Final publish draft

Author: yelevin

articles/sentinel/manage-analytics-rule-templates.md

@@ -43,9 +43,9 @@ With the implementation of template version control, you can see and track the v
 
 1. Select any rule of type **Scheduled**.  
 
-    - If the rule displays the "*Update available*" badge, its details pane will have a **Review and update** button next to the **Edit** button (see image 1 below).
+    - If the rule displays the "*Update available*" badge, its details pane will have a **Review and update** button next to the **Edit** button (see image 1 in the next step below).
 
-    - If the rule was created from a template but does not have the "*Update available*" badge, its details pane will have a **Compare with template** button next to the **Edit** button (see images 2 and 3 below).
+    - If the rule was created from a template but does not have the "*Update available*" badge, its details pane will have a **Compare with template** button next to the **Edit** button (see images 2 and 3 in the next step below).
 
     - If there is only an **Edit** button, the rule was created from scratch, not from a template.
 
@@ -64,11 +64,13 @@ With the implementation of template version control, you can see and track the v
 
     > [!NOTE]
     > Images 2 and 3 above show two examples of rules created from templates, where the template has not been updated.
-    > - Image 2 shows a rule that had been created after Azure Sentinel's initial implementation of template version control in mid-2021 (***EXACT MONTH?***)
-    > - Image 3 shows a rule that had been created before that time, so there is no version information for the template. If there is a latest template version available, it is likely a new version of the template.
+    > - Image 2 shows a rule that has a version number for its current template. This signals that the rule was created after Azure Sentinel's initial implementation of template version control in October 2021.
+    > - Image 3 shows a rule that doesn't have a current template version. This shows that the rule had been created before October 2021. If there is a latest template version available, it's likely a newer version of the template than the one used to create the rule.
 
 ## Compare your active rule with its template
 
+Choose one of the following tabs according to the action you wish to take, to see the instructions for that action:
+
 # [Update template](#tab/update)
 
 Having selected a rule and determined that you want to consider updating it, select **Review and update** on the details pane (see above). You'll see that the **Analytics rule wizard** now has a **Compare to latest version** tab.

articles/sentinel/whats-new.md

@@ -30,8 +30,21 @@ If you're looking for items older than six months, you'll find them in the [Arch
 
 ## October 2021
 
+- [Manage template versions for your scheduled analytics rules (Public preview)](#manage-template-versions-for-your-scheduled-analytics-rules-public-preview)
 - [DHCP normalization schema (Public preview)](#dhcp-normalization-schema-public-preview)
 
+### Manage template versions for your scheduled analytics rules (Public preview)
+
+When you create analytics rules from [built-in Azure Sentinel rule templates](detect-threats-built-in.md), you effectively create a copy of the template. Past that point, the active rule is ***not*** dynamically updated to match any changes that get made to the originating template.
+
+However, rules created from templates ***do*** remember which templates they came from, which allows you two advantages:
+
+- If you made changes to a rule when creating it from a template (or at any time after that), you can always revert the rule back to its original version (as a copy of the template).
+
+- You can get notified when a template is updated, and you'll have the choice to update your rules to the new version of their templates or leave them as they are.
+
+[Learn how to manage these tasks](manage-analytics-rule-templates.md), and what to keep in mind. These procedures apply to any [Scheduled](detect-threats-built-in.md#scheduled) analytics rules created from templates.
+
 ### DHCP normalization schema (Public preview)
 
 The Azure Sentinel Information Model (ASIM) now supports a DHCP normalization schema, which is used to describe events reported by a DHCP server and is used by Azure Sentinel to enable source-agnostic analytics.