A reference list in Microsoft Sentinel, for example of IP ranges or VIP users, kept in the Watchlist table so queries and rules can look values up. It takes no action on incidents.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Watchlist in context, with comparison tables and the common traps.
Terms in this definition
- List
Permission on Key Vault secrets allowing a caller to enumerate those in a vault, though their values are not returned.
- Microsoft Sentinel
Microsoft's cloud-native SIEM, with SOAR capabilities, which stores and queries its data in a Log Analytics workspace.
- VIP
The frontend address of a load balancer, also called its virtual IP. Its availability is tracked by the Data Path Availability metric.
- Event
Table in Log Analytics where entries from Windows event logs are kept.
- VALUES
Returns in DAX the distinct column values, or table rows, still visible after filters are applied, sometimes with an extra blank entry. CALCULATE often takes the result as a table filter.
Related terms
- SearchKey
Picked when a watchlist is made, it marks the column you expect to join or filter on most. Microsoft Sentinel queries using it via _GetWatchlist are the quickest.