continued metadata includes

batamig · batamig · commit b5f2775df2cf · 2024-03-28T15:19:21.000+02:00
diff --git a/articles/sentinel/connect-data-sources.md b/articles/sentinel/connect-data-sources.md
@@ -8,6 +8,7 @@ ms.author: yelevin
 appliesto:
     - Microsoft Sentinel in the Azure portal
     - Microsoft Sentinel in the Microsoft Defender portal
+ms.collection: usx-security
 #customer intent: As a security architect or SOC analyst, I want to understand what data connectors are in Microsoft Sentinel.
 ---
 
diff --git a/articles/sentinel/customize-alert-details.md b/articles/sentinel/customize-alert-details.md
@@ -5,6 +5,10 @@ author: yelevin
 ms.topic: how-to
 ms.date: 03/05/2024
 ms.author: yelevin
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
+ms.collection: usx-security
 ---
 
 # Customize alert details in Microsoft Sentinel 
diff --git a/articles/sentinel/customize-entity-activities.md b/articles/sentinel/customize-entity-activities.md
@@ -5,6 +5,10 @@ author: yelevin
 ms.topic: how-to
 ms.date: 03/16/2024
 ms.author: yelevin
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
+ms.collection: usx-security
 ---
 
 # Customize activities on entity page timelines
diff --git a/articles/sentinel/data-connectors-reference.md b/articles/sentinel/data-connectors-reference.md
@@ -8,6 +8,7 @@ ms.author: cwatson
 appliesto:
     - Microsoft Sentinel in the Azure portal
     - Microsoft Sentinel in the Microsoft Defender portal
+ms.collection: usx-security
 ---
 
 # Find your Microsoft Sentinel data connector
diff --git a/articles/sentinel/detect-threats-custom.md b/articles/sentinel/detect-threats-custom.md
@@ -6,6 +6,10 @@ ms.author: yelevin
 ms.topic: how-to
 ms.custom: devx-track-arm-template
 ms.date: 03/26/2024
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
+ms.collection: usx-security
 ---
 
 # Create a custom analytics rule from scratch
diff --git a/articles/sentinel/domain-based-essential-solutions.md b/articles/sentinel/domain-based-essential-solutions.md
@@ -8,6 +8,7 @@ ms.author: cwatson
 appliesto:
     - Microsoft Sentinel in the Azure portal
     - Microsoft Sentinel in the Microsoft Defender portal.
+ms.collection: usx-security
 #Customer intent: As a security engineer, I want to learn how I can minimize the amount of solution content I have to deploy and manage by using Microsoft essential solutions for Microsoft Sentinel.
 ---
 
diff --git a/articles/sentinel/enable-entity-behavior-analytics.md b/articles/sentinel/enable-entity-behavior-analytics.md
@@ -5,6 +5,10 @@ author: yelevin
 ms.author: yelevin
 ms.topic: how-to
 ms.date: 03/18/2024
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
+ms.collection: usx-security
 ---
 
 # Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel
diff --git a/articles/sentinel/entity-pages.md b/articles/sentinel/entity-pages.md
@@ -5,6 +5,10 @@ author: yelevin
 ms.author: yelevin
 ms.topic: conceptual
 ms.date: 03/16/2024
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
+ms.collection: usx-security
 ---
 
 # Entity pages in Microsoft Sentinel
diff --git a/articles/sentinel/hunts.md b/articles/sentinel/hunts.md
@@ -27,6 +27,8 @@ Use the end to end hunting experience within Microsoft Sentinel to:
 - Keep track of your new, active, and closed hunts in one place.
 - View metrics based on validated hypotheses and tangible results.
 
+[!INCLUDE [unified-soc-preview](includes/unified-soc-preview.md)]
+
 ## Prerequisites
 In order to use the hunts feature, you either need to be assigned a built-in Microsoft Sentinel role, or a custom Azure RBAC role. Here are your options:
 
diff --git a/articles/sentinel/identify-threats-with-entity-behavior-analytics.md b/articles/sentinel/identify-threats-with-entity-behavior-analytics.md
@@ -5,6 +5,10 @@ author: yelevin
 ms.author: yelevin
 ms.topic: conceptual
 ms.date: 03/19/2024
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
+ms.collection: usx-security
 ---
 
