fixing applies to and removing commented out lines

batamig · batamig · commit eabff6813be0 · 2024-03-28T13:23:15.000+02:00
diff --git a/articles/sentinel/add-advanced-conditions-to-automation-rules.md b/articles/sentinel/add-advanced-conditions-to-automation-rules.md
@@ -5,7 +5,9 @@ ms.topic: how-to
 author: batamig
 ms.author: bagol
 ms.date: 03/14/2024
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Defender XDR
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 
 ---
diff --git a/articles/sentinel/billing-reduce-costs.md b/articles/sentinel/billing-reduce-costs.md
@@ -6,7 +6,9 @@ ms.author: cwatson
 ms.custom: subject-cost-optimization
 ms.topic: conceptual
 ms.date: 03/07/2024
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 ---
 
diff --git a/articles/sentinel/connect-threat-intelligence-taxii.md b/articles/sentinel/connect-threat-intelligence-taxii.md
@@ -6,7 +6,9 @@ author: austinmccollum
 ms.topic: how-to
 ms.date: 3/14/2024
 ms.author: austinmc
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 #customer intent: As a SOC admin, I want to connect Microsoft Sentinel to a STIX/TAXII feed to ingest threat intelligence, so I can generate alerts incidents.
 ---
diff --git a/articles/sentinel/connect-threat-intelligence-tip.md b/articles/sentinel/connect-threat-intelligence-tip.md
@@ -6,7 +6,9 @@ author: austinmccollum
 ms.topic: how-to
 ms.date: 3/14/2024
 ms.author: austinmc
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 #customer intent: As a SOC admin, I want to use a Threat Intelligence Platform solution to ingest threat intelligence, so I can generate alerts incidents.
 ---
diff --git a/articles/sentinel/connect-threat-intelligence-upload-api.md b/articles/sentinel/connect-threat-intelligence-upload-api.md
@@ -6,7 +6,9 @@ author: austinmccollum
 ms.topic: how-to
 ms.date: 3/14/2024
 ms.author: austinmc
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 #customer intent: As a SOC admin, I want to connect my Threat Intelligence Platform with the upload indicators API to ingest threat intelligence, so I can utilize the benefits of this updated API.
 ---
diff --git a/articles/sentinel/create-manage-use-automation-rules.md b/articles/sentinel/create-manage-use-automation-rules.md
@@ -5,7 +5,9 @@ ms.topic: how-to
 author: batamig
 ms.author: bagol
 ms.date: 03/14/2024
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 ---
 
diff --git a/articles/sentinel/create-tasks-automation-rule.md b/articles/sentinel/create-tasks-automation-rule.md
@@ -5,7 +5,9 @@ ms.topic: how-to
 author: batamig
 ms.author: bagol
 ms.date: 03/14/2024
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 
 ---
diff --git a/articles/sentinel/create-tasks-playbook.md b/articles/sentinel/create-tasks-playbook.md
@@ -5,7 +5,9 @@ ms.topic: how-to
 author: batamig
 ms.author: bagol
 ms.date: 03/14/2024
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 ---
 
diff --git a/articles/sentinel/data-connectors-reference.md b/articles/sentinel/data-connectors-reference.md
@@ -5,7 +5,9 @@ author: cwatson-cat
 ms.topic: reference
 ms.date: 03/02/2024
 ms.author: cwatson
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ---
 
 # Find your Microsoft Sentinel data connector
diff --git a/articles/sentinel/define-playbook-access-restrictions.md b/articles/sentinel/define-playbook-access-restrictions.md
@@ -5,7 +5,9 @@ ms.topic: how-to
 author: batamig
 ms.author: bagol
 ms.date: 03/14/2024
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 ---
 
diff --git a/articles/sentinel/domain-based-essential-solutions.md b/articles/sentinel/domain-based-essential-solutions.md
@@ -5,7 +5,9 @@ author: cwatson-cat
 ms.topic: conceptual
 ms.date: 03/01/2024
 ms.author: cwatson
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal.
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal.
 #Customer intent: As a security engineer, I want to learn how I can minimize the amount of solution content I have to deploy and manage by using Microsoft essential solutions for Microsoft Sentinel.
 ---
 
diff --git a/articles/sentinel/hunting.md b/articles/sentinel/hunting.md
@@ -5,7 +5,9 @@ ms.topic: conceptual
 ms.date: 03/13/2024
 ms.author: austinmc
 author: austinmccollum
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 ---
 
diff --git a/articles/sentinel/hunts.md b/articles/sentinel/hunts.md
@@ -6,7 +6,9 @@ author: austinmccollum
 ms.author: austinmc
 ms.topic: how-to
 ms.date: 03/12/2024
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 ---
 
diff --git a/articles/sentinel/identify-threats-with-entity-behavior-analytics.md b/articles/sentinel/identify-threats-with-entity-behavior-analytics.md
@@ -63,8 +63,6 @@ See how behavior analytics is used in [Microsoft Defender for Cloud Apps](https:
 
 Learn more about [entities in Microsoft Sentinel](entities.md) and see the full list of [supported entities and identifiers](entities-reference.md).
 
