Queries for the ConfidentialWatchlist table
Get confidential Watchlist aliases
Gets a distinct list of all confidential Watchlist aliases in a workspace.
ConfidentialWatchlist
| take 100
Lookup events using a confidential Watchlist
Lookup events in Heartbeat table against data from a Watchlist by treating the confidential Watchlist as a table for joins and lookups.
Heartbeat
| lookup kind=leftouter _GetWatchlist('mywatchlist')
on $left.ComputerIP == $right.SearchKey
| limit 100
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for