Merge pull request #191642 from duongau/github-3

Update DDoS alert example instructions - minor edits

Author: laurabren

articles/ddos-protection/alerts.md

@@ -8,7 +8,7 @@ ms.service: ddos-protection
 ms.topic: article
 ms.tgt_pltfrm: na
 ms.workload: infrastructure-services
-ms.date: 12/28/2020
+ms.date: 3/11/2022
 ms.author: yitoh
 
 ---
@@ -51,16 +51,30 @@ This [template](https://aka.ms/ddosalert) deploys the necessary components of an
 You can select any of the available DDoS protection metrics to alert you when there’s an active mitigation during an attack, using the Azure Monitor alert configuration. 
 
 1. Sign in to the [Azure portal](https://portal.azure.com/) and browse to your DDoS Protection Plan.
-2. Under **Monitoring**, select **Metrics**.
-3. In the gray navigation bar, select **New alert rule**. 
-4. Enter, or select your own values, or enter the following example values, accept the remaining defaults, and then select **Create alert rule**:
-
-    |Setting                  |Value                                                                                               |
-    |---------                |---------                                                                                           |
-    | Scope                   | Select **Select resource**. </br> Select the **Subscription** that contains the public IP address you want to log, select **Public IP Address** for **Resource type**, then select the specific public IP address you want to log metrics for. </br> Select **Done**. | 
-    | Condition | Select **Select condition**. </br> Under signal name, select **Under DDoS attack or not**. </br> Under **Operator**, select **Greater than or equal to**. </br> Under **Aggregation type**, select **Maximum**. </br> Under **Threshold value**, enter *1*. For the **Under DDoS attack or not** metric, **0** means you are not under attack while **1** means you are under attack. </br> Select **Done**. | 
-    | Actions | Select **Add actions groups**. </br> Select **Create action group**. </br> Under **Notifications**, under **Notification type**, select **Email/SMS message/Push/Voice**. </br> Under **Name**, enter _MyUnderAttackEmailAlert_. </br> Click the edit button, then select **Email** and as many of the following options you require, and then select **OK**. </br> Select **Review + create**. | 
-    | Alert rule details | Under **Alert rule name**, Enter _MyDdosAlert_. |
+
+1. Under **Monitoring**, select **Alerts**.
+
+1. Select the **+ New Alert Rule** button or select **+ Create** on the navigation bar, then select **Alert rule**.
+
+1. Close the **Select a Signal** page.
+
+1. On the **Create an alert rule** page, you'll see the follow tabs:
+
+    - Scope
+    - Condition
+    - Actions
+    - Details
+    - Tags
+    - Review + create
+    
+    For each step use the values described below:
+
+    | Setting | Value |
+    |--|--|
+    | Scope | 1) Select **+ Select Scope**. <br/> 2) From the *Filter by subscription* dropdown list, select the **Subscription** that contains the public IP address you want to log. <br/> 3) From the *Filter by resource type* dropdown list, select **Public IP Address**, then select the specific public IP address you want to log metrics for. <br/> 4) Select **Done**. |
+    | Condition | 1) Select the **+ Add Condition** button <br/> 2) In the *Search by signal name* search box, select **Under DDoS attack or not**. <br/> 3) Leave *Chart period* and *Alert Logic* as default. <br/> 4) From the *Operator* drop-down, select **Greater than or equal to**. <br/> 5) From the *Aggregation type* drop-down, select **Maximum**. <br/> 6) In the *Threshold value* box, enter **1**. For the *Under DDoS attack or not metric*, **0** means you're not under attack while **1** means you are under attack. <br/> 7) Select **Done**. |
+    | Actions | 1) Select the **+ Create action group** button. <br/> 2) On the **Basics** tab, select your subscription, a resource group and provide the *Action group name* and *Display name*. <br/> 3) On the *Notifications* tab, under *Notification type*, select **Email/SMS message/Push/Voice**. <br/> 4) Under *Name*, enter **MyUnderAttackEmailAlert**. <br/> 5) On the *Email/SMS message/Push/Voice* page enter the **Email** and as many of the available options you require, and then select **OK**. <br/> 6) Select **Review + create** and then select **Create**. |
+    | Details | 1) Under *Alert rule name*, enter *MyDdosAlert*. <br/> 2) Select **Review + create** and then select **Create**. |
 
 Within a few minutes of attack detection, you should receive an email from Azure Monitor metrics that looks similar to the following picture: