Tweaking away

memildin · memildin · commit 6b85498c7f0e · 2020-03-18T17:00:26.000+02:00
diff --git a/articles/security-center/alerts-schemas.md b/articles/security-center/alerts-schemas.md
@@ -40,43 +40,30 @@ If you're using any programmatic methods to consume the alerts, you'll need the
 ## The schemas 
 
 
-### [Workflow automation](#tab/schema-workflowautomation)
-
-### Sample JSON for alerts sent to workflow automation
-
-This is the schema of the alert events passed to Logic App instances that were configured in Security Center's workflow automation. For more information about the workflow automation feature see [Automate responses to alerts and recommendations](workflow-automation.md).
-
-[!INCLUDE [Workflow schema](../../includes/security-center-alerts-schema-workflowautomation.md)]
+### [Workflow automation and continuous export to Event Hub](#tab/schema-continuousexport)
 
+### Sample JSON for alerts sent to Logic Apps, Event Hub, and third-party SIEMs
 
+This is the schema of the alert events passed to:
 
+- Azure Logic App instances that were configured in Security Center's workflow automation
+- Azure Event Hub using Security Center's continuous export feature
 
-### [Continuous export to Event Hub](#tab/schema-continuousexport)
-
-### Sample JSON for alerts sent with continuous export to Event Hub and third-party SIEMs
-
-This is the schema of the alert events passed to an Event Hub using the Security Center's continuous export feature. For more information about continuous export, see [Export alerts and recommendations](continuous-export.md).
+For more information about the workflow automation feature see [Automate responses to alerts and recommendations](workflow-automation.md).
+For more information about continuous export, see [Export alerts and recommendations](continuous-export.md).
 
 [!INCLUDE [Workflow schema](../../includes/security-center-alerts-schema-workflowautomation.md)]
 
 
 
 
-### [Azure Sentinel](#tab/schema-sentinel)
+### [Azure Sentinel and Log Analytics workspaces](#tab/schema-sentinel)
 
 The Sentinel Connector gets alerts from Azure Security Center and sends them to the Log Analytics Workspace for Azure Sentinel. 
 
 To create a Sentinel case or incident using Security Center alerts, you'll need the schema for those alerts shown below. 
 
-> [!TIP]
-> For more information about Azure Sentinel, see [the documentation](https://docs.microsoft.com/azure/sentinel/).
-
-[!INCLUDE [Sentinel and workspace schema](../../includes/security-center-alerts-schema-loganalyticsworkspace.md)]
-
-
-
-
-### [Log Analytics workspace](#tab/schema-workspace)
+For more information about Azure Sentinel, see [the documentation](https://docs.microsoft.com/azure/sentinel/).
 
 [!INCLUDE [Sentinel and workspace schema](../../includes/security-center-alerts-schema-loganalyticsworkspace.md)]
 
@@ -87,12 +74,12 @@ To create a Sentinel case or incident using Security Center alerts, you'll need
 
 Azure Security Center audits generated Security alerts as events in Azure Activity Log.
 
-You can easily view the security alerts events in Activity log by searching for the Activate Alert event:
+You can view the security alerts events in Activity Log by searching for the Activate Alert event as shown:
 
 [![Searching the Activity log for the Activate Alert event](media/alerts-schemas/SampleActivityLogAlert.png)](media/alerts-schemas/SampleActivityLogAlert.png#lightbox)
 
