// Cloud ASN Risk Watchlist, snapshot 2026-10-09
// Source: https://blog.infostruction.com/research/cloud-asn-risk-watchlist/
//
// Paste-ready set literals for Defender XDR advanced hunting, which has no
// watchlist feature. In Microsoft Sentinel prefer a Watchlist built from
// utilities/sentinel-watchlist.csv, so the list can be updated without
// editing every analytics rule.
//
// An ASN match is context, not a verdict. Every query below is written to
// need a second signal before it means anything.

// T1 and T2, the alerting set. 463 ASNs.
let AsnT1T2 = dynamic([
    245, 2601, 2702, 3507, 3563, 5065, 6186, 6207, 6729, 7857, 8129, 8649, 9164, 9465, 11527, 13875, 14576,
    14956, 17612, 18526, 20052, 20292, 23865, 24544, 25288, 25862, 26132, 26173, 26833, 31561, 33042, 33993,
    34254, 34450, 34939, 34985, 35478, 35624, 35830, 36680, 37707, 38149, 38871, 38946, 39287, 39600, 40193,
    41155, 42397, 42505, 43444, 43463, 43481, 43668, 43743, 44208, 44382, 44386, 44559, 46370, 46664, 47516,
    47890, 47893, 47926, 47945, 48090, 48198, 48214, 48282, 48589, 48693, 48721, 49418, 49581, 51124, 51396,
    51447, 51511, 51722, 51852, 52209, 53958, 54497, 54801, 55154, 55933, 56153, 56362, 56584, 57100, 57415,
    57509, 58061, 58192, 58854, 58961, 59425, 59651, 59683, 60117, 60647, 60842, 60890, 61125, 61432, 61879,
    62206, 62240, 62380, 62864, 63734, 63881, 64199, 131388, 131750, 131831, 132574, 132827, 132930, 133320,
    133488, 133668, 133692, 133731, 133994, 134121, 134176, 134196, 135271, 135388, 135752, 136367, 136787,
    136923, 137156, 138687, 138749, 138808, 138915, 138968, 140125, 140129, 140155, 140184, 140208, 140787,
    140869, 140941, 140947, 141039, 141333, 141567, 141738, 141803, 141835, 141836, 141853, 141875, 142002,
    142062, 142430, 142519, 142622, 146887, 147034, 147049, 147211, 147269, 147287, 147291, 149089, 149181,
    149196, 149197, 149208, 149242, 149286, 149978, 150030, 150036, 150082, 150091, 150100, 150101, 150102,
    150604, 150813, 150860, 151604, 152149, 152170, 152192, 152194, 152327, 152485, 152486, 154177, 154206,
    197170, 197176, 197450, 197555, 197769, 198071, 198189, 198571, 198636, 198926, 198953, 198981, 199330,
    199420, 199457, 199467, 199724, 199804, 200010, 200051, 200130, 200373, 200499, 200593, 200651, 200671,
    200699, 200912, 201249, 201292, 201303, 201304, 201380, 201572, 201626, 201738, 201813, 201814, 201824,
    201836, 202144, 202171, 202226, 202267, 202302, 202306, 202318, 202383, 202388, 202412, 202425, 202481,
    203044, 203120, 203273, 203771, 203861, 203950, 203979, 203999, 204428, 204490, 204491, 204502, 204552,
    204610, 204794, 204868, 204872, 205083, 205301, 205397, 205486, 205733, 205745, 205770, 205884, 205997,
    206005, 206127, 206305, 206340, 206378, 206413, 206479, 206535, 206560, 206582, 206590, 206623, 206644,
    206728, 206744, 206750, 206991, 207043, 207088, 207137, 207326, 207566, 207812, 207957, 207986, 208137,
    208185, 208198, 208241, 208317, 208525, 208846, 209121, 209274, 209373, 209375, 209396, 209413, 209425,
    209474, 209588, 209605, 209847, 209868, 209883, 209889, 209896, 209944, 209946, 209961, 209963, 209982,
    210006, 210240, 210316, 210457, 210530, 210546, 210558, 210644, 210654, 210703, 210705, 210707, 210714,
    210848, 210940, 210950, 211066, 211121, 211199, 211238, 211301, 211443, 211663, 211720, 211762, 211859,
    211860, 211922, 211955, 212017, 212238, 212283, 212448, 212622, 212651, 212666, 212835, 212867, 212913,
    213035, 213137, 213200, 213373, 213388, 213389, 213438, 213441, 213488, 213652, 213702, 213753, 213790,
    213897, 213921, 213945, 213954, 213995, 214018, 214154, 214351, 214357, 214422, 214497, 214576, 214762,
    214927, 215117, 215136, 215183, 215238, 215310, 215311, 215340, 215376, 215402, 215460, 215474, 215730,
    215731, 215765, 215925, 215930, 216078, 216127, 216193, 216246, 216378, 216473, 216475, 218731, 218732,
    218986, 219067, 219326, 219502, 265919, 266702, 266724, 266842, 268433, 272096, 327837, 327952, 328095,
    328819, 328958, 329007, 394082, 395092, 395898, 397006, 397702, 397881, 398638, 398741, 399073, 399471,
    399979, 400018, 400171, 400177, 400328, 400377, 400506, 400522, 400641, 400992, 401626, 401696, 401701,
    402075, 402253, 402647, 403005
]);

// Everything enabled by default, including T3 context. 559 ASNs.
