L14. Watchlists, Threat Intelligence and UEBA
Visual workflow edition
Worked example, diagrams and a question with time to think. Synthetic American-English narration; examples are fictional. Reviewed October 2026.
Read the video transcript
An event matches an address in a reference list. Does that make it malicious? The answer depends on what the list means, how current it is, and what behavior you observed. Let's separate watchlists, threat indicators, and behavioral context so enrichment improves judgment instead of replacing it.
A watchlist provides reference data you can use in queries and investigations. It might identify critical assets or approved locations. Choose a useful search key and validate the values. A mismatch in formatting can prevent a join from working. The list also needs an owner and an update process, because stale context can mislead a detection.
Threat intelligence supplies indicators and context from a source. Review validity, confidence, and relevance before acting on a match. An address can be shared or reassigned. A historical match is not automatically evidence of current malicious control. Keep the source and timing attached to the finding so an analyst can judge what it actually supports.
Our fictional event involves a critical server connecting to a listed address. The asset context raises the priority, but you still inspect the connection time and available process evidence. Was the indicator valid then? Is there a legitimate explanation? Enrichment helps choose what to investigate first; it does not finish the investigation for you.
User and entity behavior analytics can highlight deviations from observed patterns when the required data and configuration are present. Unusual behavior is not necessarily malicious behavior. A new job role or an administrative task may explain the change. Combine behavioral context with event evidence rather than treating an anomaly score as a verdict.
A critical asset matches an old indicator whose validity is unclear. What is the best next step? Pause and separate the reason to prioritize from the evidence needed to conclude.
Prioritize investigation and validate the indicator's timing and the actual activity. Review the reference data's owner and freshness too. The key distinction is simple: a watchlist adds your context, intelligence adds external context, and behavior adds a pattern comparison. None independently proves that an attack succeeded.
Course outlineLesson 14 of 18
Watchlists, threat intelligence integration, and User and Entity Behavior Analytics (UEBA) enhance Sentinel detection and investigation capabilities. This lesson covers watchlist operations, TI indicators, UEBA configuration, and their use in analytics rules for the SC-200 exam.
Watchlists
Watchlists are lookup tables uploaded to Sentinel (typically from CSV files) that enrich detection and investigation: Common watchlist use cases:
- Privileged user accounts to monitor closely
- Terminated employee accounts for activity detection
- Approved IP ranges for allowlisting in analytics rules
- Critical assets requiring heightened alerting
- Service accounts with their expected behaviors
Watchlists are referenced in KQL using the _GetWatchlist('WatchlistAlias') function:
let TerminatedUsers = _GetWatchlist('TerminatedEmployees')
| project UserPrincipalName;
SigninLogs
| where UserPrincipalName in (TerminatedUsers)
| project TimeGenerated, UserPrincipalName, IPAddress, ResultType- Maximum active items: 10 million across all watchlists in a workspace
- Supported formats: CSV (with header row)
- Choose a SearchKey column for frequent searches and joins; it need not contain unique values
- Watchlists are stored in the workspace and queryable like any table
_GetWatchlist() in KQL to reference watchlist data. Watchlists are ideal for enrichment and allowlisting/blocklisting in analytics rules.
Threat Intelligence
Sentinel integrates threat intelligence (TI) indicators for detection and enrichment: Ingestion methods:
| Method | Source |
|---|---|
| Threat Intelligence - TAXII connector | STIX/TAXII 2.0 and 2.1 feeds |
| Threat Intelligence Upload API (preview) | Import supported STIX objects without a data connector |
| Microsoft Defender Threat Intelligence feed | Microsoft-provided indicators; verify current connector prerequisites |
| Threat intelligence platforms (Anomali, ThreatConnect, etc.) | Use a currently supported API integration; verify the platform and connector documentation |
Threat intelligence is stored in two STIX-based tables: ThreatIntelIndicators holds indicators of compromise (IP addresses, domains, URLs, file hashes), and ThreatIntelObjects holds related STIX objects such as threat actors, malware families, campaigns and attack patterns. Microsoft Sentinel stopped ingesting into the legacy ThreatIntelligenceIndicator table after July 31, 2025, so older queries, rules, and workbooks that reference it no longer see new indicators. Migrate them and test field mappings rather than only renaming the table.
Indicators can be:
- Used in analytics rules for IOC matching
- Queried in hunting sessions
- Visualized in the Threat Intelligence blade
- Matched automatically using the TI Map analytics rules
TI Map IP Entity to ...: Matches IPs from TI against sign-in logs, firewall logs, DNS logs, etc.TI Map Domain Entity to ...: Matches domains against DNS queries and proxy logsTI Map FileHash Entity to ...: Matches file hashes against endpoint events
Microsoft Threat Intelligence Sources
Microsoft documents a Defender Threat Intelligence feed and enrichment playbooks. Availability and access differ by integration; verify the current connector prerequisites instead of assuming a standalone product license grants every capability. Ingested indicators are context for investigation, not proof that an observed event is malicious.
User and Entity Behavior Analytics (UEBA)
UEBA builds behavioral baselines for users and entities, then flags anomalies: Data sources for UEBA:
- Microsoft Entra ID (sign-in and audit logs)
- Azure Activity logs
- Windows Security Events
- Other sources only where supported by the current UEBA configuration
- Unusual sign-in location or time
- First-time access to a resource
- Anomalous number of failed authentications
- Unusual volume of activity
- Impossible travel (sign-ins from geographically distant locations in short succession)
UEBA adds investigation priority scores to entity pages. Higher scores indicate more anomalous behavior. Configuration steps:
- Enable UEBA in Sentinel Settings > Entity behavior
- Select data sources to analyze
- Review the connected sources and investigate baselines as data accumulates; do not assume a universal readiness deadline
References
- ✓Use _GetWatchlist("alias"); the workspace limit is 10 million active items across all watchlists.
- ✓Built-in "TI Map" analytics rules automatically correlate threat intelligence indicators against log data.
- ✓UEBA needs relevant data and validated behavioral baselines; there is no universal reliability deadline.
- ✓Threat intelligence indicators land in the ThreatIntelIndicators table; related STIX objects land in ThreatIntelObjects. Sentinel stopped ingesting into the legacy ThreatIntelligenceIndicator table after July 31, 2025.
- ✓TAXII 2.0/2.1 connectors ingest STIX-formatted threat intelligence feeds into Sentinel.
- ✓UEBA adds investigation priority scores to entity pages based on behavioral anomalies.
1. An analytics rule needs to check if a sign-in IP address appears in a list of known malicious IPs uploaded as a CSV. Which Sentinel feature should be used?
2. UEBA has been enabled in Sentinel today. When will the behavioral anomaly detections become reliable?
3. Which Sentinel table stores threat intelligence indicators ingested from TAXII feeds and the upload API?
Keep learning
Use the knowledge check above to test your understanding. You can browse every lesson without signing in; opening another lesson does not mark this one complete.
Next lesson: Defender for Cloud: CSPM and CWP Fundamentals →