>
    Strata Copilot
    Manage Watchlists
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. Watchlists
    4. Manage Watchlists
    Download PDF
    SaaS Security

    Manage Watchlists

    Table of Contents

    Manage Watchlists

    Create, edit, and delete watchlists to group and monitor high-priority users with configurable risk amplifiers.
    Where Can I Use This?What Do I Need?
    • Strata Cloud Manager
    • Data Security license
    Or any of the following licenses that include the Data Security license:
    • CASB-X
    • CASB-PA
    Watchlists allow you to apply risk amplifiers to specific user groups, ensuring that policy violations from high-priority personas contribute more heavily to their overall risk score. You can manage up to 10 watchlists—4 predefined and 6 custom. All watchlist actions are recorded in the platform's audit logs for compliance tracking.
    1. Log in to Strata Cloud Manager.
    2. Select ConfigurationSaaS SecurityBehavior ThreatsUsers.
    3. Scroll down to the Watchlists section and click View All to view all the configured watchlists.
      The watchlist management view displays each watchlist with its name, status (enabled or disabled), number of users, type (predefined or custom), risk amplifier value, and the actions you can perform on the watchlist. You can also download all the watchlist details as a single CSV file using the download option.
    4. Create a Custom Watch List: Click Add New, specify the following details and Save.
      • Name—A descriptive name for the watchlist.
      • Description—A brief explanation of the watchlist's purpose.
      • Status—Enabled or disabled.
      • Risk Amplifier—The multiplier applied to risk scores for users on this watchlist. Values increase in increments of 0.1 from 0.1 to 2. A value greater than 1.0 increases the user's risk score impact, while a value less than 1.0 reduces it. The default value is 1.0 (no amplification).
      • Manage Users
        • Add Users—Upload a CSV file with email addresses of users you want to add to the watchlist. A downloadable sample CSV file is also available.
        • User List—List of users that you have added to this watchlist.
    5. Edit a Watchlist
      1. Edit a predefined watchlist: Click the name of your watchlist to open the Watchlist Settings page. Edit the details as per your need and Save. You cannot edit the name of your predefined watchlist.
      2. Edit a custom watchlist: Click the name of your watchlist to open the Watchlist Settings page. Edit the details as per your need and Save.
      You can also use the Action menu option to delete your custom watchlist. However, you cannot delete predefined watchlists. To stop monitoring users in the predefined watchlist, disable it instead.

    © 2026 Palo Alto Networks, Inc. All rights reserved.