more USX language cleanup

Author: batamig

articles/sentinel/microsoft-sentinel-defender-portal.md

@@ -32,7 +32,7 @@ The following table describes the new or improved capabilities available in the
 | Capabilities      | Description              |
 | ----------------- | ------------------------ |
 | Advanced hunting  | Query from a single portal across different data sets to make hunting more efficient and remove the need for context-switching. Use Security Copilot to help generate your KQL. View and query all data including data from Microsoft security services and Microsoft Sentinel. Use all your existing Microsoft Sentinel workspace content, including queries and functions.<br><br>  For more information, see the following articles:<br>- [Advanced hunting in the Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2264410)<br>- [Security Copilot in advanced hunting](/defender-xdr/advanced-hunting-security-copilot) |
-| Case management | Manage SecOps cases natively in the Defender portal without losing security context. Define your own case workflow with custom status values. Assign tasks to collaborators and configure due dates. Handle escalations and complex cases by linking multiple incidents to a case.</br></br>For more information, see [Manage cases natively in Microsoft's unified security operations platform](/unified-secops-platform/cases-overview).
+| Case management | Manage SecOps cases natively in the Defender portal without losing security context. Define your own case workflow with custom status values. Assign tasks to collaborators and configure due dates. Handle escalations and complex cases by linking multiple incidents to a case.</br></br>For more information, see [Manage cases natively in the Microsoft Defender portal](/unified-secops-platform/cases-overview).
 | Microsoft Copilot in Microsoft Defender | When investigating incidents in the Defender portal, <br>- [Summarize incidents](/defender-xdr/security-copilot-m365d-incident-summary) <br>- [Analyze scripts](/defender-xdr/security-copilot-m365d-script-analysis)<br>- [Analyze files](/defender-xdr/copilot-in-defender-file-analysis)<br>- [Create incident reports](/defender-xdr/security-copilot-m365d-create-incident-report) <br><br>When hunting for threats in advanced hunting, create ready-to-run KQL queries by using the query assistant. For more information, see [Microsoft Security Copilot in advanced hunting](/defender-xdr/advanced-hunting-security-copilot).|
 | SOC optimizations   | Get high-fidelity and actionable recommendations to help you identify areas to:<br>- Reduce costs <br>- Add security controls<br>- Add missing data<br>SOC optimizations are available in the Defender and Azure portals, are tailored to your environment, and are based on your current coverage and threat landscape.  <br><br>For more information, see the following articles:<br>- [Optimize your security operations](soc-optimization/soc-optimization-access.md) <br>- [Use SOC optimizations programmatically](soc-optimization/soc-optimization-api.md)<br>- [SOC optimization reference of recommendations](soc-optimization/soc-optimization-reference.md)  |
 
@@ -84,7 +84,7 @@ The following limitations also apply to Microsoft Sentinel in Defender portal wi
 
 ## Quick reference
 
-Some Microsoft Sentinel capabilities, like the unified incident queue, are integrated with Microsoft Defender XDR in Microsoft's unified security operations platform. Many other Microsoft Sentinel capabilities are available in the **Microsoft Sentinel** section of the Defender portal.
+Some Microsoft Sentinel capabilities, like the unified incident queue, are integrated with Microsoft Defender XDR in the Defender portal. Many other Microsoft Sentinel capabilities are available in the **Microsoft Sentinel** section of the Defender portal.
 
 The following image shows the **Microsoft Sentinel** menu in the Defender portal:
 

articles/sentinel/sap/deployment-attack-disrupt.md

@@ -28,11 +28,11 @@ Content in this article is intended for your **security**, **infrastructure**, a
 > [!NOTE]
 > Attack disruption requires a data connector agent and isn't supported for the [SAP agentless solution](deployment-overview.md#data-connector) (limited preview).
 
-## Attack disruption for SAP and the unified security operations platform
+## Attack disruption for SAP in the Microsoft Defender portal
 
 Attack disruption for SAP is configured by updating your data connector agent version and ensuring that the relevant roles are applied in Azure and your SAP system. However, automatic attack disruption itself surfaces only in the Microsoft Defender portal.
 
-For more information, see [Automatic attack disruption in Microsoft Defender XDR](/microsoft-365/security/defender/automatic-attack-disruption).
+For more information, see [Automatic attack disruption in Microsoft Defender XDR](/microsoft-365/security/defender/automatic-attack-disruption) and [Connect Microsoft Sentinel to the Microsoft Defender portal](/unified-secops-platform/microsoft-sentinel-onboard).
 
 ## Minimum agent version and required roles
 

articles/sentinel/use-multiple-workspaces.md

@@ -29,7 +29,7 @@ For Microsoft Sentinel in the Azure portal, you can:
 
 - **Manage multiple workspaces with workspace manager**: Centrally manage multiple workspaces within one or more Azure tenants. For more information, see [Centrally manage multiple Microsoft Sentinel workspaces with workspace manager](workspace-manager.md).
 
-Only one Microsoft Sentinel workspace per tenant is currently supported in the unified security operations platform. For more information, see [Microsoft Defender multitenant management](/defender-xdr/mto-overview).
+Only one Microsoft Sentinel workspace per tenant is currently supported in the Microsoft Defender portal. For more information, see [Microsoft Defender multitenant management](/defender-xdr/mto-overview).
 
 ## Next steps