diff --git a/windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md b/windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md
index 6a96701a1a..cb99281b6b 100644
--- a/windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md
+++ b/windows/keep-secure/experiment-custom-ti-windows-defender-advanced-threat-protection.md
@@ -49,6 +49,8 @@ This step will guide you in creating an alert definition and an IOC for a malici
 
 3. Run the script and verify that the operation succeeded in the results the window. Wait up to 20 minutes until the new or updated alert definition propagates to the detection engines.
 
+  ![Image of the script running](images/atp-running-script.png)
+
   >[!NOTE]
   >If you get the exception “The remote server returned an error: (407) >Proxy Authentication Required", you need to add the proxy configuration by adding the following code to the PowerShell script: