L14. Watchlists, Threat Intelligence and UEBA
Visual workflow edition
Worked example, diagrams and a question with time to think. Synthetic American-English narration; examples are fictional. Reviewed October 2026.
Read the video transcript
An event matches an address in a reference list. Does that make it malicious? The answer depends on what the list means, how current it is, and what behavior you observed. Let's separate watchlists, threat indicators, and behavioral context so enrichment improves judgment instead of replacing it.
A watchlist provides reference data you can use in queries and investigations. It might identify critical assets or approved locations. Choose a useful search key and validate the values. A mismatch in formatting can prevent a join from working. The list also needs an owner and an update process, because stale context can mislead a detection.
Threat intelligence supplies indicators and context from a source. Review validity, confidence, and relevance before acting on a match. An address can be shared or reassigned. A historical match is not automatically evidence of current malicious control. Keep the source and timing attached to the finding so an analyst can judge what it actually supports.
Our fictional event involves a critical server connecting to a listed address. The asset context raises the priority, but you still inspect the connection time and available process evidence. Was the indicator valid then? Is there a legitimate explanation? Enrichment helps choose what to investigate first; it does not finish the investigation for you.
User and entity behavior analytics can highlight deviations from observed patterns when the required data and configuration are present. Unusual behavior is not necessarily malicious behavior. A new job role or an administrative task may explain the change. Combine behavioral context with event evidence rather than treating an anomaly score as a verdict.
A critical asset matches an old indicator whose validity is unclear. What is the best next step? Pause and separate the reason to prioritize from the evidence needed to conclude.
Prioritize investigation and validate the indicator's timing and the actual activity. Review the reference data's owner and freshness too. The key distinction is simple: a watchlist adds your context, intelligence adds external context, and behavior adds a pattern comparison. None independently proves that an attack succeeded.
Course outlineLesson 14 of 18
Watchlists, threat intelligence integration, and User and Entity Behavior Analytics (UEBA) enhance Sentinel detection and investigation capabilities. This lesson covers watchlist operations, TI indicators, UEBA configuration, and their use in analytics rules for the SC-200 exam.
Watchlists
Watchlists are lookup tables uploaded to Sentinel (typically from CSV files) that enrich detection and investigation: Common watchlist use cases:
- Privileged user accounts to monitor closely
- Terminated employee accounts for activity detection
- Approved IP ranges for allowlisting in analytics rules
- Critical assets requiring heightened alerting
- Service accounts with their expected behaviors
Watchlists are referenced in KQL using the _GetWatchlist('WatchlistAlias') function:
let TerminatedUsers = _GetWatchlist('TerminatedEmployees')
| project UserPrincipalName;
SigninLogs
| where UserPrincipalName in (TerminatedUsers)
| project TimeGenerated, UserPrincipalName, IPAddress, ResultType- Maximum size: 10 million rows per watchlist
- Supported formats: CSV (with header row)
- Each watchlist needs a unique SearchKey column
- Watchlists are stored in the workspace and queryable like any table
_GetWatchlist() in KQL to reference watchlist data. Watchlists are ideal for enrichment and allowlisting/blocklisting in analytics rules.
Threat Intelligence
Sentinel integrates threat intelligence (TI) indicators for detection and enrichment: Ingestion methods:
| Method | Source |
|---|---|
| Threat Intelligence: TAXII connector | STIX/TAXII 2.0 and 2.1 feeds |
| Threat Intelligence upload API | Bulk indicator import via API |
| Microsoft Defender Threat Intelligence (MDTI) | Microsoft's own TI platform |
| Threat intelligence platforms | Integration with TIP products (Anomali, ThreatConnect, etc.) |
TI indicators are stored in the ThreatIntelligenceIndicator table and can be:
- Used in analytics rules for IOC matching
- Queried in hunting sessions
- Visualized in the Threat Intelligence blade
- Matched automatically using the TI Map analytics rules
TI Map IP Entity to ...: Matches IPs from TI against sign-in logs, firewall logs, DNS logs, etc.TI Map Domain Entity to ...: Matches domains against DNS queries and proxy logsTI Map FileHash Entity to ...: Matches file hashes against endpoint events
Microsoft Defender Threat Intelligence (MDTI)
MDTI provides Microsoft-curated threat intelligence including:
- Reputation scoring for IPs, domains, and URLs
- Analyst-written articles on threat actors and campaigns
- Attack surface discovery (internet-exposed assets)
- Vulnerability intelligence
MDTI data enriches Sentinel investigations by providing context for entities encountered during incident analysis.
User and Entity Behavior Analytics (UEBA)
UEBA builds behavioral baselines for users and entities, then flags anomalies: Data sources for UEBA:
- Microsoft Entra ID (sign-in and audit logs)
- Azure Activity logs
- Windows Security Events
- Syslog data
- Unusual sign-in location or time
- First-time access to a resource
- Anomalous number of failed authentications
- Unusual volume of activity
- Impossible travel (sign-ins from geographically distant locations in short succession)
UEBA adds investigation priority scores to entity pages. Higher scores indicate more anomalous behavior. Configuration steps:
- Enable UEBA in Sentinel Settings > Entity behavior
- Select data sources to analyze
- Wait for the baseline learning period (typically 14 days)
- ✓Watchlists are referenced in KQL using _GetWatchlist("alias") and support up to 10 million rows.
- ✓Built-in "TI Map" analytics rules automatically correlate threat intelligence indicators against log data.
- ✓UEBA requires a 14-day learning period to establish behavioral baselines for accurate anomaly detection.
- ✓Threat intelligence indicators are stored in the ThreatIntelligenceIndicator table.
- ✓TAXII 2.0/2.1 connectors ingest STIX-formatted threat intelligence feeds into Sentinel.
- ✓UEBA adds investigation priority scores to entity pages based on behavioral anomalies.
1. An analytics rule needs to check if a sign-in IP address appears in a list of known malicious IPs uploaded as a CSV. Which Sentinel feature should be used?
2. UEBA has been enabled in Sentinel today. When will the behavioral anomaly detections become reliable?
3. Which Sentinel table stores threat intelligence indicators ingested from TAXII feeds and the upload API?
Keep learning
Use the knowledge check above to test your understanding. You can browse every lesson without signing in; opening another lesson does not mark this one complete.
Next lesson: Defender for Cloud: CSPM and CWP Fundamentals →