more-laa

Author: batamig

articles/sentinel/ama-migrate.md

@@ -11,11 +11,11 @@ ms.author: yelevin
 
 This article describes the migration process to the Azure Monitor Agent (AMA) when you have an existing, legacy [Log Analytics Agent (MMA/OMS)](/azure/azure-monitor/agents/log-analytics-agent), and are working with Microsoft Sentinel.
 
-The Log Analytics agent is [retired as of **31 August, 2024**](https://azure.microsoft.com/updates/were-retiring-the-log-analytics-agent-in-azure-monitor-on-31-august-2024/). If you are using the Log Analytics agent in your Microsoft Sentinel deployment, we recommend that you migrate to the AMA.
+The Log Analytics agent is [retired as of 31 August, 2024](https://azure.microsoft.com/updates/were-retiring-the-log-analytics-agent-in-azure-monitor-on-31-august-2024/). If you are using the Log Analytics agent in your Microsoft Sentinel deployment, we recommend that you migrate to the AMA.
 
 ## Prerequisites
 
-Start with the [Azure Monitor documentation](/azure/azure-monitor/agents/azure-monitor-agent-migration) which provides an agent comparison and general information for this migration process.
+Start with the [Azure Monitor documentation](/azure/azure-monitor/agents/azure-monitor-agent-migration), which provides an agent comparison and general information for this migration process.
 
 This article provides specific details and differences for Microsoft Sentinel.
 
@@ -29,9 +29,9 @@ Each organization will have different metrics of success and internal migration
 
 1. Run a proof of concept to test how the AMA sends data to Microsoft Sentinel, ideally in a development or sandbox environment.
 
-    1. To connect your Windows machines to the [Windows Security Event connector](data-connectors/windows-security-events-via-ama.md), start with **Windows Security Events via AMA** data connector page in Microsoft Sentinel. For more information, see [Windows agent-based connections](connect-services-windows-based.md).
+    1. To connect your Windows machines to the [Windows Security Event connector](data-connectors/windows-security-events-via-ama.md), start with the **Windows Security Events via AMA** data connector page in Microsoft Sentinel. For more information, see [Windows agent-based connections](connect-services-windows-based.md).
 
-    1. Go to the **Security Events via Legacy Agent** data connector page. On the **Instructions** tab, under **Configuration** > Step 2, **Select which events to stream**, select **None**. This configures your system so that you won't receive any security events through the MMA/OMS, but other data sources relying on this agent will continue to work. This step affects all machines reporting to your current Log Analytics workspace.
+    1. Go to the **Security Events via Legacy Agent** data connector page. On the **Instructions** tab, under **Configuration** > **Step 2** > **Select which events to stream**, select **None**. This configures your system so that you won't receive any security events through the MMA/OMS, but other data sources relying on this agent will continue to work. This step affects all machines reporting to your current Log Analytics workspace.
 
     > [!IMPORTANT]
     > Ingesting data from the same source using two different types of agents will result in double ingestion charges and duplicate events in the Microsoft Sentinel workspace. 

articles/sentinel/media/tutorial-enrich-ip-information/4-playbook-connections-tab.png

@@ -339,6 +339,7 @@ The following table lists known discrepancies:
 | Microsoft DNS Server Collected using the DNS connector and the Log Analytics Agent | The connector doesn't provide the mandatory DnsQuery field for original event ID 264 (Response to a dynamic update). The data is available at the source, but not forwarded by the connector. |
 | Corelight Zeek | Corelight Zeek may not provide the mandatory DnsQuery field. We have observed such behavior in certain cases in which the DNS response code name is `NXDOMAIN`. |
 
+
 ## Handling DNS response
 
 In most cases, logged DNS events don't include response information, which may be large and detailed. If your record includes more response information, store it in the [ResponseName](#responsename) field as it appears in the record.

articles/sentinel/normalization-schema-dns.md

@@ -276,8 +276,8 @@ Microsoft Sentinel supports two new features for data ingestion and transformati
 - [**Logs ingestion API**](/azure/azure-monitor/logs/logs-ingestion-api-overview): Use it to send custom-format logs from any data source to your Log Analytics workspace and then store those logs either in certain specific standard tables, or in custom-formatted tables that you create. You can perform the actual ingestion of these logs by using direct API calls. You can use Azure Monitor [data collection rules](/azure/azure-monitor/essentials/data-collection-rule-overview) to define and configure these workflows.
 
