removed extra file

Author: guywi-ms

articles/sentinel/media/summary-rules/diagram-copy.mmd

@@ -1,26 +1,29 @@
-diagram.mmd
-
-
 ---
 config:
   look: neo
   theme: default
+  sequence:
+    actorFontSize: 22
+    messageFontSize: 20
+    noteFontSize: 20
 ---
 sequenceDiagram
   actor User as User
-  participant Azure AD as Azure AD
+  participant Entra ID as Entra ID
   participant Azure Monitor as Azure Monitor
   participant Log Analytics Workspace as Log Analytics Workspace
   participant VM as VM
-  participant P1 as New Participant
-  User ->> Azure AD: 1. Register Microsoft Entra application
-  Azure AD ->> User: Provide Application ID and secret
-  User ->> Azure AD: 2. Assign the Monitoring Metrics Publisher role to the application
-  User ->> Azure Monitor: 3. Create Data Collection Endpoint (DCE)
-  Azure Monitor ->> User: Provide DCE URI
-  User ->> Azure Monitor: 4. Create Data Collection Rule (DCR)
-  Azure Monitor ->> User: Provide DCR Immutable ID
-  User ->> Log Analytics Workspace: 5. Create custom table
-  User ->> VM: 6. Run LogGenerator.ps1 script
+  User ->> Entra ID: 1. Register Microsoft Entra application
+  Entra ID ->> User: Provide Application ID and secret
+  User ->> Azure Monitor: 2. Create DCE, DCR, and custom Auxiliary table using ARM template
+  Azure Monitor ->> User: Provide DCE URI and DCR Immutable ID
+  User ->> Azure Monitor: 3. Grant your application permission to send data to the DCE
+  User ->> VM: 4. Update Logstash configuration file
   VM ->> Azure Monitor: Send data to DCE
-  Azure Monitor ->> Log Analytics Workspace: Ingest data into custom table
+  Azure Monitor ->> Log Analytics Workspace: Ingest raw data into CommonSecurityLog_CL table
+  User ->> Log Analytics Workspace: 5. Query Auxiliary table to verify data ingestion
+  User ->> Azure Monitor: 6. Create summary rule
+  VM ->> Azure Monitor: Send data to DCE
+  Azure Monitor ->> Log Analytics Workspace: Ingest raw data into CommonSecurityLog_CL table
+  Azure Monitor ->> Log Analytics Workspace: Ingest aggregated data into custom Analytics table
+  User ->> Log Analytics Workspace: 7. Query Analytics table to view aggregated data