diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md
index 8d0e9d0859..1de854c1a4 100644
--- a/windows/client-management/mdm/defender-csp.md
+++ b/windows/client-management/mdm/defender-csp.md
@@ -7,7 +7,7 @@ ms.topic: article
 ms.prod: w10
 ms.technology: windows
 author: MariciaAlforque
-ms.date: 07/18/2018
+ms.date: 07/19/2018
 ---
 
 # Defender CSP
@@ -114,6 +114,9 @@ The following table describes the supported values:
 | 46    | Behavior                    |
 | 47    | Vulnerability               |
 | 48    | Policy                      |
+| 49    | EUS (Enterprise Unwanted Software)|
+| 50    | Ransomware                  |
+| 51    | ASR Rule                    |
 
  
 
@@ -126,19 +129,17 @@ The data type is a integer.
 
 The following list shows the supported values:
 
--   0 = Unknown
--   1 = Detected
--   2 = Cleaned
--   3 = Quarantined
--   4 = Removed
--   5 = Allowed
--   6 = Blocked
--   102 = Clean failed
--   103 = Quarantine failed
--   104 = Remove failed
--   105 = Allow failed
--   106 = Abandoned
--   107 = Block failed
+-   0 = Active
+-   1 = Action failed
+-   2 = Manual steps required
+-   3 = Full scan required
+-   4 = Reboot required
+-   5 = Remediated with non critical failures
+-   6 = Quarantined
+-   7 = Removed
+-   8 = Cleaned
+-   9 = Allowed
+-   10 = No Status ( Cleared)
 
 Supported operation is Get.
 
diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md
index f7efa0b32e..b7ac65f33b 100644
--- a/windows/security/threat-protection/TOC.md
+++ b/windows/security/threat-protection/TOC.md
@@ -81,12 +81,11 @@
 ######## [View deep analysis reports](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports)
 ######## [Troubleshoot deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis)
 
-###### [Use Automated investigation to investigate and remediate threats](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md)
 ###### [Query data using Advanced hunting](windows-defender-atp\advanced-hunting-windows-defender-advanced-threat-protection.md)
 ####### [Advanced hunting reference](windows-defender-atp\advanced-hunting-reference-windows-defender-advanced-threat-protection.md)
 ####### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
 
-
+#### [Use Automated investigation to investigate and remediate threats](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md)
 ####  [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md)
 
 ####API and SIEM support
diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md
index fa8be23611..e0acbff6f6 100644
--- a/windows/security/threat-protection/windows-defender-atp/TOC.md
+++ b/windows/security/threat-protection/windows-defender-atp/TOC.md
@@ -72,11 +72,12 @@
 ###### [View deep analysis reports](respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports)
 ###### [Troubleshoot deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis)
 
-### [Use Automated investigation to investigate and remediate threats](automated-investigations-windows-defender-advanced-threat-protection.md)
 ### [Query data using Advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md)
 #### [Advanced hunting reference](advanced-hunting-reference-windows-defender-advanced-threat-protection.md)
 #### [Advanced hunting query language best practices](advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
 
+## [Use Automated investigation to investigate and remediate threats](automated-investigations-windows-defender-advanced-threat-protection.md)
+
 ## [Protect data with conditional access](conditional-access-windows-defender-advanced-threat-protection.md)
 ##API and SIEM support
 ### [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md)