source' is optional. the filename of the watchlist, called 'source'.. The parameter '--source-type' is optional. the sourcetype of the watchlist.. The parameter '--tenant-id' is optional. the tenantid where the watchlist belongs to.. The parameter '--updated' is optional. the last time the watchlist was updated.. The parameter '--updated-by' is optional. describes a user that updated the watchlist  support shorthand-syntax, json-file and yaml-file. try "??" to show more.. The parameter '--upload-status' is optional. the status of the watchlist upload : new, inprogress or complete. pls note : when a watchlist upload status is equal to inprogress, the watchlist cannot be deleted.. The parameter '--watchlist-id' is optional. the id (a guid) of the watchlist.. The parameter '--watchlist-type' is optional. the type of the watchlist.. 