Merge pull request #50846 from MicrosoftDocs/main

Taojunshen · web-flow · commit e8e5a79e69f3 · 2025-06-10T06:54:15.000+08:00
6/9/2025 PM Publish
diff --git a/learn-pr/azure/run-docker-with-azure-container-instances/includes/2-run-aci.md b/learn-pr/azure/run-docker-with-azure-container-instances/includes/2-run-aci.md
@@ -29,8 +29,6 @@ For scenarios where you need full container orchestration, including service dis
     az group create --name learn-deploy-aci-rg --location eastus
     ```
 
-    Create a container by providing a name, a Docker image, and an Azure resource group to the `az container create` command. You can optionally expose the container to the Internet by specifying a DNS name label. In this example, deploy a container that hosts a small web app. You can also select the location to place the image; we use the **East US** region, but you can change it to a location close to you.
-
 1. Provide a DNS name to expose your container to the Internet. Your DNS name must be unique. For learning purposes, run this command from Cloud Shell to create a Bash variable that holds a unique name:
 
     ```azurecli
diff --git a/learn-pr/paths/develop-language-solutions-azure-ai/index.yml b/learn-pr/paths/develop-language-solutions-azure-ai/index.yml
@@ -1,20 +1,20 @@
 ### YamlMime:LearningPath
 uid: learn.wwl.develop-language-solutions-azure-ai
 metadata:
-  title: Develop natural language processing solutions with Azure AI Services AI-3003
-  description: Develop natural language processing solutions with Azure AI Services (AI-3003)
-  ms.date: 09/14/2023
+  title: Develop natural language solutions in Azure
+  description: Develop natural language solutions in Azure
+  ms.date: 06/09/2025
   author: ivorb
   ms.author: berryivor
   ms.topic: learning-path
-title: Develop natural language processing solutions with Azure AI Services
+title: Develop natural language solutions in Azure
 prerequisites: |
   Before starting this learning path, you should already have:
   *   Familiarity with Azure and the Azure portal.
   *   Experience programming with C# or Python.
   If you have no previous programming experience, we recommend you complete the [Take your first steps with C#](/training/paths/csharp-first-steps/) or [Take your first steps with Python](/training/paths/python-first-steps/) learning path before starting this one.
 summary: |
-  Natural language processing (NLP) solutions use language models to interpret the semantic meaning of written or spoken language. You can use the Language Understanding service to build language models for your applications.
+  Natural language solutions use language models to interpret the semantic meaning of written or spoken language, and in some cases respond based on that meaning. You can use the Language service to build language models for your applications, and explore Azure AI Foundry to use generative models for speech.
 iconUrl: /training/achievements/create-language-solution-azure-cognitive-services.svg
 levels:
 - intermediate
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/2-exercise-setup.yml b/learn-pr/wwl-sci/analyze-data-in-sentinel/2-exercise-setup.yml
@@ -4,7 +4,7 @@ title: Exercise - Detect threats with Microsoft Sentinel analytics
 metadata:
   title: Exercise - Detect threats with Microsoft Sentinel analytics
   description: "Detect threats by using Microsoft Sentinel Analytics."
-  ms.date: 05/23/2025
+  ms.date: 06/09/2025
   author: KenMAG
   ms.author: kelawson
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/2-exercise-setup.md b/learn-pr/wwl-sci/analyze-data-in-sentinel/includes/2-exercise-setup.md
@@ -25,13 +25,13 @@ To deploy the prerequisites for the exercise, perform the following tasks.
     | Workspace Name  | Provide a unique name for the Microsoft Sentinel Workspace such as `<yourName>-sentinel`, where *\<yourName>* represents the workspace name that you chose in the previous task. |
     | Location | Accept the default value of **[resourceGroup().location]**. |
     | Simplevm Name | Accept the default value of **simple-vm**. |
-    | Simplevm Windows OS Version | Accept the default value of **2016-Datacenter**. |
+    | Simplevm Windows OS Version | Accept the default value of **2022-Datacenter**. |
 
 1. Select the **Review + create**. When validation passes, select **Create**.
 
     :::image type="content" source="../media/02-custom-deployment.png" alt-text="Screenshot of the Custom Deployment page." border="true":::
 
-    > [!Note]
+    > [!NOTE]
     > Wait for the deployment to complete. The deployment should take less than five minutes.
 
