Incorp PG feedback

Author: cwatson-cat

articles/sentinel/TOC.yml

@@ -87,8 +87,8 @@
       href: sentinel-solutions.md
     - name: Content hub catalog
       href: sentinel-solutions-catalog.md
-    - name: Essential solutions for domain categories
-      href: essential-solutions.md      
+    - name: ASIM-based domain solutions
+      href: domain-based-essential-solutions.md      
     - name: Manage custom content with repositories
       href: ci-cd-custom-content.md
     - name: OOTB content centralization changes

articles/sentinel/essential-solutions.md renamed to articles/sentinel/domain-based-essential-solutions.md

@@ -1,5 +1,5 @@
 ---
-title: Microsoft essential solutions for Microsoft Sentinel
+title: ASIM-based domain solutions - Essentials for Microsoft Sentinel
 description: Learn about the Microsoft essential solutions for Microsoft Sentinel that span across different ASIM schemas like networks, DNS, and web sessions.
 author: cwatson-cat
 ms.topic: conceptual
@@ -8,26 +8,25 @@ ms.author: cwatson
 #Customer intent: As a security engineer, I want to minimize the amount of solution content I have to deploy and manage by using Microsoft essential solutions for Microsoft Sentinel.
 ---
 
-# Microsoft essential solutions for Microsoft Sentinel
+# Microsoft essential solutions - Advanced Security Information Model (ASIM) based domain solutions for Microsoft Sentinel
 
-Microsoft essential solutions are a collection of solutions that....provide centralized content for specific domain categories...?  Essential solutions use the normalization technique Advanced Security Information Model (ASIM) to normalize the data at query time or ingestion time. The ingestion time normalization results can be ingested into following normalized table:
+Microsoft essential solutions helps you reduce the amount of content you manage in Microsoft Sentinel for specific domains like Security - Network. Essential solutions use the normalization technique Advanced Security Information Model (ASIM) to normalize the data at query time or ingestion time.
 
-- [ASimDnsActivityLogs](/azure/azure-monitor/reference/tables/asimdnsactivitylogs) for the DNS schema.
-- [ASimNetworkSessionLogs](/azure/azure-monitor/reference/tables/asimnetworksessionlogs) for the Network Session schema
+## Why use ASIM-based Microsoft essential solutions
 
-For more information, see [Ingest time normalization](/azure/sentinel/normalization-ingest-time).
+When multiple solutions in a domain category share similar detection patterns, it makes sense to have the data captured under a normalized schema like ASIM. Essential solutions makes use of this ASIM schema to detect threats at scale. 
 
-## Why Microsoft essential solutions
+- A normalized schema makes it easier for you to query incident details. You don't have to remember different vendor syntax for similar log attributes.
+- If you don't have to manage content for multiple solutions, it makes use case deployment and incident handling much easier.
+- A consolidated workbook view gives you better environment visibility and possible query time parsing with high performing ASIM parsers.
 
-Today, we have over 280 product solutions in the content hub. There are multiple product solutions for different domain categories like Security - Network. For example, Azure Firewall, Palo Alto Firewall, and Corelight have product solutions for the Security-Network domain category. 
+In the content hub, there are multiple product solutions for different domain categories like Security - Network. For example, Azure Firewall, Palo Alto Firewall, and Corelight have product solutions for the Security  -Network domain category.
 
 - These solutions have differing data ingest components by design. But there’s a certain pattern to the analytics, hunting, workbooks, and other content within the same domain category.
 - Most of the major network products have a common basic set of firewall alerts that includes malicious threats coming from unusual IP addresses. The analytic rule template is, in general, duplicated for each of the Security - Network category of product solutions. If you're running multiple network products, you need to check and configure multiple analytic rules individually, which is inefficient. You'd also get alerts for each rule configured and might end up with alert fatigue.
 
 If you have duplicative hunting queries, you might have less performant hunting experiences with the run-all mode of hunting. These duplicative hunting queries also introduce inefficiencies for threat hunters to select-run similar queries.
 
-Microsoft essential solution reduces the amount of content you need to manage or provides efficiencies in.... 
-
 ## ASIM schemas supported
 
 The essentials solutions are currently spanned across the following different ASIM schemas that Sentinel supports:
@@ -42,44 +41,23 @@ The essentials solutions are currently spanned across the following different AS
 
 For more information, see [Advanced Security Information Model (ASIM) schemas](/azure/sentinel/normalization-about-schemas).
 
-## Connectors not included
-
-The essential solutions don't have a connector of their own. They depend on the source specific connectors to pull in the logs. Then the solutions use the ASIM parsers in their built in analytic rules, hunting queries, and workbooks to identify anomalies. The ASIM parsers provide a consolidated report or dashboard view for all the source specific solutions that were part of prerequisite lists.
-
-## Network session essentials solution
-
-One of the first solutions available in the essentials series is the network session essential solution. This solution doesn't have a connector of its own. Instead, it uses the ASIM parsers for query time parsing. This solution comes with seven analytic rules, four hunting queries, one playbook, one workbook, and watchlists.
+## Ingestion time normalization
 
-Analytics rules included:
+The ingestion time normalization results can be ingested into following normalized table:
 
-- Network session traffic anomaly
-- Anomaly in port usage
-- More than defined port usage
-- Excessive number of failed connections from a Single source
-- Detect possible flooding  
-- Possible external to internal port sweep 
-- Possible port scan
-- Potential Beaconing activity
-- TI map IP entity to Network Session Events
+- [ASimDnsActivityLogs](/azure/azure-monitor/reference/tables/asimdnsactivitylogs) for the DNS schema.
+- [ASimNetworkSessionLogs](/azure/azure-monitor/reference/tables/asimnetworksessionlogs) for the Network Session schema
 
-Hunting queries included:
+For more information, see [Ingest time normalization](/azure/sentinel/normalization-ingest-time).
 
-- Detect Anomaly in port usage
-- Detect More than defined port usage
-- Detect multiple users with same MAC address
-- Destination App and associated standard port mismatch
+## Connectors not included
 
-Playbook: Summarization playbook
+The essential solutions don't have a connector of their own. They depend on the source specific connectors to pull in the logs. Then the solutions use the ASIM parsers in their built in analytic rules, hunting queries, and workbooks to identify anomalies. The ASIM parsers provide a consolidated report or dashboard view for all the source specific solutions that were part of prerequisite lists.
 
-- The playbook summarizes end point security events and stores them in a pre-defined table. 
-- This playbook is helpful where you have a high number of end points security events. For example, you might have a high number of events in a large organization where network traffic is being monitoring by multiple source specific network solutions.
+## Network session essentials solution
 
-- By default, this playbook is available as a template. If you have a high number of end point security events on your network and you notice a performance issue when loading the workbook, then enable the playbook template.
+One of the first solutions available in the essentials series is the network session essential solution. This solution doesn't have a connector of its own. Instead, it uses the ASIM parsers for query time parsing. For more information about this solution, see (Marketplace listing)
 
-Workbook:
-The workbook covers details for the following listed events.
+## Next steps
 
-- Traffic visibility
-- Security visibility
-- Policy rule
-- Network security event viewer
+- [Using the Advanced Security Information Model (ASIM)](/azure/sentinel/normalization-about-parsers)

articles/sentinel/sentinel-solutions-catalog.md

@@ -30,7 +30,7 @@ When you deploy a solution, the security content included with the solution, suc
 | **[Microsoft Defender for IoT](https://azuremarketplace.microsoft.com/marketplace/apps/azuresentinel.azure-sentinel-solution-unifiedmicrosoftsocforot?tab=Overview)** | [Analytics rules, playbooks, workbook](iot-advanced-threat-monitoring.md) | Internet of Things (IoT), Security - Threat Protection | Microsoft |
 |**[Maturity Model for Event Log Management M2131](https://azuremarketplace.microsoft.com/marketplace/apps/azuresentinel.azure-sentinel-solution-maturitymodelforeventlogma?tab=Overview)** | [Analytics rules, hunting queries, playbooks, workbook](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/modernize-log-management-with-the-maturity-model-for-event-log/ba-p/3072842) | Compliance | Microsoft|
 |**[Microsoft 365 Insider Risk Management](https://azuremarketplace.microsoft.com/marketplace/apps/azuresentinel.azure-sentinel-solution-insiderriskmanagement?tab=Overview)** (IRM) |[Data connector](data-connectors/microsoft-365-insider-risk-management.md), [workbook, analytics rules, hunting queries, playbook](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/announcing-the-microsoft-sentinel-microsoft-insider-risk/ba-p/2955786) |Security - Insider threat | Microsoft|
-|**Network Session Essential Solutions**|[Analytics rules, hunting queries, playbooks, workbook](essential-solutions.md)|Security - Network | Microsoft|
+|**Network Session Essential Solution**|[Analytics rules, hunting queries, playbooks, workbook](essential-solutions.md)|Security - Network | Microsoft|
 |**[NIST SP 800-53](https://azuremarketplace.microsoft.com/marketplace/apps/azuresentinel.azure-sentinel-solution-nistsp80053?tab=Overview)**|[Workbooks, analytic rules, playbooks](https://techcommunity.microsoft.com/t5/public-sector-blog/microsoft-sentinel-nist-sp-800-53-solution/ba-p/3401307)|Security - Threat Protection|Microsoft|
 |**[Security Threat Essentials](https://azuremarketplace.microsoft.com/marketplace/apps/azuresentinel.azure-sentinel-solution-securitythreatessentialsol?tab=Overview)**|Analytic rules, Hunting queries|Security - Others|Microsoft|
 |**[Zero Trust (TIC 3.0)](https://azuremarketplace.microsoft.com/marketplace/apps/azuresentinel.azure-sentinel-solution-zerotrust?tab=Overview)**  |[Analytics rules, playbook,  workbooks](/security/zero-trust/integrate/sentinel-solution) |Compliance, Identity, Security - Others |Microsoft  |