Watchlists are a critical component to enhance security operations and provide data correlation. Up till now, watchlist files have been limited to 3.8 MB per upload. We are excited to announce that Watchlists now support up to 500 MB file size per upload!
There are many scenarios where you will need to reference and look up a larger dataset in your detection rules or investigation. Here are some sample use cases you can use the large watchlists for.
- Map database of IPv4 address networks with their respective geographical location from known sources such as MaxMind or IP2Location.
- Leverage the CVE vulnerability database to help enrich incidents and alerts that may be related to a known exploit.
- Enrich alerts and incidents with custom datasets that are larger than 3.8MB in size.
How to create a large watchlist
To create a large watchlist, you will need to upload a watchlist file in an Azure Storage account. Then create a shared access signature (SAS) URL for Microsoft Sentinel to securely retrieve the watchlist data. Finally upload the watchlist to your workspace in Microsoft Sentinel.
Check out our step-by-step instructions to create a large watchlist.
Considerations:
- Creating a watchlist from a local file is still limited to 3.8 MB per upload. The increased limit applies only to watchlist files stored in Azure Storage.
- Microsoft Sentinel will require an Azure Storage Blob SAS URL to access and download the file for processing and ingestion into the watchlist table. The SAS URL must have at least 6 hours away from its expiry time.
- An entry in the CSV file must not exceed 10,240 characters per line.
Further reading resources:
- Overview of watchlist in Microsoft Sentinel
- Options to create a watchlist
- Protecting your azure storage using shared access signatures (SAS)
Try out this new watchlist capability and let us know your feedback!
Posted at https://sl.advdat.com/3IwCogxhttps://sl.advdat.com/3IwCogx
