switch image and description position

Author: austinmccollum

articles/sentinel/understand-threat-intelligence.md

@@ -133,6 +133,8 @@ Two of the most common threat intelligence tasks are creating new threat intelli
 - Add free-form tags to objects with multi-select.
 
 The following STIX objects are available in Microsoft Sentinel:
+:::image type="content" source="media/understand-threat-intelligence/new-object.png" alt-text="Screenshot of the add new menu STIX object options."::: 
+
 | STIX object | Description |
 |---|---|
 | Threat actor | From script kiddies to nation states, threat actors objects describe motivations, sophistication and resourcing levels. |
@@ -141,8 +143,6 @@ The following STIX objects are available in Microsoft Sentinel:
 | Identity | Describe victims, organizations and other groups or individuals along with the business sectors most closely associated with them. |
 | Relationship | The threads that connect threat intelligence, helping to make connections across disparate signals and data points are described with relationships. |
 
-:::image type="content" source="media/understand-threat-intelligence/new-object.png" alt-text="Screenshot of the add new menu STIX object options.":::
-
 Tagging threat intelligence is a quick way to group objects together to make them easier to find. Typically, you might apply tags related to a particular incident. But, if an indicator represents threats from a particular known actor or well-known attack campaign you might create a relationship instead of a tag. After you search for the threat intelligence that you want to work with, tag them individually or multiselect and tag them all at once. Because tagging is free-form, we recommend that you create standard naming conventions for threat intelligence tags.
 
 For more information, see [Work with threat intelligence in Microsoft Sentinel](work-with-threat-indicators.md#create-and-manage-objects).