Skip to content

Commit e6e2e38

Browse files
update intro to mesh with updated overview
1 parent 0f46044 commit e6e2e38

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

articles/sentinel/watchlists-queries.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ ms.collection: usx-security
1717

1818
# Build queries or detection rules with watchlists in Microsoft Sentinel
1919

20-
Query data in any table against data from a watchlist by treating the watchlist as a table for joins and lookups. When you create a watchlist, you define the *SearchKey*. The search key is the name of a column in your watchlist that you expect to use as a join with other data or as a frequent object of searches.
20+
Correlate your watchlist data against any Microsoft Sentinel data with Kusto tabular operators such as `join` and `lookup`. When you create a watchlist, you define the *SearchKey*. The search key is the name of a column in your watchlist that you expect to use as a join with other data or as a frequent object of searches.
2121

2222
For optimal query performance, use **SearchKey** as the key for joins in your queries.
2323

0 commit comments

Comments
 (0)