SC-200 · Question #67
You have an Azure Sentinel deployment in the East US Azure region. You create a Log Analytics workspace named LogsWest in the West US Azure region. You need to ensure that you can use scheduled…
The correct answer is C. Add Azure Sentinel to a workspace. Cross-workspace queries can now be included in scheduled analytics rules. You can use cross- workspace analytics rules in a central SOC, and across tenants (using Azure Lighthouse) as in the case of an MSSP, subject to the following limitations: Up to 20 workspaces can be…
Question
You have an Azure Sentinel deployment in the East US Azure region. You create a Log Analytics workspace named LogsWest in the West US Azure region. You need to ensure that you can use scheduled analytics rules in the existing Azure Sentinel deployment to generate alerts based on queries to LogsWest. What should you do first?
Options
- ADeploy Azure Data Catalog to the West US Azure region.
- BModify the workspace settings of the existing Azure Sentinel deployment.
- CAdd Azure Sentinel to a workspace.
- DCreate a data connector in Azure Sentinel.
How the community answered
(47 responses)- A6% (3)
- B4% (2)
- C77% (36)
- D13% (6)
Explanation
Cross-workspace queries can now be included in scheduled analytics rules. You can use cross- workspace analytics rules in a central SOC, and across tenants (using Azure Lighthouse) as in the case of an MSSP, subject to the following limitations: * Up to 20 workspaces can be included in a single query. * Azure Sentinel must be deployed on every workspace referenced in the query. * Alerts generated by a cross-workspace analytics rule, and the incidents created from them, exist only in the workspace where the rule was defined. They will not be displayed in any of the other workspaces referenced in the query. https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces- tenants#cross-workspace-workbooks
Topics
Community Discussion
No community discussion yet for this question.