Continued work 5

yelevin · yelevin · commit 39a633513601 · 2025-01-01T12:53:05.000+02:00
diff --git a/articles/sentinel/monitor-data-connector-health.md b/articles/sentinel/monitor-data-connector-health.md
@@ -52,7 +52,7 @@ There are three tabbed sections in this workbook:
 
 - The **Overview** tab shows the general status of data ingestion in the selected workspace: volume measures, EPS rates, and time last log received.
 
-- The **Data collection anomalies** tab will help you to detect anomalies in the data collection process, by table and data source. Each tab presents anomalies for a particular table (the **General** tab includes a collection of tables). The anomalies are calculated using the **series_decompose_anomalies()** function that returns an **anomaly score**. [Learn more about this function](/azure/data-explorer/kusto/query/series-decompose-anomaliesfunction?WT.mc_id=Portal-fx). Set the following parameters for the function to evaluate:
+- The **Data collection anomalies** tab will help you to detect anomalies in the data collection process, by table and data source. Each tab presents anomalies for a particular table (the **General** tab includes a collection of tables). The anomalies are calculated using the **series_decompose_anomalies()** function that returns an **anomaly score**. [Learn more about this function](/kusto/query/series-decompose-anomalies-function?view=microsoft-sentinel&preserve-view=true&WT.mc_id=Portal-fx). Set the following parameters for the function to evaluate:
 
     - **AnomaliesTimeRange**: This time picker applies only to the data collection anomalies view.
     - **SampleInterval**: The time interval in which data is sampled in the given time range. The anomaly score is calculated only on the last interval's data.
@@ -117,45 +117,56 @@ SentinelHealth
 **Detect connectors with changes from fail to success state**:
 
 ```kusto
-let lastestStatus = SentinelHealth
+let latestStatus = SentinelHealth
 | where TimeGenerated > ago(12h)
 | where OperationName == 'Data fetch status change'
 | where Status in ('Success', 'Failure')
 | project TimeGenerated, SentinelResourceName, SentinelResourceId, LastStatus = Status
 | summarize TimeGenerated = arg_max(TimeGenerated,*) by SentinelResourceName, SentinelResourceId;
-let nextToLastestStatus = SentinelHealth
+let nextTolatestStatus = SentinelHealth
 | where TimeGenerated > ago(12h)
 | where OperationName == 'Data fetch status change'
 | where Status in ('Success', 'Failure')
-| join kind = leftanti (lastestStatus) on SentinelResourceName, SentinelResourceId, TimeGenerated
+| join kind = leftanti (latestStatus) on SentinelResourceName, SentinelResourceId, TimeGenerated
 | project TimeGenerated, SentinelResourceName, SentinelResourceId, NextToLastStatus = Status
 | summarize TimeGenerated = arg_max(TimeGenerated,*) by SentinelResourceName, SentinelResourceId;
-lastestStatus
-| join kind=inner (nextToLastestStatus) on SentinelResourceName, SentinelResourceId
+latestStatus
+| join kind=inner (nextTolatestStatus) on SentinelResourceName, SentinelResourceId
 | where NextToLastStatus == 'Failure' and LastStatus == 'Success'
 ```
 
 **Detect connectors with changes from success to fail state**:
 
 ```kusto
-let lastestStatus = SentinelHealth
+let latestStatus = SentinelHealth
 | where TimeGenerated > ago(12h)
 | where OperationName == 'Data fetch status change'
 | where Status in ('Success', 'Failure')
 | project TimeGenerated, SentinelResourceName, SentinelResourceId, LastStatus = Status
 | summarize TimeGenerated = arg_max(TimeGenerated,*) by SentinelResourceName, SentinelResourceId;
-let nextToLastestStatus = SentinelHealth
+let nextTolatestStatus = SentinelHealth
 | where TimeGenerated > ago(12h)
 | where OperationName == 'Data fetch status change'
 | where Status in ('Success', 'Failure')
-| join kind = leftanti (lastestStatus) on SentinelResourceName, SentinelResourceId, TimeGenerated
+| join kind = leftanti (latestStatus) on SentinelResourceName, SentinelResourceId, TimeGenerated
 | project TimeGenerated, SentinelResourceName, SentinelResourceId, NextToLastStatus = Status
 | summarize TimeGenerated = arg_max(TimeGenerated,*) by SentinelResourceName, SentinelResourceId;
-lastestStatus
-| join kind=inner (nextToLastestStatus) on SentinelResourceName, SentinelResourceId
+latestStatus
+| join kind=inner (nextTolatestStatus) on SentinelResourceName, SentinelResourceId
 | where NextToLastStatus == 'Success' and LastStatus == 'Failure'
 ```
 
