Watchlist

Azure Sentinel Watchlist contains imported data from CSV files that can be used to join or filter as an alert/incident condition.

Table attributes

Attribute Value
Resource types -
Categories Security
Solutions SecurityInsights
Basic log No
Ingestion-time transformation Yes
Sample Queries Yes

Columns

Column Type Description
AzureTenantId string The AAD tenant ID to which this Watchlist table belongs.
_BilledSize real The record size in bytes
CorrelationId string The ID for correlated events.
CreatedBy dynamic The JSON object with the user who created the Watchlist or Watchlist item, including: Object ID, email and name.
CreatedTimeUTC datetime The time (UTC) when the Watchlist or Watchlist item was first created.
DefaultDuration string The JSON object describing the default duration to live that each item of a Watchlist should inherit on creation. The default duration has this format : P(n)Y(n)M(n)DT(n)H(n)M(n)S, where P, Y, M, DT, H, M and S are invariant. For example, P3Y6M4DT12H30M9S represents a duration of three years, six months, four days, twelve hours, thirty minutes, and nine seconds.
_DTItemId string The Watchlist or Watchlist item unique ID. As an example, a Watchlist 'RiskyUsers' can contain Watchlist item 'Name:John Doe; email:[email protected]'. A Watchlist item has unique ID and belongs to a Watchlist. The containing Watchlist can identified using the 'WatchlistId'.
_DTItemStatus string Was the Watchlist or Watchlist item created, updated or deleted by user. As an example, a Watchlist 'RiskyUsers' can contain Watchlist item 'Name:John Doe; email:[email protected]'. If a Watchlist is added, the the status would be 'Created'. If the name of the Watchlist is updated from 'RiskyUsers' to 'RiskyEmployees' the status would be 'Updated'.
_DTItemType string Distinguish between a Watchlist and a Watchlist item. As an example, a Watchlist 'RiskyUsers' can contain Watchlist item 'Name:John Doe; email:[email protected]'. A Watchlist item type will belong to a Watchlist type and the containing Watchlist can identified using the 'WatchlistId'.
_DTTimestamp datetime The time (UTC) when the event was generated.
EntityMapping dynamic The JSON object with Azure Sentinel entity mapping to input columns.
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
LastUpdatedTimeUTC datetime The time (UTC) when Watchlist or Watchlist item was last updated.
Notes string The notes provided by user.
Provider string The input provider of the Watchlist.
SearchKey string The SearchKey is used to optimize query performance when using watchlists for joins with other data. For example, enable a column with IP addresses to be the designated SearchKey field, then use this field to join in other event tables by IP address.
Source string The input source of the Watchlist.
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
Tags string The JSON array of tags provided by user.
TenantId string The Log Analytics workspace ID
TimeGenerated datetime The timestamp (UTC) of when the event was generated.
TimeToLive datetime The time to live for a Watchlist record, expressed as a date and time of day (e.g. 2020-08-20T17:00:00.9618037Z). Its original value is inherited from Watchlist's default duration. If TimeToLive passes, the record is considered deleted. A record's duration can be extended at any time by updating the TimeToLive value.
Type string The name of the table
UpdatedBy dynamic The JSON object with the user who last updated the Watchlist or Watchlist item, including: Object ID, email and name.
WatchlistAlias string The unique string referring to the Watchlist.
WatchlistCategory string The Watchlist category provided by user.
WatchlistId string The Resource Manager Watchlist resource name.
WatchlistItem dynamic The JSON object with key-value pairs from the input Watchlist source.
WatchlistItemId string The Watchlist item unique ID.
WatchlistName string The display name of Watchlist.