watchlist

Microsoft Sentinel: validate a watchlist before it drives automated response

A production runbook for proving watchlist freshness, schema, SearchKey, deletions and KQL behavior before allowing it to influence automated response.