Entity looup table cleanup

Author: jpipkin1

docs/cse/records-signals-entities-insights/configure-entity-lookup-table.md

@@ -26,25 +26,34 @@ In addition, in some systems a user or a host has both a name and a unique ID, t
 * `d8ece0f8-10a4-3c62-b8a3-2e636a3a0509`
 * `testk-122.testlabs.local`
 
-Multiple identifiers for the same user or host are a problem when it comes to correlating Signals around a common Entity: unless you allow for all permutations of a username or hostname, your rule or search won’t function as intended with all data sources.
+Multiple identifiers for the same user or host are a problem when it comes to correlating Signals around a common Entity. Unless you allow for all permutations of a username or hostname, your rule or search won’t function as intended with all data sources.
+
+### Examples of when you create Lookup Tables
+
+Following are some examples of situations when you'd want to use Entity Lookup Tables:
+* CrowdStrike FDR data uses an agent ID (AID) instead of a hostname for some messages.
+* Mail Transfer Agent (MTA) systems report usernames in an email format.
+* Your users have different login names on different systems (for example, Windows, Linux, and AWS).
+
+### How does an Entity Lookup Table work?
 
 An Entity Lookup Table defines two sets of values: a lookup value to look for in an incoming message and a substitution value. You can create Entity Lookup Tables to support the following types of normalization:
 
 * **Host ID to Normalized Hostname**
 * **User ID to Normalized Username**
 * **Username to Normalized Username**
 
-Entity Lookup Tables are based on Sumo Logic’s Lookup Tables feature. Here is an example of a **Host ID to Normalized Hostname** Lookup Table in the Sumo Logic Library:
+Entity Lookup Tables are based on Sumo Logic’s [Lookup Tables](/docs/search/lookup-tables/) feature. Here is an example of a **Host ID to Normalized Hostname** Lookup Table in the Sumo Logic Library:
 
 <img src={useBaseUrl('img/cse/example-table.png')} alt="Example Entity lookup table" style={{border: '1px solid gray'}} width="800"/>
 
-## Limitations
+## Creating a Lookup Table
 
-You can configure a maximum of five Entity Lookup Tables. 
+Before you configure a Lookup Table in Cloud SIEM, you must [create the Lookup Table](/docs/search/lookup-tables/create-lookup-table/) in the Sumo Logic platform. There are a variety of ways to create a Lookup Table. 
 
-## Creating a Lookup Table
+### Limitations
 
-Before you configure a Lookup Table in Cloud SIEM, you must create the Lookup Table in the Sumo Logic platform. There are a variety of ways to create a Lookup Table. 
+You can configure a maximum of five Entity Lookup Tables. 
 
 ### Populate table from inventory data
 
@@ -56,11 +65,11 @@ This method–the typical way to populate a Lookup Table for the purpose of Enti
 
 If you already have a Lookup Table that contains normalization data, you can configure it in Cloud SIEM. Or, if you have existing normalization data that is not currently in a Lookup Table you can create a Lookup Table with that data. Note that your Lookup Table must contain a field that contains a lookup value and one that contains a substitution value. There is no requirement for particular column names.
 
-For instructions, see the Create a Lookup Table topic. After creating the table, perform the steps in [Configure the Lookup Table in Cloud SIEM](#configure-the-lookup-table-in-cloud-siem), below.
+For instructions, see [Create a Lookup Table](/docs/search/lookup-tables/create-lookup-table/). After creating the table, perform the steps in [Configure the Lookup Table in Cloud SIEM](#configure-the-lookup-table-in-cloud-siem), below.
 
 ### Configure the Lookup Table in Cloud SIEM
 
-After you’ve created your Entity Lookup Table in the Sumo Logic Library, you can configure it in Cloud SIEM.
+After you've [created your Entity Lookup Table](/docs/search/lookup-tables/create-lookup-table/) in the Sumo Logic Library, you can configure it in Cloud SIEM.
 
 1. [**Classic UI**](/docs/cse/introduction-to-cloud-siem/#classic-ui). In the top menu select **Configuration**, and then under **Entities** select **Normalization**. <br/>[**New UI**](/docs/cse/introduction-to-cloud-siem/#new-ui). In the top menu select **Configuration**, and then under **Cloud SIEM Entities** select **Normalization**. You can also click the **Go To...** menu at the top of the screen and select **Normalization**.  
 1. On the **Entity Normalization** page, click **Lookup Tables**.

docs/search/lookup-tables/create-lookup-table.md

@@ -6,18 +6,21 @@ description: Learn about lookup tables and how to create and manage them.
 
 import useBaseUrl from '@docusaurus/useBaseUrl';
 
-This section has instructions for creating and and managing Lookup Tables using the Sumo Logic UI.
+This section has instructions for creating Lookup Tables using the Sumo Logic UI.
 
-:::tip
-You can also use the [Lookups API](https://api.sumologic.com/docs/#tag/lookupManagement) to create and manage Lookup Tables. 
-:::
-
-For information about updating, exporting, and sharing Lookup Tables, see [Manage and Update Lookup Tables](manage-update-lookup-tables.md).
+For additional articles about lookup tables, see the following:
+* To update, export, and share Lookup Tables, see [Manage and Update Lookup Tables](manage-update-lookup-tables.md). 
+* To configure a Lookup Table for use in Cloud SIEM, see [Configure an Entity Lookup Table](/docs/cse/records-signals-entities-insights/configure-entity-lookup-table/).
+* To populate a Lookup Table with Cloud SIEM inventory data, see [Save Inventory Data to a Lookup Table](/docs/cse/administration/save-inventory-data-lookup-table/).
 
 :::note
 New Lookup Tables are available in all deployments except Sumo Logic's Montreal deployment, pending AWS providing a required AWS service in the Montreal region.
 :::
 
+:::tip
+You can also use the [Lookups API](https://api.sumologic.com/docs/#tag/lookupManagement) to create and manage Lookup Tables. 
+:::
+
 ## Introduction to Lookup Tables
 
 A Lookup Table is a table of data hosted on Sumo Logic that you can use to enrich the log data received by Sumo Logic. For example, in a Sumo Logic log search, you'd refer to a Lookup Table of user account data to map the user ID in an incoming log to a row in the Lookup Table, and return other attributes of that user, for instance, email address or phone number. The fields you look up appear as part of your search results.