Added FFX/ mooncake documentation commands

Author: oferInbar

articles/sentinel/sap/deploy-data-connector-agent-container.md

@@ -121,23 +121,30 @@ If you're not using SNC, then your SAP configuration and authentication secrets
 
 1. **Create and configure a data disk** to be mounted at the Docker root directory.
 
-1. Run the following command to **download and run the deployment Kickstart script**:
-
+1. **download and run the deployment Kickstart script**:
+    For public cloud, the command is:
     ```bash
     wget -O sapcon-sentinel-kickstart.sh https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/sapcon-sentinel-kickstart.sh && bash ./sapcon-sentinel-kickstart.sh
     ```
-
+    For Azure China 21Vianet, the command is:
+    ```bash
+    wget -O sapcon-sentinel-kickstart.sh https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/sapcon-sentinel-kickstart.sh && bash ./sapcon-sentinel-kickstart.sh --cloud mooncake
+    ```
+    For Azure Government - US, the command is:
+    ```bash
+    wget -O sapcon-sentinel-kickstart.sh https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Solutions/SAP/sapcon-sentinel-kickstart.sh && bash ./sapcon-sentinel-kickstart.sh --cloud fairfax
+    ```
     The script updates the OS components, installs the Azure CLI and Docker software and other required utilities (jq, netcat, curl), and prompts you for configuration parameter values. You can supply additional parameters to the script to minimize the amount of prompts or to customize the container deployment. For more information on available command line options, see [Kickstart script reference](reference-kickstart.md).
 
-1. **Follow the on-screen instructions** to enter your SAP and key vault details and complete the deployment. When the deployment is complete, a confirmation message is displayed:
+2. **Follow the on-screen instructions** to enter your SAP and key vault details and complete the deployment. When the deployment is complete, a confirmation message is displayed:
 
     ```bash
     The process has been successfully completed, thank you!
     ```
 
    Note the Docker container name in the script output. You'll use it in the next step.
 
-1. Run the following command to **configure the Docker container to start automatically**.
+3. Run the following command to **configure the Docker container to start automatically**.
 
     ```bash
     docker update --restart unless-stopped <container-name>

articles/sentinel/sap/deployment-solution-configuration.md

@@ -72,7 +72,6 @@ Now Microsoft Sentinel will be able to differentiate a logon from 192.168.10.15
 - SAP - Sensitive Tables
 - SAP - Sensitive ABAP Programs
 - SAP - Sensitive Transactions
-- SAP - Critical Authorizations
 
 All of these watchlists identify sensitive actions or data that can be carried out or accessed by users. Several well-known operations, tables and authorizations have been pre-configured in the watchlists, however we recommend you consult with the SAP BASIS team to identify which operations, transactions, authorizations and tables are considered to be sensitive in your SAP environment.
 
@@ -81,6 +80,7 @@ All of these watchlists identify sensitive actions or data that can be carried o
 - SAP - Sensitive Profiles
 - SAP - Sensitive Roles
 - SAP - Privileged Users
+- SAP - Critical Authorizations
 
 The Microsoft Sentinel Solution for SAP uses User Master data gathered from SAP systems to identify which users, profiles, and roles should be considered sensitive. Some sample data is included in the watchlists, though we recommend you consult with the SAP BASIS team to identify sensitive users, roles and profiles and populate the watchlists accordingly.