updated toc

windows/security/threat-protection/TOC.md

@@ -54,7 +54,7 @@
 #### [Get started]()
 ##### [Permissions & prerequisites](microsoft-defender-atp/tvm-prerequisites.md)
 ##### [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md)
-##### [Assign device values](microsoft-defender-atp/tvm-assign-device-value.md)
+##### [Assign device value](microsoft-defender-atp/tvm-assign-device-value.md)
 #### [Assess your security posture]()
 ##### [Dashboard insights](microsoft-defender-atp/tvm-dashboard-insights.md)
 ##### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md)
@@ -62,11 +62,11 @@
 #### [Improve your security posture & reduce risk]()
 ##### [Address security recommendations](microsoft-defender-atp/tvm-security-recommendation.md)
 ##### [Remediate vulnerabilities](microsoft-defender-atp/tvm-remediation.md)
-##### [File an exception](microsoft-defender-atp/tvm-exception.md)
+##### [Exceptions for security recommendations](microsoft-defender-atp/tvm-exception.md)
 ##### [Plan for end-of-support software](microsoft-defender-atp/tvm-end-of-support-software.md)
 #### [Understand vulnerabilities on your devices]()
 ##### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md)
-##### [List of vulnerabilities](microsoft-defender-atp/tvm-weaknesses.md)
+##### [Vulnerabilities in my organization](microsoft-defender-atp/tvm-weaknesses.md)
 ##### [Event timeline](microsoft-defender-atp/threat-and-vuln-mgt-event-timeline.md)
 ##### [Hunt for exposed devices](microsoft-defender-atp/tvm-hunt-exposed-devices.md)
 

windows/security/threat-protection/index.md

@@ -25,7 +25,7 @@ ms.topic: conceptual
 <center><h2>Microsoft Defender ATP</center></h2>
 <table>
 <tr>
-<td><a href="#tvm"><center><img src="images/TVM_icon.png"> <br><b>Threat & Vulnerability Management</b></center></a></td>
+<td><a href="#tvm"><center><img src="images/TVM_icon.png"> <br><b>Threat & vulnerability management</b></center></a></td>
 <td><a href="#asr"><center><img src="images/asr-icon.png"> <br><b>Attack surface reduction</b></center></a></td>
 <td><center><a href="#ngp"><img src="images/ngp-icon.png"><br> <b>Next-generation protection</b></a></center></td>
 <td><center><a href="#edr"><img src="images/edr-icon.png"><br> <b>Endpoint detection and response</b></a></center></td>
@@ -47,19 +47,14 @@ ms.topic: conceptual
 
 >[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4obJq]
 
-**[Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)**<br>
+**[Threat & vulnerability management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)**<br>
 This built-in capability uses a game-changing risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations.
 
-- [Risk-based Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)
-- [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md)
-- [What's in the dashboard and what it means for my organization](microsoft-defender-atp/tvm-dashboard-insights.md)
-- [Exposure score](microsoft-defender-atp/tvm-exposure-score.md)
-- [Microsoft Secure Score for Devices](microsoft-defender-atp/tvm-microsoft-secure-score-devices.md)
-- [Security recommendations](microsoft-defender-atp/tvm-security-recommendation.md)
-- [Remediation](microsoft-defender-atp/tvm-remediation.md)
-- [Software inventory](microsoft-defender-atp/tvm-software-inventory.md)
-- [Weaknesses](microsoft-defender-atp/tvm-weaknesses.md)
-- [Scenarios](microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md)
+- [Threat & vulnerability management overview](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)
+- [Get started](microsoft-defender-atp/tvm-prerequisites.md)
+- [Access your security posture](microsoft-defender-atp/tvm-dashboard-insights.md)
+- [Improve your security posture and reduce risk](microsoft-defender-atp/tvm-security-recommendation)
+- [Understand vulnerabilities on your devices](microsoft-defender-atp/tvm-software-inventory.md)
 
 <a name="asr"></a>
 
@@ -111,15 +106,6 @@ In conjunction with being able to quickly respond to advanced attacks, Microsoft
 
