Merge pull request #261912 from ElazarK/wi194631-alerts-repeat

combined articles

Author: Jill Grant

.openpublishing.redirection.defender-for-cloud.json

@@ -588,7 +588,7 @@
         {
             "source_path_from_root": "/articles/security-center/managing-and-responding-alerts.md",
             "redirect_url": "/azure/defender-for-cloud/managing-and-responding-alerts",
-            "redirect_document_id": true
+            "redirect_document_id": false
         },
         {
             "source_path_from_root": "/articles/security-center/os-coverage.md",
@@ -702,8 +702,8 @@
         },
         {
             "source_path_from_root": "/articles/security-center/tutorial-security-incident.md",
-            "redirect_url": "/azure/defender-for-cloud/tutorial-security-incident",
-            "redirect_document_id": true
+            "redirect_url": "/azure/defender-for-cloud/managing-and-responding-alerts",
+            "redirect_document_id": false
         },
         {
             "source_path_from_root": "/articles/security-center/tutorial-security-policy.md",
@@ -904,6 +904,11 @@
             "source_path_from_root": "/articles/defender-for-cloud/attack-path-reference.md",
             "redirect_url": "/azure/defender-for-cloud/how-to-manage-attack-path",
             "redirect_document_id": true
+        },
+        {
+            "source_path_from_root": "/articles/defender-for-cloud/tutorial-security-incident.md",
+            "redirect_url": "/azure/defender-for-cloud/managing-and-responding-alerts",
+            "redirect_document_id": true
         }
     ]
 }

articles/defender-for-cloud/TOC.yml

@@ -109,9 +109,6 @@
     - name: Protect VMs
       displayName: manage, access, harden
       href: tutorial-protect-resources.md
-    - name: Investigate and respond to security alerts
-      displayName: triage, security, alerts, investigate,
-      href: tutorial-security-incident.md
     - name: Investigate the health of your resources
       displayName: health, resources, outstanding, security, issues,
       href: investigate-resource-health.md
@@ -394,7 +391,7 @@
           href: powershell-onboarding.md
     - name: Alerts, incidents, and threat reports
       items:
-        - name: Respond to security alerts
+        - name: Manage and respond to security alerts
           displayName: security alerts, alerts
           href: managing-and-responding-alerts.md
         - name: Create and manage alerts suppression rules

articles/defender-for-cloud/alerts-overview.md

@@ -115,5 +115,5 @@ In this article, you learned about the different types of alerts available in De
 
 - [Security alerts in Azure Activity log](https://go.microsoft.com/fwlink/?linkid=2114113) - In addition to being available in the Azure portal or programmatically, Security alerts and incidents are audited as events in Azure Activity Log
 - [Reference table of Defender for Cloud alerts](alerts-reference.md)
-- [Respond to security alerts](managing-and-responding-alerts.md#respond-to-security-alerts)
+- [Respond to security alerts](managing-and-responding-alerts.md#respond-to-a-security-alert)
 - Learn how to [manage security incidents in Defender for Cloud](incidents.md).

articles/defender-for-cloud/alerts-schemas.md

@@ -9,26 +9,26 @@ ms.date: 11/09/2021
 
 # Security alerts schemas
 
-If your subscription has Defender for Cloud [Defender plans](defender-for-cloud-introduction.md#protect-cloud-workloads) enabled, you'll receive security alerts when Defender for Cloud detects threats to their resources.
+If your subscription has Defender for Cloud [Defender plans](defender-for-cloud-introduction.md#protect-cloud-workloads) enabled, you receive security alerts when Defender for Cloud detects threats to their resources.
 
-You can view these security alerts in Microsoft Defender for Cloud's pages - [overview dashboard](overview-page.md), [alerts](tutorial-security-incident.md), [resource health pages](investigate-resource-health.md), or [workload protections dashboard](workload-protections-dashboard.md) - and through external tools such as:
+You can view these security alerts in Microsoft Defender for Cloud's pages - [overview dashboard](overview-page.md), [alerts](managing-and-responding-alerts.md), [resource health pages](investigate-resource-health.md), or [workload protections dashboard](workload-protections-dashboard.md) - and through external tools such as:
 
