fixing tab content

Author: batamig

articles/sentinel/soc-optimization/soc-optimization-access.md

@@ -41,7 +41,8 @@ Watch the following video for an overview and demo of SOC optimization in the Mi
 
 ## Access the SOC optimization page
 
-Use one of the following tabs, depending on whether you're working in the Azure portal or Defender portal:
+Use one of the following tabs, depending on whether you're working in the Azure portal or Defender portal. When your workspace is onboarded for unified security operations, SOC optimizations include coverage from across Microsoft security services.
+
 
 ### [Azure portal](#tab/azure-portal)
 
@@ -55,8 +56,6 @@ In the Defender portal, select **SOC optimization**.
 
 :::image type="content" source="media/soc-optimization-access/soc-optimization-xdr.png" alt-text="Screenshot of the SOC optimization page in the Defender portal." lightbox="media/soc-optimization-access/soc-optimization-xdr.png":::
 
-When your workspace is onboarded for unified security operations, SOC optimizations include coverage from across Microsoft security services.
-
 ---
 
 ## Understand SOC optimization overview metrics
@@ -80,7 +79,7 @@ Select **See all threat scenarios** to view the full list of relevant threats, a
 |---------|---------|
 |**Recent optimization value**    | Shows value gained based on recommendations you recently implemented |
 |**Data ingested**     | Shows the total data ingested in your workspace over the last 90 days. |
-|**Threat-based coverage optimizations**     |   Shows a **High**, **Medium**, and **Low** coverage indicator, based on the number of analytics rules (detections) found in your workspace, compared with the number of rules recommended by the Microsoft research team.<br>The metrics show a ratio of your active detections, and if you're onboarded to the unified security operations platform, the ratio of active security services in your environment.<br><br>Select **View all threat scenarios** to view the full list of relevant to view the full list of relevant threats, active and recommended detections, and coverage levels. Select a threat scenario to drill down for more details about the recommendation. |
+|**Threat-based coverage optimizations**     |   Shows a **High**, **Medium**, and **Low** coverage indicator, based on the number of analytics rules (detections) found in your workspace, compared with the number of rules recommended by the Microsoft research team.<br><br>The metrics show a ratio of your active detections and the ratio of active security services in your environment.<br><br>Select **View all threat scenarios** to view the full list of relevant threats, active and recommended detections, and coverage levels. Then, select a threat scenario to drill down for more details about the recommendation on a separate, threat scenario details page. |
 |**Optimization status**     | Shows the number of recommended optimizations that are currently active, completed, and dismissed.        |
 
 <!--do we have an indication of what low med high mean? we use to have best, better, good, moderate, none-->
@@ -118,7 +117,20 @@ Filter the optimizations based on optimization type, or search for a specific op
 
 ### View optimization details and take action
 
-1. In each optimization card, select **View  details** to see a full description of the observation that led to the recommendation, and the value you see in your environment when that recommendation is implemented.
+Select one of the following tabs, depending on the portal you're using:
+
+### [Azure portal](#tab/azure-portal)
+
+In each optimization card, select **View details** to see a full description of the observation that led to the recommendation, and the value you see in your environment when that recommendation is implemented.
+
+Scroll down to the bottom of the details pane for a link to where you can take the recommended actions. For example:
+
+- If an optimization includes recommendations to add analytics rules, select **Go to Content Hub**.
+- If an optimization includes recommendations to move a table to basic logs, select **Change plan**.
+
+### [Defender portal](#tab/defender-portal)
+
+1. In each optimization card, select **View details** to see a full description of the observation that led to the recommendation, and the value you see in your environment when that recommendation is implemented.
 
 1. For threat-based coverage optimizations:
 
@@ -133,6 +145,8 @@ Filter the optimizations based on optimization type, or search for a specific op
 
     :::image type="content" source="media/soc-optimization-access/threat-scenario-page.png" alt-text="Screenshot of the SOC optimization threat scenario page.":::
 
+---
+
 If you choose to install an analytics rule template from the Content hub, and you don't already have the solution installed, only the analytics rule template that you install is shown in the solution when you're done. Install the full solution to see all available content items from the selected solution. For more information, see [Discover and manage Microsoft Sentinel out-of-the-box content](../sentinel-solutions-deploy.md).
 
 ### Manage optimizations