 <a name="ss"></a>
 
-**[Microsoft Secure Score for Devices](microsoft-defender-atp/tvm-microsoft-secure-score-devices.md)**<br>
-
-Microsoft Defender ATP includes a Microsoft Secure Score for Devices to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security of your organization.
-
-- [Microsoft Secure Score for Devices](microsoft-defender-atp/tvm-microsoft-secure-score-devices.md)
-- [Threat analytics](microsoft-defender-atp/threat-analytics.md)
-
-<a name="mte"></a>
-
 **[Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md)**<br>
 Microsoft Defender ATP's new managed threat hunting service provides proactive hunting, prioritization and additional context and insights that further empower Security Operation Centers (SOCs) to identify and respond to threats quickly and accurately.
 

windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md

@@ -41,45 +41,49 @@ Threat and vulnerability management is built in, real time, and cloud powered. I
 
 Vulnerability management is the first solution in the industry to bridge the gap between security administration and IT administration during remediation process. Create a security task or ticket by integrating with Microsoft Intune and Microsoft Endpoint Configuration Manager.
 
-It provides the following solutions to frequently cited gaps across security operations, security administration, and IT administration workflows and communication:
-
-- Real-time endpoint detection and response (EDR) insights correlated with endpoint vulnerabilities
-- Linked device vulnerability and security configuration assessment data in the context of exposure discovery
-- Built-in remediation processes through Microsoft Intune and Configuration Manager
-
 ### Real-time discovery
 
 To discover endpoint vulnerabilities and misconfiguration, threat and vulnerability management uses the same agentless built-in Microsoft Defender ATP sensors to reduce cumbersome network scans and IT overhead.
 
 It also provides:
 
-- Real-time device inventory. Devices onboarded to Microsoft Defender ATP automatically report and push vulnerability and security configuration data to the dashboard.
-- Visibility into software and vulnerabilities. Optics into the organization's software inventory, and software changes like installations, uninstalls, and patches. Newly discovered vulnerabilities are reported with actionable mitigation recommendations for 1st and 3rd party applications.
-- Application runtime context. Visibility on application usage patterns for better prioritization and decision-making.
-- Configuration posture. Visibility into organizational security configuration or misconfigurations. Issues are reported in the dashboard with actionable security recommendations.
+- **Real-time device inventory** - Devices onboarded to Microsoft Defender ATP automatically report and push vulnerability and security configuration data to the dashboard.
+- **Visibility into software and vulnerabilities** - Optics into the organization's software inventory, and software changes like installations, uninstalls, and patches. Newly discovered vulnerabilities are reported with actionable mitigation recommendations for 1st and 3rd party applications.
+- **Application runtime context** - Visibility on application usage patterns for better prioritization and decision-making.
+- **Configuration posture** - Visibility into organizational security configuration or misconfigurations. Issues are reported in the dashboard with actionable security recommendations.
 
 ### Intelligence-driven prioritization
 
-Threat and vulnerability management helps customers prioritize and focus on those weaknesses that pose the most urgent and the highest risk to the organization. Rather than using static prioritization by severity scores, threat and vulnerability management highlights the most critical weaknesses that need attention. It fuses security recommendations with dynamic threat and business context:
+Threat and vulnerability management helps customers prioritize and focus on the weaknesses that pose the most urgent and the highest risk to the organization. It fuses security recommendations with dynamic threat and business context:
 
-- Exposing emerging attacks in the wild. Through its advanced cyber data and threat analytics platform, threat and vulnerability management dynamically aligns the prioritization of its security recommendations. It focuses on vulnerabilities currently being exploited in the wild and emerging threats that pose the highest risk.
-- Pinpointing active breaches. Microsoft Defender ATP correlates threat and vulnerability management and EDR insights to prioritize vulnerabilities being exploited in an active breach within the organization.
-- Protecting high-value assets. Microsoft Defender ATP's integration with Azure Information Protection allows threat and vulnerability management to identify the exposed devices with business-critical applications, confidential data, or high-value users.
+- **Exposing emerging attacks in the wild** - Dynamically aligns the prioritization of security recommendations. Threat and vulnerability management focuses on vulnerabilities currently being exploited in the wild and emerging threats that pose the highest risk.
+- **Pinpointing active breaches** - Correlates threat and vulnerability management and EDR insights to prioritize vulnerabilities being exploited in an active breach within the organization.
+- **Protecting high-value assets** - Identify the exposed devices with business-critical applications, confidential data, or high-value users.
 
 ### Seamless remediation
 
-Microsoft Defender ATP's threat and vulnerability management capability allows security administrators and IT administrators to collaborate seamlessly to remediate issues.
+Threat and vulnerability management allows security administrators and IT administrators to collaborate seamlessly to remediate issues.
 
