services / Azure / Microsoft Sentinel watchlist

A Microsoft Sentinel watchlist, a named lookup table (asset lists, allow/deny lists, high-value accounts) that analytics rules and hunting queries join against for detection context.

Watchlists supply context that detections depend on; tampering can create blind spots and deletion can break dependent rules, but they are narrower than the detection engine itself, so this is MEDIUM.

Microsoft.​SecurityInsights/​Watchlists/​delete

Deleting a watchlist breaks the analytics rules and hunting queries that reference it, silently disabling the detections that depend on its context.

Risks

1. Defense destruction (EVASION)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links