When you have multiple Log Analytics workspaces across several Azure subscriptions, and you want to perform cross-workspace hunting queries from a central Microsoft Sentinel deployment, you must complete two steps according to Microsoft's official Sentinel documentation:
* Add the Microsoft Sentinel solution to each workspace - Microsoft Sentinel must be enabled or connected to every Log Analytics workspace that you want to query. This step allows those workspaces to participate in Sentinel analytics, hunting, and investigation features. Without Sentinel being enabled in each workspace, the hunting queries will not have permission or access to their data.
"To query across multiple workspaces, each workspace must have Microsoft Sentinel enabled."
* Use the workspace() expression and the union operator - Microsoft Sentinel hunting queries can run across multiple workspaces by explicitly referencing them with the workspace() function and combining them with the union operator, for example:
* union workspace('ProjectA-Workspace').SecurityEvent,
* workspace('ProjectB-Workspace').SecurityEvent,
* workspace('ProjectC-Workspace').SecurityEvent
* | where EventID == 4625
The workspace() function identifies the remote workspaces, and union combines results into a single query output.
Other options are incorrect:
* A and B: alias and resource expressions are used for multi-resource queries within a workspace, not for cross-workspace queries.
* E: Adding the Security Events connector applies only to ingesting Windows logs but does not enable cross-workspace hunting.
# Correct Answers: C and D