-<!-- Is this the "Investigation priority score" that appears on the entity pages in Microsoft Defender? If so, is it coming directly from MDA there, or from UEBA? -->
-
 ### Entity pages
 
 Information about **entity pages** can now be found at [Entity pages in Microsoft Sentinel](entity-pages.md).
diff --git a/articles/sentinel/indicators-bulk-file-import.md b/articles/sentinel/indicators-bulk-file-import.md
@@ -7,7 +7,9 @@ ms.service: microsoft-sentinel
 ms.topic: how-to
 ms.date: 3/14/2024
 ms.author: austinmc
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 #Customer intent: As a security analyst, I want to bulk import indicators from common file types to my threat intelligence (TI), so I can more effectively share TI during an investigation.
 ---
diff --git a/articles/sentinel/investigate-large-datasets.md b/articles/sentinel/investigate-large-datasets.md
@@ -5,7 +5,9 @@ author: cwatson-cat
 ms.topic: conceptual
 ms.date: 03/03/2024
 ms.author: cwatson
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 ---
 
diff --git a/articles/sentinel/livestream.md b/articles/sentinel/livestream.md
@@ -6,7 +6,9 @@ ms.date: 03/12/2024
 ms.author: austinmc
 author: austinmccollum
 ms.collection: usx-security
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ---
 
 # Detect threats by using hunting livestream in Microsoft Sentinel
diff --git a/articles/sentinel/migrate-playbooks-to-automation-rules.md b/articles/sentinel/migrate-playbooks-to-automation-rules.md
@@ -5,7 +5,9 @@ ms.topic: how-to
 author: batamig
 ms.author: bagol
 ms.date: 03/14/2024
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 
 ---
@@ -43,7 +45,7 @@ Finally, the ability to invoke playbooks from analytics rules will be **deprecat
 
 1. Under **Active rules**, find an analytics rule already configured to run a playbook.
 
-1. Select **Edit**. <!--add screenshot if there's time-->
+1. Select **Edit**.
 
     :::image type="content" source="media/migrate-playbooks-to-automation-rules/find-analytics-rule.png" alt-text="Screenshot of finding and selecting an analytics rule.":::
 
diff --git a/articles/sentinel/monitor-your-data.md b/articles/sentinel/monitor-your-data.md
@@ -5,7 +5,9 @@ author: yelevin
 ms.topic: how-to
 ms.date: 03/07/2024
 ms.author: yelevin
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 ---
 
diff --git a/articles/sentinel/notebook-get-started.md b/articles/sentinel/notebook-get-started.md
@@ -5,7 +5,9 @@ author: austinmccollum
 ms.author: austinmc
 ms.topic: how-to
 ms.date: 03/08/2024
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 ---
 
diff --git a/articles/sentinel/notebooks-hunt.md b/articles/sentinel/notebooks-hunt.md
@@ -5,7 +5,9 @@ author: cwatson-cat
 ms.author: cwatson
 ms.topic: how-to
 ms.date: 03/08/2024
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 #Customer intent: As a security analyst, I want to deploy and launch a Jupyter notebook to hunt for security threats.
 ---
diff --git a/articles/sentinel/notebooks.md b/articles/sentinel/notebooks.md
@@ -6,7 +6,9 @@ ms.author: cwatson
 ms.topic: conceptual
 ms.custom: devx-track-python
 ms.date: 03/07/2024
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 ---
 
diff --git a/articles/sentinel/playbook-triggers-actions.md b/articles/sentinel/playbook-triggers-actions.md
@@ -5,7 +5,9 @@ ms.topic: how-to
 author: batamig
 ms.author: bagol
 ms.date: 03/14/2024
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 
 ---
diff --git a/articles/sentinel/restore.md b/articles/sentinel/restore.md
@@ -5,7 +5,9 @@ author: cwatson-cat
 ms.topic: how-to
 ms.date: 03/03/2024
 ms.author: cwatson
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 ---
 
diff --git a/articles/sentinel/roles.md b/articles/sentinel/roles.md
@@ -6,7 +6,9 @@ ms.topic: conceptual
 ms.date: 03/07/2024
 ms.author: yelevin
 ms.collection: usx-security
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ---
 
 # Roles and permissions in Microsoft Sentinel
diff --git a/articles/sentinel/search-jobs.md b/articles/sentinel/search-jobs.md
@@ -5,7 +5,9 @@ author: austinmccollum
 ms.topic: how-to
 ms.date: 03/07/2024
 ms.author: austinmc
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 ---
 
diff --git a/articles/sentinel/sentinel-solutions-catalog.md b/articles/sentinel/sentinel-solutions-catalog.md
@@ -5,7 +5,9 @@ author: cwatson-cat
 ms.topic: reference
 ms.date: 03/01/2024
 ms.author: cwatson
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal.
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal.
 ---
 