+See more information on the following items used in the preceding examples, in the Kusto documentation:
+- [***let*** statement](/kusto/query/let-statement?view=microsoft-sentinel&preserve-view=true)
+- [***where*** operator](/kusto/query/where-operator?view=microsoft-sentinel&preserve-view=true)
+- [***project*** operator](/kusto/query/project-operator?view=microsoft-sentinel&preserve-view=true)
+- [***summarize*** operator](/kusto/query/summarize-operator?view=microsoft-sentinel&preserve-view=true)
+- [***join*** operator](/kusto/query/join-operator?view=microsoft-sentinel&preserve-view=true)
+- [***ago()*** function](/kusto/query/ago-function?view=microsoft-sentinel&preserve-view=true)
+- [***arg_max()*** aggregation function](/kusto/query/arg-max-aggregation-function?view=microsoft-sentinel&preserve-view=true)
+
+[!INCLUDE [kusto-reference-general-no-alert](includes/kusto-reference-general-no-alert.md)]
+
 ### Configure alerts and automated actions for health issues
 
 While you can use the Microsoft Sentinel [analytics rules](automate-incident-handling-with-automation-rules.md) to configure automation in Microsoft Sentinel logs, if you want to be notified and take immediate action for health drifts in your data connectors, we recommend that you use [Azure Monitor alert rules](/azure/azure-monitor/alerts/alerts-overview).
diff --git a/articles/sentinel/normalization-develop-parsers.md b/articles/sentinel/normalization-develop-parsers.md
@@ -410,7 +410,7 @@ Handle the results as follows:
 | Missing recommended alias [\<Field\>] aliasing existing column [\<Field\>] | Add the alias to your parser |
 | Missing optional alias [\<Field\>] aliasing existing column [\<Field\>] | Add the alias to your parser |
 | Missing mandatory alias [\<Field\>] aliasing missing column [\<Field\>] | This error accompanies a similar error for the aliased field. Correct the aliased field error and add this alias to your parser. |
-| Type mismatch for field [\<Field\>]. It is currently [\<Type\>] and should be [\<Type\>] | Make sure that the type of normalized field is correct, usually by using a [conversion function](/azure/data-explorer/kusto/query/scalarfunctions#conversion-functions) such as `tostring`. |
+| Type mismatch for field [\<Field\>]. It is currently [\<Type\>] and should be [\<Type\>] | Make sure that the type of normalized field is correct, usually by using a [conversion function](/kusto/query/scalar-functions?view=microsoft-sentinel&preserve-view=true#conversion-functions) such as `tostring`. |
 
 | Info | Action |
 | ----- | ------ |
@@ -447,7 +447,7 @@ Handle the results as follows:
 
 | Message | Action |
 | ------- | ------ |
-| **(0) Error: type mismatch for column  [\<Field\>]. It is currently [\<Type\>] and should be [\<Type\>]** | Make sure that the type of normalized field is correct, usually by using a [conversion function](/azure/data-explorer/kusto/query/scalarfunctions#conversion-functions) such as `tostring`.  |
+| **(0) Error: type mismatch for column  [\<Field\>]. It is currently [\<Type\>] and should be [\<Type\>]** | Make sure that the type of normalized field is correct, usually by using a [conversion function](/kusto/query/scalar-functions?view=microsoft-sentinel&preserve-view=true#conversion-functions) such as `tostring`.  |
 | **(0) Error: Invalid value(s) (up to 10 listed) for field [\<Field\>] of type [\<Logical Type\>]** | Make sure that the parser maps the correct source field to the output field. If mapped correctly, update the parser to transform the source value to the correct type, value or format. Refer to the [list of logical types](normalization-about-schemas.md#logical-types) for more information on the correct values and formats for each logical type. <br><br>Note that the testing tool lists only a sample of 10 invalid values.   |
 | **(1) Warning: Empty value in mandatory field [\<Field\>]** | Mandatory fields should be populated, not just defined. Check whether the field can be populated from other sources for records for which the current source is empty. |
 | **(2) Info: Empty value in recommended field [\<Field\>]** | Recommended fields should usually be populated. Check whether the field can be populated from other sources for records for which the current source is empty. |
diff --git a/articles/sentinel/normalization-parsers-overview.md b/articles/sentinel/normalization-parsers-overview.md
@@ -13,7 +13,7 @@ ms.author: ofshezaf
 
