Your SOC maintains a daily CSV with IPAddress and Action (Allow/Deny). You need to use it in Microsoft Sentinel to enrich analytics rules so they alert when a Deny IP appears in sign-in data, and the list must update automatically every morning from a secure storage location. What two actions should you take?

The problem requires an automatically updating list of IP addresses to enrich analytics rules. Watchlists in Microsoft Sentinel are designed for this purpose, allowing you to correlate data from external sources with events in Sentinel. Creating a watchlist that imports from a Storage account blob via a Shared Access Signature (SAS) token ensures secure access to the CSV and allows for daily recurring imports to keep the data synchronized. Once the watchlist is created, you reference it in your KQL analytics rule using GetWatchlist('ListName'). This function allows you to join the watchlist data with your sign-in data and trigger an alert when an IP address from the watchlist with an Action of "Deny" is found. Uploading the CSV once without a refresh schedule would not meet the requirement for automatic daily updates. Using the Threat Intelligence - TAXII connector is for ingesting threat intelligence feeds, not for custom CSV files from internal storage. Creating a workbook parameter is for dynamic visualization in workbooks, not for enriching analytics rules.