mdpuckettCopper ContributorJan 07, 2021Using Watchlists in Sentinel I'm beating my head against using a watchlist in Sentinel and can't figure out where I'm going wrong. My goal is to find logon activity for our privileged accounts. I've created a watchlist calle...Show More
mdpuckettCopper ContributorJan 07, 2021mdpuckett Figured it out, I needed to refer to the column differently. _GetWatchlist('2020-12-22-admin-accounts') |join ( SecurityEvent | where EventID == 4624 ) on $left.['admin-account'] == $right.TargetUserName
