diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md
index fdfc93411b..1ec6b4c431 100644
--- a/windows/security/threat-protection/TOC.md
+++ b/windows/security/threat-protection/TOC.md
@@ -34,6 +34,7 @@
 #### [Configure server endpoints](windows-defender-atp\configure-server-endpoints-windows-defender-advanced-threat-protection.md)
 #### [Configure non-Windows endpoints](windows-defender-atp\configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
 #### [Run a detection test on a newly onboarded endpoint](windows-defender-atp\run-detection-test-windows-defender-advanced-threat-protection.md)
+#### [Run simulated attacks](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md)
 #### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md)
 #### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
 ### [Understand the Windows Defender ATP portal](windows-defender-atp\use-windows-defender-advanced-threat-protection.md)
diff --git a/windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md
index d54abefc95..9b09e550ba 100644
--- a/windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md
@@ -13,7 +13,7 @@ ms.localizationpriority: high
 ms.date: 28/02/2018
 ---
 
-#  Experience Windows Defender ATP through simulated attacks 
+# Experience Windows Defender ATP through simulated attacks 
 
 **Applies to:**
 
@@ -23,13 +23,13 @@ ms.date: 28/02/2018
 - Windows 10 Pro Education
 - Windows Defender Advanced Threat Protection (Windows Defender ATP)
 
-**Preparations**
+## Preparations
 
 To run the provided simulations, you need at least [one onboarded machine](onboard-configure-windows-defender-advanced-threat-protection.md). 
 
 Before running a simulation, ensure you read the walkthrough document provided with each attack scenario. The document provides detailed instructions as well as specific endpoint OS and application requirements. In general, running the latest Windows build on the test machine helps ensure compatibility.
 
-**Run the simulations**
+## Run a simulation
 
 1. Select your desired simulation scenario from from **Help** > **Simulations and tutorials**.