Cross-Workspace Auto-Disabled Analytics Query

Sathish Sivaprakash 0

Hello,

We are using Azure lighthouse, and we are utilizing the cross-workspace query in analytics to run in all the tenant from master tenant.

The Cross-workspace query running using the function, please find the function code below,

union isfuzzy = true workspace("xxxxx-xxxxx-xxxxxx-xxxxxxxxxxxx").SecurityEvent, //Customer1 workspace("xxxxx-xxxxx-xxxxxx-xxxxxxxxxxxx").SecurityEvent, //Customer2 workspace("xxxxx-xxxxx-xxxxxx-xxxxxxxxxxxx").SecurityEvent, //Customer3 workspace("xxxxx-xxxxx-xxxxxx-xxxxxxxxxxxx").SecurityEvent, //Customer4 workspace("xxxxx-xxxxx-xxxxxx-xxxxxxxxxxxx").SecurityEvent, //Customer5 workspace("xxxxx-xxxxx-xxxxxx-xxxxxxxxxxxx").SecurityEvent, //Customer6

But all the queries are getting auto disabled soon after rule is deployed.

Requesting you to please provide the solution to run cross workspace without getting auto disabled.

Clive Watson 6,836 Reputation points MVP

2024-07-04T12:04:53.0333333+00:00

Do you know the reason given for it being disabled? Is that the real query, I assume you must be looking at specifics or filtering the SecurityEvent Table, not just returning everything?

You should see the failure reason in the in the description https://learn.microsoft.com/en-us/azure/sentinel/troubleshoot-analytics-rules
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Share via

Cross-Workspace Auto-Disabled Analytics Query

Your answer