Merge pull request #283273 from MicrosoftDocs/repo_sync_working_branch

PhilKang0704 · web-flow · commit 6bf02d2a1593 · 2024-08-02T13:23:23.000+08:00
Confirm merge from repo_sync_working_branch to main to sync with https://github.com/MicrosoftDocs/azure-docs (branch main)
diff --git a/articles/ai-services/openai/includes/python.md b/articles/ai-services/openai/includes/python.md
@@ -46,7 +46,7 @@ pip install openai==0.28.1
 
 ## Retrieve key and endpoint
 
-To successfully make a call against the Azure OpenAI service, you'll need the following:
+To successfully make a call against the Azure OpenAI Service, you'll need the following:
 
 |Variable name | Value |
 |--------------------------|-------------|
diff --git a/articles/azure-monitor/containers/kubernetes-monitoring-enable.md b/articles/azure-monitor/containers/kubernetes-monitoring-enable.md
@@ -22,7 +22,7 @@ This article describes how to enable complete monitoring of your Kubernetes clus
 > 
 >- [Configure data collection and cost optimization in Container insights using data collection rule](./container-insights-data-collection-dcr.md)<br>Details on customizing log collection once you've enabled monitoring, including using preset cost optimization configurations.
 >- [Best practices for monitoring Kubernetes with Azure Monitor](../best-practices-containers.md)<br>Best practices for monitoring Kubernetes clusters organized by the five pillars of the [Azure Well-Architected Framework](/azure/architecture/framework/), including cost optimization.
->- [Cost optimization in Azure Monitor](../best-practices-cost.md)<br>Best practices for configuring all features of Azure Monitor to optimize you costs and limit the amount of data that you collect.
+>- [Cost optimization in Azure Monitor](../best-practices-cost.md)<br>Best practices for configuring all features of Azure Monitor to optimize your costs and limit the amount of data that you collect.
 
 ## Supported clusters
 
@@ -188,6 +188,7 @@ If the Azure Managed Grafana instance is already linked to an Azure Monitor work
     - Parameter file: [https://aka.ms/azureprometheus-enable-bicep-template-parameters](https://aka.ms/azureprometheus-enable-arm-template-parameters)
     - DCRA module: [https://aka.ms/nested_azuremonitormetrics_dcra_clusterResourceId](https://aka.ms/nested_azuremonitormetrics_dcra_clusterResourceId)
     - Profile module: [https://aka.ms/nested_azuremonitormetrics_profile_clusterResourceId](https://aka.ms/nested_azuremonitormetrics_profile_clusterResourceId)
+    - Azure Managed Grafana Role Assignment module: [https://aka.ms/nested_grafana_amw_role_assignment](https://aka.ms/nested_grafana_amw_role_assignment)
 
     **Arc-Enabled cluster ARM**
 
diff --git a/articles/sentinel/data-connectors/slack-audit.md b/articles/sentinel/data-connectors/slack-audit.md
@@ -49,30 +49,87 @@ To integrate with Slack Audit (using Azure Functions) make sure you have:
 
 
 > [!NOTE]
-   >  This connector uses Azure Functions to connect to the Slack REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.
-
+> This connector uses Azure Functions to connect to the Slack REST API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details.
 
 >**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App.
 
-
 > [!NOTE]
-   >  This data connector depends on a parser based on a Kusto Function to work as expected. [Follow these steps](https://aka.ms/sentinel-SlackAuditAPI-parser) to create the Kusto functions alias, **SlackAudit**
-
+> This data connector depends on a parser based on a Kusto Function to work as expected. [Follow these steps](https://aka.ms/sentinel-SlackAuditAPI-parser) to create the Kusto functions alias, **SlackAudit**
 
 **STEP 1 - Configuration steps for the Slack API**
 
  [Follow the instructions](https://api.slack.com/web#authentication) to obtain the credentials. 
 
+**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**
 
+> [!IMPORTANT]
+> Before deploying the Slack Audit data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following).
 
-**STEP 2 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**
+Option 1 - Azure Resource Manager (ARM) Template
+
+Use this method for automated deployment of the Slack Audit data connector using an ARM Tempate.
+
+1. Select the **Deploy to Azure** button below. 
+
+   [![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-SlackAuditAPI-azuredeploy)
+
+2. Select the preferred **Subscription**, **Resource Group** and **Location**.
+   
+   > [!NOTE]
+   > Within the same resource group, you can't mix Windows and Linux apps in the same region. Select existing resource group without Windows apps in it or create new resource group.
+
+4. Enter the **SlackAPIBearerToken** and deploy. 
+5. Mark the checkbox labeled **I agree to the terms and conditions stated above**. 
+6. Select **Purchase** to deploy.
+
+Option 2 - Manual Deployment of Azure Functions
+
+Use the following step-by-step instructions to deploy the Slack Audit data connector manually with Azure Functions (Deployment via Visual Studio Code).
+
+**1. Deploy a Function App**
+
+> [!NOTE]
+> You will need to [prepare VS code](/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.
+
+1. Download the [Azure Function App](https://aka.ms/sentinel-SlackAuditAPI-functionapp) file. Extract archive to your local development computer.
+2. Start VS Code. Choose File in the main menu and select Open Folder.
+3. Select the top level folder from extracted files.
+4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.
+
+   - If you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**
+   - If you're already signed in, go to the next step.
+
+6. Provide the following information at the prompts:
+
+	a. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.
+
+	b. **Select Subscription:** Choose the subscription to use.
+
+	c. Select **Create new Function App in Azure** (Don't choose the Advanced option)
+
+	d. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. SlackAuditXXXXX).
+
+	e. **Select a runtime:** Choose Python 3.8.
 
