diff --git a/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md index 404273b702..48e45aa5b5 100644 --- a/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md @@ -60,7 +60,7 @@ Portal label | SIEM field name | ArcSight field| Example value | Description -![Image of alert with numbers](images/atp-mapping1.png) +![Image of alert with numbers](images/atp-siem-mapping1.png) ![Image of alert details pane with numbers](images/atp-mapping2.png) diff --git a/windows/threat-protection/windows-defender-atp/images/atp-mapping5.png b/windows/threat-protection/windows-defender-atp/images/atp-mapping5.png index 7951786b59..6f7913fea1 100644 Binary files a/windows/threat-protection/windows-defender-atp/images/atp-mapping5.png and b/windows/threat-protection/windows-defender-atp/images/atp-mapping5.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping1.png b/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping1.png new file mode 100644 index 0000000000..cfd65658fd Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping1.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping2.png b/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping2.png new file mode 100644 index 0000000000..4d4ecd5c09 Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping2.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping3.png b/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping3.png new file mode 100644 index 0000000000..2a6a8ce090 Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping3.png differ diff --git a/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping4.png b/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping4.png new file mode 100644 index 0000000000..5b4d1048d5 Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping4.png differ