Merge branch 'more-laa' of https://github.com/batamig/azure-docs-pr into more-laa

Author: batamig

articles/sentinel/entities-reference.md

@@ -153,7 +153,7 @@ The following section contains a more in-depth look at the full schemas of each
 | **NetBiosName** | String | The host name (pre-Windows 2000). |
 | **IoTDevice** | Entity ([IoT Device](#iot-device)) | The IoT Device entity (if this host represents an IoT Device). |
 | **AzureID** | String | The Azure resource ID of the VM, if known. |
-| **OMSAgentID** | String | The OMS agent ID, if the host has OMS agent installed. |
+| **OMSAgentID** | String | The OMS agent ID, if the host has a [legacy OMS agent](/azure/azure-monitor/agents/log-analytics-agent) installed. |
 | **OSFamily** | Enum? | One of the following values: <li>Linux<li>Windows<li>Android<li>IOS<li>Mac |
 | **OSVersion** | String | A free-text representation of the operating system.<br>This field is meant to hold specific versions the are more fine-grained than OSFamily, or future values not supported by OSFamily enumeration. |
 | **IsDomainJoined** | Bool | Indicates whether this host belongs to a domain. |

articles/sentinel/migration-arcsight-detection-rules.md

@@ -114,7 +114,7 @@ SecurityEvent
 | where isnotempty(SubjectDomainName)
 ```
 
-This rule assumes that Azure Monitoring Agent (AMA) collects the Windows Security Events. Therefore, the rule uses the Microsoft Sentinel [SecurityEvent](/azure/azure-monitor/reference/tables/securityevent) table.
+This rule assumes that the Azure Monitoring Agent (AMA) collects the Windows Security Events. Therefore, the rule uses the Microsoft Sentinel [SecurityEvent](/azure/azure-monitor/reference/tables/securityevent) table.
 
 Consider these best practices: