Add description of each step

Author: ConnorKirk

docs/step-2.md

@@ -1,8 +1,12 @@
 # Step 2 - Customising and extending AWS WAF Security Automations Solution
 
+In this step, you will configure the WAF Security Automation Solution. Once you have configured the HTTP Flood Protection and Probe/Scanner Log Parser, you will test the new rules.
 
 ## 2.1.1 Customise HTTP Flood Protection (AWS Lambda Log Parser)
 
+The HTTP Flood protection provided by the Security Automation Solution can be configured. In this step, you will explore the possible configuration options.
+
+
 The HTTP Flood log parser comes with some extensions points, they are:
 
 * Request Threshold: the maximum acceptable requests per five minutes per IP address.
@@ -13,7 +17,9 @@ The HTTP Flood log parser comes with some extensions points, they are:
 The goal now is to apply customizations and check how it affects the log parser behavior. 
 
 
-### 2.1.2 Customising the Parser
+### 2.1.2 Customising the HTTP Log Parser
+
+In this step you will edit the configuration file for the HTTP Log parser. This configuration is used by the Lambda Log Parser when processing log files.
 
 * Go to the S3 bucket used for WAF Logs Bucket. To check it's name, go to stack's Outputs tab and search for the value defined for WafLogBucket;
 * Download the configuration file `<stack_name>-waf_log_conf.json`;
@@ -62,8 +68,10 @@ curl -s -o /dev/null -w "Return Code: %{http_code}\n" <your-endpoint>
 
 
 
-Now we will customise our Scanner and Probe rules. These use Amazon Athena.
-The solutions refer to the Athena by a saved query ID. As Athena don't allow you to change saved queries, the process to apply customizations to Athena query is by creating a new query and updating the Athena log parser event to use the new query ID.
+Now you will customise our Scanner and Probe rules. These use Amazon Athena to query the logs generated by an application.
+The solutions refer to Athena by a saved query ID. As Athena don't allow you to change saved queries, the process to apply customizations to Athena query is by creating a new query and updating the Athena log parser event to use the new query ID.
+
+By customising the query performed by Athena, you can specify the rules for blocking scanners and probes.
 
 ### 2.2.1
 * Navigate to the Amazon Athena console, select the Saved Queries tab;