how many alerts MAX

%3CLINGO-SUB%20id%3D%22lingo-sub-2428137%22%20slang%3D%22en-US%22%3Ehow%20many%20alerts%20MAX%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2428137%22%20slang%3D%22en-US%22%3E%3CP%3EFirst%20of%20all%2C%20thanks%20for%20the%20help.%3C%2FP%3E%3CP%3EI%20would%20like%20to%20know%20what%20is%20the%20current%20alert%20limit%20of%20Azure%20Sentinel.%3C%2FP%3E%3CP%3EWe%20are%20a%20SOC%20with%20many%20alerts%20of%20its%20own%20and%20I%20think%20there%20is%20a%20limitation.%3C%2FP%3E%3CP%3EWe%20use%20an%20MSSP%20model%20with%20Lighthouse%3C%2FP%3E%3CP%3EThanks%20in%20advance.%3C%2FP%3E%3CP%3EI%20would%20also%20like%20to%20confirm%20the%20limit%20of%20Workspace%20that%20we%20can%20manage%2C%20if%20it%20is%2020.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2430038%22%20slang%3D%22en-US%22%3ERe%3A%20how%20many%20alerts%20MAX%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2430038%22%20slang%3D%22en-US%22%3EAt%20any%20point%20of%20time%20you%20can%20view%20the%20incidents%20of%2010%20workspaces%20only%20using%20light%20house%20and%20coming%20to%20the%20limitation%20of%20alerts%20on%20sentinel.%20I%20dont%20think%20there%20is%20any%20limitation%20on%20the%20alerts%20Azure%20Sentinel%20can%20trigger.%20You%20may%20not%20see%20the%20older%20alerts%20if%20it%20crosses%20the%20Sentinel%20retention%20period%3C%2FLINGO-BODY%3E
Occasional Contributor

First of all, thanks for the help.

I would like to know what is the current alert limit of Azure Sentinel.

We are a SOC with many alerts of its own and I think there is a limitation.

We use an MSSP model with Lighthouse

Thanks in advance.

I would also like to confirm the limit of Workspace that we can manage, if it is 20.

2 Replies
At any point of time you can view the incidents of 10 workspaces only using light house and coming to the limitation of alerts on sentinel. I dont think there is any limitation on the alerts Azure Sentinel can trigger. You may not see the older alerts if it crosses the Sentinel retention period
10 is a limit in the Azure Sentinel UI, you can use a Workbook (example is "Sentinel Central" - see Workbooks - Templates), from which can see 10+ workspaces, or those you select. Or you can use a cross workspace query to look over 10+ (which is what the workbook does). Please note accessing lots of workspaces (especially across regions) can be slow. please see: https://www.linkedin.com/pulse/announcing-azure-sentinel-central-workbook-clive-watson/