diff --git a/Application Insights.md b/Application Insights.md
deleted file mode 100644
index 2d75aee..0000000
--- a/Application Insights.md
+++ /dev/null
@@ -1,6 +0,0 @@
-## Application Insights examples
-
-##### [Find exceptions that failed requests](~/examples/Application Insights/Find exceptions that failed requests.md)
-##### [Percentiles of request duration](~/examples/Application Insights/Percentiles of request duration in the last 24 hours.md)
-##### [Top 10 custom events](~/examples/Application Insights/Top 10 custom events.md)
-##### [Top 10 countries by traffic](~/examples/Application Insights/Pie chart the top 10 countries by traffic.md)
\ No newline at end of file
diff --git a/Command Usage.md b/Command Usage.md
deleted file mode 100644
index 3255a97..0000000
--- a/Command Usage.md
+++ /dev/null
@@ -1,7 +0,0 @@
-## Command usage examples
-
-##### [Bar chart unstacked](~/examples/Command usage/Bar chart unstacked.md)
-##### [Pie chart top 10 items](~/examples/Command usage/Pie chart top 10 items.md)
-##### [Calculate multiple percentiles timechart](~/examples/Command usage/Calculate multiple percentiles timechart.md)
-##### [Join kind - inner](~/examples/Command usage/Join kind - inner.md)
-##### [Join - match on two fields](~/examples/Command usage/Join on two field matches.md)
\ No newline at end of file
diff --git a/Log Analytics.md b/Log Analytics.md
deleted file mode 100644
index 585737c..0000000
--- a/Log Analytics.md
+++ /dev/null
@@ -1,56 +0,0 @@
-## Log Analytics examples
-
-
-### Across all data types
-##### [Chart the record-count per table in the last 5 hours](~/examples/Log Analytics/Chart the record-count per table in the last 5 hours.md)
-##### [Count all logs collected over the last hour, per type](~/examples/Log Analytics/Count all logs collected over the last hour per type.md)
-
-### AzureDiagnostics
-##### [Count Azure diagnostics records per category](~/examples/Log Analytics/Count Azure diagnostics records per category.md)
-##### [Get a random record for each unique category](~/examples/Log Analytics/Get a random record for each unique category.md)
-##### [Get the latest record per category](~/examples/Log Analytics/Get the latest record per category.md)
-
-### Usage
-##### [Calculate the average size of perf usage reports per computer](~/examples/Log Analytics/Calculate the average size of perf usage reports per computer.md)
-##### [Timechart latency percentiles 50 and 95](~/examples/Log Analytics/Timechart latency percentiles 50 and 95.md)
-##### [Usage of computer today](~/examples/Log Analytics/Usage of computers today.md)
-
-### Heartbeat
-##### [Chart a week-over-week view of the number of computers sending data](~/examples/Log Analytics/Chart a week-over-week view of the number of computers sending data.md)
-##### [Find stale computers](~/examples/Log Analytics/Find stale computers.md)
-##### [Get latest heartbeat record per computer IP](~/examples/Log Analytics/Get latest heartbeat record per computer IP.md)
-##### [Match protection and heartbeat records](~/examples/Log Analytics/Match protection status records with heartbeat records.md)
-##### [Calculate availability rate for connected servers](~/examples/Log Analytics/Server availability rate.md)
-
-### Updates
-##### [Computers still missing updates](~/examples/Log Analytics/Computers still missing updates.md)
-
-### ProtectionStatus
-##### [Computers with non-reporting protection status duration](~/examples/Log Analytics/Computers with non-reporting protection status duration.md)
-##### [Match protection and heartbeat records](~/examples/Log Analytics/Match protection status records with heartbeat records.md)
-
-### NetworkMonitoring
-##### [Computers with unhealthy latency](~/examples/Log Analytics/Computers with unhealthy latency.md)
-
-### Perf
-##### [Correlate computer memory and CPU](~/examples/Log Analytics/Correlate computer memory and cpu.md)
-##### [Perf CPU Utilization graph per computer](~/examples/Log Analytics/Perf CPU Utilization graph per computer.md)
-
-### Alert
-##### [Count alerts by severity per day](~/examples/Log Analytics/Count and chart alerts severity per day.md)
-##### [Get a numbered list of the latest alerts](~/examples/Log Analytics/Get a numbered list of the latest alerts.md)
-
-### SecurityEvent
-##### [Count security events by activity ID](~/examples/Log Analytics/Count security events by activity ID.md)
