Question

Your organization is a managed security service provider (MSSP) that monitors three customer tenants, each with its own Microsoft Sentinel workspace, plus your own central workspace. Analysts in your SOC need to run a single scheduled analytics rule that correlates sign-in failures across all four workspaces to detect password-spray campaigns spanning tenants. What is the recommended approach to enable this cross-workspace, cross-tenant detection while keeping each customer's data in its own workspace?

Accepted Answer

Use Azure Lighthouse to delegate access to the customer workspaces, then author a scheduled analytics rule in the central workspace that queries across workspaces with the workspace() and union operators.

Answer

Export all sign-in logs from each customer workspace into the central workspace via Log Analytics data export, then run the rule only against the central workspace.

Answer

Create identical scheduled analytics rules in each customer workspace and manually merge the resulting incidents in the central workspace each day.

Answer

Enable the Microsoft Sentinel workspace manager to push a copy of each customer's SigninLogs table into the central workspace in near real time.