diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md
index f5a74dfff8..e2fa73f5c7 100644
--- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md
+++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md
@@ -154,14 +154,14 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt
 
 |**Allowed traffic endpoints** | 
 | --- | 
-|ctldl.windowsupdate.com|
+|activation-v2.sls.microsoft.com/*|
 |cdn.onenote.net|
+|client.wns.windows.com|
+|crl.microsoft.com/pki/crl/*|
+|ctldl.windowsupdate.com|
+|dm3p.wns.windows.com|
+|\*microsoft.com/pkiops/\*|
+|ocsp.digicert.com/*|
 |r.manage.microsoft.com|
 |tile-service.weather.microsoft.com|
 |settings-win.data.microsoft.com|
-|client.wns.windows.com|
-|dm3p.wns.windows.com|
-|crl.microsoft.com/pki/crl/*|
-|*microsoft.com/pkiops/**|
-|activation-v2.sls.microsoft.com/*|
-|ocsp.digicert.com/*|
diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md
index a82f47f963..9180ed1db4 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-filecreationevents-table.md
@@ -59,6 +59,13 @@ For information on other tables in the Advanced hunting schema, see  [the Advanc
 | InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event |
 | InitiatingProcessParentFileName | string | Name of the parent process that spawned the process responsible for the event |
 | InitiatingProcessParentCreationTime | datetime | Date and time when the parent of the process responsible for the event was started |
+| RequestProtocol | string | Network protocol, if applicable, used to initiate the activity: Unknown, Local, SMB, or NFS |
+| ShareName | string | Name of shared folder containing the file |
+| RequestSourceIP | string | IPv4 or IPv6 address of the remote device that initiated the activity |
+| RequestSourcePort | string | Source port on the remote device that initiated the activity |
+| RequestAccountName | string | User name of account used to remotely initiate the activity |
+| RequestAccountDomain | string | Domain of the account used to remotely initiate the activity |
+| RequestAccountSid | string | Security Identifier (SID) of the account to remotely initiate the activity |
 | ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns |
 | AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
 | SensitivityLabel | string | Label applied to an email, file, or other content to classify it for information protection |