 - [**Workspace data transformations for standard logs**](/azure/azure-monitor/essentials/data-collection-transformations-workspace): It uses [data collection rules](/azure/azure-monitor/essentials/data-collection-rule-overview) to filter out irrelevant data, to enrich or tag your data, or to hide sensitive or personal information. You can configure data transformation at ingestion time for the following types of built-in data connectors:
-    - Azure Monitor Agent (AMA)-based data connectors
-    - Data connectors that use diagnostics settings
+    - Azure Monitor Agent (AMA)-based data connectors ([Syslog and CEF](connect-cef-syslog-ama.md) | [Windows DNS](connect-dns-ama.md) | [Custom](connect-custom-logs-ama.md) )
+    - [Data connectors that use diagnostics settings](connect-services-diagnostic-setting-based.md)
     - [Service-to-service data connectors](data-connectors-reference.md)
 
 For more information, see: 

articles/sentinel/skill-up-resources.md

@@ -70,7 +70,7 @@ Microsoft Sentinel includes ready-made, out-of-the-box playbook templates that y
 
     1. Edit the **Playbook name** by adding to the end of the suggested name "*Get-VirusTotalIPReport*". This way you'll be able to tell which original template this playbook came from, while still ensuring that it has a unique name in case you want to create another playbook from this same template. Let's call it "*Get-VirusTotalIPReport-Tutorial-1*".
 
-    1. Leave the **ENable diagnostics logs in Log Analytics unchecked.
+    1. Leave the **Enable diagnostics logs in Log Analytics** option unchecked.
 
     1. Select **Next : Connections >**.
 
@@ -94,23 +94,23 @@ Microsoft Sentinel includes ready-made, out-of-the-box playbook templates that y
 
 ## Authorize logic app connections
 
-Recall that when we created the playbook from the template, we were told that the Azure Log Analytics Data Collector and Virus Total connections would be configured later. 
+Recall that when we created the playbook from the template, we were told that the Azure Log Analytics Data Collector and Virus Total connections would be configured later.
 
 :::image type="content" source="media/tutorial-enrich-ip-information/7-authorize-connectors.png" alt-text="Screenshot of review information from playbook creation wizard.":::
 
 Here's where we do that.
 
 ### Authorize Virus Total connection
 
-1. Select the **For each** action to expand it and review its contents (the actions that will be performed for each IP address).
+1. Select the **For each** action to expand it and review its contents, which include the actions that will be performed for each IP address. For example:
 
     :::image type="content" source="media/tutorial-enrich-ip-information/8-for-each-loop.png" alt-text="Screenshot of for-each loop statement action in logic app designer.":::
 
-1. The first action item you see is labeled **Connections** and has an orange warning triangle. 
+1. The first action item you see is labeled **Connections** and has an orange warning triangle.
 
     If instead, that first action is labeled **Get an IP report (Preview)**, that means you already have an existing connection to Virus Total and you can go to the [next step](#next-step-condition).
 
-    1. Select the **Connections** action to open it. 
+    1. Select the **Connections** action to open it.
     1. Select the icon in the **Invalid** column for the displayed connection.
 
         :::image type="content" source="media/tutorial-enrich-ip-information/9-virus-total-invalid.png" alt-text="Screenshot of invalid Virus Total connection configuration.":::
@@ -243,7 +243,7 @@ If you're not going to continue to use this automation scenario, delete the play
 1. Mark the check box next to your automation rule in the list, and select **Delete** from the top banner.  
     (If you don't want to delete it, you can select **Disable** instead.)
 
-## Next steps
+## Related content
 
 Now that you've learned how to automate a basic incident enrichment scenario, learn more about automation and other scenarios you can use it in.