Forum Discussion
Tracking Incidents across Lighthouse
Hi everyone! I have a customer with multiple Sentinel instances and they're hooked together via Lighthouse. The main/master instance will display "Incidents" for the local Instance but not the ot...
JKatzmandu When I look at all the incidents from various tenants I have access to, they are grouped by the workspace so the Incident ID would be sequential within each workspace.
If you are not seeing the incidents from the other tenants I would double check your Lighthouse configuration to make sure it it working correctly. Can you go into the individual tenant directly and see the incidents from each tenant enabled via Lighthouse?
Aha! There is a "view incidents" link you can select after you check all the workspaces. Once you do that you can see them all. Thank you!
- CliveWatson
Microsoft
I have an example Workbook that may also help Announcing: Azure Sentinel Central Workbook | LinkedIn
