Skip to content

Commit 7ee0c38

Browse files
committed
Learn Editor: Update extend-sentinel-across-workspaces-tenants.md
1 parent 1db1ed1 commit 7ee0c38

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

articles/sentinel/extend-sentinel-across-workspaces-tenants.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,10 @@ You can then write a query across both workspaces by beginning with `unionSecuri
8686
<!-- Bookmark added for backward compatibility with old heading -->
8787
You can now include cross-workspace queries in scheduled analytics rules. You can use cross-workspace analytics rules in a central SOC, and across tenants (using Azure Lighthouse), suitable for MSSPs. This use is subject to the following limitations:
8888

89-
- You can include **up to 20 workspaces** in a single query. However, for good performance, we recommend keeping it under 5.
89+
- You can include **up to 20 workspaces** in a single query. However, for good performance, we recommend including no more than 5.
9090
- - You must deploy Microsoft Sentinel **on every workspace** referenced in the query.
9191
- Alerts generated by a cross-workspace analytics rule, and the incidents created from them, exist **only in the workspace where the rule was defined**. The alerts won't be displayed in any of the other workspaces referenced in the query.
92-
- A cross-workspace analytics rule will continue running even if the user who created the rule loses access to workspaces referenced in the rule's query.
92+
- A cross-workspace analytics rule, like any analytics rule, will continue running even if the user who created the rule loses access to workspaces referenced in the rule's query.
9393

9494
Alerts and incidents created by cross-workspace analytics rules contain all the related entities, including those from all the referenced workspaces and the "home" workspace (where the rule was defined). This way, analysts get a full picture of alerts and incidents.
9595

@@ -137,3 +137,4 @@ In this article, you learned how Microsoft Sentinel's capabilities can be extend
137137
- Learn how to [work with multiple tenants](./multiple-tenants-service-providers.md) in Microsoft Sentinel, using Azure Lighthouse.
138138
- Learn how to [view and manage incidents in multiple workspaces](./multiple-workspace-view.md) seamlessly.
139139

140+

0 commit comments

Comments
 (0)