-##### [Count security events related to permissions](~/examples/Log Analytics/Count security events related to permissions.md)
-##### [Find accounts that failed to logon from computers on which we identify a security detection](~/examples/Log Analytics/Find accounts that failed to logon from computers on which we identify a security detection.md)
-##### [Is my security data available](~/examples/Log Analytics/Is my security data available.md)
-##### [Parse activity name and ID](~/examples/Log Analytics/Parse activity name and ID.md)
-##### [Processes that used explicit credentials](~/examples/Log Analytics/Pie chart explicit credentials processes.md)
-##### [Top 5 running processes in the last 3 days](~/examples/Log Analytics/Top 5 running processes in the last 3 days.md)
-##### [Find repeating failed login attempts by the same account from different IPs](~/examples/Log Analytics/Find repeating failed login attempts by the same account from different IPs.md)
-##### [Find user accounts that failed to login over 5 time in 1 day](~/examples/Log Analytics/Find user accounts that failed to login over 5 time in 1 day.md)
-
-### Event
-##### [Search application-level events described as Cryptographic](~/examples/Log Analytics/Search application-level events described as Cryptographic.md)
-##### [Search events related to unmarshaling](~/examples/Log Analytics/Search events related to unmarshaling.md)
diff --git a/Smart Analytics.md b/Smart Analytics.md
deleted file mode 100644
index aeebd76..0000000
--- a/Smart Analytics.md
+++ /dev/null
@@ -1,6 +0,0 @@
-## Smart Analytics - analyze application usage patterns
-
-##### [Detect disruptions with regression analysis](~/examples/Smart Analytics/automated detector for service disruptions based on app trace logs.md)
-##### [Rolling monthly active users (MAU)](~/examples/Smart Analytics/sliding window calculations - rolling MAU.md)
-##### [Measure "user stickiness"](~/examples/Smart Analytics/sliding window calculations - user stickiness.md)
-##### [Cohort analysis](~/examples/Smart Analytics/sliding window calculations - cohort analysis.md)
diff --git a/application-insights.md b/application-insights.md
new file mode 100644
index 0000000..fd67c59
--- /dev/null
+++ b/application-insights.md
@@ -0,0 +1,6 @@
+## Application Insights examples
+
+##### [Find exceptions that failed requests](~/examples/application-insights/find-exceptions-that-failed-requests.md)
+##### [Percentiles of request duration](~/examples/application-insights/percentiles-of-request-duration-in-the-last-24-hours.md)
+##### [Top 10 custom events](~/examples/application-insights/top-10-custom-events.md)
+##### [Top 10 countries by traffic](~/examples/application-insights/pie-chart-the-top-10-countries-by-traffic.md)
\ No newline at end of file
diff --git a/Application Insights/Find exceptions that failed requests.md b/application-insights/find-exceptions-that-failed-requests.md
similarity index 100%
rename from Application Insights/Find exceptions that failed requests.md
rename to application-insights/find-exceptions-that-failed-requests.md
diff --git a/Application Insights/Percentiles of request duration in the last 24 hours.md b/application-insights/percentiles-of-request-duration-in-the-last-24-hours.md
similarity index 100%
rename from Application Insights/Percentiles of request duration in the last 24 hours.md
rename to application-insights/percentiles-of-request-duration-in-the-last-24-hours.md
diff --git a/Application Insights/Pie chart the top 10 countries by traffic.md b/application-insights/pie-chart-the-top-10-countries-by-traffic.md
similarity index 88%
rename from Application Insights/Pie chart the top 10 countries by traffic.md
rename to application-insights/pie-chart-the-top-10-countries-by-traffic.md
index f7a283a..a3c05a4 100644
--- a/Application Insights/Pie chart the top 10 countries by traffic.md
+++ b/application-insights/pie-chart-the-top-10-countries-by-traffic.md
@@ -13,4 +13,4 @@ requests
```
The output will look like this:
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/Application Insights/Top 10 custom events.md b/application-insights/top-10-custom-events.md
similarity index 90%
rename from Application Insights/Top 10 custom events.md
rename to application-insights/top-10-custom-events.md
index a085522..4ae2d35 100644
--- a/Application Insights/Top 10 custom events.md
+++ b/application-insights/top-10-custom-events.md
@@ -14,4 +14,4 @@ customEvents
