Add steps to get activity dc to connected state

Author: cwatson-cat

articles/sentinel/quickstart-onboard.md

@@ -4,7 +4,7 @@ description: In this quickstart, you enable Microsoft Sentinel, and set up data
 author: yelevin
 ms.author: yelevin
 ms.topic: quickstart
-ms.date: 06/01/2023
+ms.date: 06/14/2023
 ms.custom: references_regions, ignite-fall-2021, mode-other
 #Customer intent: As a security operator, set up data connectors in one place so I can monitor and protect my environment.
 ---
@@ -32,7 +32,7 @@ Microsoft Sentinel comes with many data connectors for Microsoft products such a
 
 - **Microsoft Sentinel is a paid service**. Review the [pricing options](https://go.microsoft.com/fwlink/?linkid=2104058) and the [Microsoft Sentinel pricing page](https://azure.microsoft.com/pricing/details/azure-sentinel/).
 
-- Before deploying Microsoft Sentinel to a production environment, review the [pre-deployment activities and prerequisites for deploying Microsoft Sentinel](prerequisites.md).
+- Before deploying Microsoft Sentinel to a production environment, review the [predeployment activities and prerequisites for deploying Microsoft Sentinel](prerequisites.md).
 
 ## Enable Microsoft Sentinel <a name="enable"></a>
 
@@ -50,48 +50,70 @@ To get started, add Microsoft Sentinel to an existing workspace or create a new
 
     :::image type="content" source="media/quickstart-onboard/choose-workspace.png" alt-text="Screenshot of choosing a workspace while enabling Microsoft Sentinel.":::      
 
-   - The default workspaces created by Microsoft Defender for Cloud are not shown in the list. You can't install Microsoft Sentinel on these workspaces.
+   - The default workspaces created by Microsoft Defender for Cloud aren't shown in the list. You can't install Microsoft Sentinel on these workspaces.
    - Once deployed on a workspace, Microsoft Sentinel **doesn't currently support** moving that workspace to another resource group or subscription.
 
 1. Select **Add Microsoft Sentinel**.
 
 ## Install a solution from the content hub
 
-The content hub in Microsoft Sentinel is the centralized location to discover and manage out-of-the-box (built-in) content including data connectors. For this quickstart, install the solution for Azure Activity.
+The content hub in Microsoft Sentinel is the centralized location to discover and manage out-of-the-box content including data connectors. For this quickstart, install the solution for Azure Activity.
 
 1. In Microsoft Sentinel, select **Content hub**.
 
 1. Find and select the **Azure Activity** solution.
 
-1. Select **Install** and then **Create**.
-1. On the **Basics** tab, select the **Resource group** and **Workspace** where Microsoft Sentinel is enabled.
-1. Select **Review + create**.
+1. On the toolbar at the top of the page, select **Install/Update**.
 
 ## Set up the data connector
 
 Microsoft Sentinel ingests data from services and apps by connecting to the service and forwarding the events and logs to Microsoft Sentinel. For this quickstart, install the data connector to forward data for Azure Activity to Microsoft Sentinel.
 
-1. In the Azure portal, search for and select **Microsoft Sentinel**.
 1. In Microsoft Sentinel, select **Data connectors**.
 1. Search for and select the **Azure Activity** data connector.
 1. In the details pane for the connector, select **Open connector page**.
 1. Review the instructions to configure the connector.
 1. Select **Launch Azure Policy Assignment Wizard**.
-1. On the **Basics** tab, set the **Scope** to the subscription and resource group that has activity to send to Microsoft Sentinel. For example, use the subscription and resource group that contains your Microsoft Sentinel instance.
+1. On the **Basics** tab, set the **Scope** to the subscription and resource group that has activity to send to Microsoft Sentinel. For example, select the subscription that contains your Microsoft Sentinel instance.
 1. Select the **Parameters** tab.
 1. Set the **Primary Log Analytics workspace**. This should be the workspace where Microsoft Sentinel is installed.
 1. Select **Review + create** and **Create**.
 
-After you set up your data connectors, your data starts streaming into Microsoft Sentinel and is ready for you to start working with. You can view the logs in the [built-in workbooks](get-visibility.md) and start building queries in Log Analytics to [investigate the data](investigate-cases.md).
+## Generate activity data
 
-Review the [data collection best practices](best-practices-data.md).
+Let's generate some activity data by enabling a rule that was included in the Azure Activity solution for Microsoft Sentinel. This step also shows you how to manage content in the content hub.
+
+1. In Microsoft Sentinel, select **Content hub**.
+1. Find and select the **Azure Activity** solution.
+1. From the right-hand side pane, select **Manage**.
+1. Find and select the rule template **Suspicious Resource deployment**.
+1. Select **Configuration**.
+1. Select the rule and **Create rule**.
+1. On the **General** tab, change the **Status** to enabled. Leave the rest of the default values.
+1. Accept the defaults on the other tabs.
+1. On the **Review and create** tab, select **Create**.
 
 ## View data ingested into Microsoft Sentinel
 
+Now that you've enabled the Azure Activity data connector and generated some activity data let's view the activity data added to the workspace.
+
+1. In Microsoft Sentinel, select **Data connectors**.
+1. Search for and select the **Azure Activity** data connector.
+1. In the details pane for the connector, select **Open connector page**.
+1. Review the **Status** of the data connector. It should be **Connected**.
+1. In the left-hand side pane above the chart, select **Go to log analytics**.
+1. On the top of the pane, next to the **New query 1** tab, select the **+** to add a new query tab.
+1. In the query pane, run the following query to view the activity date ingested into the workspace.
+
+   ```kusto
+    AzureActivity
+   ```
+
 
 ## Next steps
 
-In this quickstart, you enabled Microsoft Sentinel and installed a solution from the content hub. Then, you set up a data connector to start ingesting data into Microsoft Sentinel.
+In this quickstart, you enabled Microsoft Sentinel and installed a solution from the content hub. Then, you set up a data connector to start ingesting data into Microsoft Sentinel. You also verified that data is being ingested by viewing the data in the workspace.
+
 Go to the next article to learn how to visualize the data you've collected by using the dashboards and workbooks.
 > [!div class="nextstepaction"]
-> [Next steps button](get-visibility.md)
+> [Next steps button](get-visibility.md)