Update incident-navigate-triage.md

Author: batamig

articles/sentinel/incident-navigate-triage.md

@@ -26,15 +26,15 @@ This article describes how to navigate and run basic triage on your incidents in
 
 1. From the Microsoft Sentinel navigation menu, under **Threat management**, select **Incidents**.
 
-    The **Incidents** page gives you basic information about all of your open incidents.
+    The **Incidents** page gives you basic information about all of your open incidents. For example:
 
-    - Across the top of the screen, you have a toolbar with actions you can take outside of a specific incident—either on the grid as a whole, or on multiple selected incidents. You also have the counts of open incidents, whether new or active, and the counts of open incidents by severity.
+    :::image type="content" source="media/investigate-incidents/incident-grid.png" alt-text="Screenshot of view of incident severity." lightbox="media/investigate-incidents/incident-grid.png":::
 
-    - In the central pane, you have an incident grid, which is a list of incidents as filtered by the filtering controls at the top of the list, and a search bar to find specific incidents.
+    - **Across the top of the screen**, you have a toolbar with actions you can take outside of a specific incident—either on the grid as a whole, or on multiple selected incidents. You also have the counts of open incidents, whether new or active, and the counts of open incidents by severity.
 
-    - On the right side, you have a details pane that shows important information about the incident highlighted in the central list, along with buttons for taking certain specific actions regarding that incident.
+    - **In the central pane**, you have an incident grid, which is a list of incidents as filtered by the filtering controls at the top of the list, and a search bar to find specific incidents.
 
-    :::image type="content" source="media/investigate-incidents/incident-grid.png" alt-text="Screenshot of view of incident severity." lightbox="media/investigate-incidents/incident-grid.png":::
+    - **On the side**, you have a details pane that shows important information about the incident highlighted in the central list, along with buttons for taking certain specific actions regarding that incident.
 
 1. Your security operations team might have [automation rules](automate-incident-handling-with-automation-rules.md#automatic-assignment-of-incidents) in place to perform basic triage on new incidents and assign them to the proper personnel.
 
@@ -64,14 +64,15 @@ This article describes how to navigate and run basic triage on your incidents in
 
 1. If the information in the details pane is sufficient to prompt further remediation or mitigation actions, select the **Actions** button at the bottom to do one of the following:
 
-    - **Investigate:** use the [graphical investigation tool](investigate-incidents.md#investigate-incidents-visually-using-the-investigation-graph) to discover relationships between alerts, entities, and activities, both within this incident and across other incidents.
-
-    - **Run playbook:** run a [playbook](automate-responses-with-playbooks.md#run-a-playbook-manually) on this incident to take particular [enrichment, collaboration, or response actions](automate-responses-with-playbooks.md#use-cases-for-playbooks) such as your SOC engineers might have made available.
-
-    - **Create automation rule:** create an [automation rule](automate-incident-handling-with-automation-rules.md#common-use-cases-and-scenarios) that runs only on incidents like this one (generated by the same analytics rule) in the future, in order to reduce your future workload or to account for a temporary change in requirements (such as for a penetration test).
-
-    - **Create team (Preview):** create a team in Microsoft Teams to collaborate with other individuals or teams across departments on handling the incident.
-
+   |Action  | Description  |
+   |---------|---------|
+   | **Investigate** | Use the [graphical investigation tool](investigate-incidents.md#investigate-incidents-visually-using-the-investigation-graph) to discover relationships between alerts, entities, and activities, both within this incident and across other incidents.|
+   |**Run playbook** | Run a [playbook](automate-responses-with-playbooks.md#run-a-playbook-manually) on this incident to take particular [enrichment, collaboration, or response actions](automate-responses-with-playbooks.md#use-cases-for-playbooks) such as your SOC engineers might have made available.|  
+   | **Create automation rule**| Create an [automation rule](automate-incident-handling-with-automation-rules.md#common-use-cases-and-scenarios) that runs only on incidents like this one (generated by the same analytics rule) in the future, in order to reduce your future workload or to account for a temporary change in requirements (such as for a penetration test). |
+   | **Create team (Preview)**| Create a team in Microsoft Teams to collaborate with other individuals or teams across departments on handling the incident. |
+   
+    For example:
+  
     :::image type="content" source="media/investigate-incidents/incident-actions.png" alt-text="Screenshot of menu of actions that can be performed on an incident from the details pane.":::
 
 1. If more information about the incident is needed, select **View full details** in the details pane to open and see the incident's details in their entirety, including the alerts and entities in the incident, a list of similar incidents, and selected top insights.
@@ -149,11 +150,11 @@ Once you resolve a particular incident (for example, when your investigation rea
 
 Select **Select classification** and choose one of the following from the drop-down list:
 
-- True Positive – suspicious activity
-- Benign Positive – suspicious but expected
-- False Positive – incorrect alert logic
-- False Positive – incorrect data
-- Undetermined
+- **True Positive** – suspicious activity
+- **Benign Positive** – suspicious but expected
+- **False Positive** – incorrect alert logic
+- **False Positive** – incorrect data
+- **Undetermined**
 
 :::image type="content" source="media/investigate-incidents/closing-reasons-dropdown.png" alt-text="Screenshot that highlights the classifications available in the Select classification list.":::
 
@@ -165,4 +166,4 @@ After choosing the appropriate classification, add some descriptive text in the
 
 ## Next step
 
-For more information, see [Investigate Microsoft Sentinel incidents in depth in the Azure portal](investigate-incidents.md)
+For more information, see [Investigate Microsoft Sentinel incidents in depth in the Azure portal](investigate-incidents.md)