Merge pull request #219200 from austinmccollum/austinmc-ti-update

update severity assignment explanation

Author: prmerger-automator[bot]

articles/sentinel/use-matching-analytics-to-detect-threats.md

@@ -44,8 +44,6 @@ Matching analytics is configured when you enable the **Microsoft Threat Intellig
 
 :::image type="content" source="media/use-matching-analytics-to-detect-threats/configure-matching-analytics-rule.png" alt-text="A screenshot showing the Microsoft Threat Intelligence Analytics rule enabled in the Active rules tab.":::
 
-Alerts are grouped on a per-observable basis. For example, all alerts generated in a 24-hour time period that match the `contoso.com` domain are grouped into a single incident with the appropriate severity.
-
 
 ## Data sources and indicators
 
@@ -74,7 +72,11 @@ Use the following steps to triage through the incidents generated by the **Micro
 
     :::image type="content" source="media/work-with-threat-indicators/matching-analytics.png" alt-text="Screenshot of incident generated by matching analytics with details pane.":::
 
-When a match is found, the indicator is also published to the Log Analytics **ThreatIntelligenceIndicators**, and displayed in the **Threat Intelligence** page. For any indicators published from this rule, the source is defined as **Microsoft Threat Intelligence Analytics**.
+1. Observe the severity assigned to the alerts and the incident. Depending on how the indicator is matched, an appropriate severity is assigned to an alert from `Informational` to `High`. For example, if the indicator is matched with firewall logs that have allowed the traffic, a high severity alert is generated. If the same indicator was matched with firewall logs that blocked the traffic, the alert generated would be low or medium.
+
+    Alerts are then grouped on a per-observable basis of the indicator. For example, all alerts generated in a 24-hour time period that match the `contoso.com` domain are grouped into a single incident with a severity assigned based on the highest alert severity.
+
+1. Observe the indicator details. When a match is found, the indicator is published to the Log Analytics **ThreatIntelligenceIndicators** table, and displayed in the **Threat Intelligence** page. For any indicators published from this rule, the source is defined as **Microsoft Threat Intelligence Analytics**.
 
 For example, in the **ThreatIntelligenceIndicators** log:
 
@@ -90,7 +92,7 @@ Part of the Microsoft Threat Intelligence available through matching analytics i
 
 :::image type="content" source="media/use-matching-analytics-to-detect-threats/mdti-article-link.png" alt-text="Screenshot of an incident with a link to the reference MDTI article.":::
 
-For more information, see the [MDTI portal](https://ti.defender.microsoft.com).
+For more information, see the [MDTI portal](https://ti.defender.microsoft.com) and [What is Microsoft Defender Threat Intelligence?](/../../defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti.md)
 
 ## Next steps