Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community
SOLVED

Parameterized function in cross workspace queries

Copper Contributor

Hi, 

 

I'm looking to get some input on a query I'm working on.

 

SHoydal_0-1718801409160.png

The thought is to create a query for each customer in our Lighthouse tenant, then be able to query a function named for the customer, so for example,

CustomerA("SigninLogs")

| where Identity contains "someperson"

 

However, when calling the function above, I'm getting the following error. 

SHoydal_1-1718801592177.png

Is there some limitation with the workspace command or where am I doing wrong?

2 Replies
best response confirmed by SHoydal (Copper Contributor)
Solution
Correct the Workspace command has always been hardcoded values only , so you cant pass a parameter to it.

There is another option, try my "Sentinel Central" workbook in the Content hub and look at the [Hunting] tab. This enables you to cross workspace query without having to name the Workspaces https://www.linkedin.com/pulse/microsoft-sentinel-central-workbook-v20-clive-watson/
Thank you for the clarification, I will check out your workbook meanwhile :)
1 best response

Accepted Solutions
best response confirmed by SHoydal (Copper Contributor)
Solution
Correct the Workspace command has always been hardcoded values only , so you cant pass a parameter to it.

There is another option, try my "Sentinel Central" workbook in the Content hub and look at the [Hunting] tab. This enables you to cross workspace query without having to name the Workspaces https://www.linkedin.com/pulse/microsoft-sentinel-central-workbook-v20-clive-watson/

View solution in original post