Merge pull request #302014 from mberdugo/Freshness

Freshness

Author: prmerger-automator[bot]

articles/sentinel/bookmarks.md

@@ -10,7 +10,6 @@ appliesto:
     - Microsoft Sentinel in the Microsoft Defender portal
     - Microsoft Sentinel in the Azure portal
 
-
 #Customer intent: As a security analyst, I want to create and manage hunting bookmarks so that I can preserve and collaborate on relevant threat investigation data.
 
 ---
@@ -19,16 +18,18 @@ appliesto:
 
 Hunting bookmarks in Microsoft Sentinel helps you preserve the queries and query results that you deem relevant. You can also record your contextual observations and reference your findings by adding notes and tags. Bookmarked data is visible to you and your teammates for easy collaboration. For more information, see [Bookmarks](hunting.md#bookmarks-to-keep-track-of-data).
 
+>[!NOTE]
+> Bookmarks can only be created in the Azure portal. While you can't add bookmarks in the Microsoft Defender portal, you can see bookmarks that were already created.
+
 [!INCLUDE [unified-soc-preview](includes/unified-soc-preview.md)]
 
-## Add a bookmark
+## Add a bookmark (Azure portal only)
 
 Create a bookmark to preserve the queries, results, your observations, and findings.
 
-1. For Microsoft Sentinel in the [Azure portal](https://portal.azure.com), under **Threat management**  select **Hunting**.<br> For Microsoft Sentinel in the [Defender portal](https://security.microsoft.com/), select **Microsoft Sentinel** > **Threat management** > **Hunting**.
-1. From the **Hunting** tab, select a hunt.
-1. Select one of the hunting queries.
-1. In the hunting query details, select **Run Query**.
+1. Under **Threat management**, select **Hunting**.
+1. From the **Queries** tab, select one or more of the hunting queries.
+1. From the top command bar, select **Run selected queries**.
 
 1. Select **View query results**. For example:
 
@@ -38,7 +39,7 @@ Create a bookmark to preserve the queries, results, your observations, and findi
 
 1. From the log query results list, use the checkboxes to select one or more rows that contain the information you find interesting.
 
-1. Select **Add bookmark**:
+1. In Azure portal, select **Add bookmark**:
 
     :::image type="content" source="media/bookmarks/add-hunting-bookmark.png" alt-text="Screenshot of adding hunting bookmark to query." lightbox="media/bookmarks/add-hunting-bookmark.png":::
 
@@ -54,9 +55,9 @@ Create a bookmark to preserve the queries, results, your observations, and findi
 
     To view the bookmark in the investigation graph, you must map at least one entity. Entity mappings to account, host, IP, and URL entity types you created are supported, preserving backwards compatibility.
 
-1. Select **Save** to commit your changes and add the bookmark. All bookmarked data is shared with other analysts, and is a first step toward a collaborative investigation experience.
+1. Select **Create** to commit your changes and add the bookmark. All bookmarked data is shared with other analysts, and is a first step toward a collaborative investigation experience.
 
-The log query results support bookmarks whenever this pane is opened from Microsoft Sentinel. For example, you select **General** > **Logs** from the navigation bar, select event links in the investigations graph, or select an alert ID from the full details of an incident. You can't create bookmarks when the **Logs** pane is opened from other locations, such as directly from Azure Monitor.
+The log query results support bookmarks whenever this pane is opened from Microsoft Sentinel. For example, if you select **General** > **Logs** from the navigation bar, select event links in the investigations graph, or select an alert ID from the full details of an incident. You can't create bookmarks when the **Logs** pane is opened from another location, such as directly from Azure Monitor.
 
 ## View and update bookmarks
 
@@ -84,9 +85,9 @@ Visualize your bookmarked data by launching the investigation experience in whic
 
 For instructions to use the investigation graph, see [Use the investigation graph to deep dive](investigate-cases.md#use-the-investigation-graph-to-deep-dive).
 
-## Add bookmarks to a new or existing incident
+## Add bookmarks to a new or existing incident (Azure portal only)
 
-Add bookmarks to an incident from the bookmarks tab on the **Hunting** page. 
+Add bookmarks to an incident from the bookmarks tab on the **Hunting** page.
 
 1. From the **Bookmarks** tab, select the bookmark or bookmarks you want to add to an incident.
 
@@ -104,7 +105,6 @@ Add bookmarks to an incident from the bookmarks tab on the **Hunting** page.
    1. Select the incident with your bookmark and **View full details**.
    1. On the incident page, in the left pane, select the **Bookmarks**.
 
-
 ## View bookmarked data in logs
 
 View bookmarked queries, results, or their history.

articles/sentinel/ci-cd.md

@@ -30,11 +30,20 @@ When creating custom content, you can manage it from your own Microsoft Sentinel
 Microsoft Sentinel currently supports connections to GitHub and Azure DevOps repositories. Before connecting your Microsoft Sentinel workspace to your source control repository, make sure that you have:
 
 - An **Owner** role in the resource group that contains your Microsoft Sentinel workspace *or* a combination of **User Access Administrator** and **Sentinel Contributor** roles to create the connection
-- Collaborator access to your GitHub repository or Project Administrator access to your Azure DevOps repository
+- Ensure custom content files you want to deploy to your workspaces are in a supported format. For supported formats, see [Plan your repository content](ci-cd-custom-content.md#plan-your-repository-content).
+
+### [GitHub prerequisites](#tab/github)
+
+- Collaborator access to your GitHub repository 
 - Actions enabled for GitHub and Pipelines enabled for Azure DevOps
+
+### [Azure DevOps prerequisites](#tab/azure-devops)
+
+- Project Administrator access to your Azure DevOps repository
 - Third-party application access via OAuth enabled for Azure DevOps [application connection policies](/azure/devops/organizations/accounts/change-application-access-policies#manage-a-policy).
-- An Azure DevOps connection must be in the same tenant as your Microsoft Sentinel workspace
-- Ensure custom content files you want to deploy to your workspaces are in a supported format. For supported formats, see [Plan your repository content](ci-cd-custom-content.md#plan-your-repository-content).
+- An Azure DevOps connection in the same tenant as your Microsoft Sentinel workspace
+
+---
 
 For more information on deployable content types, see [Validate your content](ci-cd-custom-content.md#validate-your-content).