Skip to content

Commit 4ff45a0

Browse files
committed
Content review
1 parent 649c8c9 commit 4ff45a0

File tree

1 file changed

+5
-6
lines changed

1 file changed

+5
-6
lines changed

articles/sentinel/bookmarks.md

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,8 @@ Hunting bookmarks in Microsoft Sentinel helps you preserve the queries and query
2626
Create a bookmark to preserve the queries, results, your observations, and findings.
2727

2828
1. For Microsoft Sentinel in the [Azure portal](https://portal.azure.com), under **Threat management** select **Hunting**.<br> For Microsoft Sentinel in the [Defender portal](https://security.microsoft.com/), select **Microsoft Sentinel** > **Threat management** > **Hunting**.
29-
1. From the **Hunting** tab, select a hunt.
30-
1. Select one of the hunting queries.
31-
1. In the hunting query details, select **Run Query**.
29+
1. From the **Queries** tab, select one or more of the hunting queries.
30+
1. From the top command bar, select **Run selected queries**.
3231

3332
1. Select **View query results**. For example:
3433

@@ -38,7 +37,7 @@ Create a bookmark to preserve the queries, results, your observations, and findi
3837

3938
1. From the log query results list, use the checkboxes to select one or more rows that contain the information you find interesting.
4039

41-
1. Select **Add bookmark**:
40+
1. In Azure portal, select **Add bookmark**:
4241

4342
:::image type="content" source="media/bookmarks/add-hunting-bookmark.png" alt-text="Screenshot of adding hunting bookmark to query." lightbox="media/bookmarks/add-hunting-bookmark.png":::
4443

@@ -56,7 +55,7 @@ Create a bookmark to preserve the queries, results, your observations, and findi
5655

5756
1. Select **Save** to commit your changes and add the bookmark. All bookmarked data is shared with other analysts, and is a first step toward a collaborative investigation experience.
5857

59-
The log query results support bookmarks whenever this pane is opened from Microsoft Sentinel. For example, you select **General** > **Logs** from the navigation bar, select event links in the investigations graph, or select an alert ID from the full details of an incident. You can't create bookmarks when the **Logs** pane is opened from other locations, such as directly from Azure Monitor.
58+
The log query results support bookmarks whenever this pane is opened from Microsoft Sentinel. For example, if you select **General** > **Logs** from the navigation bar, select event links in the investigations graph, or select an alert ID from the full details of an incident. You can't create bookmarks when the **Logs** pane is opened from another location, such as directly from Azure Monitor.
6059

6160
## View and update bookmarks
6261

@@ -86,7 +85,7 @@ For instructions to use the investigation graph, see [Use the investigation grap
8685

8786
## Add bookmarks to a new or existing incident
8887

89-
Add bookmarks to an incident from the bookmarks tab on the **Hunting** page.
88+
Add bookmarks to an incident from the bookmarks tab on the **Hunting** page.
9089

9190
1. From the **Bookmarks** tab, select the bookmark or bookmarks you want to add to an incident.
9291

0 commit comments

Comments
 (0)