```
The output will look like this:
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/command-usage.md b/command-usage.md
new file mode 100644
index 0000000..df40bb9
--- /dev/null
+++ b/command-usage.md
@@ -0,0 +1,7 @@
+## Command usage examples
+
+##### [Bar chart unstacked](~/examples/command-usage/bar-chart-unstacked.md)
+##### [Pie chart top 10 items](~/examples/command-usage/pie-chart-top-10-items.md)
+##### [Calculate multiple percentiles timechart](~/examples/command-usage/calculate-multiple-percentiles-timechart.md)
+##### [Join kind - inner](~/examples/command-usage/join-kind-inner.md)
+##### [Join - match on two fields](~/examples/command-usage/join-on-two-field-matches.md)
\ No newline at end of file
diff --git a/Command usage/Bar chart unstacked.md b/command-usage/bar-chart-unstacked.md
similarity index 100%
rename from Command usage/Bar chart unstacked.md
rename to command-usage/bar-chart-unstacked.md
diff --git a/Command usage/Calculate multiple percentiles timechart.md b/command-usage/calculate-multiple-percentiles-timechart.md
similarity index 100%
rename from Command usage/Calculate multiple percentiles timechart.md
rename to command-usage/calculate-multiple-percentiles-timechart.md
diff --git a/Command usage/Join kind - inner.md b/command-usage/join-kind-inner.md
similarity index 100%
rename from Command usage/Join kind - inner.md
rename to command-usage/join-kind-inner.md
diff --git a/Command usage/Join on two field matches.md b/command-usage/join-on-two-field-matches.md
similarity index 100%
rename from Command usage/Join on two field matches.md
rename to command-usage/join-on-two-field-matches.md
diff --git a/Command usage/Pie chart top 10 items.md b/command-usage/pie-chart-top-10-items.md
similarity index 88%
rename from Command usage/Pie chart top 10 items.md
rename to command-usage/pie-chart-top-10-items.md
index 68edec5..6280fae 100644
--- a/Command usage/Pie chart top 10 items.md
+++ b/command-usage/pie-chart-top-10-items.md
@@ -13,4 +13,4 @@ requests
```
The output will look like this:
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/GitHub Repo.md b/github-repo.md
similarity index 100%
rename from GitHub Repo.md
rename to github-repo.md
diff --git a/images/availability_hours.png b/images/availability-hours.png
similarity index 100%
rename from images/availability_hours.png
rename to images/availability-hours.png
diff --git a/images/availability_rate.png b/images/availability-rate.png
similarity index 100%
rename from images/availability_rate.png
rename to images/availability-rate.png
diff --git a/images/rolling_mau.png b/images/rolling-mau.png
similarity index 100%
rename from images/rolling_mau.png
rename to images/rolling-mau.png
diff --git a/images/top_10_countries_by_traffic.png b/images/top-10-countries-by-traffic.png
similarity index 100%
rename from images/top_10_countries_by_traffic.png
rename to images/top-10-countries-by-traffic.png
diff --git a/images/top_10_custom_events.png b/images/top-10-custom-events.png
similarity index 100%
rename from images/top_10_custom_events.png
rename to images/top-10-custom-events.png
diff --git a/images/user_stickiness.png b/images/user-stickiness.png
similarity index 100%
rename from images/user_stickiness.png
rename to images/user-stickiness.png
diff --git a/log-analytics.md b/log-analytics.md
new file mode 100644
index 0000000..2043def
--- /dev/null
+++ b/log-analytics.md
@@ -0,0 +1,56 @@
+## Log Analytics examples
+
+
+### Across all data types
+##### [Chart the record-count per table in the last 5 hours](~/examples/log-analytics/chart-the-record-count-per-table-in-the-last-5-hours.md)
+##### [Count all logs collected over the last hour, per type](~/examples/log-analytics/count-all-logs-collected-over-the-last-hour-per-type.md)
+
+### AzureDiagnostics
+##### [Count Azure diagnostics records per category](~/examples/log-analytics/count-azure-diagnostics-records-per-category.md)
+##### [Get a random record for each unique category](~/examples/log-analytics/get-a-random-record-for-each-unique-category.md)
+##### [Get the latest record per category](~/examples/log-analytics/get-the-latest-record-per-category.md)
+
+### Usage
+##### [Calculate the average size of perf usage reports per computer](~/examples/log-analytics/calculate-the-average-size-of-perf-usage-reports-per-computer.md)
+##### [Timechart latency percentiles 50 and 95](~/examples/log-analytics/timechart-latency-percentiles-50-and-95.md)
+##### [Usage of computer today](~/examples/log-analytics/usage-of-computers-today.md)
+
+### Heartbeat
+##### [Chart a week-over-week view of the number of computers sending data](~/examples/log-analytics/chart-a-week-over-week-view-of-the-number-of-computers-sending-data.md)
+##### [Find stale computers](~/examples/log-analytics/find-stale-computers.md)
+##### [Get the latest heartbeat record per computer IP](~/examples/log-analytics/get-latest-heartbeat-record-per-computer-ip.md)
+##### [Match protection and heartbeat records](~/examples/log-analytics/Match protection status records with heartbeat records.md)
+##### [Calculate availability rate for connected servers](~/examples/log-analytics/server-availability-rate.md)
+
+### Updates
+##### [Computers still missing updates](~/examples/log-analytics/computers-still-missing-updates.md)
+
+### ProtectionStatus
+##### [Computers with non-reporting protection status duration](~/examples/log-analytics/computers-with-non-reporting-protection-status-duration.md)
+##### [Match protection and heartbeat records](~/examples/log-analytics/match-protection-status-records-with-heartbeat-records.md)
+
+### NetworkMonitoring
+##### [Computers with unhealthy latency](~/examples/log-analytics/computers-with-unhealthy-latency.md)
+
+### Perf
+##### [Correlate computer memory and CPU](~/examples/log-analytics/correlate-computer-memory-and-cpu.md)
+##### [Perf CPU Utilization graph per computer](~/examples/log-analytics/perf-cpu-utilization-graph-per-computer.md)
+
+### Alert
+##### [Count alerts by severity per day](~/examples/log-analytics/count-and-chart-alerts-severity-per-day.md)
+##### [Get a numbered list of the latest alerts](~/examples/log-analytics/get-a-numbered-list-of-the-latest-alerts.md)
+
+### SecurityEvent
+##### [Count security events by activity ID](~/examples/log-analytics/count-security-events-by-activity-id.md)
+##### [Count security events related to permissions](~/examples/log-analytics/count-security-events-related-to-permissions.md)
+##### [Find accounts that failed to logon from computers on which we identify a security detection](~/examples/log-analytics/find-accounts-that-failed-to-logon-from-computers-on-which-we-identify-a-security-detection.md)
+##### [Is my security data available](~/examples/log-analytics/is-my-security-data-available.md)
+##### [Parse activity name and ID](~/examples/log-analytics/parse-activity-name-and-id.md)
+##### [Processes that used explicit credentials](~/examples/log-analytics/pie-chart-explicit-credentials-processes.md)
+##### [Top 5 running processes in the last 3 days](~/examples/log-analytics/top-5-running-processes-in-the-last-3-days.md)
+##### [Find repeating failed login attempts by the same account from different IPs](~/examples/log-analytics/find-repeating-failed-login-attempts-by-the-same-account-from-different-ips.md)
+##### [Find user accounts that failed to login over 5 times in 1 day](~/examples/log-analytics/find-user-accounts-that-failed-to-login-over-5-times-in-1-day.md)
+
+### Event
+##### [Search application-level events described as Cryptographic](~/examples/log-analytics/search-application-level-events-described-as-cryptographic.md)
+##### [Search events related to unmarshaling](~/examples/log-analytics/search-events-related-to-unmarshaling.md)
diff --git a/Log Analytics/Calculate the average size of perf usage reports per computer.md b/log-analytics/calculate-the-average-size-of-perf-usage-reports-per-computer.md
similarity index 100%
rename from Log Analytics/Calculate the average size of perf usage reports per computer.md
rename to log-analytics/calculate-the-average-size-of-perf-usage-reports-per-computer.md
diff --git a/Log Analytics/Chart a week-over-week view of the number of computers sending data.md b/log-analytics/chart-a-week-over-week-view-of-the-number-of-computers-sending-data.md
similarity index 100%
rename from Log Analytics/Chart a week-over-week view of the number of computers sending data.md
rename to log-analytics/chart-a-week-over-week-view-of-the-number-of-computers-sending-data.md
diff --git a/Log Analytics/Chart the record-count per table in the last 5 hours.md b/log-analytics/chart-the-record-count-per-table-in-the-last-5-hours.md
similarity index 100%
rename from Log Analytics/Chart the record-count per table in the last 5 hours.md
rename to log-analytics/chart-the-record-count-per-table-in-the-last-5-hours.md
