Forum Discussion
Cross Workspace Queries - Possible in a central Sentinel instance you use Lighthouse to access?
Hi all, Example scenario is that an MSSP accesses a clients Microsoft Sentinel instance via Azure Lighthouse for management, however, this customer also has lets say 3 further regions which will h...
Personally I'd treat all 3 extra instances as standalone and manage them in the same way you do the first Sentinel (I'm no fan of cross workspace apart from reporting, certainly not for Analytics). It would really depend on the MSSP and what they require / and support.