 - [Microsoft Sentinel](../sentinel/index.yml) - Microsoft's cloud-native SIEM. The Sentinel Connector gets alerts from Microsoft Defender for Cloud and sends them to the [Log Analytics workspace](../azure-monitor/logs/quick-create-workspace.md) for Microsoft Sentinel.
-- Third-party SIEMs - Send data to [Azure Event Hubs](../event-hubs/index.yml). Then integrate your Event Hub data with a third-party SIEM. Learn more in [Stream alerts to a SIEM, SOAR, or IT Service Management solution](export-to-siem.md).
+- Third-party SIEMs - Send data to [Azure Event Hubs](../event-hubs/index.yml). Then integrate your Event Hubs data with a third-party SIEM. Learn more in [Stream alerts to a SIEM, SOAR, or IT Service Management solution](export-to-siem.md).
 - [The REST API](/rest/api/defenderforcloud/) - If you're using the REST API to access alerts, see the [online Alerts API documentation](/rest/api/defenderforcloud/alerts).
 
-If you're using any programmatic methods to consume the alerts, you'll need the correct schema to find the fields that are relevant to you. Also, if you're exporting to an Event Hub or trying to trigger Workflow Automation with generic HTTP connectors, use the schemas to properly parse the JSON objects.
+If you're using any programmatic methods to consume the alerts, you need the correct schema to find the fields that are relevant to you. Also, if you're exporting to an Event Hubs or trying to trigger Workflow Automation with generic HTTP connectors, use the schemas to properly parse the JSON objects.
 
 >[!IMPORTANT]
-> The schema is slightly different for each of these scenarios, so make sure you select the relevant tab below.
+> The schema is slightly different for each of these scenarios, so make sure you select the relevant tab.
 
 ## The schemas
 
 ### [Microsoft Sentinel](#tab/schema-sentinel)
 
 The Sentinel Connector gets alerts from Microsoft Defender for Cloud and sends them to the Log Analytics Workspace for Microsoft Sentinel.
 
-To create a Microsoft Sentinel case or incident using Defender for Cloud alerts, you'll need the schema for those alerts shown below.
+To create a Microsoft Sentinel case or incident using Defender for Cloud alerts, you need the schema for those alerts shown.
 
 Learn more in the [Microsoft Sentinel documentation](../sentinel/index.yml).
 
@@ -117,16 +117,16 @@ You can view the security alerts events in Activity Log by searching for the Act
 |**id**|The fully qualified alert ID|
 |**level**|Constant, "Informational"|
 |**operationId**|See correlationId|
-|**operationName**|The value field is constant - "Microsoft.Security/locations/alerts/activate/action", and the localized value will be "Activate Alert" (can potentially be localized par the user locale)|
-|**resourceGroupName**|Will include the resource group name|
+|**operationName**|The value field is constant - `Microsoft.Security/locations/alerts/activate/action`, and the localized value is `Activate Alert` (can potentially be localized par the user locale)|
+|**resourceGroupName**| Includes the resource group name|
 |**resourceProviderName**|The value and localizedValue subfields are constant - "Microsoft.Security"|
 |**resourceType**|The value and localizedValue subfields are constant - "Microsoft.Security/locations/alerts"|
 |**resourceId**|The fully qualified Azure resource ID|
 |**status**|The value and localizedValue subfields are constant - "Active"|
 |**subStatus**|The value and localizedValue subfields are empty|
 |**submissionTimestamp**|The UTC timestamp of event submission to Activity Log|
 |**subscriptionId**|The subscription ID of the compromised resource|
-|**properties**|A JSON bag of additional properties pertaining to the alert. These can change from one alert to the other, however, the following fields will appear in all alerts:<br>- severity: The severity of the attack<br>- compromisedEntity: The name of the compromised resource<br>- remediationSteps: Array of remediation steps to be taken<br>- intent: The kill-chain intent of the alert. Possible intents are documented in the [Intentions table](alerts-reference.md#intentions)|
+|**properties**|A JSON bag of other properties pertaining to the alert. Properties can change from one alert to the other, however, the following fields appear in all alerts:<br>- severity: The severity of the attack<br>- compromisedEntity: The name of the compromised resource<br>- remediationSteps: Array of remediation steps to be taken<br>- intent: The kill-chain intent of the alert. Possible intents are documented in the [Intentions table](alerts-reference.md#intentions)|
 |**relatedEvents**|Constant - empty array|
 
 
@@ -138,8 +138,8 @@ For the alerts schema when using workflow automation, see the [connectors docume
 
 Defender for Cloud's continuous export feature passes alert data to:
 
-- Azure Event Hub using the same schema as [the alerts API](/rest/api/defenderforcloud/alerts).
-- Log Analytics workspaces according to the [SecurityAlert schema](/azure/azure-monitor/reference/tables/SecurityAlert) in the Azure Monitor data reference documentation.
+- Azure Event Hubs using the same schema as [the alerts API](/rest/api/defenderforcloud/alerts).
+- Log Analytics workspaces according to the [SecurityAlert schema](/azure/azure-monitor/reference/tables/SecurityAlert) in the Azure Monitor data documentation.
 