-- Remediation requests to IT. Through Microsoft Defender ATP's integration with Microsoft Intune and Microsoft Endpoint Configuration Manager, security administrators can create a remediation task in Microsoft Intune from the Security recommendation pages. We plan to expand this capability to other IT security management platforms.
-- Alternate mitigations. Threat and vulnerability management provides insights on additional mitigations, such as configuration changes that can reduce risk associated with software vulnerabilities.
-- Real-time remediation status. Microsoft Defender ATP provides real-time monitoring of the status and progress of remediation activities across the organization.
+- **Remediation requests sent to IT** - Create a remediation task in Microsoft Intune from a specific security recommendation. We plan to expand this capability to other IT security management platforms.
+- **Alternate mitigations** - Gain insights on additional mitigations, such as configuration changes that can reduce risk associated with software vulnerabilities.
+- **Real-time remediation status** - Real-time monitoring of the status and progress of remediation activities across the organization.
 
-## Reduce organizational risk with threat and vulnerability management
+## Threat and vulnerability management walk-through
 
 Watch this video for a comprehensive walk-through of threat and vulnerability management.
 
 >[!VIDEO https://aka.ms/MDATP-TVM-Interactive-Guide]
 
+## Navigation pane
+
+Area | Description
+:---|:---
+**Dashboard**   | Get a high-level view of the organization exposure score, Microsoft Secure Score for Devices, device exposure distribution, top security recommendations, top vulnerable software, top remediation activities, and top exposed device data.
+[**Security recommendations**](tvm-security-recommendation.md) | See the list of security recommendations and related threat information. When you select an item from the list, a flyout panel opens with vulnerability details, a link to open the software page, and remediation and exception options. You can also open a ticket in Intune if your devices are joined through Azure Active Directory and you've enabled your Intune connections in Microsoft Defender ATP.
+[**Remediation**](tvm-remediation.md) | See remediation activities you've created and recommendation exceptions.
+[**Software inventory**](tvm-software-inventory.md) | See the list of vulnerable software in your organization, along with weakness and threat information.
+[**Weaknesses**](tvm-weaknesses.md) | See the list of common vulnerabilities and exposures (CVEs) in your organization.
+
 ## APIs
 
 Run threat and vulnerability management-related API calls to automate vulnerability management workflows. Learn more from this [Microsoft Tech Community blog post](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/threat-amp-vulnerability-management-apis-are-now-generally/ba-p/1304615).

windows/security/threat-protection/microsoft-defender-atp/tvm-assign-device-value.md

@@ -1,7 +1,7 @@
 ---
-title: Scenarios - threat and vulnerability management
-description: Learn how threat and vulnerability management can be used to help security admins, IT admins, and SecOps collaborate.
-keywords: mdatp-tvm scenarios, mdatp, tvm, tvm scenarios, reduce threat & vulnerability exposure, reduce threat and vulnerability, improve security configuration, increase Microsoft Secure Score for Devices, increase threat & vulnerability Microsoft Secure Score for Devices, Microsoft Secure Score for Devices, exposure score, security controls 
+title: Assign device value - threat and vulnerability management
+description: Learn how to assign a low, normal, or high value to a device to help you differentiate between asset priorities.
+keywords: microsoft defender atp device value, threat and vulnerability management device value, high value devices, device value exposure score
 search.product: eADQiWindows 10XVcnh
 search.appverid: met150
 ms.prod: w10
@@ -19,7 +19,7 @@ ms.collection:
 ms.topic: article
 ---
 
-# Define a device's value to the organization
+# Assign device value - threat and vulnerability management
 
 [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
 
@@ -32,7 +32,7 @@ ms.topic: article
 
 [!include[Prerelease information](../../includes/prerelease.md)]
 
-Defining a device’s value helps you differentiate between asset priorities. The device value is used to incorporate the risk appetite of an individual asset into the threat and vulnerability management exposure score calculation. Devices marked as “high value” will receive more weight.
+Defining a device’s value helps you differentiate between asset priorities. The device value is used to incorporate the risk appetite of an individual asset into the threat and vulnerability management exposure score calculation. Devices assigned as “high value” will receive more weight.
 
 You can also use the [set device value API](set-device-value.md).
 
