edits

Author: schmurky

defender-xdr/advanced-hunting-defender-results.md

@@ -93,15 +93,15 @@ You can use the link to incident feature to add advanced hunting query results t
     - URL
     - MailCluster
     - MailMessage
-
+<br>
     > [!NOTE]
-  > For queries containing only XDR data, only entity types that are available in XDR tables are shown.
-
+> For queries containing only XDR data, only entity types that are available in XDR tables are shown.
+<br>
     After an entity type is selected, select an identifier type that exists in the selected records and will be used to identify this entity. Each entity type has a list of supported identifiers, as can be seen in the relevant drop down. Use the description displayed when hovering on each identifier to better understand it. 
 
-     After selecting the identifier, select a column from the query results’ that contains the selected identifier. You can click on the schema icon to open the schema reference and read the description on every column, to make sure you chose the right column that matches the selected identifier. 
+    After selecting the identifier, select a column from the query results’ that contains the selected identifier. You can click on the schema icon to open the schema reference and read the description on every column, to make sure you chose the right column that matches the selected identifier. 
 
-      :::image type="content" source="/defender/media/advanced-hunting-results-link5.png" alt-text="Screenshot of the options available in saved queries in the Microsoft Defender portal" lightbox="/defender/media/advanced-hunting-results-link5.png":::
+    :::image type="content" source="/defender/media/advanced-hunting-results-link5.png" alt-text="Screenshot of the options available in saved queries in the Microsoft Defender portal" lightbox="/defender/media/advanced-hunting-results-link5.png":::
 
      In our example, we used a query to find events related to a possible email exfiltration incident, therefore the recipient’s mailbox and recipient’s account are the impacted entities, and the sender’s IP as well as mail message are related evidence.