Sentinel watchlists import issue when the field starts or ends with double quotes

Hi team,

I wanted to report a bug that was present in Microsoft Sentinel for a long time and it was not addressed by Microsoft yet.

The bug is present in the Sentinel watchlists.

When you create a new watchlist with any random fields and then you edit the watchlist and you edit a field for example like this:

Old value: cmd.exe

New value: "cmd.exe"

Or even this new value (where the value starts with a double quotes): "cmd.exe" /some parameters here

This works properly and you can see in the watchlist editor or in the logs the double quotes present in the beginning or/and at the end of the value.

The issue starts when you export the watchlist from the logs as a CSV. This is what an example looks like:

Watchlist in the Sentinel watchlist editor

column1,column2
"value1","""value2"""

So that was the watchlist after exporting it.

When I try to import it again as a watchlist, I get the following preview:

which is great.

But what I didn't expect is when I save the watchlist, this is what I get:

The double quotes are gone. And they are gone only when they are used in the beginning of any field or/and the end of any field. No matter how many fields matches that condition, the double quotes are deleted. The double quotes remain in the middle of the fields but not at the beginning or at the end.

I experienced the same issue when I used the watchlist Azure CLI as well (this is the only way I could use to automate the deployment of a CSV file and I insist that I can only deploy a CSV file not a JSON file):

New-AzResourceGroupDeployment -Name $deploymentName -ResourceGroupName $ResourceGroupName -TemplateFile $path -displayName $displayName -alias $alias -description $description -itemsSearchKey $itemsSearchKey -numberOfLinesToSkip $numberOfLinesToSkip -workspace $workspaceName -TemplateParameterFile $parameterFile -ErrorAction Stop -csv_file_content $watchlistCSVContent | Out-Host

Un`fortunately, the update operation in the Sentinel Watchlist editor (in the web browser) is performed using JSON (the following screenshot was taken from the network tab of my web browser when I updated the watchlist from the Watchlist editor by clicking on the "save" button):

If the bulk update preview showed that there are double quotes, why the real content of the watchlist doesn't show the double quotes?

I'd like to ask Microsoft to fix the bug of the double quotes removal for the "New-AzResourceGroupDeployment" CLI (mainly) because I'm updating the watchlist in an automated way. And of course I'd like to ask Microsoft to fix the bug when the bulk update is used in Sentinel (in the web browser).

I'd appreciate if I can get an estimation on how much time the bug could be fixed.

Thank you for your collaboration.

Best regards