Skip to content

Commit c7b0637

Browse files
authored
Update mto-advanced-hunting.md
1 parent d58b804 commit c7b0637

File tree

1 file changed

+0
-8
lines changed

1 file changed

+0
-8
lines changed

unified-secops-platform/mto-advanced-hunting.md

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -70,14 +70,6 @@ You can run any query that you already have access to in the multitenant managem
7070
7171
To learn more about advanced hunting in Microsoft Defender XDR, read [Proactively hunt for threats with advanced hunting in Microsoft Defender XDR](/defender-xdr/advanced-hunting-overview).
7272

73-
### Use adx(x) operator for Azure Data Explorer queries carefully
74-
75-
Consider carefully before using the `adx(x)` operator for queries on multiple tenants. Advanced hunting in the multitenant portal sends each query to each of the selected tenants in parallel. The tenants returns the results, which are then aggregated and sent back to the portal. Using the `adx(x)` operator in your queries effectively queries ADX multiple times, once for each tenant, and the returned and aggregated data might include duplicate information.
76-
77-
We recommend using the `adx(x)` operator with multiple tenants only when you want to join results from each tenant with ADX data.
78-
79-
For more information, see [Use Microsoft Sentinel functions, saved queries, and custom rules](/defender-xdr/advanced-hunting-defender-use-custom-rules#use-adx-operator-for-azure-data-explorer-queries).
80-
8173
## Run cross-workspace queries
8274

8375
To run queries across multiple workspaces in the same tenant, use the [workspace( ) expression](/azure/azure-monitor/logs/cross-workspace-query#query-across-log-analytics-workspaces-using-workspace), with the workspace identifier as the argument in your query to refer to a table in a different workspace.

0 commit comments

Comments
 (0)