fixed indentation

in defender-xdr/alert-policies.md + defender-xdr/copilot-in-defender-device-summary.md

Author: sbreingold-ms

defender-xdr/alert-policies.md

@@ -95,7 +95,7 @@ You can also define user tags as a condition of an alert policy. This definition
 
 - **When the alert is triggered**. You can configure a setting that defines how often an activity can occur before an alert is triggered. This allows you to set up a policy to generate an alert every time an activity matches the policy conditions, when a certain threshold is exceeded, or when the occurrence of the activity the alert is tracking becomes unusual for your organization.
 
-  ![Configure how alerts are triggered, based on when the activity occurs, a threshold, or unusual activity for your organization.](media/alert-policies/howalertsaretriggered.png)
+    ![Configure how alerts are triggered, based on when the activity occurs, a threshold, or unusual activity for your organization.](media/alert-policies/howalertsaretriggered.png)
 
     If you select the setting based on unusual activity, Microsoft establishes a baseline value that defines the normal frequency for the selected activity. It takes up to seven days to establish this baseline, during which alerts aren't generated. After the baseline is established, an alert is triggered when the frequency of the activity tracked by the alert policy greatly exceeds the baseline value. For auditing-related activities (such as file and folder activities), you can establish a baseline based on a single user or based on all users in your organization; for malware-related activities, you can establish a baseline based on a single malware family, a single recipient, or all messages in your organization.
 

defender-xdr/copilot-in-defender-device-summary.md

@@ -65,15 +65,15 @@ You can access the device summary capability through the following ways:
 
 - From the main menu, open the Device inventory page by selecting **Devices** under Assets. Choose a device to investigate from the list. Upon opening the device page, Copilot automatically summarizes the device information of the chosen device and displays the summary in the Copilot pane.
 
-  :::image type="content" source="media/copilot-in-defender-device-summary/copilot-defender-device-summary-device-page-small.png" alt-text="Screenshot of the device summary results in Copilot in Defender." lightbox="media/copilot-in-defender-device-summary/copilot-defender-device-summary-device-page.png":::
+   :::image type="content" source="media/copilot-in-defender-device-summary/copilot-defender-device-summary-device-page-small.png" alt-text="Screenshot of the device summary results in Copilot in Defender." lightbox="media/copilot-in-defender-device-summary/copilot-defender-device-summary-device-page.png":::
 
 - From an incident page, you can choose a device on the incident graph and then (1) select **Device details**. On the device pane, (2) select **Summarize** to generate the device summary. The summary is displayed in the Copilot pane.
 
-  :::image type="content" source="media/copilot-in-defender-device-summary/copilot-defender-device-summary-device-page-small.png" alt-text="Screenshot highlighting the steps to access the device summary in an incident page in Copilot in Defender." lightbox="media/copilot-in-defender-device-summary/copilot-defender-device-summary-device-page-small.png":::
+   :::image type="content" source="media/copilot-in-defender-device-summary/copilot-defender-device-summary-device-page-small.png" alt-text="Screenshot highlighting the steps to access the device summary in an incident page in Copilot in Defender." lightbox="media/copilot-in-defender-device-summary/copilot-defender-device-summary-device-page-small.png":::
 
    You can also access the device summary capability by choosing a device listed in the **Assets** tab of an incident. Select **Copilot** in the device pane to generate the device summary.
 
-  :::image type="content" source="media/copilot-in-defender-device-summary/copilot-defender-device-summary-assets-small.png" alt-text="Screenshot highlighting the device summary option in the assets tab of an incident page in Copilot in Defender." lightbox="media/copilot-in-defender-device-summary/copilot-defender-device-summary-assets.png":::
+   :::image type="content" source="media/copilot-in-defender-device-summary/copilot-defender-device-summary-assets-small.png" alt-text="Screenshot highlighting the device summary option in the assets tab of an incident page in Copilot in Defender." lightbox="media/copilot-in-defender-device-summary/copilot-defender-device-summary-assets.png":::
 
 Review the results of the device summary. You can copy the results to clipboard, regenerate the results, or open the Security Copilot portal by selecting the More actions ellipsis (...) on top of the device summary card.