diff --git a/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md
index 9cc621003d..38cd73f19f 100644
--- a/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md
@@ -278,10 +278,10 @@ Field numbers match the numbers in the images below.
 
 ![Image of alert timeline with numbers](images/atp-siem-mapping4.png)
 
-![Image browser URL](images/atp-mapping5.png)
-
 ![Image machine view](images/atp-mapping6.png)
 
+![Image browser URL](images/atp-mapping5.png)
+
 ![Image actor alert](images/atp-mapping7.png)