Skip to content

Commit 529b1fb

Browse files
authored
Added cross-workspace support in how-to doc
1 parent 4b16eb5 commit 529b1fb

File tree

1 file changed

+3
-5
lines changed

1 file changed

+3
-5
lines changed

articles/sentinel/create-nrt-rules.md

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -80,17 +80,15 @@ You create NRT rules the same way you create regular [scheduled-query analytics
8080

8181
- You can automate responses to both alerts and incidents.
8282

83+
- You can run the rule query across multiple workspaces.
84+
8385
Because of the [**nature and limitations of NRT rules**](near-real-time-rules.md#considerations), however, the following features of scheduled analytics rules will *not be available* in the wizard:
8486

8587
- **Query scheduling** is not configurable, since queries are automatically scheduled to run once per minute with a one-minute lookback period.
8688
- **Alert threshold** is irrelevant, since an alert is always generated.
8789
- **Event grouping** configuration is now available to a limited degree. You can choose to have an NRT rule generate an alert for each event for up to 30 events. If you choose this option and the rule results in more than 30 events, single-event alerts will be generated for the first 29 events, and a 30th alert will summarize all the events in the result set.
8890

89-
In addition, the query itself has the following requirements:
90-
91-
- You can't run the query across workspaces.
92-
93-
- Due to the size limits of the alerts, your query should make use of `project` statements to include only the necessary fields from your table. Otherwise, the information you want to surface could end up being truncated.
91+
In addition, due to the size limits of the alerts, your query should make use of `project` statements to include only the necessary fields from your table. Otherwise, the information you want to surface could end up being truncated.
9492

9593
## Next steps
9694

0 commit comments

Comments
 (0)