diff --git a/windows/threat-protection/windows-defender-atp/images/atp-File-location-icon.png b/windows/threat-protection/windows-defender-atp/images/atp-File-path-icon.png
similarity index 100%
rename from windows/threat-protection/windows-defender-atp/images/atp-File-location-icon.png
rename to windows/threat-protection/windows-defender-atp/images/atp-File-path-icon.png
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-command-line-icon.png b/windows/threat-protection/windows-defender-atp/images/atp-command-line-icon.png
new file mode 100644
index 0000000000..dd01894c3d
Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-command-line-icon.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-cprompt-icon.png b/windows/threat-protection/windows-defender-atp/images/atp-cprompt-icon.png
deleted file mode 100644
index 7569e5d4ad..0000000000
Binary files a/windows/threat-protection/windows-defender-atp/images/atp-cprompt-icon.png and /dev/null differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-process-tree.png b/windows/threat-protection/windows-defender-atp/images/atp-process-tree.png
new file mode 100644
index 0000000000..f76a65a2f1
Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-process-tree.png differ
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-windows-defender-not-detected-icon.png b/windows/threat-protection/windows-defender-atp/images/atp-unsigned-file-icon.png
similarity index 100%
rename from windows/threat-protection/windows-defender-atp/images/atp-windows-defender-not-detected-icon.png
rename to windows/threat-protection/windows-defender-atp/images/atp-unsigned-file-icon.png
diff --git a/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
index 78e521eab7..1c33a5b370 100644
--- a/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
@@ -84,6 +84,11 @@ Icon | Description
 ![Other events icon](images\atp-Other-events-icon.png)| Other events
 ![Access token modification icon](images\atp-access-token-modification-icon.png)| Access token modification
 ![File creation icon](images\atp-file-creation-icon.png)| File creation
+![Signer icon](images\atp-signer-icon.png)| Signer
+![File path icon](images\atp-File-path-icon.png)| File path
+![Command line icon](images\atp-command-line-icon.png)| Command line
+![Unsigned file icon](images\atp-unsigned-file-icon.png)| Unsigned file
+![Process tree icon](images\atp-process-tree.png)| Process tree
 ![Memory allocation icon](images\atp-memory-allocation-icon.png)| Memory allocation
 ![Process injection icon](images\atp-process-injection.png)| Process injection
 ![Powershell command run icon](images\atp-powershell-command-run-icon.png)| Powershell command run