first draft

Author: Shereen-Bhar

articles/defender-for-iot/organizations/tutorial-palo-alto.md

@@ -20,6 +20,7 @@ The following integration types are available:
 In this tutorial, you learn how to:
 
 > [!div class="checklist"]
+>
 > - Configure immediate blocking by a specified Palo Alto firewall
 > - Create Panorama blocking policies in Defender for IoT
 
@@ -33,7 +34,7 @@ If you don't have an Azure subscription, create a [free account](https://azure.m
 
 ## Configure immediate blocking by a specified Palo Alto firewall
 
-In cases, such as malware-related alerts, you can enable automatic blocking. Defender for IoT forwarding rules is utilized to send a blocking command directly to a specific Palo Alto firewall.
+In cases, such as malware-related alerts, you can enable automatic blocking. If the alert in question hasn't been raised prior to the integration, Defender for IoT forwarding rules is utilized to send a blocking command directly to a specific Palo Alto firewall.
 
 When Defender for IoT identifies a critical threat, it sends an alert that includes an option of blocking the infected source. Selecting **Block Source** in the alert’s details activates the forwarding rule, which sends the blocking command to the specified Palo Alto firewall.
 
@@ -106,15 +107,15 @@ The first step in creating Panorama blocking policies in Defender for IoT is to
 
 1. In the console left pane, select **System settings** > **Network monitoring** > **DNS Reverse Lookup**.
 1. Select **Add DNS server**.
-1. In the **Schedule Reverse Lookup** field define the scheduling options:
+1. In the **Schedule Reverse Lookup** field, define the scheduling options:
       - By specific times: Specify when to perform the reverse lookup daily.
-    - By fixed intervals (in hours): Set the frequency for performing the reverse lookup.
-1. In the **Number of Labels** field instruct Defender for IoT to automatically resolve network IP addresses to device FQDNs. <br />To configure DNS FQDN resolution, add the number of domain labels to display. Up to 30 characters are displayed from left to right.
+      - By fixed intervals (in hours): Set the frequency for performing the reverse lookup.
+1. In the **Number of Labels** field instruct Defender for IoT to automatically resolve network IP addresses to device FQDNs. <br /> To configure DNS FQDN resolution, add the number of domain labels to display. Up to 30 characters are displayed from left to right.
 1. Add the following server details:
 
-    - **DNS Server Address**: Enter the IP address, or the FQDN of the network DNS Server.
-   - **DNS Server Port**: Enter the port used to query the DNS server.
-   - **Subnets**: Set the Dynamic IP address subnet range. The range that Defender for IoT reverses lookup their IP address in the DNS server to match their current FQDN name.
+      - **DNS Server Address**: Enter the IP address, or the FQDN of the network DNS Server.
+      - **DNS Server Port**: Enter the port used to query the DNS server.
+      - **Subnets**: Set the Dynamic IP address subnet range. The range that Defender for IoT reverses lookup their IP address in the DNS server to match their current FQDN name.
 
 1. Select **Save**.
 1. Turn on the **Enabled** toggle to activate the lookup.
@@ -123,7 +124,7 @@ The first step in creating Panorama blocking policies in Defender for IoT is to
 
 ## Block suspicious traffic with the Palo Alto firewall
 
-Suspicious traffic will need to be blocked with the Palo Alto firewall. You can block suspicious traffic through the use forwarding rules in Defender for IoT.
+Suspicious traffic will need to be blocked with the Palo Alto firewall. You can block suspicious traffic through the use forwarding rules in Defender for IoT. However, this use of forwarding rules is only valid for alerts that haven't been raised prior to the integration.
 
 **To block suspicious traffic with the Palo Alto firewall using a Defender for IoT forwarding rule**:
 
@@ -191,4 +192,3 @@ There are no resources to clean up.
 ## Next step
 
 In this article, you learned how to get started with the [Palo Alto integration](./tutorial-splunk.md).
-