diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md
index a7902e1daf..baa17c2bc0 100644
--- a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md
@@ -98,6 +98,8 @@ each column has it's own section and shows the distinct values that appear in th
 
 You can refine your query based on the filter by clicking the "+" or "-" buttons on the values that you want to include or exclude and click **Run query**.
 
+![Image of advanced hunting filter](images/atp-filter-advanced-hunting.png)
+
 The filter selections will resolve as an additional query term and the results will be updated accordingly.
 
 
diff --git a/windows/security/threat-protection/windows-defender-atp/images/atp-filter-advanced-hunting.png b/windows/security/threat-protection/windows-defender-atp/images/atp-filter-advanced-hunting.png
new file mode 100644
index 0000000000..d432af83be
Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/atp-filter-advanced-hunting.png differ