Forum Discussion
Sharing logs between two Sentinels on the same Tenants
Hi Everyone, Due to a specific business requirement where different teams will be monitoring different alerts, we are thinking that the best solution would be to have 2 workspaces and 2 sentinels...
If the Alerts are different (or you dont mind naming them or just selecting them), then you could use an Automation rule to assign them to either Group. Both would be able to see each others data and Alerts, but they would be assigned to each Team/Group, by the rule.
e.g. I assigned 3 rules for this group.
note: you need to setup a group for each (I just used "unassigned" as an example). Your other choice is double ingestion like you say, but this does provide separation.