diff --git a/Log Analytics/Computers still missing updates.md b/log-analytics/computers-still-missing-updates.md
similarity index 100%
rename from Log Analytics/Computers still missing updates.md
rename to log-analytics/computers-still-missing-updates.md
diff --git a/Log Analytics/Computers with non-reporting protection status duration.md b/log-analytics/computers-with-non-reporting-protection-status-duration.md
similarity index 100%
rename from Log Analytics/Computers with non-reporting protection status duration.md
rename to log-analytics/computers-with-non-reporting-protection-status-duration.md
diff --git a/Log Analytics/Computers with unhealthy latency.md b/log-analytics/computers-with-unhealthy-latency.md
similarity index 100%
rename from Log Analytics/Computers with unhealthy latency.md
rename to log-analytics/computers-with-unhealthy-latency.md
diff --git a/Log Analytics/Correlate computer memory and cpu.md b/log-analytics/correlate-computer-memory-and-cpu.md
similarity index 100%
rename from Log Analytics/Correlate computer memory and cpu.md
rename to log-analytics/correlate-computer-memory-and-cpu.md
diff --git a/Log Analytics/Count all logs collected over the last hour per type.md b/log-analytics/count-all-logs-collected-over-the-last-hour-per-type.md
similarity index 100%
rename from Log Analytics/Count all logs collected over the last hour per type.md
rename to log-analytics/count-all-logs-collected-over-the-last-hour-per-type.md
diff --git a/Log Analytics/Count and chart alerts severity per day.md b/log-analytics/count-and-chart-alerts-severity-per-day.md
similarity index 100%
rename from Log Analytics/Count and chart alerts severity per day.md
rename to log-analytics/count-and-chart-alerts-severity-per-day.md
diff --git a/Log Analytics/Count Azure diagnostics records per category.md b/log-analytics/count-azure-diagnostics-records-per-category.md
similarity index 100%
rename from Log Analytics/Count Azure diagnostics records per category.md
rename to log-analytics/count-azure-diagnostics-records-per-category.md
diff --git a/Log Analytics/Count security events by activity ID.md b/log-analytics/count-security-events-by-activity-id.md
similarity index 100%
rename from Log Analytics/Count security events by activity ID.md
rename to log-analytics/count-security-events-by-activity-id.md
diff --git a/Log Analytics/Count security events related to permissions.md b/log-analytics/count-security-events-related-to-permissions.md
similarity index 100%
rename from Log Analytics/Count security events related to permissions.md
rename to log-analytics/count-security-events-related-to-permissions.md
diff --git a/Log Analytics/Find accounts that failed to logon from computers on which we identify a security detection.md b/log-analytics/find-accounts-that-failed-to-logon-from-computers-on-which-we-identify-a-security-detection.md
similarity index 100%
rename from Log Analytics/Find accounts that failed to logon from computers on which we identify a security detection.md
rename to log-analytics/find-accounts-that-failed-to-logon-from-computers-on-which-we-identify-a-security-detection.md
diff --git a/Log Analytics/Find repeating failed login attempts by the same account from different IPs.md b/log-analytics/find-repeating-failed-login-attempts-by-the-same-account-from-different-ips.md
similarity index 100%
rename from Log Analytics/Find repeating failed login attempts by the same account from different IPs.md
rename to log-analytics/find-repeating-failed-login-attempts-by-the-same-account-from-different-ips.md
diff --git a/Log Analytics/Find stale computers.md b/log-analytics/find-stale-computers.md
similarity index 100%
rename from Log Analytics/Find stale computers.md
rename to log-analytics/find-stale-computers.md
diff --git a/Log Analytics/Find user accounts that failed to login over 5 time in 1 day.md b/log-analytics/find-user-accounts-that-failed-to-login-over-5-times-in-1-day.md
similarity index 95%
rename from Log Analytics/Find user accounts that failed to login over 5 time in 1 day.md
rename to log-analytics/find-user-accounts-that-failed-to-login-over-5-times-in-1-day.md
index 7845a97..362c834 100644
--- a/Log Analytics/Find user accounts that failed to login over 5 time in 1 day.md
+++ b/log-analytics/find-user-accounts-that-failed-to-login-over-5-times-in-1-day.md
@@ -1,4 +1,4 @@
-## Find user accounts that failed to login over 5 time in 1 day
