I am trying to create a watchlist that displays specific alerts from different business units

Copper Contributor

here is the query below.  I would like to be able to determine which specific business unit server an alert was generated into Azure sentinel but I am unable to create a tag that includes a watchlist that provides the expected result.  Please help 

 

Heartbeat

| lookup kind=leftouter _GetWatchlist('MBSFQDN_01')

 on $left.Computer == $right.SearchKey

| project UNIT, Computer

20 Replies
Thank you very much for the prompt response Louis. Can you please explain what each line of code does because if I present it to our SOC team they would ask me to explain what each line of code does as we are all new to Sentinel so I would really appreciate your help with it.
Thank you so much
Caitlin