services / Azure / Microsoft Sentinel confidential watchlists

Confidential Watchlists are sensitive curated reference data sets in Microsoft Sentinel (e.g. VIP users, terminated employees, sensitive assets/IPs) that analytics rules correlate against during detection.

Explicitly marked confidential; contents are sensitive security operations data, so the asset is HIGH sensitivity.

Microsoft.​SecurityInsights/​ConfidentialWatchlists/​write

Creating or updating Confidential Watchlists lets an attacker tamper with the reference data that detection logic correlates against, skewing or evading analytics rules.

Risks

1. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links