Forum Discussion
Watchlist
I have been trying to see if there is a way that I could have a notification sent out (email or teams) when a watchlist has been modified or changed in anyway. I looked through the action in logic ap...
Rod_Trent
Microsoft
MicrosoftJust need to create a Logic App that runs a query looking for Watchlist editing which will be contained in AzureActivity under MICROSOFT.SECURITYINSIGHTS/WATCHLISTS/.
Here's a start: https://github.com/rod-trent/SentinelKQL/blob/master/WatchListAudit.txt
And here's the Watchlist values: https://learn.microsoft.com/en-us/azure/templates/microsoft.securityinsights/watchlists
Here's a start: https://github.com/rod-trent/SentinelKQL/blob/master/WatchListAudit.txt
And here's the Watchlist values: https://learn.microsoft.com/en-us/azure/templates/microsoft.securityinsights/watchlists
Awesome, thank you for pointing me in the right direction!