Advanced Hunting Microsoft Defender

@@ -88,7 +88,7 @@ In the unified portal, you can view the schema column names and descriptions, as - Custom detections have the following limitations:     - Near real-time detection frequency isn't available for detections that include Microsoft Sentinel data.      - Custom functions that you create and save in Microsoft Sentinel aren't supported.-- When creating a new Microsoft Sentinel function in Log Analytics, there is a delay of up to 20 minutes until it appears in Advanced Hunting.+- When you create a new Microsoft Sentinel function in Log Analytics, it can take up to 20 minutes to appear in advanced hunting. - Bookmarks aren't supported in the advanced hunting experience. They're supported in the **Microsoft Sentinel > Threat management > Hunting** feature. Alternatively, you can use the [Link to incident](advanced-hunting-defender-results.md#link-query-results-to-an-incident) feature to link query results to new or existing incidents. - If you're streaming Defender XDR tables to Log Analytics, there might be a difference between the `Timestamp` and `TimeGenerated` columns. If the data arrives to Log Analytics after 48 hours, the ingestion process overrides it to `now()`. Therefore, to get the actual time the event happened, rely on the `Timestamp` column. - When prompting [Security Copilot](advanced-hunting-security-copilot.md) for advanced hunting queries, you might find that not all Microsoft Sentinel tables are currently supported. However, support for these tables can be expected in the future.