hard20 pts · first answer countssiemmicrosoft-sentinelkql
Querying several workspaces at once
An MSSP in Dubai manages Sentinel for three clients, each with its own workspace, through Azure Lighthouse. How can one hunting query cover all three?
Discussion 0
Join free to post in the discussion.
Related questions
- What stats count by does in SPLCybersecurity Analyst
- Grouping with summarize in KQLCybersecurity Analyst
- Why logs go to a SIEMCybersecurity Analyst
- Why normalise to a common schemaCybersecurity Analyst
- What a SIEM is forCybersecurity Analyst
- What a Splunk index isCybersecurity Analyst
- What sourcetype tells SplunkCybersecurity Analyst
- The Splunk Universal ForwarderCybersecurity Analyst