Querying Sentinel Watchlists via Azure Resource Graph

SC-200 By islever Editorial Last updated

Configure the Microsoft Sentinel SIEM and platform

Short answer

D Use Azure Resource Graph to query the SecurityInsightsWatchlist resource type and return the list of all watchlists in the workspace.

Question

You have a Microsoft Sentinel workspace named Workspace1.
In Workspace1, you create a Microsoft Sentinel workbook named WB1.
You need to add a query to WB1 that will return a list of all the watchlists in Workspace1.
To what should you set Data source for the query?
  1. SQL database
  2. Logs (Analytics)
  3. Storage account
  4. Azure Resource Graph Correct Answer

Key Takeaways

Watchlists are Azure resources, not log data; therefore, they must be queried via Azure Resource Graph, not the Log Analytics workspace.

Learn how to list all watchlists in a Microsoft Sentinel workspace by configuring an Azure Resource Graph data source in a workbook.

Common mistake: Choosing Logs (Analytics) because watchlists contain data that is often used in log queries, but failing to distinguish between querying the resource definition versus the data it contains.

Expert Analysis

The question asks for the data source to query the list of watchlists defined within a Microsoft Sentinel workspace. Watchlists are Azure resources managed at the subscription or resource group level, not raw log data ingested into the Log Analytics workspace.

Option D (Azure Resource Graph) is correct. Azure Resource Graph allows you to query and analyze metadata across your Azure resources. To get a list of watchlists, you must query the SecurityInsightsWatchlist resource type using the Kusto Query Language (KQL). Workbooks in Microsoft Sentinel support Azure Resource Graph as a data source specifically for this purpose—querying resource metadata rather than telemetry logs.

Option B (Logs (Analytics)) is incorrect because Log Analytics stores telemetry and alert data. While you can query data stored in watchlists (to enrich other queries), you cannot query the watchlist definitions themselves from the Log Analytics table. As noted in community comments, some users confuse querying the content of watchlists with querying the existence of watchlist resources. The comment stating "Logs (Analytics) is used to query Log Analy…" highlights that Logs are for analytics, not resource inventory.

Options A and C are irrelevant; SQL databases and Storage accounts do not host Sentinel watchlist definitions.

Official Reference

https://learn.microsoft.com/en-us/azure/sentinel/watchlists-overview

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about managing or listing security configuration objects (like watchlists, automation rules, or connectors) in Microsoft Sentinel, always consider Azure Resource Graph first. These are infrastructure-as-code resources, not telemetry events. Reserve 'Logs (Analytics)' only for questions explicitly asking about querying historical security data or enrichment data stored within those objects.

Frequently Asked Questions

Can I query watchlist data in a Sentinel workbook?

Yes, but you must use the 'Logs (Analytics)' data source to query the actual data stored in the watchlist. To list the watchlist resources themselves, you must use Azure Resource Graph.

What KQL query lists Sentinel watchlists?

You query the SecurityInsightsWatchlist resource type using Azure Resource Graph: search type == SecurityInsightsWatchlist.

More SC-200 FAQ →

Community Votes

B
50%
D
50%

50% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 2 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 2

  1. nick34567 👍 4 Answered D
    Correct answer: D. Azure Resource Graph To list all Sentinel watchlists themselves, you query Azure resources, not the log data inside the workspace. Workbooks support Azure Resource Graph as a data source, and Resource Graph is used to query Azure resource metadata. Microsoft’s workbook docs list Azure Resource Graph as a supported workbook data source. Logs (Analytics) is used to query Log Analytics tables. In Sentinel, _GetWatchlist('watchlist-name') is used to query the contents/items of a specific watchlist, but it is not the best data source to enumerate all watchlist resources in the workspace
  2. cbdfbaf 👍 1 Answered B
    I would go for B https://learn.microsoft.com/en-us/azure/sentinel/watchlists-queries

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Least-privilege roles for Microsoft 365 Defender action approvals

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide