restructure how to for new STIX capabilities

Author: austinmccollum

articles/sentinel/understand-threat-intelligence.md

@@ -123,10 +123,13 @@ For more information, see [Connect Microsoft Sentinel to STIX/TAXII threat intel
 
 ## Create and manage threat intelligence
 
-Threat intelligence management is unified with Microsoft Defender Threat Intelligence (MDTI) and Threat Analytics in the Defender portal.
+Threat intelligence powered by Microsoft Sentinel is managed next to Microsoft Defender Threat Intelligence (MDTI) and Threat Analytics in Microsoft's unified SecOps platform.
 
 :::image type="content" source="media/understand-threat-intelligence/intel-management-defender-portal.png" alt-text="Screenshot showing intel management page in the Defender portal.":::
 
+>[!NOTE]
+> Threat intelligence in the Azure portal remains in Microsoft Sentinel > **Threat management** > **Threat intelligence**.
+
 Two of the most common threat intelligence tasks are creating new threat intelligence related to security investigations and tagging intel objects. The management interface streamlines the manual process of creating individual threat intel with a few key features.
 - Define relationships as you create new STIX objects.
 - Curate existing TI with the relationship builder.

articles/sentinel/whats-new.md

@@ -39,7 +39,7 @@ Managing Microsoft Sentinel-powered threat intelligence has moved in the Defende
 Enhanced threat intelligence capabilities are available in both Microsoft's unified SecOps platform and Microsoft Sentinel in the Azure portal. The management interface streamlines the manual process of creating individual threat intel with these key features:
 - Define relationships as you create new STIX objects.
 - Curate existing threat intelligence with the new relationship builder.
-- Quickly create multiple objects by using the duplicate feature to copy the metadata from a new or existing threat intel.
+- Quickly create multiple objects by using the duplicate feature to copy the metadata from a new or existing threat intel objects.
 
 Use advanced search to sort and filter your threat intelligence objects without even writing a Log Analytics query. For more information, see the following articles:
 - [New STIX objects in Microsoft Sentinel](https://techcommunity.microsoft.com/blog/microsoftsentinelblog/announcing-public-preview-new-stix-objects-in-microsoft-sentinel/4369164)

articles/sentinel/work-with-threat-indicators.md

@@ -10,23 +10,43 @@ appliesto:
     - Microsoft Sentinel in the Azure portal
     - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
-
-
 #Customer intent: As a security analyst, I want to use threat intelligence managed by Microsoft Sentinel so that I can detect and respond to security threats more effectively.
-
 ---
 
 # Work with threat intelligence in Microsoft Sentinel
 
-Manage your threat intelligence with the following features:
+This article demonstrates how to make the most of threat intelligence (TI) integration in the management interface with these activities:
+
+- Create TI in the management interface
+- Manage TI by viewing, curating, and visualizing 
 
-- **Import threat intelligence** into Microsoft Sentinel by enabling *data connectors* to various threat intelligence [platforms](connect-threat-intelligence-tip.md) and [feeds](connect-threat-intelligence-taxii.md).
-- **View and manage** the imported threat intelligence in **Logs** and the management interface.
-- **Detect threats** and generate security alerts and incidents by using the built-in **Analytics** rule templates based on your imported threat intelligence.
-- **Visualize key information** about your imported threat intelligence in Microsoft Sentinel with the **Threat Intelligence workbook**.
+All of these activities have the same steps except the management interface is accessed differently depending which portal you use.
+ 
+- For Microsoft Sentinel-powered threat intelligence in the Defender portal, navigate to **Threat intelligence** > **Intel management**.
+- For Microsoft Sentinel in the Azure portal, navigate to **Threat management** > **Threat intelligence**.
 
 [!INCLUDE [unified-soc-preview](includes/unified-soc-preview.md)]
 
+## Create threat intelligence in the management interface
+
+Use the management interface to create threat intelligence objects and perform other common threat intelligence tasks such as indicator tagging and establishing connections between objects security investigations.
+
+- Define relationships as you create new STIX objects.
+- Curate existing TI with the relationship builder.
+- Quickly create multiple objects by using the duplicate feature to copy the metadata from a new or existing TI object.
+
+### Create a new indicator
+
+1. On the menu bar at the top of the page, select **Add new**.
+
+    :::image type="content" source="media/work-with-threat-indicators/threat-intel-add-new-indicator.png" alt-text="Screenshot that shows adding a new threat indicator." lightbox="media/work-with-threat-indicators/threat-intel-add-new-indicator.png":::
+
+1. Choose the indicator type, and then fill in the form on the **New indicator** pane. The required fields are marked with an asterisk (*).
+
+1. Select **Apply**. The indicator is added to the indicators list and is also sent to the `ThreatIntelligenceIndicator` table in **Logs**.
+
+## Manage threat intelligence 
+
 ## View your threat intelligence in Microsoft Sentinel
 
 Learn how to work with threat intelligence intelligence throughout Microsoft Sentinel.
@@ -74,23 +94,7 @@ To view your threat intelligence indicators in **Logs**:
 
     :::image type="content" source="media/work-with-threat-indicators/ti-table-results.png" alt-text="Screenshot that shows sample ThreatIntelligenceIndicator table results with the details expanded." lightbox="media/work-with-threat-indicators/ti-table-results.png":::
 
-## Create and manage objects
-
-Use the management interface to create threat intelligence objects and perform other common threat intelligence tasks such as indicator tagging and establishing connections between objects security investigations.
-
-### Create a new indicator
-
-1. In the [Defender portal](https://security.microsoft.com/), select **** > **Threat intelligence** > **Intel management**.
-   
-   For Microsoft Sentinel in the [Azure portal](https://portal.azure.com), under **Threat management**, select **Threat intelligence**.
 
-1. On the menu bar at the top of the page, select **Add new**.
-
-    :::image type="content" source="media/work-with-threat-indicators/threat-intel-add-new-indicator.png" alt-text="Screenshot that shows adding a new threat indicator." lightbox="media/work-with-threat-indicators/threat-intel-add-new-indicator.png":::
-
-1. Choose the indicator type, and then fill in the form on the **New indicator** pane. The required fields are marked with an asterisk (*).
-
-1. Select **Apply**. The indicator is added to the indicators list and is also sent to the `ThreatIntelligenceIndicator` table in **Logs**.
 
 ### Tag and edit threat indicators