Merge branch 'main' into AHtimeilne

Author: mberdugo

defender-endpoint/api/post-ti-indicator.md

@@ -25,10 +25,6 @@ appliesto:
 
 [!INCLUDE [Microsoft Defender XDR rebranding](../../includes/microsoft-defender.md)]
 
-
-
-
-
 [!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
 
 [!include[Improve request performance](../../includes/improve-request-performance.md)]
@@ -71,20 +67,20 @@ Content-Type|string|application/json. **Required**.
 
 In the request body, supply a JSON object with the following parameters:
 
-Parameter|Type|Description
-:---|:---|:---
-indicatorValue|String|Identity of the [Indicator](ti-indicator.md) entity. **Required**
-indicatorType|Enum|Type of the indicator. Possible values are: `FileSha1`, `FileMd5`, `CertificateThumbprint`, `FileSha256`, `IpAddress`, `DomainName`, and `Url`. **Required**
-action|Enum|The action that is taken if the indicator is discovered in the organization. Possible values are: `Alert`, `Warn`, `Block`, `Audit`, `BlockAndRemediate`, `AlertAndBlock`, and `Allowed`. **Required**. The `GenerateAlert` parameter must be set to `TRUE` when creating an action with `Audit`.
-application|String|The application associated with the indicator. This field only works for new indicators. It doesn't update the value on an existing indicator. **Optional**
-title|String|Indicator alert title. **Required**
-description|String|Description of the indicator. **Required**
-expirationTime|DateTimeOffset|The expiration time of the indicator. **Optional**
-severity|Enum|The severity of the indicator. Possible values are: `Informational`, `Low`, `Medium`, and `High`. **Optional**
-recommendedActions|String|TI indicator alert recommended actions. **Optional**
-rbacGroupNames|String|Comma-separated list of RBAC group names the indicator would be applied to. **Optional**
-educateUrl|String|Custom notification/support URL. Supported for Block and Warn action types for URL indicators. **Optional**
-generateAlert|Enum|**True** if alert generation is required, **False** if this indicator shouldn't generate an alert.
+|Parameter|Type|Description|
+|:---|:---|:---|
+|indicatorValue|String|Identity of the [Indicator](ti-indicator.md) entity. **Required**|
+|indicatorType|Enum|Type of the indicator. Possible values are: `FileSha1`, `FileMd5`, `CertificateThumbprint`, `FileSha256`, `IpAddress`, `DomainName`, and `Url`. **Required**|
+|action|Enum|The action that is taken if the indicator is discovered in the organization. Possible values are: `Alert`, `Warn`, `Block`, `Audit`, `BlockAndRemediate`, `AlertAndBlock`, and `Allowed`. **Required**. The `GenerateAlert` parameter must be set to `TRUE` when creating an action with `Audit`.|
+|application|String|A user-friendly name for the content blocked by the indicator. If specified, this text will be shown in the blocking notification in place of the blocked filename or domain. This field only works for new indicators; it doesn't update the value on an existing indicator. **Optional**|
+|title|String|Indicator alert title. **Required**|
+|description|String|Description of the indicator. **Required**|
+|expirationTime|DateTimeOffset|The expiration time of the indicator. **Optional**|
+|severity|Enum|The severity of the indicator. Possible values are: `Informational`, `Low`, `Medium`, and `High`. **Optional**|
+|recommendedActions|String|TI indicator alert recommended actions. **Optional**|
+|rbacGroupNames|String|Comma-separated list of RBAC group names the indicator would be applied to. **Optional**|
+|educateUrl|String|Custom notification/support URL. Supported for Block and Warn action types for URL indicators. **Optional**|
+|generateAlert|Enum|**True** if alert generation is required, **False** if this indicator shouldn't generate an alert.|
 ## Response
 
 - If successful, this method returns 200 - OK response code and the created / updated [Indicator](ti-indicator.md) entity in the response body.