fixing blocking issues

Author: rkarlin

articles/sentinel/multiple-tenants-service-providers.md

@@ -27,8 +27,10 @@ If you’re a managed security service provider (MSSP) and you’re using [Azure
    ![Check resource providers](media/multiple-tenants-service-providers/check-resource-provider.png)
 ## How to access Azure Sentinel from other tenants
 1. Under **Directory + subscription**, select the delegated directories, and the subscriptions where your customer’s Azure Sentinel workspaces are located.
+
    ![Generate security incidents](media/multiple-tenants-service-providers/directory-subscription.png)
-2. Open Azure Sentinel. You will see all the workspaces in the selected subscriptions, and you’ll be able to work with them seamlessly, like any workspace in your own tenant.
+
+1. Open Azure Sentinel. You will see all the workspaces in the selected subscriptions, and you’ll be able to work with them seamlessly, like any workspace in your own tenant.
 
 > [!NOTE]
 > You will not be able to connect connectors in Azure Sentinel from within a managed workspace. To connect a connector, you must directly sign into the tenant on which you want to connect a connector and authenticate there with the required permissions.

articles/sentinel/offboard.md

@@ -69,7 +69,7 @@ Within the first 48 hours, the data and alert rules (including real-time automat
 
 -   Bookmarks
 
-Your playbooks, saved workbooks, saved hunting queries, and notebooks are not deleted. **Some may brake due to the removed data. You can remove those manually.**
+Your playbooks, saved workbooks, saved hunting queries, and notebooks are not deleted. **Some may break due to the removed data. You can remove those manually.**
 
 After you remove the service, there is a grace period of 30 days during which you can re-enable the solution and your data and alert rules will be restored but the configured connectors that were disconnected must be reconnected.
 

articles/sentinel/tutorial-detect-threats-custom.md

@@ -40,7 +40,7 @@ You can create custom analytic rules to help you search for the types of threats
 
     ![Start creating a custom analytic rule](media/tutorial-detect-threats-custom/general-tab.png)
 
-1. In the **Settings** tab, you can either write a query directly, or create the query in Log Analytics, and then paste it into the **Search query** field. As you change and configure your query, Azure Sentinel simulates the query results in the **Results preview** window, on the right. This enables you to gain insight into how much data would be generated over a specific time interval for the alert you are creating. The amound depends on what you set for **Run query every** and **Lookup data from the last**. If you see that, on average, your alert would trigger alerts too frequently, you can set the number of results higher, so that it's above your average baseline.
+1. In the **Settings** tab, you can either write a query directly, or create the query in Log Analytics, and then paste it into the **Search query** field. As you change and configure your query, Azure Sentinel simulates the query results in the **Results preview** window, on the right. This enables you to gain insight into how much data would be generated over a specific time interval for the alert you are creating. The amount depends on what you set for **Run query every** and **Lookup data from the last**. If you see that, on average, your alert would trigger alerts too frequently, you can set the number of results higher, so that it's above your average baseline.
 
    ![Create query in Azure Sentinel](media/tutorial-detect-threats-custom/settings-tab.png)
 
@@ -64,7 +64,7 @@ You can create custom analytic rules to help you search for the types of threats
 
 1. Define alert trigger conditions under **Alert trigger**. Under **Entity mapping**, you can map the columns in your query to entity fields recognized by Azure Sentinel. For each field, map the relevant column in the query you created in Log Analytics to the appropriate entity field. Each entity includes multiple fields, for example SID and GUID. You can map the entity according to any  fields, not just the upper level entity.
 
-1.  In the **Response automation** tab, select any playbooks you want to run automatically when an alert is generated by the custom rule. For more information on creating and automating playbooks, see [Respond to threats](https://review.docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook).
+1.  In the **Response automation** tab, select any playbooks you want to run automatically when an alert is generated by the custom rule. For more information on creating and automating playbooks, see [Respond to threats](tutorial-respond-threats-playbook.md).
 
     ![Automate response to threats in Azure Sentinel](media/tutorial-detect-threats-custom/response-automation-custom.png)
 
@@ -74,7 +74,7 @@ You can create custom analytic rules to help you search for the types of threats
 
 1.  After the alert is created, a custom rule is added to the table under **Active analytic rules**. From this list you can enable, disable, or delete each rule.
 
-1.  To view the results of the alert rules you create, go to the **Incidents** page, where you can triage, [investigate incidents](https://review.docs.microsoft.com/en-us/azure/sentinel/tutorial-investigate-cases), and remediate the threats.
+1.  To view the results of the alert rules you create, go to the **Incidents** page, where you can triage, [investigate incidents](tutorial-investigate-cases.md), and remediate the threats.
 
 
 > [!NOTE]