Skip to content

Commit 39a59ee

Browse files
authored
Apply suggestions from code review
1 parent b8858f4 commit 39a59ee

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

articles/sentinel/summary-rules.md

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@ This procedure describes a sample process for using summary rules with [auxiliar
259259
260260
1. Deploy the following ARM template to your Microsoft Sentinel workspace to create a custom table with data collection rules (DCR) and a data collection endpoint (DCE).
261261
262-
[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https://%3A%2F%2Faka.ms%2FDeployCEFresources)
262+
[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/aka.ms/DeployCEFresources)
263263
264264
265265
1. Note the following deatails from the ARM template output:
@@ -300,7 +300,6 @@ This procedure describes a sample process for using summary rules with [auxiliar
300300
add_field => {"LogstashVersion" => "${LOGSTASH_VERSION}"}
301301
}
302302
prune {
303-
whitelist_names => [ "Message", "TimeGenerated", "Activity", "LogSeverity", "CefVersion", "DeviceVendor", "DeviceProduct", "DeviceVersion", "DeviceEventClassID"]
304303
}
305304
}
306305
output {

0 commit comments

Comments
 (0)