feedback from SME review

Author: Shereen-Bhar

articles/defender-for-iot/organizations/how-to-create-risk-assessment-reports.md

@@ -1,23 +1,49 @@
 ---
 title: Create risk assessment reports on an OT sensor - Microsoft Defender for IoT
 description: Gain insight into network risks detected by individual Defender for IoT OT sensors or an aggregate view of risks detected by all OT sensors.
-ms.date: 02/03/2022
+ms.date: 12/01/2022
 ms.topic: how-to
 ---
 
 # Risk assessment reporting
 
-Risk assessment reports, generated by Defender for IoT OT network sensors and on-premises management consoles, provide details about security scores, vulnerabilities, and operational issues on detected devices as well as risks coming from imported firewall rules.
+Risk assessment reports provide details about security scores, vulnerabilities, and operational issues on detected devices as well as risks coming from imported firewall rules.
 
-Each sensor has access to reports generated for that sensor, while the on-premises management console allows you view reports from all connected sensors from the same page. The on-premises management console also supports customizations for the logo that appears in your report.
+Each Defender for IoT network sensor can generate a risk assessment report, while the on-premises management console collects those reports from all connected sensors.
 
 ## Prerequisites
 
 - You must be an **Admin** user to import firewall rules to an OT sensor or add backup and anti-virus server addresses.
 
 - You must be an **Admin** or **Security Analyst** user to create or view risk assessment reports on the OT sensor or on-premises management console.
 
-## Import firewall rules to a OT sensor
+## Create and view risk assessment reports for a specific sensor
+
+Use an individual OT sensor to view reports generated for that sensor only.
+
+**To generate a report**:
+
+1. Sign in to the sensor console and select **Risk assessment** > **Generate report**. The report is generated and appears in the **Reports list**, along with the timestamp and report size.
+
+    Reports are automatically named `risk-assessment-report-<integer>`, where the `<integer>` is incremented automatically.
+
+1. Select the report name to download it and open it in your browser.
+
+## Risk assessment report contents
+
+Risk assessment reports include the following details:
+
+|Details  |Description  |
+|---------|---------|
+| **Security scores** | An overall security score for all detected devices, and a security score for each individual device. <br><br> Security scores are based on data learned from packet inspection, behavioral modeling engines, and a SCADA-specific state machine design, and are categorized as follows: <br><br> - **Secure Devices** are devices with a security score above 90%. <br> - **Devices Needing Improvement** are devices with a security score between 70 percent and 89%. <br> - **Vulnerable Devices** are devices with a security score below 70%. |
+| **Security and operational issues** | Insight into any of the following security and operational issues: <br><br> - Configuration issues <br> - Device vulnerability, prioritized by security level <br> - Network security issues <br> - Network operational issues <br> - Connections to ICS networks <br> - Internet connections <br> - Industrial malware indicators <br> - Protocol issues <br> - Attack vectors |
+| **Firewall rule risk** | The Risk Assessment report highlights if a rule isn't secure, or if there's a mismatch between the rule and the monitored network. |
+
+## Enriching the risk assessment report
+
+You can enrich a risk assessment report to provide you with more content. For example, you can import firewall data to your sensor, and then the risk assessment report will also include data about firewall rule risk, based on the imported rules. You can also define addresses for backup and anti-virus servers.
+
+### Import firewall rules to an OT sensor
 
 Import firewall rules to your OT sensor for analysis in **Risk assessment** reports. Importing firewall rules is supported for Checkpoint, Fortinet, and Juniper firewalls.
 
@@ -33,56 +59,32 @@ For example:
 
 :::image type="content" source="media/how-to-create-risk-assessment-reports/import-firewall-rules.png" alt-text="Screenshot of how to import firewall rules." lightbox="media/how-to-create-risk-assessment-reports/import-firewall-rules.png":::
 
-## Add backup and anti-virus server addresses to your sensor
+### Add backup and anti-virus server addresses to your sensor
 
-Backup and anti-virus servers are not defined on your sensor by default. We recommend defining these addresses on your sensor to keep your network risk assessment low.
+Backup and anti-virus servers aren't defined on your sensor by default. We recommend defining these addresses on your sensor to keep your network risk assessment low.
 
 **To add backup and anti-virus server addresses**:
 
 1. Sign into your OT sensor and select **System Settings** > **System Properties** > **Vulnerability Assessment**.
 1. Add your backup and anti-virus server addresses to the **backup_servers** and **AV_addresses** fields, respectively. Use commas to separate multiple addresses.
 1. Select **Save** to save your changes.
 
-## Create and view risk assessment reports for a specific sensor
-
-Use an individual OT sensor to view reports generated for that sensor only.
-
-**To generate a report**:
-
-1. Sign in to the sensor console and select **Risk assessment** > **Generate report**. The report is generated and appears in the **Reports list**, along with the timestamp and report size.
-
-    Reports are automatically named `risk-assessment-report-<integer>`, where the `<integer>` is incremented automatically.
-
-1. Select the report name to download it and open it in your browser.
-
 ## Create and view risk assessment reports for multiple sensors
 
-Use an on-premises management console to create and view risk assessment reports for all connected sensors, or to customize your report logo.
+Use an on-premises management console to view risk assessment reports for all connected sensors.
 
 **To generate a report**:
 
 1. Sign in to your on-premises management console and select **Risk assessment**.
 
-1. To customize the logo that appears on your report, select **Import logo**. Browse to and select the logo file you want to use.
-
 1. From the **Select Sensor** drop-down menu, select the sensor for which you want to generate the report, and then select **Generate Report**.
 
     A new report is listed in the **Archived Reports** area, listed by the time and date it was created, and showing the security score and report size.
 
 1. Select **Download** to download a report and open it in your browser.
 
-## Risk assessment report contents
-
-Risk assessment reports include the following details:
-
-|Details  |Description  |
-|---------|---------|
-| **Security scores** | An overall security score for all detected devices, and a security score for each individual device. <br><br> Security scores are based on data learned from packet inspection, behavioral modeling engines, and a SCADA-specific state machine design, and are categorized as follows: <br><br> - **Secure Devices** are devices with a security score above 90%. <br> - **Devices Needing Improvement** are devices with a security score between 70 percent and 89%. <br> - **Vulnerable Devices** are devices with a security score below 70%. |
-| **Security and operational issues** | Insight into any of the following security and operational issues: <br><br> - Configuration issues <br> - Device vulnerability, prioritized by security level <br> - Network security issues <br> - Network operational issues <br> - Connections to ICS networks <br> - Internet connections <br> - Industrial malware indicators <br> - Protocol issues <br> - Attack vectors |
-| **Firewall rule risk** | If you've imported firewall data to your sensor, the risk assessment reports also include data about firewall rule risk, based on the imported rules. The Risk Assessment report highlights if a rule is not secure, or if there's a mismatch between the rule and the monitored network. |
-
 ## Next steps
 
-Take action based on the recommendations provided in the risk assessment reports to improve your overall network security score. For example, you might install the latest security or firmware updates, or investigate any PLCs that are currently in unsecure states. 
+Take action based on the recommendations provided in the risk assessment reports to improve your overall network security score. For example, you might install the latest security or firmware updates, or investigate any PLCs that are currently in unsecure states.
 
 For more information, see [Enhance security posture with security recommendations](recommendations.md).