Merge branch 'vulnerabilities-page-fix' of https://github.com/limwainstein/defender-docs-pr into vulnerabilities-page-fix

Author: limwainstein

defender-for-identity/identity-inventory.md

@@ -46,7 +46,8 @@ There are several options you can choose from to customize the identities list v
 > [!NOTE]
 > When exporting the identities list to a CSV file, a maximum of 5,000 identities are displayed.
 
-## ![A screenshot of identity inventory page.](media/identity-inventory/inventory11.png)
+:::image type="content" source="media/identity-inventory/inventory-page.png" alt-text="Screenshot of the identity inventory page in the Microsoft Defender portal.":::
+
 
 ### Identity details 
 

defender-for-identity/link-unlink-account-to-identity.md

@@ -59,7 +59,7 @@ Follow these steps to manually link accounts to a selected identity.
 1. Navigate to **Assets** > **Identity Inventory**.
 1. Select an **Identity** from the list.
 
-    :::image type="content" source="media/identity-inventory/inventory11.png" alt-text="Screenshot of the Identity Inventory page in the Defender portal. " lightbox="media/identity-inventory/inventory11.png":::
+      :::image type="content" source="media/identity-inventory/inventory-page.png" alt-text="Screenshot of the identity inventory page in the Microsoft Defender portal." lightbox="media/identity-inventory/inventory-page.png":::
 
 1. Select the **Observed in organization** tab.
 1. Open the **Accounts** tab.
@@ -73,22 +73,31 @@ Follow these steps to manually link accounts to a selected identity.
     - Security identifier (SID)
     - Source provider account
 1. Select one account from the table.
+
+    :::image type="content" source="media/link-unlink-account-to-identity/select-accounts.png" alt-text="Screenshot that shows a list of accounts that you can link. " lightbox="media/link-unlink-account-to-identity/select-accounts.png":::
+
 1. Select **Next**.
 1. Enter a short justification comment explaining why you're linking these accounts.
 1. Your justification must:
     - Be between 1 and 50 characters
     - Use only letters, numbers, spaces, @, and _
     - If your input includes invalid characters or exceeds the limit, an error message will appear.
+
+    :::image type="content" source="media/link-unlink-account-to-identity/enter-justification.png" alt-text="Screenshot that shows where to enter the justification for why you are linking the accounts." lightbox="media/link-unlink-account-to-identity/enter-justification.png":::
+
 1. Select **Next**.
 1. Review the selected accounts and your justification.
+
+    :::image type="content" source="media/link-unlink-account-to-identity/review-and-finish.png" alt-text="Screenshot that shows the review of the selected accounts and the justification." lightbox="media/link-unlink-account-to-identity/review-and-finish.png":::
+
 1. Confirm that the accounts listed are correct.
 1. The account list refreshes automatically.
 
 ## Unlink accounts from an identity
 
 Follow these steps to manually unlink accounts from a selected identity.
 
-1. Go to **Identity Inventory > Observed in organization**
+1. Go to **Identity Inventory > Observed in organization**.
 1. Open the **Accounts** tab.
 1. Select one account set from the table.
 1. Select **Unlink account**.

…media/identity-inventory/inventory11.png …ia/identity-inventory/inventory-page.pngdefender-for-identity/media/identity-inventory/inventory11.png renamed to defender-for-identity/media/identity-inventory/inventory-page.png defender-for-identity/media/identity-inventory/inventory11.png renamed to defender-for-identity/media/identity-inventory/inventory-page.png

@@ -48,7 +48,7 @@ For information on other tables in the advanced hunting schema, see [the advance
 | Column name | Data type | Description |
 |-------------|-----------|-------------|
 | `ReportId` | `string` | Unique identifier for the record|
-| `Timestamp` | `string` | Date and time when the record was created|
+| `Timestamp` | `datetime` | Date and time when the record was created|
 | `OAuthAppId` | `string` | The unique  identifier for the app as assigned by Microsoft Entra ID|
 | `ServicePrincipalId` | `string` | The unique identifier for the service principal instance of the application in the tenant|
 | `AppName` | `string` | The application's display name as exposed by the associated service principal|
@@ -61,6 +61,7 @@ For information on other tables in the advanced hunting schema, see [the advance
 | `ConsentedUsersCount` | `integer` | Count of users who have consented to the app; this information is only available when the app isn't admin consented|
 | `IsAdminConsented` | `boolean` | Value is True if a user has provided admin consent to the app on behalf of all the users in the org, otherwise the value is False|
 | `AppOrigin` | `string` | Specifies whether the app is internal to the organization or registered in an external tenant|
+| `LastUsedTime` | `datetime` | Date and time when the app last signed in. Tracking of this data goes back to June, 2022| 
 | `AppOwnerTenantId` | `string` |Specifies the ID of the tenant where the app was registered|