Updated units, fixed MD and fixed ARM template

Ken Lawson · Ken Lawson · commit d041fc7b1481 · 2025-03-18T09:49:32.000-06:00
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/1-introduction.yml b/learn-pr/wwl-sci/analyze-data-in-sentinel/1-introduction.yml
@@ -4,7 +4,7 @@ title: Introduction
 metadata:
   title: Introduction
   description: "Provide an introduction of Microsoft Sentinel Analytics."
-  ms.date: 05/15/2023
+  ms.date: 03/18/2025
   author: wwlpublish
   ms.author: kelawson
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/2-exercise-setup.yml b/learn-pr/wwl-sci/analyze-data-in-sentinel/2-exercise-setup.yml
@@ -4,7 +4,7 @@ title: Exercise - Detect threats with Microsoft Sentinel analytics
 metadata:
   title: Exercise - Detect threats with Microsoft Sentinel analytics
   description: "Detect threats by using Microsoft Sentinel Analytics."
-  ms.date: 02/24/2025
+  ms.date: 03/18/2025
   author: wwlpublish
   ms.author: kelawson
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/4-analytics-rules.yml b/learn-pr/wwl-sci/analyze-data-in-sentinel/4-analytics-rules.yml
@@ -4,7 +4,7 @@ title: Types of analytics rules
 metadata:
   title: Types of analytics rules
   description: "Identify different template rules to create analytic rules."
-  ms.date: 05/15/2023
+  ms.date: 03/18/2025
   author: wwlpublish
   ms.author: kelawson
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/5-create-rule-from-templates.yml b/learn-pr/wwl-sci/analyze-data-in-sentinel/5-create-rule-from-templates.yml
@@ -4,7 +4,7 @@ title: Create an analytics rule from templates
 metadata:
   title: Create an analytics rule from templates
   description: "Describes the procedure to create an analytics rule from templates."
-  ms.date: 05/15/2023
+  ms.date: 03/18/2025
   author: wwlpublish
   ms.author: kelawson
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/6-create-rule-from-wizard.yml b/learn-pr/wwl-sci/analyze-data-in-sentinel/6-create-rule-from-wizard.yml
@@ -4,7 +4,7 @@ title: Create an analytics rule from wizard
 metadata:
   title: Create an analytics rule from wizard
   description: "Describes how to create an analytics rule by using the wizard."
-  ms.date: 05/15/2023
+  ms.date: 03/18/2025
   author: wwlpublish
   ms.author: kelawson
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/7-manage-analytics-rules.yml b/learn-pr/wwl-sci/analyze-data-in-sentinel/7-manage-analytics-rules.yml
@@ -4,7 +4,7 @@ title: Manage analytics rules
 metadata:
   title: Manage analytics rules
   description: "Describes how to manage and modify analytics rules."
-  ms.date: 05/15/2023
+  ms.date: 03/18/2025
   author: wwlpublish
   ms.author: kelawson
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/8-exercise-detect-threats.yml b/learn-pr/wwl-sci/analyze-data-in-sentinel/8-exercise-detect-threats.yml
@@ -4,7 +4,7 @@ title: Exercise - Detect threats with Microsoft Sentinel analytics
 metadata:
   title: Exercise - Detect threats with Microsoft Sentinel analytics
   description: "Detect threats by using Microsoft Sentinel Analytics."
-  ms.date: 05/15/2023
+  ms.date: 03/18/2025
   author: wwlpublish
   ms.author: kelawson
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/2-exercise-setup.md b/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/2-exercise-setup.md
@@ -1,5 +1,3 @@
-
-
 The Threat detection with Microsoft Sentinel Analytics exercise in this module is an optional unit. However, if you want to perform this exercise, you need access to an Azure subscription where you can create Azure resources. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?azure-portal=true) before you begin.
 
 To deploy the prerequisites for the exercise, perform the following tasks.
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/3-azure-sentinel-analytics-overview.md b/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/3-azure-sentinel-analytics-overview.md
@@ -61,11 +61,11 @@ The **Analytics** home page provides the following filters:
 
 - **Severity**. Use to filter the rules by levels of severity.
 
-- **Rule Type**. There are currently six types of rules: Scheduled, NRT (near real time), Fusion, Microsoft Security, ML (machine learning) Behavior Analytics, and Threat Intelligence.
+- **Rule Type**. There are currently seven types of rules: Scheduled, NRT (near real time), Fusion, Microsoft Security, ML (machine learning) Behavior Analytics, and Threat Intelligence.
 
 - **Tactics**. Use to filter the rules based on 14 specific methodologies in ATT&amp;CK model.
 
 - **Data Sources**. Use to filter the rules by the data source connector that generates the alert.
 
