Update detect-threats-custom.md

Numbered list fix

Author: Jill Grant

articles/sentinel/detect-threats-custom.md

@@ -33,15 +33,15 @@ Analytics rules search for specific events or sets of events across your environ
 
 ### Analytics rule wizard—General tab
 
-- Provide a unique **Name** and a **Description**.
+1. Provide a unique **Name** and a **Description**.
 
-- In the **Tactics and techniques** field, you can choose from among categories of attacks by which to classify the rule. These are based on the tactics and techniques of the [MITRE ATT&CK](https://attack.mitre.org/) framework.
+1. In the **Tactics and techniques** field, you can choose from among categories of attacks by which to classify the rule. These are based on the tactics and techniques of the [MITRE ATT&CK](https://attack.mitre.org/) framework.
 
     [Incidents](investigate-cases.md) created from alerts that are detected by rules mapped to MITRE ATT&CK tactics and techniques automatically inherit the rule's mapping.
 
-- Set the alert **Severity** as appropriate.
+1. Set the alert **Severity** as appropriate.
 
-- When you create the rule, its **Status** is **Enabled** by default, which means it will run immediately after you finish creating it. If you don’t want it to run immediately, select **Disabled**, and the rule will be added to your **Active rules** tab and you can enable it from there when you need it.
+1 When you create the rule, its **Status** is **Enabled** by default, which means it will run immediately after you finish creating it. If you don’t want it to run immediately, select **Disabled**, and the rule will be added to your **Active rules** tab and you can enable it from there when you need it.
 
    :::image type="content" source="media/tutorial-detect-threats-custom/general-tab.png" alt-text="Start creating a custom analytics rule":::
 
@@ -106,15 +106,15 @@ In the **Set rule logic** tab, you can either write a query directly in the **Ru
 
 ### Query scheduling and alert threshold
 
-- In the **Query scheduling** section, set the following parameters:
+1. In the **Query scheduling** section, set the following parameters:
 
    :::image type="content" source="media/tutorial-detect-threats-custom/set-rule-logic-tab-2.png" alt-text="Set query schedule and event grouping" lightbox="media/tutorial-detect-threats-custom/set-rule-logic-tab-all-2-new.png":::
 
-  - Set **Run query every** to control how often the query is run—as frequently as every 5 minutes or as infrequently as once every 14 days.
+  1. Set **Run query every** to control how often the query is run—as frequently as every 5 minutes or as infrequently as once every 14 days.
 
-  - Set **Lookup data from the last** to determine the time period of the data covered by the query—for example, it can query the past 10 minutes of data, or the past 6 hours of data. The maximum is 14 days.
+  1. Set **Lookup data from the last** to determine the time period of the data covered by the query—for example, it can query the past 10 minutes of data, or the past 6 hours of data. The maximum is 14 days.
   
-  - For the new **Start running** setting (in Preview):
+  1. For the new **Start running** setting (in Preview):
 
       - Leave it set to **Automatically** to continue the original behavior: the rule will run for the first time immediately upon being created, and after that at the interval set in the **Run query every** setting.
 
@@ -138,7 +138,7 @@ In the **Set rule logic** tab, you can either write a query directly in the **Ru
     >
     > For more information, see [Handle ingestion delay in scheduled analytics rules](ingestion-delay.md).
 
-- Use the **Alert threshold** section to define the sensitivity level of the rule. For example, set **Generate alert when number of query results** to **Is greater than** and enter the number 1000 if you want the rule to generate an alert only if the query returns more than 1000 results each time it runs. This is a required field, so if you don’t want to set a threshold – that is, if you want your alert to register every event – enter 0 in the number field.
+1. Use the **Alert threshold** section to define the sensitivity level of the rule. For example, set **Generate alert when number of query results** to **Is greater than** and enter the number 1000 if you want the rule to generate an alert only if the query returns more than 1000 results each time it runs. This is a required field, so if you don’t want to set a threshold – that is, if you want your alert to register every event – enter 0 in the number field.
 
 ### Results simulation