Updates from review

Author: jpipkin1

blog-cse/2025-04-14-content.md

@@ -11,18 +11,18 @@ hide_table_of_contents: true
 import useBaseUrl from '@docusaurus/useBaseUrl';
 
 This content release includes:
-- Additional data requirements for GitHub rules added to rule descriptions
-- Spelling corrections for AWS Lambda rules
-- New Slack Anomaly Event log mapper and supporting parsing changes
-   - Enables passthrough detection of Slack Anomaly Events using Normalized Security Signal (MATCH-S00402)
-   - Requires parser be defined for passthrough detection
-- Updates to Sysdig parsing and mapping to support additional events
-- Support for Microsoft Windows Sysmon-29 event
-- Additional normalized field mappings for Microsoft Windows Sysmon events
-- New user_phoneNumber and targetUser_phoneNumber schema fields
+- Additional data requirements for GitHub rules added to rule descriptions.
+- Spelling corrections for AWS Lambda rules.
+- New Slack Anomaly Event log mapper and supporting parsing changes:
+   - Enables passthrough detection of Slack Anomaly Events using Normalized Security Signal (MATCH-S00402).
+   - Requires parser be defined for passthrough detection.
+- Updates to Sysdig parsing and mapping to support additional events.
+- Support for Microsoft Windows Sysmon-29 event.
+- Additional normalized field mappings for Microsoft Windows Sysmon events.
+- New `user_phoneNumber` and `targetUser_phoneNumber` schema fields.
 
 
-## Rules
+### Rules
 - [Updated] MATCH-S00874 AWS Lambda Function Recon
 - [Updated] MATCH-S00952 GitHub - Administrator Added or Invited
 - [Updated] MATCH-S00953 GitHub - Audit Logging Modification
@@ -46,36 +46,36 @@ This content release includes:
 - [Updated] MATCH-S00965 GitHub - Secret Scanning Potentially Disabled
 - [Updated] MATCH-S00966 GitHub - Two-Factor Authentication Disabled for Organization
 
-## Log Mappers
+### Log Mappers
 - [New] Slack Anomaly Event
 - [New] Windows - Microsoft-Windows-Sysmon/Operational - 16
 - [New] Windows - Microsoft-Windows-Sysmon/Operational - 19|20
 - [New] Windows - Microsoft-Windows-Sysmon/Operational-29
 - [Updated] Sysdig Secure Packages
 - [Updated] Sysdig Secure Vulnerability
 - [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 1
+- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 2
+- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 3
+- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 4
+- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 5
+- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 6
+- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 7
+- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 8
+- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 9
 - [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 10
 - [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 11
 - [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 15
 - [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 17
 - [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 18
-- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 2
 - [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 23
 - [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 24
 - [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 26
 - [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 27
-- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 3
-- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 4
-- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 5
-- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 6
-- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 7
-- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 8
-- [Updated] Windows - Microsoft-Windows-Sysmon/Operational - 9
 
-## Parsers
+### Parsers
 - [New] /Parsers/System/Slack/Slack Enterprise Audit
 - [Updated] /Parsers/System/Sysdig/Sysdig Secure
 
-## Schema
-- [New] targetUser_phoneNumber
-- [New] user_phoneNumber
+### Schema
+- [New] `targetUser_phoneNumber`
+- [New] `user_phoneNumber`