diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md
index 9535492f02..eed873bdf4 100644
--- a/windows/security/threat-protection/TOC.md
+++ b/windows/security/threat-protection/TOC.md
@@ -429,7 +429,6 @@
 ####Troubleshoot attack surface reduction
 ##### [Network protection](windows-defender-exploit-guard/troubleshoot-np.md)
 ##### [Attack surface reduction rules](windows-defender-exploit-guard/troubleshoot-asr.md)
-##### [Collect diagnostic data for files](windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md)
  
 #### [Troubleshoot next generation protection](windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md)
 
diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/manage-alerts.md
index 9a0cc2d05f..3113e4b4f9 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/manage-alerts.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/manage-alerts.md
@@ -74,6 +74,7 @@ Create custom rules to control when alerts are suppressed, or resolved. You can
     * Folder path - wildcard supported
     * IP address
     * URL - wildcard supported
+    * Command line - wildcard supported
 
 3. Select the **Trigerring IOC**.