move text into note

Author: duongau

articles/firewall/monitor-firewall.md

@@ -98,10 +98,11 @@ New resource specific tables are now available in Diagnostic setting that allows
 - [Top flow log](/azure/azure-monitor/reference/tables/azfwfatflow) - The Top Flows (Fat Flows) log shows the top connections that are contributing to the highest throughput through the firewall.
 - [Flow trace](/azure/azure-monitor/reference/tables/azfwflowtrace) - Contains flow information, flags, and the time period when the flows were recorded. You can see full flow information such as SYN, SYN-ACK, FIN, FIN-ACK, RST, INVALID (flows).
 
-All resource specific tables now support Basic log mode, which can reduce logging costs by up to 80%. However, [Policy Analytics](policy-analytics.md) and [Security Copilot integrations](firewall-copilot.md) aren't compatible with Basic log mode. For more information on the limitations and differences of this logging mode, see [Azure Monitor Logs](/azure/azure-monitor/logs/data-platform-logs#table-plans). To learn about the new querying experience, see [Query data in a basic and auxiliary table](/azure/azure-monitor/logs/basic-logs-query).
+All resource specific tables now support *Basic* table plan, which can reduce logging costs by up to 80%. For more information on the limitations and differences of this new logging mode, see [Azure Monitor Logs](/azure/azure-monitor/logs/data-platform-logs#table-plans). To learn about the new querying experience, see [Query data in a basic and auxiliary table](/azure/azure-monitor/logs/basic-logs-query).
 
 > [!NOTE]
-> The table plan can be updated only once every **7 days**.
+> - [Policy Analytics](policy-analytics.md) and [Security Copilot integrations](firewall-copilot.md) aren't compatible with Basic log mode. To enable these features, make sure the required log tables are configured under the analytics table plan.
+> - The table plan can be updated only once every **7 days**.
 
 ### Enable structured logs