 # The Advanced Security Information Model (ASIM) parsers (Public preview)
 
-In Microsoft Sentinel, parsing and [normalizing](normalization.md) happen at query time. Parsers are built as [KQL user-defined functions](/azure/data-explorer/kusto/query/functions/user-defined-functions) that transform data in existing tables, such as **CommonSecurityLog**, custom logs tables, or Syslog, into the normalized schema.
+In Microsoft Sentinel, parsing and [normalizing](normalization.md) happen at query time. Parsers are built as [KQL user-defined functions](/kusto/query/functions/user-defined-functions?view=microsoft-sentinel&preserve-view=true) that transform data in existing tables, such as **CommonSecurityLog**, custom logs tables, or Syslog, into the normalized schema.
 
 Users [use Advanced Security Information Model (ASIM) parsers](normalization-about-parsers.md) instead of table names in their queries to view data in a normalized format, and to include all data relevant to the schema in your query. 
 
diff --git a/articles/sentinel/normalization-schema-audit.md b/articles/sentinel/normalization-schema-audit.md
@@ -76,7 +76,7 @@ The following filtering parameters are available:
 | **object_has_any** | dynamic/string | Filter only events in which [Object](#object) field includes any of the terms provided. | 
 | **newvalue_has_any** | dynamic/string | Filter only events in which [NewValue](#object) field includes any of the terms provided. | 
 
-Some parameter can accept both list of values of type `dynamic` or a single string value. To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/azure/data-explorer/kusto/query/scalar-data-types/dynamic#dynamic-literals.md). For example: `dynamic(['192.168.','10.'])`
+Some parameter can accept both list of values of type `dynamic` or a single string value. To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/kusto/query/scalar-data-types/dynamic?view=microsoft-sentinel&preserve-view=true#dynamic-literals). For example: `dynamic(['192.168.','10.'])`
 
 For example, to filter only audit events with the terms `install` or `update` in their [Operation](#operation) field, from the last day , use:
 
diff --git a/articles/sentinel/normalization-schema-authentication.md b/articles/sentinel/normalization-schema-authentication.md
@@ -67,7 +67,7 @@ imAuthentication (targetusername_has = 'johndoe', starttime = ago(1d), endtime=n
 
 
 > [!TIP]
-> To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/azure/data-explorer/kusto/query/scalar-data-types/dynamic#dynamic-literals.md). For example: `dynamic(['192.168.','10.'])`.
+> To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/kusto/query/scalar-data-types/dynamic?view=microsoft-sentinel&preserve-view=true#dynamic-literals). For example: `dynamic(['192.168.','10.'])`.
 >
 
 
diff --git a/articles/sentinel/normalization-schema-dns.md b/articles/sentinel/normalization-schema-dns.md
@@ -108,7 +108,7 @@ let torProxies=dynamic(["tor2web.org", "tor2web.com", "torlink.co"]);
 _Im_Dns (domain_has_any = torProxies)
 ```
 
-Some parameter can accept both list of values of type `dynamic` or a single string value. To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/azure/data-explorer/kusto/query/scalar-data-types/dynamic#dynamic-literals.md). For example: `dynamic(['192.168.','10.'])`
+Some parameter can accept both list of values of type `dynamic` or a single string value. To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/kusto/query/scalar-data-types/dynamic?view=microsoft-sentinel&preserve-view=true#dynamic-literals). For example: `dynamic(['192.168.','10.'])`
 
 ## Normalized content
 
diff --git a/articles/sentinel/normalization-schema-network.md b/articles/sentinel/normalization-schema-network.md
@@ -71,7 +71,7 @@ The following filtering parameters are available:
 | **dvcaction** | dynamic/string | Filter only network sessions for which the [Device Action field](#dvcaction) is any of the values listed. | 
 | **eventresult** | String | Filter only network sessions with a specific **EventResult** value. |
 
-Some parameter can accept both list of values of type `dynamic` or a single string value. To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/azure/data-explorer/kusto/query/scalar-data-types/dynamic#dynamic-literals.md). For example: `dynamic(['192.168.','10.'])`
+Some parameter can accept both list of values of type `dynamic` or a single string value. To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/kusto/query/scalar-data-types/dynamic?view=microsoft-sentinel&preserve-view=true#dynamic-literals). For example: `dynamic(['192.168.','10.'])`
 
 For example, to filter only network sessions for a specified list of domain names, use:
 
@@ -81,7 +81,7 @@ _Im_NetworkSession (hostname_has_any = torProxies)
 ```
 
