Forum Discussion
Solved
Parameterized function in cross workspace queries
Hi, I'm looking to get some input on a query I'm working on. The thought is to create a query for each customer in our Lighthouse tenant, then be able to query a function named for the...
- Correct the Workspace command has always been hardcoded values only , so you cant pass a parameter to it.
There is another option, try my "Sentinel Central" workbook in the Content hub and look at the [Hunting] tab. This enables you to cross workspace query without having to name the Workspaces https://www.linkedin.com/pulse/microsoft-sentinel-central-workbook-v20-clive-watson/
Correct the Workspace command has always been hardcoded values only , so you cant pass a parameter to it.
There is another option, try my "Sentinel Central" workbook in the Content hub and look at the [Hunting] tab. This enables you to cross workspace query without having to name the Workspaces https://www.linkedin.com/pulse/microsoft-sentinel-central-workbook-v20-clive-watson/
There is another option, try my "Sentinel Central" workbook in the Content hub and look at the [Hunting] tab. This enables you to cross workspace query without having to name the Workspaces https://www.linkedin.com/pulse/microsoft-sentinel-central-workbook-v20-clive-watson/
Thank you for the clarification, I will check out your workbook meanwhile 🙂