 # Advanced threat detection with User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel
diff --git a/articles/sentinel/indicators-bulk-file-import.md b/articles/sentinel/indicators-bulk-file-import.md
@@ -20,6 +20,8 @@ In this how-to guide, you'll add indicators from a CSV or JSON file into Microso
 
 > [!IMPORTANT]
 > This feature is currently in PREVIEW. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
+>
+> [!INCLUDE [unified-soc-preview-without-alert](includes/unified-soc-preview-without-alert.md)]
 
 ## Prerequisites
 
diff --git a/articles/sentinel/livestream.md b/articles/sentinel/livestream.md
@@ -27,6 +27,7 @@ Use hunting livestream to create interactive sessions that let you test newly cr
     
     If there's an active investigation that involves an asset such as a host or user, view specific (or any) activity in the log data as it occurs on that asset. Be notified when that activity occurs.
 
+[!INCLUDE [unified-soc-preview](includes/unified-soc-preview.md)]
 
 ## Create a livestream session
 
diff --git a/articles/sentinel/map-data-fields-to-entities.md b/articles/sentinel/map-data-fields-to-entities.md
@@ -5,6 +5,10 @@ author: yelevin
 ms.topic: how-to
 ms.date: 04/26/2022
 ms.author: yelevin
+ms.collection: usx-security
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ---
 
 # Map data fields to entities in Microsoft Sentinel 
diff --git a/articles/sentinel/microsoft-365-defender-sentinel-integration.md b/articles/sentinel/microsoft-365-defender-sentinel-integration.md
@@ -26,9 +26,6 @@ Other services whose alerts are collected by Microsoft Defender XDR include:
 
 In addition to collecting alerts from these components and other services, Microsoft Defender XDR generates alerts of its own. It creates incidents from all of these alerts and sends them to Microsoft Sentinel.
 
-> [!IMPORTANT]
-> The Microsoft Defender XDR connector is now generally available!
-
 ## Common use cases and scenarios
 
 - One-click connect of Microsoft Defender XDR incidents, including all alerts and entities from Microsoft Defender XDR components, into Microsoft Sentinel.
@@ -59,7 +56,7 @@ Once the Microsoft Defender XDR integration is connected, the connectors for all
 
 - To avoid creating duplicate incidents for the same alerts, we recommend that customers turn off all **Microsoft incident creation rules** for Microsoft Defender XDR-integrated products (Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud Apps, and Microsoft Entra ID Protection) when connecting Microsoft Defender XDR. This can be done by disabling incident creation in the connector page. Keep in mind that if you do this, any filters that were applied by the incident creation rules will not be applied to Microsoft Defender XDR incident integration.
 
-- Incident creation rules aren't supported in workspaces onboarded to the unified SOC platform. For more information, see [After onboarding to the unified SOC platform](automation.md#after-onboarding-to-the-unified-soc-platform).
+- Incident creation rules aren't supported in workspaces onboarded to the unified SOC platform. For more information, see [After onboarding to the unified SOC platform](automation.md#after-onboarding-to-the-unified-soc-platform) and [Microsoft Sentinel in the Microsoft Defender portal](microsoft-sentinel-defender-portal.md).
 
 ## Working with Microsoft Defender XDR incidents in Microsoft Sentinel and bi-directional sync
 
diff --git a/articles/sentinel/notebook-get-started.md b/articles/sentinel/notebook-get-started.md
@@ -31,6 +31,8 @@ For more information, see [Use notebooks to power investigations](hunting.md#use
 
 Several Microsoft Sentinel notebooks don't use MSTICPy, such as the **Credential Scanner** notebooks, or the PowerShell and C# examples. Notebooks that don't use MSTICpy don't need the MSTICPy configuration described in this article.
 
+[!INCLUDE [unified-soc-preview](includes/unified-soc-preview.md)]
+
 ## Prerequisites
 
 Before you begin, make sure you have the required permissions and resources.
diff --git a/articles/sentinel/playbook-triggers-actions.md b/articles/sentinel/playbook-triggers-actions.md
@@ -22,6 +22,8 @@ For an introduction to playbooks, see [Automate threat response with playbooks i
 
 For the complete specification of the Microsoft Sentinel connector, see the [Logic Apps connector documentation](/connectors/azuresentinel/).
 
+[!INCLUDE [unified-soc-preview](includes/unified-soc-preview.md)]
+
 ## Permissions required
 
 | Roles \ Connector components | Triggers | "Get" actions | Update incident,<br>add a comment |
