Watchlists
Microsoft Sentinel watchlists store reference data such as high-value assets, allow lists, user groups, or investigation enrichment values for correlation and hunting.
capabilitiesCurrent
Relationships
Configuration Methods
| Method | Support | Reference or Gap |
|---|---|---|
| Portal | Supported | Reference |
| PowerShell | Gap | No product-specific PowerShell automation surface is recorded for this capability yet. |
| REST API | Supported | Reference |
| Graph | Gap | No supported Microsoft Graph configuration surface is recorded for this capability yet. |
| ARM | Supported | Reference |
| Bicep | Supported | Reference |
| Terraform | Supported | azurermazurerm_sentinel_watchlist Reference Use azurerm_sentinel_watchlist_item or azapi_resource for item-level automation depending on provider coverage. |
| GitHub Actions | Supported | Reference |
| Azure DevOps | Supported | Reference |