 > [!TIP]
-> To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/azure/data-explorer/kusto/query/scalar-data-types/dynamic#dynamic-literals.md). For example: `dynamic(['192.168.','10.'])`.
+> To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/kusto/query/scalar-data-types/dynamic?view=microsoft-sentinel&preserve-view=true#dynamic-literals). For example: `dynamic(['192.168.','10.'])`.
 >
 
 ## Normalized content
diff --git a/articles/sentinel/normalization-schema-process-event.md b/articles/sentinel/normalization-schema-process-event.md
@@ -75,7 +75,7 @@ imProcessCreate (targetusername_has = 'johndoe', starttime = ago(1d), endtime=no
 ```
 
 > [!TIP]
-> To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/azure/data-explorer/kusto/query/scalar-data-types/dynamic#dynamic-literals.md). For example: `dynamic(['192.168.','10.'])`.
+> To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/kusto/query/scalar-data-types/dynamic?view=microsoft-sentinel&preserve-view=true#dynamic-literals). For example: `dynamic(['192.168.','10.'])`.
 >
 
 ## Normalized content
diff --git a/articles/sentinel/normalization-schema-web.md b/articles/sentinel/normalization-schema-web.md
@@ -86,7 +86,7 @@ The following filtering parameters are available:
 | **eventresultdetails_in** | dynamic | Filter only web sessions for which the HTTP status code, stored in the [EventResultDetails](#eventresultdetails) field, is any of the values listed. | 
 | **eventresult** | string | Filter only network sessions with a specific **EventResult** value. |
 
-Some parameter can accept both list of values of type `dynamic` or a single string value. To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/azure/data-explorer/kusto/query/scalar-data-types/dynamic#dynamic-literals). For example: `dynamic(['192.168.','10.'])`
+Some parameter can accept both list of values of type `dynamic` or a single string value. To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/kusto/query/scalar-data-types/dynamic?view=microsoft-sentinel&preserve-view=true#dynamic-literals). For example: `dynamic(['192.168.','10.'])`
 
 For example, to filter only Web sessions for a specified list of domain names, use:
 
diff --git a/articles/sentinel/normalization.md b/articles/sentinel/normalization.md
@@ -80,7 +80,7 @@ For more information, see [ASIM schemas](normalization-about-schemas.md).
 
 ### Query time parsers
 
-ASIM uses query time parsers to map existing data to the normalized schemas using [KQL functions](/azure/data-explorer/kusto/query/functions/user-defined-functions). Many ASIM parsers are available out of the box with Microsoft Sentinel. More parsers, and versions of the built-in parsers that can be modified can be deployed from the [Microsoft Sentinel GitHub repository](https://aka.ms/AzSentinelASim).
+ASIM uses query time parsers to map existing data to the normalized schemas using [KQL functions](/kusto/query/functions/user-defined-functions?view=microsoft-sentinel&preserve-view=true). Many ASIM parsers are available out of the box with Microsoft Sentinel. More parsers, and versions of the built-in parsers that can be modified can be deployed from the [Microsoft Sentinel GitHub repository](https://aka.ms/AzSentinelASim).
 
 For more information, see [ASIM parsers](normalization-parsers-overview.md).
 
diff --git a/articles/sentinel/skill-up-resources.md b/articles/sentinel/skill-up-resources.md
@@ -309,7 +309,7 @@ The current implementation is based on query time normalization, which uses KQL
     - View the "Understanding normalization in Microsoft Sentinel" webinar: [YouTube](https://www.youtube.com/watch?v=WoGD-JeC7ng) or [presentation](https://1drv.ms/b/s!AnEPjr8tHcNmjDY1cro08Fk3KUj-?e=murYHG).
     - View the "Deep Dive into Microsoft Sentinel normalizing parsers and normalized content" webinar: [YouTube](https://www.youtube.com/watch?v=zaqblyjQW6k), [MP3](https://aka.ms/AS_Normalizing_Parsers_and_Normalized_Content_11AUG2021_MP4), or [presentation](https://1drv.ms/b/s!AnEPjr8tHcNmjGtoRPQ2XYe3wQDz?e=R3dWeM).
 
-- **Parsers** map existing data to the normalized schemas. You implement parsers by using [KQL functions](/azure/data-explorer/kusto/query/functions/user-defined-functions). View the "Extend and manage ASIM: Developing, testing and deploying parsers" webinar: [YouTube](https://youtu.be/NHLdcuJNqKw) or [presentation](https://1drv.ms/b/s!AnEPjr8tHcNmk0_k0zs21rL7euHp?e=5XkTnW).
