Forum Discussion
Watchlist
I have been trying to see if there is a way that I could have a notification sent out (email or teams) when a watchlist has been modified or changed in anyway. I looked through the action in logic apps and found nothing. I tried looking at PowerAutomate but ran into another brick wall. Any idea that this could be done?
2 Replies
- Rod_Trent
Microsoft
Just need to create a Logic App that runs a query looking for Watchlist editing which will be contained in AzureActivity under MICROSOFT.SECURITYINSIGHTS/WATCHLISTS/.
Here's a start: https://github.com/rod-trent/SentinelKQL/blob/master/WatchListAudit.txt
And here's the Watchlist values: https://learn.microsoft.com/en-us/azure/templates/microsoft.securityinsights/watchlists- Awesome, thank you for pointing me in the right direction!
