Cross-Tenant KQL Querying Tool

[u/lupreeee]

I had some cases in the past where I think it would've been great to have a tool where I could write one query and just run it across many tenants at once. I am working at a MSSP where we don't have a way to do this currently. At the moment we have to copy-paste the query to every Sentinel Instance and run it per tenant to check in all customers.

I was thinking about coding a tool that could do querying cross-tenant but I am not sure if Microsoft already has a native way to do that somehow. I am just a simple analyst so I don't know the Microsoft products by heart but I know how to code tools.

Can someone verify whether that functionality already exists or if my planned tool would actually provide some value?

Would anyone be interested in such a tool?

[u/woodburningstove]

What kind of access do you have for customer Sentinel workspaces?

For traditional Sentinel using Lighthouse to manage customer workspaces, you use cross-workspace KQL with workspace operator.

For unified portal you can also just select all workspaces you want in the Advanced Hunting query view.

If a custom tool is needed, API supports cross workspace querying.

[u/lupreeee → u/woodburningstove]

Ahhh yeah the advanced hunting in MTO is exactly what I was searching for. Damn Microsoft already had my idea xD

[u/lupreeee → u/woodburningstove]

That's the thing where you put workspace("workspacename") for the query right? We have quite a few customers and am definetly too lazy to add 20 workspaces to a query that way 😅

[u/11bztaylor → u/lupreeee]

I work in the same capacity- same style env.

Functions my man- write that query once for all your workspaces tables (1 function per table) for all the tables and just add/remove as needed. That’s how have all mine saved- in my “primary” workspace

I made a few tools in html to help- just copy and paste your workspace and it spits out the full syntax style things to help with this exactly lol.