Indentations

Author: schmurky

defender-xdr/advanced-hunting-defender-results.md

@@ -93,21 +93,21 @@ You can use the link to incident feature to add advanced hunting query results t
     - URL
     - MailCluster
     - MailMessage
-<br>
-    > [!NOTE]
+
+> [!NOTE]
 > For queries containing only XDR data, only entity types that are available in XDR tables are shown.
-<br>
-    After an entity type is selected, select an identifier type that exists in the selected records and will be used to identify this entity. Each entity type has a list of supported identifiers, as can be seen in the relevant drop down. Use the description displayed when hovering on each identifier to better understand it. 
 
-    After selecting the identifier, select a column from the query results’ that contains the selected identifier. You can click on the schema icon to open the schema reference and read the description on every column, to make sure you chose the right column that matches the selected identifier. 
+After an entity type is selected, select an identifier type that exists in the selected records and will be used to identify this entity. Each entity type has a list of supported identifiers, as can be seen in the relevant drop down. Use the description displayed when hovering on each identifier to better understand it. 
+
+After selecting the identifier, select a column from the query results’ that contains the selected identifier. You can click on the schema icon to open the schema reference and read the description on every column, to make sure you chose the right column that matches the selected identifier. 
 
-    :::image type="content" source="/defender/media/advanced-hunting-results-link5.png" alt-text="Screenshot of the options available in saved queries in the Microsoft Defender portal" lightbox="/defender/media/advanced-hunting-results-link5.png":::
+:::image type="content" source="/defender/media/advanced-hunting-results-link5.png" alt-text="Screenshot of the options available in saved queries in the Microsoft Defender portal" lightbox="/defender/media/advanced-hunting-results-link5.png":::
 
-     In our example, we used a query to find events related to a possible email exfiltration incident, therefore the recipient’s mailbox and recipient’s account are the impacted entities, and the sender’s IP as well as mail message are related evidence.
+In our example, we used a query to find events related to a possible email exfiltration incident, therefore the recipient’s mailbox and recipient’s account are the impacted entities, and the sender’s IP as well as mail message are related evidence.
 
-       :::image type="content" source="/defender/media/advanced-hunting-results-link6.png" alt-text="Screenshot of the options available in saved queries in the Microsoft Defender portal" lightbox="/defender/media/advanced-hunting-results-link6.png":::
+:::image type="content" source="/defender/media/advanced-hunting-results-link6.png" alt-text="Screenshot of the options available in saved queries in the Microsoft Defender portal" lightbox="/defender/media/advanced-hunting-results-link6.png":::
 
-    A different alert is created for each record with a unique combination of impacted entities. In our example, if there are three different recipients mailboxes and recipient object ids combinations, for instance, then three alerts are created and linked to the chosen incident.
+A different alert is created for each record with a unique combination of impacted entities. In our example, if there are three different recipients mailboxes and recipient object ids combinations, for instance, then three alerts are created and linked to the chosen incident.
 
 6. Select **Next**.
 7. Review the details you've provided in the Summary section.