 # Microsoft Sentinel content hub catalog
diff --git a/articles/sentinel/sentinel-solutions-delete.md b/articles/sentinel/sentinel-solutions-delete.md
@@ -5,7 +5,9 @@ author: cwatson-cat
 ms.topic: how-to
 ms.date: 03/01/2024
 ms.author: cwatson
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal.
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal.
 ---
 
 # Delete installed Microsoft Sentinel out-of-the-box content and solutions
diff --git a/articles/sentinel/sentinel-solutions-deploy.md b/articles/sentinel/sentinel-solutions-deploy.md
@@ -5,7 +5,9 @@ author: austinmccollum
 ms.topic: how-to
 ms.date: 03/01/2024
 ms.author: austinmc
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal.
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal.
 ---
 
 # Discover and manage Microsoft Sentinel out-of-the-box content
diff --git a/articles/sentinel/sentinel-solutions.md b/articles/sentinel/sentinel-solutions.md
@@ -5,7 +5,9 @@ author: cwatson-cat
 ms.topic: conceptual
 ms.date: 03/01/2024
 ms.author: cwatson
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal.
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal.
 ---
 
 # About Microsoft Sentinel content and solutions
diff --git a/articles/sentinel/threat-intelligence-integration.md b/articles/sentinel/threat-intelligence-integration.md
@@ -5,7 +5,9 @@ author: austinmccollum
 ms.topic: concept
 ms.date: 3/14/2024
 ms.author: austinmc
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 ---
 
diff --git a/articles/sentinel/tutorial-enrich-ip-information.md b/articles/sentinel/tutorial-enrich-ip-information.md
@@ -5,7 +5,9 @@ ms.topic: tutorial
 author: batamig
 ms.author: bagol
 ms.date: 03/14/2024
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 ---
 
@@ -52,7 +54,7 @@ Microsoft Sentinel includes ready-made, out-of-the-box playbook templates that y
 
     1. Clear the **Select all** checkbox, then mark the **Enrichment** checkbox. Select **OK**.
 
-    For example: <!--more screnshots if there's time-->
+    For example:
 
     :::image type="content" source="media/tutorial-enrich-ip-information/1-filter-playbook-template-list.png" alt-text="Screenshot of list of playbook templates to be filtered by tags." lightbox="media/tutorial-enrich-ip-information/1-filter-playbook-template-list.png":::
 
diff --git a/articles/sentinel/tutorial-extract-incident-entities.md b/articles/sentinel/tutorial-extract-incident-entities.md
@@ -5,7 +5,9 @@ ms.topic: tutorial
 author: batamig
 ms.author: bagol
 ms.date: 03/14/2024
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 
 ---
@@ -55,7 +57,7 @@ To complete this tutorial, make sure you have:
 1. In the **Create playbook** wizard, under **Basics**, select the subscription and resource group, and give the playbook a name. 
 1. Select **Next: Connections >**.
 
-    Under **Connections**, the **Microsoft Sentinel - Connect with managed identity** connection should be visible. For example:<!--create new screenshot if possible-->
+    Under **Connections**, the **Microsoft Sentinel - Connect with managed identity** connection should be visible. For example:
 
     :::image type="content" source="media/tutorial-extract-incident-entities/create-playbook.png" alt-text="Screenshot of creating a new playbook with an incident trigger.":::
 
diff --git a/articles/sentinel/tutorial-respond-threats-playbook.md b/articles/sentinel/tutorial-respond-threats-playbook.md
@@ -5,7 +5,9 @@ ms.topic: tutorial
 author: batamig
 ms.author: bagol
 ms.date: 03/14/2024
-appliesto: Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
+appliesto:
+    - Microsoft Sentinel in the Azure portal
+    - Microsoft Sentinel in the Microsoft Defender portal
 ms.collection: usx-security
 ---
 
diff --git a/articles/sentinel/understand-threat-intelligence.md b/articles/sentinel/understand-threat-intelligence.md
diff --git a/articles/sentinel/use-matching-analytics-to-detect-threats.md b/articles/sentinel/use-matching-analytics-to-detect-threats.md
diff --git a/articles/sentinel/use-playbook-templates.md b/articles/sentinel/use-playbook-templates.md
diff --git a/articles/sentinel/use-threat-indicators-in-analytics-rules.md b/articles/sentinel/use-threat-indicators-in-analytics-rules.md
diff --git a/articles/sentinel/watchlists-create.md b/articles/sentinel/watchlists-create.md
diff --git a/articles/sentinel/watchlists-manage.md b/articles/sentinel/watchlists-manage.md
diff --git a/articles/sentinel/watchlists-queries.md b/articles/sentinel/watchlists-queries.md
diff --git a/articles/sentinel/watchlists.md b/articles/sentinel/watchlists.md
diff --git a/articles/sentinel/work-with-threat-indicators.md b/articles/sentinel/work-with-threat-indicators.md