-### Sample JSON for alerts sent to Azure Activity Log
 
+### Sample JSON for alerts sent to Azure Activity Log
 
 ```json
 {
diff --git a/articles/security-center/threat-protection.md b/articles/security-center/threat-protection.md
@@ -18,11 +18,11 @@ When Security Center detects a threat in any area of your environment, it genera
 
 Azure Security Center's threat protection provides comprehensive defenses for your environment:
 
-* **Threat protection for compute resources**: Windows machines, Linux machines, Azure App Service, and Azure containers
+* **Threat protection for Azure compute resources**: Windows machines, Linux machines, Azure App Service, and Azure containers
 
-* **Threat protection for data resources**: SQL Database and SQL Data Warehouse, Azure Storage, and Azure Cosmos DB
+* **Threat protection for Azure data resources**: SQL Database and SQL Data Warehouse, Azure Storage, and Azure Cosmos DB
 
-* **Threat protection for the service layer**: Azure network layer, Azure management layer (Azure Resource Manager) (Preview), and Azure Key Vault (Preview)
+* **Threat protection for Azure service layers**: Azure network layer, Azure management layer (Azure Resource Manager) (Preview), and Azure Key Vault (Preview)
 
 Whether an alert is generated by Security Center, or received by Security Center from a different security product, you can export it. To export your alerts to Azure Sentinel (or a third-party SIEM) or any other external tool, follow the instructions in [Exporting alerts to a SIEM](continuous-export.md). 
 
diff --git a/includes/security-center-alerts-schema-loganalyticsworkspace.md b/includes/security-center-alerts-schema-loganalyticsworkspace.md
@@ -14,7 +14,6 @@ ms.custom: include file
 |Field|Description|
 |----|----|
 |**AlertName**|Alert display name|
-|**Severity**|The alert severity (High/Medium/Low/Informational)|
 |**AlertType**|unique alert identifier|
 |**ConfidenceLevel**|(Optional) The confidence level of this alert (High/Low)|
 |**ConfidenceScore**|(Optional) Numeric confidence indicator of the security alert|
@@ -31,6 +30,7 @@ ms.custom: include file
 |**ProviderName**|unused|
 |**RemediationSteps**|Manual action items to take to remediate the security threat|
 |**ResourceId**|Full identifier of the affected resource|
+|**Severity**|The alert severity (High/Medium/Low/Informational)|
 |**SourceComputerId**|a unique GUID for the affected server (if the alert is generated on the server)|
 |**SourceSystem**|unused|
 |**StartTime**|The impact start time of the alert (the time of the first event contributing to the alert)|
diff --git a/includes/security-center-alerts-schema-workflowautomation.md b/includes/security-center-alerts-schema-workflowautomation.md
@@ -55,23 +55,23 @@ ms.custom: include file
 
 |Field|Data type|Description|
 |----|----|----|
-|**VendorName**|String|The name of the vendor that raises the alert.|
+|**AlertDisplayName**|String|The display name of the alert.|
 |**AlertType**|String|The type of alert. Alerts of the same type should have the same value. This field is a keyed string representing the type of alert and not of an alert instance. All alert instances from the same detection logic/analytic should have the same value for alert type.|
-|**StartTimeUtc**|DateTime|The time of the first event or activity included in the alert. The field should be a string that conforms to the ISO8601 format, including UTC timezone information.|
+|**CompromisedEntity**|String|The display name of the resource most related to this alert.|
+|**Description**|String|Description of the alert.|
 |**EndTimeUtc**|DateTime|The time of the last event or activity included in the alert.  The field should be a string that conforms to the ISO8601 format, including UTC timezone information.|
-|**ProcessingEndTime**|DateTime|The time the alert was accessible to the end user in the original product holding the alert.|
-|**TimeGenerated**|DateTime|The time the alert was generated by the alert provider. If not reported by internal alert providers, a product can choose to assign the time it was received for processing by the product.  The field should be a string that conforms to the ISO8601 format, including UTC timezone information.|
+|**Entities**|IEnumerable (IEntity)|A list of entities related to the alert. This list can hold a mixture of entities of diverse types. The entities type can be any of the types defined in the Entities section. Entities that are not in the list below can also be sent, however it is not guaranteed that they will be processed (the alert will not fail validation with new types of entities).|
+|**ExtendedProperties**|Dictionary (String,String)|Providers might (optionally) include custom fields here.|
+|**Intent**|Enum|The kill chain related intent behind the alert. For list of supported values, and explanations of Azure Security Center's supported kill chain intents, see [Intentions](/articles/security-center/alerts-reference.md#intentions).<br/>This field might have multiple values (separated by comma).|
 |**IsIncident**|Bool|This field determines whether the alert is an incident (a compound grouping of several alerts) or a single alert. Default value for the field is 'false' (meaning it's a single alert).|
-|**Severity**|Enum|The severity of the alert as reported by the provider. Possible Values: Informational, Low, Medium, and High.|
-|**Status**|Enum|The life-cycle status of the alert.<br/>Supported statuses are: New, Resolved, Dismissed, Unknown.<br/>An alert that specifies a value other than the supported options is assigned the status 'Unknown'.<br/>An alert that doesn't specify a value is assigned the status 'New'.|
+|**ProcessingEndTime**|DateTime|The time the alert was accessible to the end user in the original product holding the alert.|
 |**ProductName**|String|The name of the product that published this alert (Azure Security Center, Azure ATP, Microsoft Defender ATP, O365 ATP, MCAS, and so on).|
-|**SystemAlertId**|String|The alert identifier.|
-|**CompromisedEntity**|String|The display name of the resource most related to this alert.|
-|**Intent**|Enum|The kill chain related intent behind the alert. For list of supported values, and explanations of Azure Security Center's supported kill chain intents, see [Intentions](/articles/security-center/alerts-reference.md#intentions).<br/>This field might have multiple values (separated by comma).|
-|**AlertDisplayName**|String|The display name of the alert.|
-|**Description**|String|Description of the alert.|
 |**RemediationSteps**|List<String>|Manual action items to take to remediate the alert.|
-|**ExtendedProperties**|Dictionary (String,String)|Providers might (optionally) include custom fields here.|
-|**Entities**|IEnumerable (IEntity)|A list of entities related to the alert. This list can hold a mixture of entities of diverse types. The entities type can be any of the types defined in the Entities section. Entities that are not in the list below can also be sent, however it is not guaranteed that they will be processed (the alert will not fail validation with new types of entities).|
 |**ResourceIdentifiers**|List (Resource Identifiers)|The resource identifiers for this alert that can be used to direct the alert to the right product exposure group (tenant, workspace, subscription etc.). There can be multiple identifiers of different type per alert.|
+|**Severity**|Enum|The severity of the alert as reported by the provider. Possible Values: Informational, Low, Medium, and High.|
+|**StartTimeUtc**|DateTime|The time of the first event or activity included in the alert. The field should be a string that conforms to the ISO8601 format, including UTC timezone information.|
+|**Status**|Enum|The life-cycle status of the alert.<br/>Supported statuses are: New, Resolved, Dismissed, Unknown.<br/>An alert that specifies a value other than the supported options is assigned the status 'Unknown'.<br/>An alert that doesn't specify a value is assigned the status 'New'.|
+|**SystemAlertId**|String|The alert identifier.|
+|**TimeGenerated**|DateTime|The time the alert was generated by the alert provider. If not reported by internal alert providers, a product can choose to assign the time it was received for processing by the product.  The field should be a string that conforms to the ISO8601 format, including UTC timezone information.|
+|**VendorName**|String|The name of the vendor that raises the alert.|
 |||
