services / Azure / Log Analytics ConfidentialWatchlist table

A Log Analytics workspace data table exposing ConfidentialWatchlist records — Microsoft Sentinel confidential watchlist contents (curated sensitive reference data such as VIP users, terminated employees, sensitive assets/IPs) that analytics rules correlate against.

Explicitly marked confidential; contents are sensitive security-operations data deliberately curated for detection, so the asset is HIGH sensitivity (consistent with Microsoft.SecurityInsights/ConfidentialWatchlists/read in the catalog).

Microsoft.​OperationalInsights/​workspaces/​Query/​ConfidentialWatchlist/​read

Reads the confidential watchlist contents, directly exfiltrating curated sensitive security data useful for targeting and evasion — beyond ordinary log telemetry.

Risks

1. Data exfiltration (CRITICAL)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links