Skip to content

Commit d58b804

Browse files
authored
Update mto-advanced-hunting.md
1 parent 78272fc commit d58b804

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

unified-secops-platform/mto-advanced-hunting.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,9 @@ You can run any query that you already have access to in the multitenant managem
6565
| take 10
6666
```
6767

68+
>[!IMPORTANT]
69+
> Running queries across multiple tenants using the `adx(x)` operator will run separate ADX queries per tenant and aggregate them, which might return duplicate results. Use the `adx(x)` operator with multiple tenants only if you need to join tenant results with ADX data. For more information, see [Use Microsoft Sentinel functions, saved queries, and custom rules](/defender-xdr/advanced-hunting-defender-use-custom-rules#use-adx-operator-for-azure-data-explorer-queries).
70+
6871
To learn more about advanced hunting in Microsoft Defender XDR, read [Proactively hunt for threats with advanced hunting in Microsoft Defender XDR](/defender-xdr/advanced-hunting-overview).
6972

7073
### Use adx(x) operator for Azure Data Explorer queries carefully

0 commit comments

Comments
 (0)