+- **Parsers** map existing data to the normalized schemas. You implement parsers by using [KQL functions](/kusto/query/functions/user-defined-functions?view=microsoft-sentinel&preserve-view=true). View the "Extend and manage ASIM: Developing, testing and deploying parsers" webinar: [YouTube](https://youtu.be/NHLdcuJNqKw) or [presentation](https://1drv.ms/b/s!AnEPjr8tHcNmk0_k0zs21rL7euHp?e=5XkTnW).
 
 - **Content** for each normalized schema includes analytics rules, workbooks, and hunting queries. This content works on any normalized data without the need to create source-specific content.
 
@@ -362,7 +362,7 @@ In this section, we grouped the modules that help you learn how to create such c
 
 ### Module 10: Kusto Query Language
 
-Most Microsoft Sentinel capabilities use [Kusto Query Language (KQL)](/azure/data-explorer/kusto/query/). When you search in your logs, write rules, create hunting queries, or design workbooks, you use KQL.  
+Most Microsoft Sentinel capabilities use [Kusto Query Language (KQL)](/kusto/query/?view=microsoft-sentinel&preserve-view=true). When you search in your logs, write rules, create hunting queries, or design workbooks, you use KQL.  
 
 The next section on writing rules explains how to use KQL in the specific context of SIEM rules.
 
diff --git a/articles/sentinel/troubleshoot-analytics-rules.md b/articles/sentinel/troubleshoot-analytics-rules.md
@@ -74,7 +74,7 @@ Another kind of permanent failure occurs due to an **improperly built query** th
 
 To re-enable the rule, you must address the issues in the query that cause it to use too many resources. See the following articles for best practices to optimize your Kusto queries:
 
-- [Query best practices - Azure Data Explorer](/azure/data-explorer/kusto/query/best-practices)
+- [Query best practices - Kusto documentation](/kusto/query/best-practices?view=microsoft-sentinel&preserve-view=true)
 - [Optimize log queries in Azure Monitor](/azure/azure-monitor/logs/query-optimization)
 
 Also see [Useful resources for working with Kusto Query Language in Microsoft Sentinel](kusto-resources.md) for further assistance.
diff --git a/articles/sentinel/watchlists.md b/articles/sentinel/watchlists.md
@@ -51,7 +51,7 @@ Before you create a watchlist, be aware of the following limitations:
 - Using Lighthouse to manage watchlists across different workspaces is not supported at this time.
 - Local file uploads are currently limited to files of up to 3.8 MB in size.
 - File uploads from an Azure Storage account (in preview) are currently limited to files up to 500 MB in size.
-- Watchlists must adhere to the same column and table restrictions as KQL entities. For more information, see [KQL entity names](/azure/data-explorer/kusto/query/schema-entities/entity-names).
+- Watchlists must adhere to the same column and table restrictions as KQL entities. For more information, see [KQL entity names](/kusto/query/schema-entities/entity-names?view=microsoft-sentinel&preserve-view=true).
 
 ## Options to create watchlists
 

Original file line number	Diff line number	Diff line change
`@@ -67,7 +67,7 @@ imAuthentication (targetusername_has = 'johndoe', starttime = ago(1d), endtime=n`
`67`	`67`
`68`	`68`
`69`	`69`	`> [!TIP]`
`70`		-> To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/azure/data-explorer/kusto/query/scalar-data-types/dynamic#dynamic-literals.md). For example: `dynamic(['192.168.','10.'])`.
	`70`	+> To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/kusto/query/scalar-data-types/dynamic?view=microsoft-sentinel&preserve-view=true#dynamic-literals). For example: `dynamic(['192.168.','10.'])`.
`71`	`71`	`>`
`72`	`72`
`73`	`73`
Original file line number	Diff line number	Diff line change
`@@ -75,7 +75,7 @@ imProcessCreate (targetusername_has = 'johndoe', starttime = ago(1d), endtime=no`
`75`	`75`	```
`76`	`76`
`77`	`77`	`> [!TIP]`
`78`		-> To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/azure/data-explorer/kusto/query/scalar-data-types/dynamic#dynamic-literals.md). For example: `dynamic(['192.168.','10.'])`.
	`78`	+> To pass a literal list to parameters that expect a dynamic value, explicitly use a [dynamic literal](/kusto/query/scalar-data-types/dynamic?view=microsoft-sentinel&preserve-view=true#dynamic-literals). For example: `dynamic(['192.168.','10.'])`.
`79`	`79`	`>`
`80`	`80`
`81`	`81`	`## Normalized content`