 > [!NOTE]
-> MITRE ATT&amp;CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&amp;CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.
+> MITRE ATT&amp;CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&amp;CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/4-analytics-rules.md b/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/4-analytics-rules.md
@@ -43,8 +43,7 @@ By default, Fusion detection is enabled in Microsoft Sentinel. Microsoft is cons
 
   - Microsoft Defender for IoT
 
-    - Microsoft Defender XDR
-
+  - Microsoft Defender XDR
 
   - Microsoft Defender for Cloud Apps
 
@@ -68,7 +67,7 @@ Some of the common attack detection scenarios that Fusion alerts identify includ
 
 - **Ransomware**. After a suspicious sign-in to a Microsoft Entra account, unusual user behavior used to encrypt data can trigger a ransomware execution alert.
 
-> [!Note]
+> [!NOTE]
 > For more information on the Fusion technology in Microsoft Sentinel, see [Advanced multistage attack detection in Microsoft Sentinel](/azure/sentinel/fusion)
 
 ## Microsoft security
@@ -93,7 +92,7 @@ You can configure the following security solutions to pass their alerts to Micro
 
 - Microsoft Defender for Endpoint
 
-> [!Note]
+> [!NOTE]
 > Microsoft unifies security information and event management (SIEM) and extended detection and response (XDR) terminology across their security products.
 
 You can filter these alerts by severity and by specific text that is contained in the alert name.
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/5-create-rule-from-templates.md b/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/5-create-rule-from-templates.md
@@ -1,25 +1,13 @@
-
-
 The Analytics section in Microsoft Sentinel contains rule templates that are preloaded from the Microsoft Sentinel GitHub repository. You can use these templates to create a rule to detect security threats.
 
-
-
 ## Exploring the existing rule templates
 
-
-
-You can use some of the existing rule templates to create a single rule and others to create multiple rules with different customization options. Templates in use display the **IN USE** label on the template page as displayed in the following screenshot. 
-
-
+You can use some of the existing rule templates to create a single rule and others to create multiple rules with different customization options. Templates in use display the **IN USE** label on the template page as displayed in the following screenshot.
 
 :::image type="content" source="../media/04-template-in-use.png" alt-text="Screenshot of the template in use." border="true":::
 
-
-
 By selecting one of the rules on the **Rule Templates** tab, you can observe the properties of the rule. For each rule, you can review:
 
-
-
 **Severity level.** This indicates the importance of the alert. There are four severity levels:
 
 - High
@@ -36,6 +24,7 @@ By selecting one of the rules on the **Rule Templates** tab, you can observe the
 - Microsoft Security
 - ML Behavior Analytics
 - Scheduled
+- NRT (Near Real Time)
 
 **Data Source.** This specifies the data source connector that generated the alert.
 
@@ -44,35 +33,19 @@ By selecting one of the rules on the **Rule Templates** tab, you can observe the
 > [!NOTE]
 > MITRE ATT&amp;CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&amp;CK knowledge base provides a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.
 
-
-
 When you select a rule from the list on either the Active rules tab or the Rule templates tab, the details pane provides more information for the selected rule. 
 
-
-
 ## Creating an analytic rule from a rule template
 
-
-
 When you select a predefined rule template, the details pane
 may display filters that can be used to define how that rule behaves. For Fusion and ML behavior analytics rules, Microsoft doesn't provide any editable information. However, for scheduled rules and Microsoft Security, you can view or edit the query, filters, and includes and excludes used in the threat detection. By selecting the **Create rule** button, you can define the   analytics rule logic using a wizard that helps you customize a rule from the selected template.
 
-
-
 For Fusion and ML behavior analytics templates, you can only enable or disable them as active rules.
 
-
-
 A rule that you create from a Microsoft security template consists of the following elements:
 
-
-
-
-
 ## General tab
 
-
-
 The following table lists the inputs on the **General** tab.
 
 |Field | Description |
@@ -85,16 +58,10 @@ The following table lists the inputs on the **General** tab.
 | Include specific alerts | Add one or more words to include results of alerts that contain specific text in their name.  |
 | Exclude specific alerts | Add one or more words to exclude results of alerts that contain specific text in their name.  |
 
-
-
 ## Automated response
 
-
-
 On the **Automated response** tab, you can define automation rules. If you select **Add new**, the **Create new automation rule** pane opens. The following fields are inputs:
 
-
-
 |Field | Description |
 |---------|---------|
 | Automation rule name | Choose a name that uniquely describes this automation rule  |
@@ -104,24 +71,14 @@ On the **Automated response** tab, you can define automation rules. If you selec
 | Rule expiration | Date and time for rule to be disabled. Default is indefinite. |
 | Order | If multiple rules are created, select sequential numbers to reorder the incident automation rules in the left pane.  |
 
-
-
 > [!NOTE]
-> When you implement filters to include or exclude specific alerts based on a text string, these alerts will not appear in Microsoft Sentinel. 
-
-
+> When you implement filters to include or exclude specific alerts based on a text string, these alerts will not appear in Microsoft Sentinel.
 