 ## Task 2: Check the resources created
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/index.yml b/learn-pr/wwl-sci/analyze-data-in-sentinel/index.yml
@@ -3,7 +3,7 @@ uid: learn.azure.analyze-data-in-sentinel
 metadata:
   title: Threat detection with Microsoft Sentinel analytics
   description: "Threat detection with Microsoft Sentinel analytics"
-  ms.date: 05/23/2025
+  ms.date: 06/09/2025
   author: KenMAG
   ms.author: kelawson
   ms.topic: module
diff --git a/learn-pr/wwl-sci/analyze-data-in-sentinel/media/02-custom-deployment.png b/learn-pr/wwl-sci/analyze-data-in-sentinel/media/02-custom-deployment.png
diff --git a/learn-pr/wwl-sci/hunt-threats-sentinel/2-exercise-setup.yml b/learn-pr/wwl-sci/hunt-threats-sentinel/2-exercise-setup.yml
@@ -3,8 +3,8 @@ uid: learn.azure.hunt-threats-sentinel.2-exercise-setup
 metadata: 
   title: Exercise setup
   description: Learn how to set up your Azure resources to hunt threats using Microsoft Sentinel.
-  ms.date: 05/25/2023
-  author: wwlpublish
+  ms.date: 06/09/2025
+  author: KenMAG
   ms.author: kelawson
   ms.topic: unit
   ms.custom:
diff --git a/learn-pr/wwl-sci/hunt-threats-sentinel/includes/2-exercise-setup.md b/learn-pr/wwl-sci/hunt-threats-sentinel/includes/2-exercise-setup.md
@@ -22,10 +22,12 @@ To deploy the prerequisites for the exercise, perform the following tasks.
     | **Workspace name**  | Provide a unique name for the Microsoft Sentinel workspace, such as `<yourName>-sentinel`, where *\<yourName>* represents the workspace name that you chose in the previous task. |
     | **Location** | Accept the default value **[resourceGroup().location]**. |
     | **Simplevm Name** | Accept the default value **simple-vm**. |
-    | **Simplevm Windows OS Version** | Accept the default value **2016-Datacenter**.|
+    | **Simplevm Windows OS Version** | Accept the default value **2022-Datacenter**.|
 
 1. Select **Review + create**, and then select **Create**.
 
+   :::image type="content" source="../media/02-custom-deployment.png" alt-text="Screenshot of the Custom Deployment page." border="true":::
+
     > [!NOTE]
     > Wait for the deployment to finish. The deployment should take less than five minutes.
 
diff --git a/learn-pr/wwl-sci/hunt-threats-sentinel/index.yml b/learn-pr/wwl-sci/hunt-threats-sentinel/index.yml
@@ -3,8 +3,8 @@ uid: learn.azure.hunt-threats-sentinel
 metadata:
   title: Threat hunting with Microsoft Sentinel
   description: Learn how to proactively identify threat behaviors by using Microsoft Sentinel queries.
-  ms.date: 03/06/2025
-  author: wwlpublish
+  ms.date: 06/09/2025
+  author: KenMAG
   ms.author: kelawson
   ms.topic: module
   ms.service: microsoft-sentinel
diff --git a/learn-pr/wwl-sci/hunt-threats-sentinel/media/02-custom-deployment.png b/learn-pr/wwl-sci/hunt-threats-sentinel/media/02-custom-deployment.png
diff --git a/learn-pr/wwl-sci/threat-response-sentinel-playbooks/2-exercise-setup.yml b/learn-pr/wwl-sci/threat-response-sentinel-playbooks/2-exercise-setup.yml
@@ -4,8 +4,8 @@ title: Exercise - Create a Microsoft Sentinel playbook
 metadata:
   title: Exercise - Create a Microsoft Sentinel playbook
   description: "Create a Microsoft Sentinel playbook."
-  ms.date: 01/25/2023
-  author: wwlpublish
+  ms.date: 06/09/2025
+  author: KenMAG
   ms.author: kelawson
   ms.topic: unit
 durationInMinutes: 15
diff --git a/learn-pr/wwl-sci/threat-response-sentinel-playbooks/3-playbook-overview.yml b/learn-pr/wwl-sci/threat-response-sentinel-playbooks/3-playbook-overview.yml
@@ -4,8 +4,8 @@ title: What are Microsoft Sentinel playbooks?
 metadata:
   title: What are Microsoft Sentinel playbooks?
   description: "Explore Microsoft Sentinel playbooks."
-  ms.date: 01/25/2023
-  author: wwlpublish
+  ms.date: 06/09/2025
+  author: KenMAG
   ms.author: kelawson
   ms.topic: unit
 durationInMinutes: 10
diff --git a/learn-pr/wwl-sci/threat-response-sentinel-playbooks/includes/2-exercise-setup.md b/learn-pr/wwl-sci/threat-response-sentinel-playbooks/includes/2-exercise-setup.md
@@ -24,7 +24,7 @@ To deploy the prerequisites for the exercise, perform the following tasks.
     | Workspace name | Provide a unique name for the Microsoft Sentinel workspace such as `<yourName>-Sentinel`, where *\<yourName>* represents the workspace name that you chose in the previous task. |
     | Location | Accept the default value of **[resourceGroup().location]**. |
     | Simplevm Name | Accept the default value of **simple-vm**.|
-    | Simplevm Windows OS Version | Accept the default value of **2016-Datacenter**.|
+    | Simplevm Windows OS Version | Accept the default value of **2022-Datacenter**.|
 
     :::image type="content" source="../media/02-custom-deployment.png" alt-text="Screenshot of the custom deployment inputs for a Microsoft template." border="true":::
 
@@ -57,7 +57,7 @@ To deploy the prerequisites for the exercise, perform the following tasks.
     | `vnet1` |Virtual network|Virtual network for the VM. |
 
 > [!NOTE]
-> The resources deployed and configuration steps completed in this exercise are required in the next exercise. If you intended completing the next exercise do not delete the resources from this exercise.
+> The resources deployed and configuration steps completed in this exercise are required in the next exercise. If you intended to complete the next exercise, don't delete the resources from this exercise.
 
 ## Task 3: Configure Microsoft Sentinel Connectors
 
@@ -87,7 +87,7 @@ To deploy the prerequisites for the exercise, perform the following tasks.
 1. Select the **Review + Create** button to review the configuration, and then select **Create**.
 
     > [!NOTE]
-    > The connector for Azure Activity uses policy assignments, you need to have role permissions that allow you to create policy assignments. And, it typically take 15 minutes to display a status of **Connected**. While the connector deploys, you can continue performing the rest of the steps in this unit and subsequent units in this module.
+    > The connector for Azure Activity uses policy assignments. You need to have role permissions that allow you to create policy assignments. And, it typically takes 15 minutes to display a status of **Connected**. While the connector deploys, you can continue performing the rest of the steps in this unit and subsequent units in this module.
 
     :::image type="content" source="../media/06-azure-activity-content-hub-solution.png" alt-text="Screenshot that displays the Microsoft Sentinel Azure Activity Content Hub solution." border="true":::
 
diff --git a/learn-pr/wwl-sci/threat-response-sentinel-playbooks/includes/3-playbook-overview.md b/learn-pr/wwl-sci/threat-response-sentinel-playbooks/includes/3-playbook-overview.md
@@ -1,101 +1,57 @@
 
 In addition to assessing and addressing problems with their security configuration, Contoso must also monitor for new problems and threats, and then respond appropriately.
 
-
-
 ## Microsoft Sentinel as a SIEM and SOAR solution
 
-
-
 Microsoft Sentinel is both a Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) solution that's designed for hybrid environments.
 
-
-
 > [!NOTE]
 > SIEM solutions provide storage and analysis of logs, events, and alerts that other systems generate. You can configure these solutions to raise their own alerts. SOAR solutions support the remediation of vulnerabilities and the overall automation of security processes.
 
-
-
 Microsoft Sentinel uses built-in and custom detections to alert you to potential security threats such as attempts to access Contoso&#39;s resources from outside its infrastructure or when data from Contoso appears to be sent to a known malicious IP address. You can also create incidents based on these alerts.
 
-
-
 ## Microsoft Sentinel playbooks
 
-
-
 You can create security playbooks in Microsoft Sentinel to respond to alerts. *Security playbooks* are collections of procedures based on Azure Logic Apps that run in response to an alert. You can run these security playbooks manually in response to your investigation of an incident or you can configure an alert to run a playbook automatically.
 
-
-
 With the ability to respond to incidents automatically, you can automate some of your security operations and make your Security Operations Center (SOC) more productive.
 
-
-
-For example, to address Contoso's concerns, you can develop a workflow with defined steps that can block a suspicious username from accessing resources from a non-secure IP address. Alternatively, you can configure the playbook to perform an operation such as notifying the SecOps team about a high-level security alert.
-
-
+For example, to address Contoso's concerns, you can develop a workflow with defined steps that can block a suspicious username from accessing resources from a nonsecure IP address. Alternatively, you can configure the playbook to perform an operation such as notifying the SecOps team about a high-level security alert.
 
 ## Azure Logic Apps
 
-
-
 Azure Logic Apps is a cloud service that automates the operation of your business processes. You use a graphical design tool called the *Logic Apps Designer* to arrange prebuilt components into the sequence you need. You can also use the code view and write your automated process in the JSON file.
 
-
-
 ## Logic Apps Connector
 
-
-
 Logic apps use connectors to connect to hundreds of services. A *connector* is a component that provides an interface to an external service.
 
-
-
 > [!NOTE]
-> A Microsoft Sentinel data connector and a Logic Apps connector are not the same thing. A Microsoft Sentinel data connector connects Microsoft Sentinel with Microsoft security products and security ecosystems for non-Microsoft solutions. A Logic Apps connector is a component that provides an API connection for an external service and allows integration of events, data, and actions across other apps, services, systems, protocols, and platforms. 
-
-
+> A Microsoft Sentinel data connector and a Logic Apps connector aren't the same thing. A Microsoft Sentinel data connector connects Microsoft Sentinel with Microsoft security products and security ecosystems for non-Microsoft solutions. A Logic Apps connector is a component that provides an API connection for an external service and allows integration of events, data, and actions across other apps, services, systems, protocols, and platforms. 
 
 ## What are triggers and actions
 
-
-
 Azure Logic Apps use triggers and actions, which are defined as follows:
 
-
-
 - A *trigger* is an event that occurs when a specific set of conditions is satisfied. Triggers activate automatically when conditions are met. For example, a security incident occurs in Microsoft Sentinel, which is a trigger for an automated action.
 
 - An *action* is an operation that performs a task in the Logic Apps workflow. Actions run when a trigger activates, another action completes, or a condition is met.
 
-
-
 ## Microsoft Sentinel Logic Apps connector
 
-
-
 A Microsoft Sentinel playbook uses a Microsoft Sentinel Logic Apps connector. It provides the triggers and actions that can start the playbook and perform defined actions.
 
 Currently, there are two triggers from Microsoft Sentinel Logic Apps connector:
 
-
-
 - When a response to a Microsoft Sentinel alert is triggered
 
 - When Microsoft Sentinel incident creation rule is triggered
 
-
-
 > [!NOTE]
 > Because Microsoft Sentinel Logic App connector is in preview, the features described in this module might change in the future.
 
-
-
 The following table lists all the current actions for the Microsoft Sentinel connector.
 
-
-
 | Name | Description |
 | --- | --- |
 | Add comment to incident | Adds comments to the selected incident. |
@@ -112,11 +68,7 @@ The following table lists all the current actions for the Microsoft Sentinel con
 | Entities - Get URLs | Returns a list of URLs associated with the alert. |
 | Remove labels from incident | Removes the labels for the selected incident. |
 
-
-
 > [!NOTE]
 > Actions that have **(V2)** or a higher number provide a new version of the action and might differ from the old functionality of the action.
 
-
-
-Some actions require integration with actions from another connectors. For example, if Contoso wants to identify all suspicious accounts returned in the alert from the defined entities, you must combine the **Entities - Get Accounts** action with the **For Each** action. Similarly, to get all individual hosts in an incident that detect suspicious hosts, you must combine the **Entities - Get Hosts** action with the **For Each** action.
+Some actions require integration with actions from another connectors. For example, if Contoso wants to identify all suspicious accounts returned in the alert from the defined entities, you must combine the **Entities - Get Accounts** action with the **For Each** action. Similarly, to get all individual hosts in an incident that detect suspicious hosts, you must combine the **Entities - Get Hosts** action with the **For Each** action.
diff --git a/learn-pr/wwl-sci/threat-response-sentinel-playbooks/index.yml b/learn-pr/wwl-sci/threat-response-sentinel-playbooks/index.yml
@@ -3,8 +3,8 @@ uid: learn.azure.threat-response-sentinel-playbooks
 metadata:
   title: Threat response with Microsoft Sentinel playbooks
   description: "Provide an introduction to implementing threat response with Microsoft Sentinel playbooks."
-  ms.date: 01/25/2023
-  author: wwlpublish
+  ms.date: 06/09/2025
+  author: KenMAG
   ms.author: kelawson
   ms.topic: module
   ms.service: microsoft-sentinel
diff --git a/learn-pr/wwl-sci/threat-response-sentinel-playbooks/media/02-custom-deployment.png b/learn-pr/wwl-sci/threat-response-sentinel-playbooks/media/02-custom-deployment.png
