update images and steps

windows/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection.md

@@ -51,9 +51,9 @@ On Windows 10, version 1710 and above, you'll have additional control over the n
 
 3. Select the check-box if you'd like to enable Outlook and Skype communication while the machine is isolated.
 
-  [JOEY: ADD SCREENSHOT OF CONFIRMATION DIALOG BOX]
+    ![Image of isolation confirmation](images/atp-confirm-isolate.png)
 
-4. Type a comment (optional) and select **Yes** to take action on the machine.
+4. Type a comment and select **Yes, isolate machine** to take action on the machine.
   >[!NOTE]
   >The machine will remain connected to the Windows Defender ATP service even if it is isolated from the network. If you've chosen to enable Outlook and Skype for Business communication, then you'll be able to communicate to the user while the machine is isolated.
 
@@ -82,9 +82,9 @@ Depending on the severity of the attack and the state of the machine you can cho
 
     ![Image of undo isolation](images/atp-undo-isolation.png)
 
-3.	Type a comment (optional) and select **Yes** to take action on the file. The machine will be reconnected to the network.
+3.	Type a comment and select **Yes, undo machine isolation** to take action on the machine. The machine will be reconnected to the network.
 
-## Restrict applications from running
+## Restrict app execution
 In addition to the ability of containing an attack by stopping malicious processes, you can also lock down a device and prevent subsequent attempts of potentially malicious programs from running.
 
 The action to restrict an application from running applies a code integrity policy that only allows running of files that are signed by a Microsoft issued certificate. This method of restriction can help prevent an attacker from controlling compromised machines and performing further malicious activities.
@@ -99,15 +99,16 @@ The action to restrict an application from running applies a code integrity poli
   - **Machines list** - Select the machine name from the list of machines.
   - **Search box** - Select Machine from the drop-down menu and enter the machine name.
 
-2.	Open the **Actions** menu and select **Restrict application from running**. [I'LL UPDATE THE BUTTONS WHEN UI/UX WORDING IS FINALIZED]
+2.	Open the **Actions** menu and select **Restrict app execution**.
 
-  [JOEY: ADD SCREEN SHOT OF BUTTON]
+    ![Image of restrict app execution action](images/atp-restrict-app.png)
 
-3. Type a comment (optional) and select **Yes** to take action on the file.
+3. Type a comment and select **Yes, restict app execution** to take action on the file.
 
-  [JOEY: ADD SCREEN SHOT OF CONFIRMATION]
+   ![Image of app restriction notification](images/atp-notification-restrict.png)
 
   The Action center shows the submission information:
+   [NEED IMAGE HERE OF APP RESTRICTION]
 
 
   - **Submission time** - Shows when the isolation action was submitted.
@@ -116,22 +117,16 @@ The action to restrict an application from running applies a code integrity poli
 
 When the application execution restriction configuration is applied, a new event is reflected in the machine timeline.
 
-**Notification on machine user**:</br>
-When application restriction is being applied on the machine, the following notification is displayed to inform the user:
 
-  [JOEY: ADD SCREEN SHOT OF NOTIICATION]
-
-
-## Undo restriction of applications from running  
+## Undo app execution restriction 
 Depending on the severity of the attack and the state of the machine, you can choose to reverse the restriction of applications policy after you have verified that the compromised machine has been remediated.
 
 1.	Select the machine where you restricted an application from running from.
 
-2.	Open the **Actions** menu and select **Undo restriction of application from running**. [I'LL UPDATE THE BUTTONS WHEN UI/UX WORDING IS FINALIZED]
+2.	Open the **Actions** menu and select **Cancel action**. 
+  [NEED SCREENSHOT OF THIS]
 
-  [JOEY: ADD SCREEN SHOT]
-
-3.	Type a comment (optional) and select **Yes** to take action on the application. The machine application restriction will no longer apply on the machine.  
+3.	Type a comment and select **Yes** to take action on the application. The machine application restriction will no longer apply on the machine.  
 
 ## Collect investigation package from machines
 As part of the investigation or response process, you can collect an investigation package from a machine. By collecting the investigation package, you can identify the current state of the machine and further understand the tools and techniques used by the attacker.
@@ -164,8 +159,12 @@ The package contains the following folders:
 
 2.	Open the **Actions** menu and select **Collect investigation package**.
 
+    ![Image of collect investigation package action](images/atp-collect-investigation-package.png)
+
+3.  Type a comment and select **Yes, collect package** to take action on the machine.
+
     The Action center shows the submission information:
-    ![Image of investigation package in action center](images/atp-investigation-package-action-center.png)
+    ![Image of investigation package in action center](images/atp-action-center-package-collection.png)
 
     - **Submission time** - Shows when the action was submitted.
     -	**Submitting user** - Shows who submitted the action on the file. You can view the comments provided by the user by selecting the information icon.