Feedback and adding links

Author: limwainstein

articles/sentinel/cloudwatch-lambda-function.md

@@ -6,25 +6,25 @@ ms.author: lwainstein
 ms.service: microsoft-sentinel
 ms.topic: how-to
 ms.date: 02/09/2023
-#Customer intent: As a security operator, I want to create a Lambda function to send CloudWatch events to S3 bucket so I can convert the format to the gzipped CSV without a header.  
+#Customer intent: As a security operator, I want to create a Lambda function to send CloudWatch events to S3 bucket so I can convert the format to the format accepted by Microsoft Sentinel.  
 ---
 
 # Create a Lambda function to send CloudWatch events to an S3 bucket
 
-In this article, you use a [Lambda function](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/AWS-S3/CloudWatchLanbdaFunction.py) within the Amazon Web Services (AWS) environment to send [CloudWatch events to an S3 bucket](connect-aws.md), and convert the format to the gzipped CSV format without a header.  
+In some cases, your CloudWatch logs may not match the format accepted by Microsoft Sentinel - gzipped CSV format without a header. In this article, you use a [lambda function](https://github.com/Azure/Azure-Sentinel/blob/master/DataConnectors/AWS-S3/CloudWatchLanbdaFunction.py) within the Amazon Web Services (AWS) environment to send [CloudWatch events to an S3 bucket](connect-aws.md), and convert the format to the accepted format. 
 
-## Create the Lambda function 
+## Create the lambda function 
 
-The Lambda function uses Python 3.9 runtime and x86_64 architecture. 
+The lambda function uses Python 3.9 runtime and x86_64 architecture. 
 
-1. In the AWS Management Console, select the Lambda service.
+1. In the AWS Management Console, select the lambda service.
 1. Select **Create function**. 
 
     :::image type="content" source="media/cloudwatch-lambda-function/lambda-basic-information.png" alt-text="Screenshot of the AWS Management Console Basic information screen." lightbox="media/cloudwatch-lambda-function/lambda-basic-information.png":::
 
 1. Type a name for the function and select **Python 3.9** as the runtime and **x86_64** as the architecture. 
 1. Select **Create function**. 
-1. Under **Layers**, select **Add layer** and select **Add**.
+1. Under **Choose a layer**, select a layer and select **Add**.
 
     :::image type="content" source="media/cloudwatch-lambda-function/lambda-add-layer.png" alt-text="Screenshot of the AWS Management Console Add layer screen." lightbox="media/cloudwatch-lambda-function/lambda-add-layer.png":::
 

articles/sentinel/connect-aws.md

@@ -7,8 +7,6 @@ ms.date: 12/12/2022
 ms.author: yelevin
 ---
 
----
-
 # Connect Microsoft Sentinel to Amazon Web Services to ingest AWS service log data
 
 Use the Amazon Web Services (AWS) connectors to pull AWS service logs into Microsoft Sentinel. These connectors work by granting Microsoft Sentinel access to your AWS resource logs. Setting up the connector establishes a trust relationship between Amazon Web Services and Microsoft Sentinel. This is accomplished on AWS by creating a role that gives permission to Microsoft Sentinel to access your AWS logs.
@@ -25,7 +23,18 @@ This connector is available in two versions: the legacy connector for CloudTrail
 
 # [S3 connector (new)](#tab/s3)
 
-This document explains how to configure the new AWS S3 connector. The process of setting it up has two parts: the AWS side and the Microsoft Sentinel side.
+This article explains how to configure the new AWS S3 connector. The process of setting it up has two parts: the AWS side and the Microsoft Sentinel side.
+
+## Prerequisites
+
+Make sure that the logs from your selected AWS service use the format accepted by Microsoft Sentinel:
+
+- **Amazon VPC**: gzip csv with headers, delimiter: space
+- **Amazon GuardDuty**: json-line and gzip
+- **AWS CloudTrail**: gzip json
+- **CloudWatch**: zipped CSV format without a header. If you need to convert your logs to this format, you can use this [CloudWatch lambda function](cloudwatch-lambda-function.md).
+
+## Connect the S3 connector
 
 - In your AWS environment: