fix link & formatting

Author: cabailey

articles/sentinel/fusion.md

@@ -44,7 +44,7 @@ Rule templates are not applicable for the advanced multistage attack detection.
 
 Using advanced multistage attack detection, Azure Sentinel supports the following scenarios that combine anomaly events from Azure Active Directory Identity Protection and Microsoft Cloud App Security:
 
-- [Impossible travel to atypical location followed by anomalous Office 365 activity](##impossible-travel-to-atypical-location-followed-by-anomalous-office-365-activity)
+- [Impossible travel to atypical location followed by anomalous Office 365 activity](#impossible-travel-to-atypical-location-followed-by-anomalous-office-365-activity)
 - [Sign-in activity for unfamiliar location followed by anomalous Office 365 activity](#sign-in-activity-for-unfamiliar-location-followed-by-anomalous-office-365-activity)
 - [Sign-in activity from infected device followed by anomalous Office 365 activity](#sign-in-activity-from-infected-device-followed-by-anomalous-office-365-activity)
 - [Sign-in activity from anonymous IP address followed by anomalous Office 365 activity](#sign-in-activity-from-anonymous-ip-address-followed-by-anomalous-office-365-activity)
@@ -56,7 +56,7 @@ In the descriptions that follow, Azure Sentinel will display the actual value fr
 
 ### Impossible travel to atypical location followed by anomalous Office 365 activity
 
-There are seven possible Azure Sentinel incidents that combine impossible travel to atypical location alerts from Azure AD Identity Protection and anomalous Office 365 alerts generated by Microsoft Cloud App Security.
+There are seven possible Azure Sentinel incidents that combine impossible travel to atypical location alerts from Azure AD Identity Protection and anomalous Office 365 alerts generated by Microsoft Cloud App Security:
 
 - **Impossible travel to atypical locations leading to Office 365 mailbox exfiltration**
 
@@ -153,7 +153,7 @@ There are seven possible Azure Sentinel incidents that combine sign-in activity
 
 ### Sign-in activity from infected device followed by anomalous Office 365 activity
 
-There are seven possible Azure Sentinel incidents that combine sign-in activity from infected device alerts from Azure AD Identity Protection and anomalous Office 365 alerts generated by Microsoft Cloud App Security.
+There are seven possible Azure Sentinel incidents that combine sign-in activity from infected device alerts from Azure AD Identity Protection and anomalous Office 365 alerts generated by Microsoft Cloud App Security:
 
 - **Sign-in event from an infected device leading to Office 365 mailbox exfiltration**
 
@@ -201,7 +201,7 @@ There are seven possible Azure Sentinel incidents that combine sign-in activity
 
 ### Sign-in activity from anonymous IP address followed by anomalous Office 365 activity
 
-There are seven possible Azure Sentinel incidents that combine sign-in activity from anonymous IP address alerts from Azure AD Identity Protection and anomalous Office 365 alerts generated by Microsoft Cloud App Security.
+There are seven possible Azure Sentinel incidents that combine sign-in activity from anonymous IP address alerts from Azure AD Identity Protection and anomalous Office 365 alerts generated by Microsoft Cloud App Security:
 
 - **Sign-in event from an anonymous IP address leading to Office 365 mailbox exfiltration**
 
@@ -249,9 +249,9 @@ There are seven possible Azure Sentinel incidents that combine sign-in activity
 
 ### Sign-in activity from user with leaked credentials followed by anomalous Office 365 activity
 
-There are seven possible Azure Sentinel incidents that combine sign-in activity from user with leaked credentials alerts from Azure AD Identity Protection and anomalous Office 365 alerts generated by Microsoft Cloud App Security.
+There are seven possible Azure Sentinel incidents that combine sign-in activity from user with leaked credentials alerts from Azure AD Identity Protection and anomalous Office 365 alerts generated by Microsoft Cloud App Security:
 
-- **Sign-in event from User with leaked credentials leading to Office 365 mailbox exfiltration**
+- **Sign-in event from user with leaked credentials leading to Office 365 mailbox exfiltration**
 
     This alert is an indication that the sign-in event by \<*account name*> used leaked credentials, followed by a suspicious inbox forwarding rule was set on a user's inbox.