Microsoft Sentinel: Watchlist synchronization issues — inconsistent behavior and delayed updates

Jennifer-0296 0 Pontos de reputação
2026-09-24T11:56:28.71+00:00

Problem description

I'm experiencing inconsistent behavior with my Microsoft Sentinel Watchlists. Although the watchlists are successfully created and appear correctly in the 'Edit Watchlist Items' section, after more than 24 hours, the portal shows zero rows for new watchlists, the '_GetWatchlist' function returns zero records, and some deleted watchlists continue to appear in the '_GetWatchlistAlias' results. Additionally, discrepancies exist between the number of watchlists shown and the watchlist items displayed. I am seeking assistance to understand and resolve these synchronization issues.

Environment

Microsoft Sentinel in an Azure workspace, functions involved include _GetWatchlist() and _GetWatchlistAlias(), scenario is in a single workspace. Specific region or SKU details are not provided.

What I've already tried

I recreated the watchlist, verified that items appear in 'Edit Watchlist Items', and observed the issue after more than 24 hours. I also noted that the support conversation did not record troubleshooting actions beyond the initial report. I reviewed self-help materials indicating that watchlists are scoped to the same workspace, and that cross-workspace scenarios are not supported. No other troubleshooting steps have been documented.

Current status

The issue persists with inconsistent synchronization between watchlist creation, display, and function results. I am seeking guidance to identify the root cause and implement a solution to ensure proper synchronization and data reflection in Microsoft Sentinel.

Azure
Azure

Uma plataforma de computação em nuvem e uma infraestrutura para criar, implantar e gerenciar aplicativos e serviços por meio de uma rede mundial de datacenters gerenciados pela Microsoft.

0 comentários Sem comentários

Sua resposta

As respostas podem ser marcadas como ‘Aceitas’ pelo autor da pergunta e ‘Recomendadas’ pelos moderadores, o que ajuda os usuários a saber a resposta que resolveu o problema do autor.