images and event timeline

windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-event-timeline.md

@@ -30,35 +30,31 @@ ms.topic: conceptual
 
 Event timeline is a risk news feed that helps you interpret how risk is introduced into the organization through new vulnerabilities or exploits. You can view events that may impact your organization's risk. For example, you can find new vulnerabilities that were introduced, vulnerabilities that became exploitable, exploit that was added to an exploit kit, and more.
 
-Event timeline also tells the story of your [exposure score](tvm-exposure-score.md) so you can determine the cause of large changes. Reduce you exposure score by addressing what needs to be remediated based on the prioritized [security recommendations](tvm-security-recommendation.md).
+Event timeline also tells the story of your [exposure score](tvm-exposure-score.md) and [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md) so you can determine the cause of large changes. Events can impact your devices or your score for devices. Reduce you exposure by addressing what needs to be remediated based on the prioritized [security recommendations](tvm-security-recommendation.md).
 
 ## Navigate to the Event timeline page
 
-You can access Event timeline mainly through three ways:
+There are also three entry points from the [threat and vulnerability management dashboard](tvm-dashboard-insights.md):
 
-- In the threat and vulnerability management navigation menu in the Microsoft Defender Security Center
-- Top events card in the [threat and vulnerability management dashboard](tvm-dashboard-insights.md). The highest impact events (for example, affect the most devices or critical vulnerabilities)
-- Hovering over the Exposure Score graph in the threat and vulnerability management dashboard
+- **Organization exposure score card**: Hover over the event dots in the "Exposure Score over time" graph and select "See all events from this day." The events represent software vulnerabilities.
+- **Microsoft Secure Score for Devices**: Hover over the event dots in the "Your score for devices over time" graph and select "See all events from this day." The events represent new configuration assessments.
+- **Top events card**: Select "Show more" at the bottom of the top events table. The card displays the three most impactful events in the last 7 days. Impactful events can include if the event affects a large number of devices, or if it is a critical vulnerability.
 
-### Navigation menu
+### Exposure score and Microsoft Secure Score for Devices graphs
 
-Go to the threat and vulnerability management navigation menu and select **Event timeline** to view impactful events.
+In the threat and vulnerability management dashboard, hover over the Exposure score graph to view top software vulnerability events from that day that impacted your devices. Hover over the Microsoft Secure Score for Devices graph to view new security configuration assessments that affect your score.
 
-### Top events card
+If there are no events that affect your devices or your score for devices, then none will be shown.
 
-In the threat and vulnerability management dashboard, the "Top events" card displays the three most impactful events in the last 7 days. Select **Show more** to go to the Event timeline page.
+![Exposure score hover](images/tvm-event-timeline-exposure-score400.png)
 
-![Event timeline page](images/tvm-top-events-card.png)
+![Microsoft Secure Score for Devices hover](images/tvm-event-timeline-devices400.png)
 
-### Exposure score graph
-
-In the threat and vulnerability management dashboard, hover over the Exposure score graph to view top events from that day that impacted your devices. If there are no events, then none will be shown.
-
-![Event timeline page](images/tvm-event-timeline-exposure-score400.png)
+### Drill down to events from that day
 
 Selecting **Show all events from this day** takes you to the Event timeline page with a custom date range for that day.
 
-![Event timeline page](images/tvm-event-timeline-drilldown.png)
+![Event timeline selected custom date range](images/tvm-event-timeline-drilldown.png)
 
 Select **Custom range** to change the date range to another custom one, or a pre-set time range.
 
@@ -78,9 +74,6 @@ The two large numbers at the top of the page show the number of new vulnerabilit
 
 ![Event timeline page](images/tvm-event-timeline-overview-mixed-type.png)
 
->[!NOTE]
->Event type called "New configuration assessment" coming soon.
-
 ### Columns
 
 - **Date**: month, day, year
@@ -93,6 +86,7 @@ The two large numbers at the top of the page show the number of new vulnerabilit
     - Exploit was verified
     - New public exploit
     - New vulnerability
+    - New configuration assessment
 - **Score trend**: exposure score trend
 
 ### Icons