First party Alerts in Different Workspace

[Vshah335]

Recommendation to view the “first party” (MCAS, Security Center, AADIP etc.) from different workspace

If you have KQL example, set up the rule, please do so. 

setdecide upon or fix definitelyMore (Definitions, Synonyms, Translation)

[#2]

You can use Azure Lighthouse to connect to all the workspaces and then you can see all the incidents in one view. This should work while MS considers your idea.