Issue with Sentinel Watchlist visibility

From the provided information, only general behavior and limitations of Microsoft Sentinel watchlists can be confirmed.

Watchlists are stored in the Sentinel workspace in the Watchlist table as name–value pairs and are intended for reference data that is then used in analytics rules, hunting queries, workbooks, and playbooks. If watchlists or their items are not visible, any playbooks or analytics rules that depend on them can fail because the expected reference data is no longer available at query time.

Relevant technical points from the documentation:

• Watchlists are cached for optimal query performance and low latency. If a watchlist is removed or changed, dependent content (rules, playbooks, workbooks) will no longer be able to use the previous cached data.
• Data in the Log Analytics Watchlist table is retained for 28 days. After that retention period, data in that table is no longer available. If playbooks rely on historical watchlist entries beyond that retention window, queries can fail or return no results.
• Watchlists are designed only for reference data and not for large data volumes; exceeding limits (for example, the maximum of 10 million active items across all watchlists in a workspace or file-size limits when updating) can cause upload or update failures, which in turn can leave watchlists empty or partially populated.
• Managing watchlists across workspaces using Azure Lighthouse is not supported. If workspaces or access patterns changed, watchlists in another workspace would not be visible.

Given these behaviors, typical technical causes for missing visibility and downstream playbook failures include:

1. Watchlists were deleted or recreated, so existing playbooks now reference names or aliases that no longer exist.
2. Watchlist data aged out of the Watchlist table due to the 28‑day retention limit, leaving playbooks with no data to query.
3. A bulk update or upload failed due to size or schema constraints (for example, file-size limits, column naming not following KQL entity naming restrictions), resulting in empty or invalid watchlists.
4. Access or workspace context changed so that the current Sentinel workspace no longer contains the expected watchlists, while playbooks are still configured to use them.

To restore playbook functionality, verify in the Sentinel workspace that:

• The expected watchlists still exist and are populated with items.
• Their names/aliases and schemas (column names) match what the playbooks and analytics rules expect.
• No recent changes to workspace, retention, or cross-workspace management have removed or hidden the data.

References:

• Watchlists in Microsoft Sentinel
• Manage watchlists in Microsoft Sentinel
• Security content reference for Microsoft Power Platform and Microsoft Dynamics 365 Customer Engagement
• Microsoft Sentinel solution for SAP applications: security content reference (connection-agentless)
• Microsoft Sentinel solution for SAP applications: security content reference (connection-agent)
• Enable SAP detections and threat protection (connection-agentless)
• Enable SAP detections and threat protection (connection-agent)