+## Find user accounts that failed to login over 5 times in 1 day
#### #let #join #project-away
diff --git a/Log Analytics/Get a numbered list of the latest alerts.md b/log-analytics/get-a-numbered-list-of-the-latest-alerts.md
similarity index 100%
rename from Log Analytics/Get a numbered list of the latest alerts.md
rename to log-analytics/get-a-numbered-list-of-the-latest-alerts.md
diff --git a/Log Analytics/Get a random record for each unique category.md b/log-analytics/get-a-random-record-for-each-unique-category.md
similarity index 100%
rename from Log Analytics/Get a random record for each unique category.md
rename to log-analytics/get-a-random-record-for-each-unique-category.md
diff --git a/Log Analytics/Get latest heartbeat record per computer IP.md b/log-analytics/get-latest-heartbeat-record-per-computer-ip.md
similarity index 79%
rename from Log Analytics/Get latest heartbeat record per computer IP.md
rename to log-analytics/get-latest-heartbeat-record-per-computer-ip.md
index 20710f8..ef6a499 100644
--- a/Log Analytics/Get latest heartbeat record per computer IP.md
+++ b/log-analytics/get-latest-heartbeat-record-per-computer-ip.md
@@ -1,4 +1,4 @@
-## Get latest heartbeat record per computer IP
+## Get the latest heartbeat record per computer IP
#### #arg_max
diff --git a/Log Analytics/Get the latest record per category.md b/log-analytics/get-the-latest-record-per-category.md
similarity index 100%
rename from Log Analytics/Get the latest record per category.md
rename to log-analytics/get-the-latest-record-per-category.md
diff --git a/Log Analytics/Is my security data available.md b/log-analytics/is-my-security-data-available.md
similarity index 100%
rename from Log Analytics/Is my security data available.md
rename to log-analytics/is-my-security-data-available.md
diff --git a/Log Analytics/Match protection status records with heartbeat records.md b/log-analytics/match-protection-status-records-with-heartbeat-records.md
similarity index 100%
rename from Log Analytics/Match protection status records with heartbeat records.md
rename to log-analytics/match-protection-status-records-with-heartbeat-records.md
diff --git a/Log Analytics/Parse activity name and ID.md b/log-analytics/parse-activity-name-and-id.md
similarity index 100%
rename from Log Analytics/Parse activity name and ID.md
rename to log-analytics/parse-activity-name-and-id.md
diff --git a/Log Analytics/Perf CPU Utilization graph per computer.md b/log-analytics/perf-cpu-utilization-graph-per-computer.md
similarity index 100%
rename from Log Analytics/Perf CPU Utilization graph per computer.md
rename to log-analytics/perf-cpu-utilization-graph-per-computer.md
diff --git a/Log Analytics/Pie chart explicit credentials processes.md b/log-analytics/pie-chart-explicit-credentials-processes.md
similarity index 100%
rename from Log Analytics/Pie chart explicit credentials processes.md
rename to log-analytics/pie-chart-explicit-credentials-processes.md
diff --git a/Log Analytics/Search application-level events described as Cryptographic.md b/log-analytics/search-application-level-events-described-as-cryptographic.md
similarity index 100%
rename from Log Analytics/Search application-level events described as Cryptographic.md
rename to log-analytics/search-application-level-events-described-as-cryptographic.md
diff --git a/Log Analytics/Search events related to unmarshaling.md b/log-analytics/search-events-related-to-unmarshaling.md
similarity index 100%
rename from Log Analytics/Search events related to unmarshaling.md
rename to log-analytics/search-events-related-to-unmarshaling.md
diff --git a/Log Analytics/Server availability rate.md b/log-analytics/server-availability-rate.md
similarity index 95%
rename from Log Analytics/Server availability rate.md
rename to log-analytics/server-availability-rate.md
index 8fec59f..928d08a 100644
--- a/Log Analytics/Server availability rate.md
+++ b/log-analytics/server-availability-rate.md
@@ -44,7 +44,7 @@ Note that this way we give a little leeway for missing heartbeat reports each ho
Instead of expecting a report every 5 or 10 minutes, we only mark a computer as "unavailable" if we didn't get any report from it during a full hour.
At this point we get a number for each computer, something like this:
-
+
So we know the number of hours each computer was available during the set time range. But what does it mean? how many hours were there altogether?
