Skip to content

Commit bb19ed9

Browse files
author
cabailey
committed
wording updates
1 parent be6c6d7 commit bb19ed9

File tree

1 file changed

+15
-14
lines changed

1 file changed

+15
-14
lines changed

articles/sentinel/bookmarks.md

Lines changed: 15 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -29,22 +29,22 @@ You can revisit your bookmarked data at any time on the **Bookmark** tab of the
2929

3030
Currently in preview, if you find something that urgently needs to be addressed while hunting in Log Analytics, in a couple of clicks, you can create a bookmark and promote it to an incident, or add the bookmark to an existing incident. For more information about incidents, see [Tutorial: Investigate incidents with Azure Sentinel](tutorial-investigate-cases.md).
3131

32-
Also in preview, you can visualize your bookmarked data, by clicking **Investigate** from bookmark details. This launches the investigation experience in which you can view, investigate, and visually communicate your findings using an interactive entity-graph diagram and timeline.
32+
Also in preview, you can visualize your bookmarked data, by clicking **Investigate** from the bookmark details. This launches the investigation experience in which you can view, investigate, and visually communicate your findings using an interactive entity-graph diagram and timeline.
3333

3434
## Add a bookmark
3535

3636
1. In the Azure portal, navigate to **Sentinel** > **Threat management** > **Hunting** to run queries for suspicious and anomalous behavior.
3737

3838
2. Select one of the hunting queries and on the right, in the hunting query details, select **Run Query**.
3939

40-
3. Select **View query results** to view the query results in the **Logs** blade. For example:
40+
3. Select **View query results** to view the query results. For example:
4141

4242
> [!div class="mx-imgBorder"]
4343
> ![view query results from Azure Sentinel hunting](./media/bookmarks/new-processes-observed-example.png)
4444
45-
4. In the log query results list, expand the row containing the information that you find interesting.
45+
4. In the **Logs** blade, log query results list, expand the row that contains the information you find interesting.
4646

47-
5. Select the ellipsis (...) at the end of the row, and select **Add hunting bookmark**:
47+
5. Select the ellipsis (...) at the end of the row, and then select **Add hunting bookmark**:
4848

4949
> [!div class="mx-imgBorder"]
5050
> ![Add hunting bookmark to query](./media/bookmarks/add-hunting-bookmark.png)
@@ -74,8 +74,7 @@ Also in preview, you can visualize your bookmarked data, by clicking **Investiga
7474

7575
4. Select individual bookmarks and view the bookmark details in the right-hand details pane.
7676

77-
5. To update tags and notes, make your changes in the editable text boxes, and then click **Save**.
78-
77+
5. Make your changes in the editable text boxes.
7978

8079
## Exploring bookmarks in the investigation graph
8180

@@ -86,7 +85,7 @@ Also in preview, you can visualize your bookmarked data, by clicking **Investiga
8685
8786
1. In the Azure portal, navigate to **Sentinel** > **Threat management** > **Hunting** > **Bookmarks** tab, and select the bookmark or bookmarks you want to investigate.
8887

89-
2. In the bookmark details pane, ensure that at least one entity is mapped. For example, for **ENTITIES**, you see entries for **IP**, **Machine**, or **Account**.
88+
2. In the bookmark details, ensure that at least one entity is mapped. For example, for **ENTITIES**, you see entries for **IP**, **Machine**, or **Account**.
9089

9190
3. Click **Investigate** to view the bookmark in the investigation graph.
9291

@@ -113,19 +112,21 @@ For instructions to use the investigation graph, see [Use the investigation grap
113112

114113
To view the bookmark within the incident: Navigate to **Sentinel** > **Threat management** > **Incidents** and select the incident with your bookmark. Select **View full details**, and then select the **Bookmarks** tab.
115114

116-
## View bookmarked data in Log Analytics
115+
## View bookmarked data in logs
116+
117+
There are multiple options to viewing your bookmarked data in logs.
118+
119+
The easiest way to view bookmarked queries, results, or history is by selecting the bookmark from the **Hunting** > **Bookmarks** tab, and use the links provided in the details pane. Options include:
117120

118-
There are multiple options to viewing your bookmarked data in Log Analytics.
121+
- **View source query** to view the source query in the **Logs** blade.
119122

120-
The easiest way to view bookmarked queries, results, or history is by selecting the desired bookmark in the **Bookmarks** table and use the links provided in the details pane. Options include:
121-
- Click **View query** to view the source query in Log Analytics.
122-
- Click **View bookmark history** to see all bookmark metadata including: who made the update, the updated values, and the time the update occurred.
123+
- **View bookmark logs** to see all bookmark metadata, which includes who made the update, the updated values, and the time the update occurred.
123124

124-
- You can also view the raw bookmark data for all bookmarks by clicking on **Bookmark logs** above the bookmark grid. This view will show the all your bookmarks in the hunting bookmark table with associated metadata. You can use KQL queries to filter down to the latest version of the specific bookmark you are looking for.
125+
You can also view the raw bookmark data for all bookmarks by clicking on **Bookmark logs** above the bookmark grid. This view will show the all your bookmarks in the hunting bookmark table with associated metadata. You can use KQL queries to filter down to the latest version of the specific bookmark you are looking for.
125126

126127

127128
> [!NOTE]
128-
> There can be significant delay (measured in minutes) between the creation of a bookmark and when it is displayed in the **HuntingBookmark** table. It is recommended to create your bookmarks first, then analyze them after the data is ingested.
129+
> There can be a significant delay (measured in minutes) between the time you create a bookmark and when it is displayed in the **Bookmarks** tab. Because of this delay, we recommend you create your bookmarks first, then analyze them after the data is ingested.
129130
130131
## Delete a bookmark
131132

0 commit comments

Comments
 (0)