At the moment the way I search SecurityEvent across all workspaces is to create a function that contains the following search syntax:
union workspace("wo