@@ -61,5 +61,5 @@ Finally we calculate the ratio between available hours and total hours:
```
and get this:
-
+
diff --git a/Log Analytics/Timechart latency percentiles 50 and 95.md b/log-analytics/timechart-latency-percentiles-50-and-95.md
similarity index 100%
rename from Log Analytics/Timechart latency percentiles 50 and 95.md
rename to log-analytics/timechart-latency-percentiles-50-and-95.md
diff --git a/Log Analytics/Top 5 running processes in the last 3 days.md b/log-analytics/top-5-running-processes-in-the-last-3-days.md
similarity index 100%
rename from Log Analytics/Top 5 running processes in the last 3 days.md
rename to log-analytics/top-5-running-processes-in-the-last-3-days.md
diff --git a/Log Analytics/Usage of computers today.md b/log-analytics/usage-of-computers-today.md
similarity index 100%
rename from Log Analytics/Usage of computers today.md
rename to log-analytics/usage-of-computers-today.md
diff --git a/smart-analytics.md b/smart-analytics.md
new file mode 100644
index 0000000..729204a
--- /dev/null
+++ b/smart-analytics.md
@@ -0,0 +1,6 @@
+## Smart Analytics - analyze application usage patterns
+
+##### [Detect disruptions with regression analysis](~/examples/smart-analytics/automated-detector-for-service-disruptions-based-on-app-trace-logs.md)
+##### [Rolling monthly active users (MAU)](~/examples/smart-analytics/sliding-window-calculations-rolling-mau.md)
+##### [Measure "user stickiness"](~/examples/smart-analytics/sliding-window-calculations-user-stickiness.md)
+##### [Cohort analysis](~/examples/smart-analytics/sliding-window-calculations-cohort-analysis.md)
diff --git a/Smart Analytics/automated detector for service disruptions based on app trace logs.md b/smart-analytics/automated-detector-for-service-disruptions-based-on-app-trace-logs.md
similarity index 100%
rename from Smart Analytics/automated detector for service disruptions based on app trace logs.md
rename to smart-analytics/automated-detector-for-service-disruptions-based-on-app-trace-logs.md
diff --git a/Smart Analytics/sliding window calculations - cohort analysis.md b/smart-analytics/sliding-window-calculations-cohort-analysis.md
similarity index 100%
rename from Smart Analytics/sliding window calculations - cohort analysis.md
rename to smart-analytics/sliding-window-calculations-cohort-analysis.md
diff --git a/Smart Analytics/sliding window calculations - rolling MAU.md b/smart-analytics/sliding-window-calculations-rolling-mau.md
similarity index 97%
rename from Smart Analytics/sliding window calculations - rolling MAU.md
rename to smart-analytics/sliding-window-calculations-rolling-mau.md
index 7b0104c..3b039fd 100644
--- a/Smart Analytics/sliding window calculations - rolling MAU.md
+++ b/smart-analytics/sliding-window-calculations-rolling-mau.md
@@ -60,4 +60,4 @@ customEvents
```
The output will look like this:
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/Smart Analytics/sliding window calculations - user stickiness.md b/smart-analytics/sliding-window-calculations-user-stickiness.md
similarity index 97%
rename from Smart Analytics/sliding window calculations - user stickiness.md
rename to smart-analytics/sliding-window-calculations-user-stickiness.md
index a1a50e7..3a13eda 100644
--- a/Smart Analytics/sliding window calculations - user stickiness.md
+++ b/smart-analytics/sliding-window-calculations-user-stickiness.md
@@ -50,4 +50,4 @@ on Timestamp
```
The output will look like this:
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/toc.md b/toc.md
index c26ba78..aa92866 100644
--- a/toc.md
+++ b/toc.md
@@ -1,5 +1,5 @@
-# [Log Analytics Examples](~/examples/Log Analytics.md)
-# [Application Insights Examples](~/examples/Application Insights.md)
-# [Command Usage](~/examples/Command Usage.md)
-# [Smart Analytics](~/examples/Smart Analytics.md)
-# [Examples GitHub repo](~/examples/GitHub Repo.md)
\ No newline at end of file
+# [Log Analytics Examples](~/examples/log-analytics.md)
+# [Application Insights Examples](~/examples/application-insights.md)
+# [Command Usage](~/examples/command-usage.md)
+# [Smart Analytics](~/examples/smart-analytics.md)
+# [Examples GitHub repo](~/examples/github-repo.md)
\ No newline at end of file