services / Azure / Microsoft Sentinel watchlist

A Microsoft Sentinel watchlist, a named lookup table (asset lists, allow/deny lists, high-value accounts) that analytics rules and hunting queries join against for detection context.

Watchlists supply context that detections depend on; tampering can create blind spots and deletion can break dependent rules, but they are narrower than the detection engine itself, so this is MEDIUM.

Microsoft.​SecurityInsights/​Watchlists/​write

Editing a watchlist lets an attacker plant entries (e.g. add their own infrastructure to an allow-list) so rules that join against it suppress alerts on their activity.

Risks

1. Data manipulation (HIGH)

Scope: MEDIUM

This privilege may grant access to confidential data, or its exploit can incur operational cost.

Links