MicrosoftIn the post it says "Watchlists are stored in your Azure Sentinel workspace as name-value pairs and are cached for optimal query performance and low latency. ".
I am getting issues with slow queries. For example, we have 348 watchlists elements, some of them being older than 128 days (they were created during the public preview). Log Analytics takes about 8 seconds to retrieve these 348 elements, this causes some of the Analytics Rules queries to fail.
Please, does anyone know if maybe I have to recreate these old elements created during the public/private preview? or how Sentinel manages the storing of the watchlists elements?
Thank you in advance.
