edit pass: sentinel-threat-intelligence-batch2

Author: paulth1

articles/sentinel/add-entity-to-threat-intelligence.md

@@ -128,7 +128,7 @@ Whichever of the two interfaces you choose, you end up here.
 
 1. When all the fields are filled in to your satisfaction, select **Apply**. A confirmation message appears in the upper-right corner stating that your indicator was created.
 
-1. The entity is added as a threat indicator in your workspace. You can find it [in the list of indicators on the Threat Intelligence page](work-with-threat-indicators.md#find-and-view-your-indicators-in-the-threat-intelligence-page). You can also find it [in the ThreatIntelligenceIndicators table in Logs](work-with-threat-indicators.md#find-and-view-your-indicators-in-logs).
+1. The entity is added as a threat indicator in your workspace. You can find it [in the list of indicators on the Threat Intelligence page](work-with-threat-indicators.md#find-and-view-your-indicators-on-the-threat-intelligence-page). You can also find it [in the ThreatIntelligenceIndicators table in Logs](work-with-threat-indicators.md#find-and-view-your-indicators-in-logs).
 
 ## Related content
 

articles/sentinel/connect-threat-intelligence-taxii.md

@@ -15,11 +15,11 @@ ms.collection: usx-security
 
 # Connect Microsoft Sentinel to STIX/TAXII threat intelligence feeds
 
-The most widely adopted industry standard for the transmission of threat intelligence is a [combination of the STIX data format and the TAXII protocol](https://oasis-open.github.io/cti-documentation/). If your organization receives threat indicators from solutions that support the current STIX/TAXII version (2.0 or 2.1), you can use the Threat intelligence - TAXII data connector to bring your threat indicators into Microsoft Sentinel. This connector enables a built-in TAXII client in Microsoft Sentinel to import threat intelligence from TAXII 2.x servers.
+The most widely adopted industry standard for the transmission of threat intelligence is a [combination of the STIX data format and the TAXII protocol](https://oasis-open.github.io/cti-documentation/). If your organization receives threat indicators from solutions that support the current STIX/TAXII version (2.0 or 2.1), you can use the Threat Intelligence - TAXII data connector to bring your threat indicators into Microsoft Sentinel. This connector enables a built-in TAXII client in Microsoft Sentinel to import threat intelligence from TAXII 2.x servers.
 
 :::image type="content" source="media/connect-threat-intelligence-taxii/threat-intel-taxii-import-path.png" alt-text="Screenshot that shows a TAXII import path.":::
 
-To import STIX-formatted threat indicators to Microsoft Sentinel from a TAXII server, you must get the TAXII server API root and collection ID. Then you enable the Threat intelligence - TAXII data connector in Microsoft Sentinel.
+To import STIX-formatted threat indicators to Microsoft Sentinel from a TAXII server, you must get the TAXII server API root and collection ID. Then you enable the Threat Intelligence - TAXII data connector in Microsoft Sentinel.
 
 Learn more about [threat intelligence](understand-threat-intelligence.md) in Microsoft Sentinel, and specifically about the [TAXII threat intelligence feeds](threat-intelligence-integration.md#taxii-threat-intelligence-feeds) that you can integrate with Microsoft Sentinel.
 
@@ -56,11 +56,11 @@ To import threat indicators into Microsoft Sentinel from a TAXII server, follow
 
 For more information about how to manage the solution components, see [Discover and deploy out-of-the-box content](sentinel-solutions-deploy.md).
 
-## Enable the Threat intelligence - TAXII data connector
+## Enable the Threat Intelligence - TAXII data connector
 
 1. To configure the TAXII data connector, select the **Data connectors** menu.
 
-1. Find and select the **Threat intelligence - TAXII** data connector, and then select **Open connector page**.
+1. Find and select the **Threat Intelligence - TAXII** data connector, and then select **Open connector page**.
 
     :::image type="content" source="media/connect-threat-intelligence-taxii/taxii-data-connector-config.png" alt-text="Screenshot that shows the Data connectors page with the TAXII data connector listed." lightbox="media/connect-threat-intelligence-taxii/taxii-data-connector-config.png":::
 

articles/sentinel/indicators-bulk-file-import.md

@@ -16,7 +16,7 @@ ms.collection: usx-security
 
 # Add indicators in bulk to Microsoft Sentinel threat intelligence from a CSV or JSON file
 
-In this how-to guide, you add indicators from a CSV or JSON file into Microsoft Sentinel threat intelligence. Threat intelligence sharing still happens across emails and other informal channels during an ongoing investigation. The ability to import indicators directly into Microsoft Sentinel threat intelligence allows you to quickly socialize emerging threats for your team. You make the threats available to power other analytics, such as producing security alerts, incidents, and automated responses.
+In this article, you add indicators from a CSV or JSON file into Microsoft Sentinel threat intelligence. Threat intelligence sharing still happens across emails and other informal channels during an ongoing investigation. You have the ability to import indicators directly into Microsoft Sentinel threat intelligence so that you can quickly relay emerging threats to your team. You make the threats available to power other analytics, such as producing security alerts, incidents, and automated responses.
 
 > [!IMPORTANT]
 > This feature is currently in preview. See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for more legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
@@ -25,7 +25,7 @@ In this how-to guide, you add indicators from a CSV or JSON file into Microsoft
 
 ## Prerequisites
 
-- You must have read and write permissions to the Microsoft Sentinel workspace to store your threat indicators.
+You must have read and write permissions to the Microsoft Sentinel workspace to store your threat indicators.
 
 ## Select an import template for your indicators
 
@@ -45,7 +45,7 @@ Add multiple indicators to your threat intelligence with a specially crafted CSV
     :::image type="content" source="media/indicators-bulk-file-import/import-using-file-menu-defender-portal.png" alt-text="Screenshot that shows the menu options to import indicators by using a file menu from the Defender portal." lightbox="media/indicators-bulk-file-import/import-using-file-menu-defender-portal.png":::
     ---
 
-1. Choose **CSV** or **JSON** from the **File format** dropdown menu.
+1. On the **File format** dropdown menu, select **CSV** or **JSON**.
 
     :::image type="content" source="media/indicators-bulk-file-import/format-select-and-download.png" alt-text="Screenshot that shows the dropdown menu to upload a CSV or JSON file, choose a template to download, and specify a source.":::
 

articles/sentinel/work-with-threat-indicators.md

@@ -128,7 +128,7 @@ Here's how to find the threat intelligence workbook provided in Microsoft Sentin
     | summarize count() by ThreatType
     ```
 
-1. In the **Visualization** dropdown list, select **Bar chart**.
+1. On the **Visualization** dropdown menu, select **Bar chart**.
 
 1. Select **Done editing**, and view the new chart for your workbook.