From 788cf1556dfac6c0787a3f00d20f0cd8b3fc1152 Mon Sep 17 00:00:00 2001
From: Tanya Bittenmaster <30839220+tbit0001@users.noreply.github.com>
Date: Tue, 19 Sep 2017 10:06:19 -0400
Subject: [PATCH] Update menu items

---
 ...e-location-icon.png => atp-File-path-icon.png} | Bin
 .../images/atp-command-line-icon.png              | Bin 0 -> 582 bytes
 .../images/atp-cprompt-icon.png                   | Bin 615 -> 0 bytes
 .../images/atp-process-tree.png                   | Bin 0 -> 659 bytes
 ...tected-icon.png => atp-unsigned-file-icon.png} | Bin
 ...windows-defender-advanced-threat-protection.md |   5 +++++
 6 files changed, 5 insertions(+)
 rename windows/threat-protection/windows-defender-atp/images/{atp-File-location-icon.png => atp-File-path-icon.png} (100%)
 create mode 100644 windows/threat-protection/windows-defender-atp/images/atp-command-line-icon.png
 delete mode 100644 windows/threat-protection/windows-defender-atp/images/atp-cprompt-icon.png
 create mode 100644 windows/threat-protection/windows-defender-atp/images/atp-process-tree.png
 rename windows/threat-protection/windows-defender-atp/images/{atp-windows-defender-not-detected-icon.png => atp-unsigned-file-icon.png} (100%)

diff --git a/windows/threat-protection/windows-defender-atp/images/atp-File-location-icon.png b/windows/threat-protection/windows-defender-atp/images/atp-File-path-icon.png
similarity index 100%
rename from windows/threat-protection/windows-defender-atp/images/atp-File-location-icon.png
rename to windows/threat-protection/windows-defender-atp/images/atp-File-path-icon.png
diff --git a/windows/threat-protection/windows-defender-atp/images/atp-command-line-icon.png b/windows/threat-protection/windows-defender-atp/images/atp-command-line-icon.png
new file mode 100644
index 0000000000000000000000000000000000000000..dd01894c3d86303f4a984d03cae45752179cc465
GIT binary patch
literal 582
zcmeAS@N?(olHy`uVBq!ia0vp^av;pX1|+Qw)-3{3oCO|{#S9F5M?jcysy3fAP>{XE
z)7O>#A*V1OtKL_C9d@vgYeb1-X-P(Y5yQ%LXFPyHJS9LOm(=3qqRfJl%=|nCVNOM5
zpg0#u+&RCXvM4h>ql94%{~0TwC?8m~C^ZqJRG}m@H<iKkJ3l8-h7%+coS#-wo>-L1
z5L@scq?{XUcxG{OP9jig5ySQaTl#^*93bKF#G<^+ymW>G($Cs~V(bw8rA5i93}62@
zzlJGu&d<$F%`0K}c4pdspcorSSx9C{PAbEScbC)|7#IaTT^vI^I^Rw+>}oNPXuZ#K
zJF-2-frVSzn}34xl5>ogq9ZF?WfUIB=IH3W&Cy}WSJ1R=2<F+nX7`%OQ+XsM;w4Z1
zuK537{o|%}+BGj;wZ0Pm!+5}Z?fvyv;;R2FpAvK-O5RM|$-(Pq{fEV8tAo7W*41-d
zi<0-#ZL#313wv~3X5IW%ucZzfC~z<t920OAWJs8$782UJN#|~Jui=YbdCC7G{WMjl
zr8XL}wFqo~P$=W5d3R0i``T%#8Mnpe6l>eRmOEb9Q#sE(+iT_eD|3oXe3P@&=g$ym
zQt=EBVbxfg(DQfJHv^uF-)%3Ml(MtETlvjv=5xy)!?3t>{gXF8th#o#G}88O$=>_b
fHBJ5>ILnqvSAU7&in4PCr4$BFS3j3^P6<r_x;fU9