->**IMPORTANT:** Before deploying the Slack Audit data connector, have the Workspace ID and Workspace Primary Key (can be copied from the following).
+	f. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.
 
+7. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.
+8. Go to Azure Portal for the Function App configuration.
 
+**2. Configure the Function App**
 
+1. In the Function App, select the Function App Name and select **Configuration**.
+1. In the **Application settings** tab, select **New application setting**.
+1. Add each of the following application settings individually, with their respective string values (case-sensitive):
+   
+   - SlackAPIBearerToken
+   - WorkspaceID
+   - WorkspaceKey
+   - logAnalyticsUri (optional)
 
+   > Use logAnalyticsUri to override the log analytics API endpoint for dedicated cloud. For example, for public cloud, leave the value empty; for Azure GovUS cloud environment, specify the value in the following format: `https://<CustomerId>.ods.opinsights.azure.us`.
 
+1. Once all application settings have been entered, click **Save**.
 
 
 ## Next steps
diff --git a/articles/sentinel/normalization-schema-network.md b/articles/sentinel/normalization-schema-network.md
@@ -152,7 +152,7 @@ Fields that appear in the table below are common to all ASIM schemas. Any guidel
 | <a name="networkdirection"></a>**NetworkDirection** | Optional | Enumerated | The direction of the connection or session:<br><br> - For the [EventType](#eventtype) `NetworkSession`, `Flow` or `L2NetworkSession`, **NetworkDirection** represents the direction relative to the organization or cloud environment boundary. Supported values are `Inbound`, `Outbound`, `Local` (to the organization), `External` (to the organization) or `NA` (Not Applicable).<br><br> - For the [EventType](#eventtype) `EndpointNetworkSession`, **NetworkDirection** represents the direction relative to the endpoint. Supported values are `Inbound`, `Outbound`, `Local` (to the system), `Listen` or `NA` (Not Applicable). The `Listen` value indicates that a device has started accepting network connections but isn't actually, necessarily, connected. |
 | <a name="networkduration"></a>**NetworkDuration** | Optional | Integer | The amount of time, in milliseconds, for the completion of the network session or connection.<br><br>Example: `1500` |
 | **Duration** | Alias | | Alias to [NetworkDuration](#networkduration). |
-|<a name="networkicmptype"></a> **NetworkIcmpType** | Optional | String | For an ICMP message, the ICMP message type number, as described in [RFC 2780](https://datatracker.ietf.org/doc/html/rfc2780) for IPv4 network connections, or in [RFC 4443](https://datatracker.ietf.org/doc/html/rfc4443) for IPv6 network connections. |
+|<a name="networkicmptype"></a> **NetworkIcmpType** | Optional | String | For an ICMP message, ICMP type name associated with the numerical value, as described in [RFC 2780](https://datatracker.ietf.org/doc/html/rfc2780) for IPv4 network connections, or in [RFC 4443](https://datatracker.ietf.org/doc/html/rfc4443) for IPv6 network connections.<br><br>Example: `Destination Unreachable` for NetworkIcmpCode `3` |
 | **NetworkIcmpCode** | Optional | Integer | For an ICMP message, the ICMP code number as described in [RFC 2780](https://datatracker.ietf.org/doc/html/rfc2780) for IPv4 network connections, or in [RFC 4443](https://datatracker.ietf.org/doc/html/rfc4443) for IPv6 network connections. |
 | **NetworkConnectionHistory** | Optional | String | TCP flags and other potential IP header information. |
 | **DstBytes** | Recommended | Long | The number of bytes sent from the destination to the source for the connection or session. If the event is aggregated, **DstBytes** should be the sum over all aggregated sessions.<br><br>Example: `32455` |
diff --git a/articles/storage/blobs/blobfuse2-what-is.md b/articles/storage/blobs/blobfuse2-what-is.md
@@ -44,6 +44,10 @@ Other key features in BlobFuse2 include:
 - Parallel downloads and uploads to improve access time for large files
 - Multiple mounts to the same container for read-only workloads
 
+> [!IMPORTANT]
+> If you are using versions 2.2.0, 2.2.1, or 2.3.0, refrain from using the `Block-cache` mode and switch to the `file-cache` mode till [known issues](https://github.com/Azure/azure-storage-fuse/wiki/Blobfuse2-Known-issues) are fixed.
+
+
 ## BlobFuse2 enhancements from BlobFuse v1
 
 BlobFuse2 has more feature support and improved performance in multiple user scenarios from BlobFuse v1. For the extensive list of improvements, see the [BlobFuse2 README](https://github.com/Azure/azure-storage-fuse/blob/main/README.md#distinctive-features-compared-to-blobfuse-v1x). Here's a summary of enhancements in BlobFuse2 from BlobFuse v1:
