Merge pull request #232342 from memildin/patch-71

Updated description of alerts & what to do with them

Author: prmerger-automator[bot]

articles/defender-for-cloud/alerts-overview.md

@@ -12,21 +12,22 @@ ms.custom: fasttrack-edit
 This article describes security alerts and notifications in Microsoft Defender for Cloud.
 
 ## What are security alerts?
-Security alerts are the notifications generated by Defender for Cloud and Defender for Cloud plans when threats are identified in your cloud, hybrid, or on-premises environment.
-
-- Security alerts are triggered by advanced detections in Defender for Cloud, and are available when you enable Defender for Cloud [Defender plans](defender-for-cloud-introduction.md#protect-cloud-workloads).
-- Each alert provides details of affected resources, issues, and remediation recommendations.
-- Defender for Cloud classifies alerts and prioritizes them by severity in the Defender for Cloud portal.
-- Alerts are displayed for 90 days, even if the resource related to the alert was deleted during that time. This is because the alert might indicate a potential breach to your organization that needs to be further investigated.     
-- Alerts can be exported to CSV format, or directly injected into Microsoft Sentinel.
+Security alerts are the notifications generated by Defender for Cloud's workload protection plans when threats are identified in your Azure, hybrid, or multi-cloud environments.
+
+- Security alerts are triggered by advanced detections available when you enable [Defender plans](defender-for-cloud-introduction.md#protect-cloud-workloads) for specific resource types.
+- Each alert provides details of affected resources, issues, and remediation steps.
+- Defender for Cloud classifies alerts and prioritizes them by severity.
+- Alerts are displayed in the portal for 90 days, even if the resource related to the alert was deleted during that time. This is because the alert might indicate a potential breach to your organization that needs to be further investigated.     
+- Alerts can be exported to CSV format.
+- Alerts can also be streamed directly to a Security Information and Event Management (SIEM) such as Microsoft Sentinel, Security Orchestration Automated Response (SOAR), or IT Service Management (ITSM) solution.
 - Defender for Cloud leverages the [MITRE Attack Matrix](https://attack.mitre.org/matrices/enterprise/) to associate alerts with their perceived intent, helping formalize security domain knowledge.
 
 ### How are alerts classified?
 
-Defender for Cloud assigns a severity to alerts to help you prioritize how you attend to each alert. Severity is based on how confident Defender for Cloud is in the:
+Alerts have a severity level assigned to help prioritize how to attend to each alert. Severity is based on:
 
-- Finding/analytic used to issue the alert
-- Confidence level that there was malicious intent behind the activity that led to the alert
+- The specific trigger
+- The confidence level that there was malicious intent behind the activity that led to the alert
 
 
 | Severity          | Recommended response                                                                                                                                                                                                                                                                                                                                                                                                                                             |