Drive Detections with Watchlists and Threat Intelligence in Microsoft Sentinel

Modern SOCs drown in alerts, and the difference between a noisy detection and an actionable one is usually context. Microsoft Sentinel provides two enrichment surfaces built for exactly this: watchlists, which import your own business context (high-value accounts, known-bad IP ranges, VIP devices) as a queryable reference table, and threat-intelligence indicators, which carry curated indicators of compromise (malicious domains, IPs, hashes, URLs) so detections fire the moment a known-bad entity appears in your telemetry. Rather than hand-coding long IOC lists into every rule, you store them once and reference them everywhere.

The bridge between these reference sets and live detections is the KQL function _GetWatchlist('<name>'), which pulls a watchlist into a query so it can be joined against any log source on a SearchKey. In this lab, you will upload a watchlist of high-value accounts and known-bad IPs into a pre-onboarded Sentinel workspace, author and deploy a scheduled analytics rule that enriches a sign-in detection with _GetWatchlist(), add a threat-intelligence indicator, and explore the Threat Intelligence blade to understand IOC-driven detection end to end.

Objectives

Upon completion of this intermediate level lab, you will be able to:

• Inspect a pre-onboarded Sentinel workspace and confirm the analytics and threat-intelligence surfaces
• Create a watchlist and populate it with high-value-account and known-bad-IP items using a defined SearchKey
• Author a KQL detection that enriches a sign-in query with watchlist context via _GetWatchlist()
• Deploy the watchlist-driven detection as a scheduled analytics rule with Terraform
• Add a threat-intelligence indicator so detections can match a known-bad entity

Who is this lab for?

This lab is designed for:

• SOC analysts enriching detections with business and threat context
• Security engineers who know basic KQL and the Sentinel analytics blade
• Detection engineers managing watchlists and threat intelligence as code