Forum Discussion
Aaron_Platek
Oct 25, 2022Copper Contributor
Watchlist
I have been trying to see if there is a way that I could have a notification sent out (email or teams) when a watchlist has been modified or changed in anyway. I looked through the action in logic apps and found nothing. I tried looking at PowerAutomate but ran into another brick wall. Any idea that this could be done?
2 Replies
Sort By
- Rod_Trent
Microsoft
Just need to create a Logic App that runs a query looking for Watchlist editing which will be contained in AzureActivity under MICROSOFT.SECURITYINSIGHTS/WATCHLISTS/.
Here's a start: https://github.com/rod-trent/SentinelKQL/blob/master/WatchListAudit.txt
And here's the Watchlist values: https://learn.microsoft.com/en-us/azure/templates/microsoft.securityinsights/watchlists- Aaron_PlatekCopper ContributorAwesome, thank you for pointing me in the right direction!