Continued work 1

Author: yelevin

articles/sentinel/tutorial-log4j-detection.md

@@ -102,6 +102,8 @@ To complete this tutorial, make sure you have:
 
    :::image type="content" source="media/tutorial-log4j-detection/set-rule-logic-tab.png" alt-text="Screenshot of the Set rule logic tab of the Analytics rule wizard." lightbox="media/tutorial-log4j-detection/set-rule-logic-tab.png":::
 
+    [!INCLUDE [kusto-reference-general-no-alert](includes/kusto-reference-general-no-alert.md)]
+
 ## Enrich alerts with entities and other details
 
 1. Under **Alert enrichment**, keep the **Entity mapping** settings as they are. Note the three mapped entities.
@@ -218,4 +220,4 @@ Now that you've learned how to search for exploits of a common vulnerability usi
     - [Alert properties](customize-alert-details.md)
 
 - Learn about [other kinds of analytics rules](detect-threats-built-in.md) in Microsoft Sentinel and their function.
-- Learn more about writing queries in Kusto Query Language (KQL). Learn more about KQL [concepts](/azure/data-explorer/kusto/concepts/) and [queries](/azure/data-explorer/kusto/query/), and see this handy [quick reference guide](/azure/data-explorer/kql-quick-reference).
+- Learn more about writing queries in Kusto Query Language (KQL). To learn more about KQL, see this [overview](/kusto/query/?view=microsoft-sentinel&preserve-view=true), learn some [best practices](/kusto/query/best-practices?view=microsoft-sentinel&preserve-view=true), and keep this handy [quick reference guide](/kusto/query/kql-quick-reference?view=microsoft-sentinel&preserve-view=true).

articles/sentinel/unified-connector-custom-device.md

@@ -262,7 +262,7 @@ Follow these steps to ingest log messages from JuniperIDP:
         
         The following screenshot shows the complete query in the preceding example in a more readable format:
 
-        :::image type="content" source="media/unified-connector-custom-device/kusto-query-screenshot.png" alt-text="Screenshot showing expanded Kusto query with line breaks for readability.":::
+        :::image type="content" source="media/unified-connector-custom-device/kusto-query-screenshot.png" alt-text="Screenshot showing expanded Kusto query with line breaks for readability." lightbox="media/unified-connector-custom-device/kusto-query-screenshot.png":::
 
         See more information on the following items used in the preceding examples, in the Kusto documentation:
         - [***parse*** operator](/kusto/query/parse-operator?view=microsoft-sentinel&preserve-view=true)