let AsnEnabled = dynamic([
    245, 2601, 2702, 3507, 3563, 5065, 6186, 6207, 6729, 7857, 8129, 8560, 8649, 9009, 9164, 9465, 11527,
    11878, 11938, 12876, 13875, 14061, 14576, 14956, 17497, 17612, 18526, 19318, 20052, 20292, 20473, 20709,
    20724, 22295, 23865, 24544, 24940, 25288, 25369, 25862, 26132, 26173, 26496, 26548, 26701, 26833, 29802,
    30860, 31561, 32167, 33042, 33993, 34254, 34450, 34828, 34939, 34985, 35048, 35346, 35478, 35624, 35830,
    36680, 37707, 38149, 38871, 38946, 39287, 39600, 40193, 40403, 41155, 41745, 42397, 42505, 43444, 43463,
    43481, 43668, 43743, 44208, 44382, 44386, 44559, 45753, 46370, 46664, 47272, 47516, 47890, 47893, 47926,
    47945, 48031, 48090, 48198, 48214, 48282, 48589, 48693, 48721, 49418, 49581, 51124, 51167, 51396, 51447,
    51511, 51722, 51852, 52209, 53667, 53958, 54203, 54497, 54801, 55154, 55933, 56153, 56362, 56584, 57100,
    57415, 57509, 57852, 58061, 58192, 58349, 58854, 58961, 59425, 59651, 59683, 59711, 60117, 60647, 60842,
    60890, 61003, 61046, 61125, 61254, 61432, 61879, 62206, 62240, 62380, 62563, 62651, 62864, 63023, 63734,
    63737, 63881, 63949, 64080, 64107, 64199, 131388, 131750, 131831, 132574, 132827, 132930, 133244, 133320,
    133488, 133668, 133692, 133731, 133944, 133994, 134121, 134176, 134196, 135271, 135377, 135388, 135752,
    135967, 136367, 136787, 136923, 137156, 138687, 138749, 138808, 138915, 138968, 140125, 140129, 140155,
    140184, 140208, 140787, 140869, 140941, 140947, 141039, 141333, 141567, 141738, 141803, 141835, 141836,
    141853, 141875, 142002, 142062, 142430, 142519, 142622, 146887, 147034, 147049, 147211, 147269, 147287,
    147291, 149089, 149181, 149196, 149197, 149208, 149242, 149286, 149978, 150030, 150036, 150055, 150082,
    150091, 150100, 150101, 150102, 150604, 150813, 150860, 151604, 152149, 152170, 152192, 152194, 152327,
    152460, 152485, 152486, 154177, 154206, 154701, 197170, 197176, 197450, 197555, 197695, 197769, 198071,
    198120, 198189, 198571, 198636, 198926, 198953, 198981, 199330, 199420, 199457, 199467, 199724, 199804,
    199829, 200010, 200051, 200130, 200373, 200499, 200509, 200593, 200651, 200671, 200699, 200912, 201002,
    201249, 201292, 201303, 201304, 201380, 201572, 201626, 201738, 201801, 201813, 201814, 201824, 201836,
    202015, 202044, 202124, 202144, 202171, 202226, 202267, 202302, 202306, 202318, 202383, 202388, 202412,
    202425, 202481, 202496, 202520, 203044, 203120, 203273, 203718, 203771, 203861, 203950, 203979, 203999,
    204428, 204490, 204491, 204502, 204552, 204610, 204794, 204868, 204872, 204997, 205083, 205090, 205301,
    205397, 205486, 205733, 205745, 205770, 205884, 205964, 205997, 206005, 206127, 206305, 206340, 206378,
    206413, 206479, 206535, 206560, 206582, 206590, 206623, 206644, 206728, 206744, 206750, 206791, 206991,
    207043, 207088, 207137, 207326, 207350, 207566, 207569, 207812, 207957, 207986, 208137, 208185, 208198,
    208241, 208317, 208525, 208846, 208981, 209121, 209178, 209207, 209274, 209373, 209375, 209396, 209413,
    209425, 209474, 209588, 209605, 209671, 209847, 209868, 209883, 209889, 209896, 209944, 209946, 209961,
    209963, 209982, 210006, 210240, 210316, 210328, 210457, 210530, 210546, 210558, 210644, 210654, 210703,
    210705, 210707, 210714, 210848, 210940, 210950, 211066, 211121, 211199, 211238, 211301, 211443, 211663,
    211720, 211762, 211859, 211860, 211922, 211955, 212017, 212171, 212238, 212283, 212448, 212622, 212651,
    212666, 212835, 212867, 212890, 212913, 213035, 213137, 213200, 213230, 213250, 213373, 213388, 213389,
    213438, 213441, 213488, 213652, 213702, 213753, 213790, 213897, 213921, 213929, 213945, 213954, 213995,
    214018, 214154, 214351, 214357, 214422, 214478, 214497, 214576, 214762, 214927, 214973, 215117, 215136,
    215183, 215238, 215240, 215310, 215311, 215340, 215376, 215402, 215460, 215474, 215540, 215730, 215731,
    215764, 215765, 215925, 215930, 216067, 216078, 216127, 216193, 216246, 216378, 216473, 216475, 218731,
    218732, 218986, 219067, 219326, 219502, 263833, 265919, 266187, 266702, 266724, 266842, 267784, 268433,
    270764, 271437, 272096, 327837, 327952, 328095, 328819, 328958, 329007, 329225, 394082, 395092, 395898,
    397006, 397081, 397273, 397702, 397881, 398638, 398741, 399073, 399471, 399935, 399979, 400018, 400171,
    400177, 400328, 400377, 400506, 400522, 400641, 400882, 400992, 401626, 401696, 401701, 402075, 402186,
    402253, 402647, 403005
]);