Pencil edit

Author: padmagit77

defender-xdr/advanced-hunting-find-ransomware.md

@@ -240,7 +240,7 @@ The consolidated query returns the following results:
 - **TotalEvidenceCount**—number of observed signs
 - **UniqueEvidenceCount**—number of types of observed signs
 
-:::image type="content" source="/defender/media/advanced-hunting-ransomware-query.png" alt-text="An example of a consolidated query for a ransomware activity in the Microsoft Defender portal" lightbox="/defender/media/advanced-hunting-ransomware-query.png":::
+    :::image type="content" source="/defender/media/advanced-hunting-ransomware-query.png" alt-text="An example of a consolidated query for a ransomware activity in the Microsoft Defender portal" lightbox="/defender/media/advanced-hunting-ransomware-query.png":::
 
 *Query results showing affected devices and counts of various signs of ransomware activity*
 
@@ -319,4 +319,4 @@ Microsoft Security team blog posts:
 - [Work with query results](advanced-hunting-query-results.md)
 - [Use shared queries](advanced-hunting-shared-queries.md)
 - [Understand the schema](advanced-hunting-schema-tables.md)
-- [Apply query best practices](advanced-hunting-best-practices.md)
+- [Apply query best practices](advanced-hunting-best-practices.md)