diff --git a/unified-secops-platform/mto-advanced-hunting.md b/unified-secops-platform/mto-advanced-hunting.md index a0e91045ee..8926308f85 100644 --- a/unified-secops-platform/mto-advanced-hunting.md +++ b/unified-secops-platform/mto-advanced-hunting.md @@ -61,8 +61,7 @@ You can run any query that you already have access to in the multitenant managem | project TenantId = WorkspaceID Or, to query multiple workspaces in the same tenant, use a query similar to the following: - - ```kusto + Usage | union workspace("WorkpaceA").Usage | take 10