Queries for the Watchlist table

For information on using these queries in the Azure portal, see Log Analytics tutorial. For the REST API, see Query.

Get Watchlist aliases

Gets a distinct list of all Watchlist aliases in a workspace.

Watchlist
| where _DTItemType == "Watchlist"
| where _DTTimestamp > ago(5d)
| distinct WatchlistAlias

Lookup events using a Watchlist

Lookup events in Heartbeat table against data from a Watchlist by treating the Watchlist as a table for joins and lookups.

Heartbeat
| lookup kind=leftouter _GetWatchlist('mywatchlist')
 on $left.ComputerIP == $right.SearchKey
 | limit 100