2,605 questions
Anlaytics use case creation issue while using cross query function on azure sentinel
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(172.8, 1%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBM%3C/text%3E%3C/svg%3E)
Bellator MOQ
0
Reputation points
I have my logs stored in mexico central LAW and sentinel in central US and i am using cross query to manage client on us sentinel but i am facing issue with creation of Analytics use case in us sentinel while data being on mexico LAW. I am able to create dashboard with same kql query but not able to create analytics use case .
Microsoft Security | Microsoft Entra | Other
{count} votes
-
Clive Watson 7,866 Reputation points MVP Volunteer Moderator2025-07-01T08:13:03.8133333+00:00 You should be able to create cross workspace queries, however as you haven't supplied an error the issue is hard to diagnose, do you have a screenshot of the issue? KQL used in a Workbook (dashboard) or the Logs blade is handled differently to a Rule (which has more restrictions)
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 90%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPM%3C/text%3E%3C/svg%3E)
Pauline Mbabu 1,160 Reputation points Microsoft Employee2025-07-01T20:37:51.6066667+00:00 Hello @Bellator MOQ ,
As Clive has pointed out, please elaborate more on the issue that you are facing so that we can get a better response for this. If you have also found a solution to your issue, kindly also give an update on the same.
Sign in to comment
Sign in to answer