At least one watchlist is configured in Microsoft Sentinel for correlation against high-value entities

Overview

Watchlists are named, KQL-queryable lookup tables in Microsoft Sentinel that hold customer-specific context — privileged user lists, terminated employee lists, VIP executives, allow-listed corporate IP ranges, known service-account inventories, third-party vendor identities, asset criticality tiers, IOCs from incident retrospectives — and are joined into analytics rules and hunting queries to convert generic detections into context-aware ones. Without watchlists, every detection is evaluated against the same baseline regardless of who or what is involved: a sign-in anomaly on a tier-0 service account is treated as equivalent to one on a contractor’s mailbox, and a session from a vendor-managed jump host is treated as equivalent to one from an arbitrary internet IP. The detection consequence is that high-value-asset (HVA) targeting by threat actors — credential reuse against domain-admin accounts, Golden Ticket forgery against tier-0, data staging from finance-and-HR mailboxes — does not get the priority treatment it deserves and competes with low-value noise in the analyst queue, increasing dwell time. Watchlists are also the documented mechanism for terminated-user monitoring (detect a re-enabled account belonging to a former employee accessing resources, an indicator of Cloud Accounts persistence). The check confirms at least one watchlist exists; mature deployments maintain a handful of curated watchlists keyed to the customer’s HVA inventory.

Remediation

• Use watchlists in Microsoft Sentinel
• Create watchlists in Microsoft Sentinel
• Use watchlists in analytics rules and hunting queries

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Low
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	Security information and event management
Product	Azure
Feature	Microsoft Sentinel
Area	Logging and detection
Licence	Consumption-based: Microsoft Sentinel
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.