Skip to content

Commit b4e1972

Browse files
CSS based updated
add clarification on cross workspace support add bullet for keyword identifiers in watchlist entity names
1 parent 993912b commit b4e1972

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

articles/sentinel/watchlists.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,10 @@ Before you create a watchlist, be aware of the following limitations:
3838
- The use of watchlists should be limited to reference data, as they aren't designed for large data volumes.
3939
- The **total number of active watchlist items** across all watchlists in a single workspace is currently limited to **10 million**. Deleted watchlist items don't count against this total. If you require the ability to reference large data volumes, consider ingesting them using [custom logs](../azure-monitor/agents/data-sources-custom-logs.md) instead.
4040
- Watchlists are refreshed in your workspace every 12 days, updating the `TimeGenerated` field.
41-
- Watchlists can only be referenced from within the same workspace. Cross-workspace and/or Lighthouse scenarios are currently not supported.
41+
- Using Lighthouse to manage watchlists across different workspaces is not supported at this time.
4242
- Local file uploads are currently limited to files of up to 3.8 MB in size.
4343
- File uploads from an Azure Storage account (in preview) are currently limited to files up to 500 MB in size.
44+
- Watchlists must adhere to the same column and table restrictions as KQL entities. For more information, see [KQL entity names](../data-explorer/kusto/query/schema-entities/entity-names.md).
4445

4546
## Options to create watchlists
4647

0 commit comments

Comments
 (0)