 The following screenshot presents an example of creating an incident from alerts generated by the Microsoft Defender for Cloud.
 
-
-
 :::image type="content" source="../media/04-create-analytics-rule.png" alt-text="Screenshot of the wizard used to create analytics rules from templates." border="true":::
 
-
-
 For instructions on how to create an analytics rule from a scheduled rule type template, see **Create an analytics rule from a scheduled rule template** in next unit (Unit 6).
 
-
-
 > [!NOTE]
-> For certain rule templates, the **Create rule** button might be disabled, which indicates that you can't create a rule from selected template because of a missing data source.
+> For certain rule templates, the **Create rule** button might be disabled, which indicates that you can't create a rule from selected template because of a missing data source.
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/6-create-rule-from-wizard.md b/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/6-create-rule-from-wizard.md
@@ -1,5 +1,3 @@
-
-
 You can create a custom analytics rule to search for suspicious activities and threats at Contoso.
 
 ## Create a custom scheduled analytics rule
@@ -42,7 +40,7 @@ AzureActivity
 | make-series dcount(ResourceId)  default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
 ```
 
-> [!Tip]
+> [!TIP]
 > For assistance with KQL query language, see the [Kusto Query Language (KQL) overview](/azure/kusto/query/).
 
 ### Alert enrichment (Preview)
@@ -109,4 +107,4 @@ For more information about how to create a playbook and run the automated activi
 
 ## Review and create tab
 
-On the **Review and create** tab, review the settings you've configured in the wizard before creating a new rule.
+On the **Review and create** tab, review the settings you've configured in the wizard before creating a new rule.
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/7-manage-analytics-rules.md b/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/7-manage-analytics-rules.md
@@ -1,4 +1,3 @@
-
 ## Manage analytics rules
 
 To adjust the noise and filter the more important threats detected, you should manage the analytics rules on an ongoing basis. This helps ensure that your rules remain useful and efficient in detecting potential security threats.
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/8-exercise-detect-threats.md b/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/8-exercise-detect-threats.md
@@ -1,4 +1,3 @@
-
 As a security engineer working for Contoso, you recently noticed that a significant number of VMs were deleted from your Azure subscription. You want to analyze this  occurrence and be alerted when a similar activity occurs in the future. You decide to implement an analytics rule to create an incident when someone deletes an existing VM.
 
 ## Exercise: Threat detection with Microsoft Sentinel Analytics
@@ -62,7 +61,7 @@ In this exercise, you'll explore a Microsoft Sentinel analytics rule and perform
 2. On the **Virtual machines** page, locate and select the **simple-vm** virtual machine that you created in the resource group for this exercise, and then on the header bar, select **Delete**. In the Delete virtual machine prompt, select **Yes**.
 3. In the **Delete virtual machine** prompt, select **OK** to delete the virtual machine.
 
-> [!Note]
+> [!NOTE]
 > This task creates an incident based on the analytics rule that you created in Task 1. Incident creation can take up to 15 minutes. You can proceed with rest of the steps of this unit and then observe the results at later time.
 
 ### Task 3: Create an analytics rule from an existing template
@@ -101,4 +100,3 @@ After you've finished with the exercise, you should delete resources to avoid in
 1. Select **azure-sentinel-rg**.
 1. On the header bar, select **Delete resource group**.
 1. In the **TYPE THE RESOURCE GROUP NAME:** field, enter the name of the resource group **azure-sentinel-rg** and select **Delete**.
-
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/index.yml b/learn-pr/wwl-sci/analyze-data-in-sentinel/index.yml
@@ -3,7 +3,7 @@ uid: learn.azure.analyze-data-in-sentinel
 metadata:
   title: Threat detection with Microsoft Sentinel analytics
   description: "Threat detection with Microsoft Sentinel analytics"
-  ms.date: 02/24/2025
+  ms.date: 03/18/2025
   author: wwlpublish
   ms.author: kelawson
   ms.topic: module

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,3 @@`
`1`		`-`
`2`		`-`
`3`	`1`	`The Threat detection with Microsoft Sentinel Analytics exercise in this module is an optional unit. However, if you want to perform this exercise, you need access to an Azure subscription where you can create Azure resources. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?azure-portal=true) before you begin.`
`4`	`2`
`5`	`3`	`To deploy the prerequisites for the exercise, perform the following tasks.`