literal 0
HcmV?d00001

diff --git a/windows/threat-protection/windows-defender-atp/images/atp-cprompt-icon.png b/windows/threat-protection/windows-defender-atp/images/atp-cprompt-icon.png
deleted file mode 100644
index 7569e5d4ad18e527b2b9960c433a850807b57507..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 615
zcmeAS@N?(olHy`uVBq!ia0vp^ia;#K!3HE3ohTOvQk(@Ik;M!Qd`Cc-ajG_-G*FPe
z#M9T6{UN6?kB*7|`*}aWLaq@dj-@3T`9%yX*PZbI3h|Txg<MjLlZ!G7N;32F7=$?$
zm4V`1AaUpXg36-I^o$aQHT-9+fTDb0(W2BukWz(`%-mE4)9?J8Kp9SuOmKc$NqJ&X
zDno3+e~@x+u;H1-$vKHYr9}+e4{YfN3Uh#j!xM}0GV{_I4oE+12a2&n^p_STr!su~
z-~1Y;%sD?dH#M(>;oF&M`+;I?AY~z$B{``KE8bmFXJBA7@^o<w@#uUzO|h@VK%(`2
z&as8k77U7x2@^Ud$}HT)zQTRs4kvzxrpF8tEJE#$6AG9-RM`_k(%bK*w4FQ0$1(5E
z?LU7%{rb0TdF8x~TlZ~aV<=-PWZUqw_RXPAW~Y~bG6FdoO?>0?&Pgyo|C29Z)m!Jq
zv9aoXa0gJZtl99JT!+8K#!7?V`|95v+1s_q;r2EI9_B=eLxppq7wep!pwek}#DM3u
z;*u#VURM=P*fgiOFLRc{QWixQ?ngyC*R;Rb#kVX|FY9|GXA?tcXk*YSR>q8!L#44j
zk9Vx#RLsi@@Cux^)Qn+6lGPLr#Sb?8g))atd|MKKWM}2vcDroyp|;-CVczqqgG;8^
zZL#iB^3W`eI<#rc_x>0ASw0KvKg+y#P`&uGxUhx7zETGbSphHhmP?`^DpR=*<Y{vQ
P!;`_&)z4*}Q$iB}L{a8k

diff --git a/windows/threat-protection/windows-defender-atp/images/atp-process-tree.png b/windows/threat-protection/windows-defender-atp/images/atp-process-tree.png
new file mode 100644
index 0000000000000000000000000000000000000000..f76a65a2f1c1643977f3ef146797c412b3d5f4f5
GIT binary patch
literal 659
zcmeAS@N?(olHy`uVBq!ia0vp^vLMXC1|-8Kr}G0T&H|6fVg?4jBOuH;Rhv&5D9B#o
z>Fdh=kW-kC#Wc<E$||ssYeb1-X-P(Y5yQ%LXFPyHJS9LOm(=3qqRfJl%=|nCVNOM5
zpg0#u+&RCXvM4h>ql94%{~0TwC?8m~C^ZqJRG}m@H<iKkJ3l8-h7%+coS#-wo>-L1
z5L@scq?{XUcxG{OP9jig5ySQaTl#^*93bKF#G<^+ymW>G($Cs~V(bw8rA5i93}62@
zzlJGu&d<$F%`0K}c4pdspcorSSx9C{PAbEScbC)|7#QO`T^vI^I^RxP-FL`A#DRZy
zDT^hieZvYT2C3Eu4+AX>BxJaLFyz=X^d599bySkN((#RZ*(ClQtIL>Mj&C`THu<fm
zR+`mJ<6`UYWkpJdIMaK}KYo;+<TJ~YvE%WKmnB|Xqn2KNx#4Ecyh(Mpc%t;C%k;b3
zoOjMXn`5>(Z1ut^Rr9|TSX_AhHNb1(ltm$03%B~|Zsp3~8I!g(O7OVh?YGkmcnW3M
zJtV6HEo;{$^-MgOqBPaZ_14>MYp%bZU%u}3sSFdL<ene<^uJcc_84woCbU!F-juq_
z@4p}Y{&#on^<yzfUww0(-dpfRz21D`{-c*RZ_9RzaIwxhtM>WloR1ZMJ~Y_w4PGkJ
z>(+cX?|9P24OSN|JwIei^RO|nI2K%s*AbKCYu^&3ySi2FUZ&mr<Dd6jvE<@Bogl#C
z5_qI;zrSwF{}8sdOEQZ->Y0hYjFa?nUNogrwEp|E37*C;mG?2IN^CM0Zut`o40{Go
LS3j3^P6<r_ui*kX

literal 0
HcmV?d00001

diff --git a/windows/threat-protection/windows-defender-atp/images/atp-windows-defender-not-detected-icon.png b/windows/threat-protection/windows-defender-atp/images/atp-unsigned-file-icon.png
similarity index 100%
rename from windows/threat-protection/windows-defender-atp/images/atp-windows-defender-not-detected-icon.png
rename to windows/threat-protection/windows-defender-atp/images/atp-unsigned-file-icon.png
diff --git a/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
index 78e521eab7..1c33a5b370 100644
--- a/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection.md
@@ -84,6 +84,11 @@ Icon | Description
 ![Other events icon](images\atp-Other-events-icon.png)| Other events
 ![Access token modification icon](images\atp-access-token-modification-icon.png)| Access token modification
 ![File creation icon](images\atp-file-creation-icon.png)| File creation
+![Signer icon](images\atp-signer-icon.png)| Signer
+![File path icon](images\atp-File-path-icon.png)| File path
+![Command line icon](images\atp-command-line-icon.png)| Command line
+![Unsigned file icon](images\atp-unsigned-file-icon.png)| Unsigned file
+![Process tree icon](images\atp-process-tree.png)| Process tree
 ![Memory allocation icon](images\atp-memory-allocation-icon.png)| Memory allocation
 ![Process injection icon](images\atp-process-injection.png)| Process injection
 ![Powershell command run icon](images\atp-powershell-command-run-icon.png)| Powershell command run