diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md
index 3f018f31f7..8ffcfaf3cd 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md
@@ -53,17 +53,11 @@ You can query Windows Defender ATP data by using [Advanced hunting](https://docs
 
 You can review the Windows event log to see events that are created when network protection blocks (or audits) access to a malicious IP or domain:
 
-1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the file *np-events.xml* to an easily accessible location on the machine.
+1.  [Copy the XML directly](event-views-exploit-guard.md).
 
-1. Type **Event viewer** in the Start menu to open the Windows Event Viewer.
+2. Click **OK**.
 
-2. On the left panel, under **Actions**, click **Import custom view...**
- 
-3. Navigate to the Exploit Guard Evaluation Package, and select the file *np-events.xml*. Alternatively, [copy the XML directly](event-views-exploit-guard.md).
-
-4. Click **OK**.
-
-5. This will create a custom view that filters to only show the following events related to network protection:
+3. This will create a custom view that filters to only show the following events related to network protection:
 
  Event ID | Description
 -|-