diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md
index 307b13fd20..93e5640492 100644
--- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md
+++ b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md
@@ -53,8 +53,8 @@ To review apps that would have been blocked, open Event Viewer and filter for Ev
 | Event ID | Description |
 |----------|-------------|
 |5007      | Event when settings are changed |
-| 1121     | Event when an attack surface reduction rule fires in audit mode |
-| 1122     | Event when an attack surface reduction rule fires in block mode |
+| 1121     | Event when an attack surface reduction rule fires in block mode |
+| 1122     | Event when an attack surface reduction rule fires in audit mode |
 
 ## Customize attack surface reduction rules