---
title: "Discussion on \"How to use Watchlists in Microsoft Sentinel\" | Hashnode"
description: "Discussion on \"How to use Watchlists in Microsoft Sentinel\". In yesterday’s article, I went over how to create an allow list in a Sentinel Analytics query to exclude benign files. In that article, I hinted that a better solution was to create a watchlist in Sentinel to use as an allow list of safe files to avo..."
url: "https://hashnode.com/posts/how-to-use-watchlists-in-microsoft-sentinel/68c23d40a1872eee7b6c038c"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [How to use Watchlists in Microsoft Sentinel](https://eddie-pena.com/how-to-use-watchlists-in-microsoft-sentinel?utm_source=hashnode&utm_medium=feed)

In yesterday’s article, I went over how to create an allow list in a Sentinel Analytics query to exclude benign files. In that article, I hinted that a better solution was to create a watchlist in Sentinel to use as an allow list of safe files to avo...

Sep 11, 2025 · 2 min read · eddie-pena.com  
Updated Sep 13, 2025  
Read the article

## Written by

[Edward Pena](https://hashnode.com/@Cryptosrage)

@Cryptosrage

  
[View profile](https://hashnode.com/@Cryptosrage)

Security Engineer by day, Security Researcher by night

## Responses

Markdown supported · ⌘↵ to post

No responses yet.