@@ -42,18 +42,18 @@ Device value options:
 - Normal (Default)
 - High
 
-Examples of devices that should be marked as high value:
+Examples of devices that should be assigned a high value:
 
 - Domain controllers, Active Directory
 - Internet facing devices
 - VIP devices
 - Devices hosting internal/external production services
 
-## Set device value
+## Choose device value
 
 1. Navigate to any device page, the easiest place is from the device inventory.
 
-2. Select **Device Value** from three dots next to the actions bar at the top of the page.
+2. Select **Device value** from three dots next to the actions bar at the top of the page.
     ![Example of the device value dropdown.](images/tvm-device-value-dropdown.png)
 
 <br><br>

windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md

@@ -1,5 +1,5 @@
 ---
-title: Threat and vulnerability management dashboard insights
+title: Dashboard insights - threat and vulnerability management
 description: The threat and vulnerability management dashboard can help SecOps and security admins address cybersecurity threats and build their organization's security resilience.
 keywords: mdatp-tvm, mdatp-tvm dashboard, threat & vulnerability management, threat and vulnerability management, risk-based threat & vulnerability management, security configuration, Microsoft Secure Score for Devices, exposure score    
 search.appverid: met150
@@ -18,11 +18,10 @@ ms.collection:
 - m365initiative-defender-endpoint 
 ms.topic: conceptual
 ---
-# Threat and vulnerability management dashboard insights
+# Dashboard insights - threat and vulnerability management
 
 [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
 
-
 **Applies to:**
 
 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
@@ -49,24 +48,10 @@ Watch this video for a quick overview of what is in the threat and vulnerability
 
 >[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4r1nv]
 
-## Threat and vulnerability management in Microsoft Defender Security Center
+## Threat and vulnerability management dashboard
 
  ![Microsoft Defender Advanced Threat Protection portal](images/tvm-dashboard-devices.png)
 
-You can navigate through the portal using the menu options available in all sections. Refer to the following tables for a description of each section.
-
-## Threat and vulnerability management navigation pane
-
-Area | Description
-:---|:---
-**Dashboard**   | Get a high-level view of the organization exposure score, Microsoft Secure Score for Devices, device exposure distribution, top security recommendations, top vulnerable software, top remediation activities, and top exposed device data.
-[**Security recommendations**](tvm-security-recommendation.md) | See the list of security recommendations, their related components, whether software or software versions in your network have reached end-of-support, insights, number or exposed devices, impact, and request for remediation. When you select an item from the list, a flyout panel opens with vulnerability details, a link to open the software page, and remediation and exception options. You can also open a ticket in Intune if your devices are joined through Azure Active Directory and you've enabled your Intune connections in Microsoft Defender ATP.
-[**Remediation**](tvm-remediation.md) | See the remediation activity, related component, remediation type, status, due date, option to export the remediation and process data to CSV, and active exceptions.
-[**Software inventory**](tvm-software-inventory.md) | See the list of software, versions, weaknesses, whether there's an exploit found on the software, whether the software or software version has reached end-of-support, prevalence in the organization, how many were installed, how many exposed devices there are, and the numerical value of the impact. You can select each item in the list and opt to open the software page that shows the associated vulnerabilities, misconfigurations, affected device, version distribution details, and missing KBs (security updates).
-[**Weaknesses**](tvm-weaknesses.md) | See the list of common vulnerabilities and exposures, the severity, the common vulnerability scoring system (CVSS) V3 score, related software, age, when it was published, related threat alerts, and how many exposed devices there are. You can select each item in the list to see a flyout panel with the vulnerability description and other details.
-
-## Threat and vulnerability management dashboard
-
 Area | Description
 :---|:---
 **Selected device groups (#/#)**   | Filter the threat and vulnerability management data you want to see in the dashboard and cards by device groups. What you select in the filter applies throughout the threat and vulnerability management pages.

windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md

@@ -130,5 +130,5 @@ You can report a false positive when you see any vague, inaccurate, incomplete,
 - [Exposure score](tvm-exposure-score.md)
 - [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md)
 - [Remediate vulnerabilities](tvm-remediation.md)
-- [Create and view exceptions for security recommendations](tvm-exceptions.md)
+- [Create and view exceptions for security recommendations](tvm-exception.md)
 - [Event timeline](threat-and-vuln-mgt-event-timeline.md)