Watchlist

[Aaron_Platek]

I have been trying to see if there is a way that I could have a notification sent out (email or teams) when a watchlist has been modified or changed in anyway. I looked through the action in logic apps and found nothing. I tried looking at PowerAutomate but ran into another brick wall. Any idea that this could be done?

[#2]

Just need to create a Logic App that runs a query looking for Watchlist editing which will be contained in AzureActivity under MICROSOFT.SECURITYINSIGHTS/WATCHLISTS/.

Here's a start: https://github.com/rod-trent/SentinelKQL/blob/master/WatchListAudit.txt

And here's the Watchlist values: https://learn.microsoft.com/en-us/azure/templates/microsoft.securityinsights/watchlists

[#3]

Awesome, thank you for pointing me in the right direction!