diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md b/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md
index ed503a7088..a0a21d751b 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/api-portal-mapping.md
@@ -84,9 +84,9 @@ Field numbers match the numbers in the images below.
 
 ![Image of alert details pane with numbers](images/atp-siem-mapping13.png)
 
-![Image of artifact timeline with numbers](images/atp-siem-mapping3.png)
+![Image of artifact timeline with numbers1](images/atp-siem-mapping3.png)
 
-![Image of artifact timeline with numbers](images/atp-siem-mapping4.png)
+![Image of artifact timeline with numbers2](images/atp-siem-mapping4.png)
 
 ![Image machine view](images/atp-mapping6.png)