 ### [MS Graph API](#tab/schema-graphapi)
 
@@ -151,7 +151,7 @@ The schema and a JSON representation for security alerts sent to MS Graph, are a
 
 ## Next steps
 
-This article described the schemas that Microsoft Defender for Cloud's threat protection tools use when sending security alert information.
+This article described the schemas that Microsoft Defenders for Cloud's threat protection tools use when sending security alert information.
 
 For more information on the ways to access security alerts from outside Defender for Cloud, see:
 

articles/defender-for-cloud/defender-for-apis-introduction.md

@@ -24,7 +24,7 @@ Defender for APIs currently provides security for APIs published in Azure API Ma
 - **Threat detection**: Ingest API traffic and monitor it with runtime anomaly detection, using machine-learning and rule-based analytics, to detect API security threats, including the [OWASP API Top 10](https://owasp.org/www-project-api-security/) critical threats.
 - **Defender CSPM integration**: Integrate with Cloud Security Graph in [Defender Cloud Security Posture Management (CSPM)](concept-cloud-security-posture-management.md) for API visibility and risk assessment across your organization.
 - **Azure API Management integration**: With the Defender for APIs plan enabled, you can receive API security recommendations and alerts in the Azure API Management portal.
-- **SIEM integration**: Integrate with security information and event management (SIEM) systems, making it easier for security teams to investigate with existing threat response workflows. [Learn more](tutorial-security-incident.md).
+- **SIEM integration**: Integrate with security information and event management (SIEM) systems, making it easier for security teams to investigate with existing threat response workflows. [Learn more](managing-and-responding-alerts.md).
 
 ## Reviewing API security findings
 

articles/defender-for-cloud/defender-for-databases-usage.md

@@ -43,7 +43,7 @@ When Microsoft Defender for Cloud is enabled on your database, it detects anomal
 > [!TIP]
 > A live tile on [Microsoft Defender for Cloud's overview dashboard](overview-page.md) tracks the status of active threats to all your resources including databases. Select the security alerts tile to go to the Defender for Cloud security alerts page and get an overview of active threats detected on your databases.
 >
-> For detailed steps and the recommended method to respond to security alerts, see [Respond to a security alert](tutorial-security-incident.md#respond-to-a-security-alert).
+> For detailed steps and the recommended method to respond to security alerts, see [Respond to a security alert](managing-and-responding-alerts.md#respond-to-a-security-alert).
 
 ### Respond to email notifications of security alerts
 
@@ -62,7 +62,7 @@ Defender for Cloud sends email notifications when it detects anomalous database
     :::image type="content" source="media/defender-for-databases-usage/specific-alert-details.png" alt-text="Details of a specific alert." lightbox="media/defender-for-databases-usage/specific-alert-details.png":::
 
 > [!TIP]
-> For a detailed tutorial on how to handle your alerts, see [Tutorial: Triage, investigate, and respond to security alerts](tutorial-security-incident.md).
+> For a detailed tutorial on how to handle your alerts, see [Manage and respond to alerts](tutorial-security-incident.md).
 
 ## Next steps
 

articles/defender-for-cloud/investigate-resource-health.md

@@ -72,13 +72,13 @@ The resource health page lists the recommendations for which your resource is "u
 
 - To investigate a security alert:
     1. From the right pane, select an alert.
-    1. Follow the instructions in [Respond to security alerts](managing-and-responding-alerts.md#respond-to-security-alerts).
+    1. Follow the instructions in [Respond to security alerts](managing-and-responding-alerts.md#respond-to-a-security-alert).
 
 ## Next steps
 
 In this tutorial, you learned about using Defender for Cloud’s resource health page.
 
 To learn more, see these related pages:
 
-- [Respond to security alerts](managing-and-responding-alerts.md#respond-to-security-alerts)
+- [Respond to security alerts](managing-and-responding-alerts.md#respond-to-a-security-alert)
 - [Review your security recommendations](review-security-recommendations.md)