# At least one watchlist is configured in Microsoft Sentinel for correlation against high-value entities
Watchlists are named, KQL-queryable lookup tables in Microsoft Sentinel that hold customer-specific context — privileged user lists, terminated employee…
Source: https://maester.dev/docs/tests/ZTA.41208
## Overview
Watchlists are named, KQL-queryable lookup tables in Microsoft Sentinel that hold customer-specific context — privileged user lists, terminated employee lists, VIP executives, allow-listed corporate IP ranges, known service-account inventories, third-party vendor identities, asset criticality tiers, IOCs from incident retrospectives — and are joined into analytics rules and hunting queries to convert generic detections into context-aware ones. Without watchlists, every detection is evaluated against the same baseline regardless of who or what is involved: a sign-in anomaly on a tier-0 service account is treated as equivalent to one on a contractor's mailbox, and a session from a vendor-managed jump host is treated as equivalent to one from an arbitrary internet IP. The detection consequence is that high-value-asset (HVA) targeting by threat actors — credential reuse against domain-admin accounts, Golden Ticket forgery against tier-0, data staging from finance-and-HR mailboxes — does not get the priority treatment it deserves and competes with low-value noise in the analyst queue, increasing dwell time. Watchlists are also the documented mechanism for terminated-user monitoring (detect a re-enabled account belonging to a former employee accessing resources, an indicator of Cloud Accounts persistence). The check confirms at least one watchlist exists; mature deployments maintain a handful of curated watchlists keyed to the customer's HVA inventory.
## Remediation
- [Use watchlists in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/watchlists)
- [Create watchlists in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/watchlists-create)
- [Use watchlists in analytics rules and hunting queries](https://learn.microsoft.com/azure/sentinel/watchlists-queries)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Low |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Security information and event management |
| Product | [Azure](/docs/tests/products/azure) |
| Feature | Microsoft Sentinel |
| Area | Logging and detection |
| Licence | Consumption-based: Microsoft Sentinel |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.