changes to watchlists - are they logged?

[aszotek]

We are using watchlists to trigger alarms/cases in ESM. Regardless of type of watchlist (static/dynamic), do you know if (and where) is any information logged what was changed?

I need to track/audit additions/removals of entries to watchlists.

[ryan.fitzpatric · Accepted solution]

They are not logged as of 9.4.2. Only system health related data is logged, unfortunately watchlists are not part of what is logged.

To see what events are logged for auditing purposes, you can go into policy editor, and under ESM, it will list all SIEM specific related events.

[aszotek]

Thanks for confirming that, Ryan.

Raised PER for this.

[davidi]

Hello, if you get any feedback for PER please share.

Thanks