diff --git a/windows/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md
index 010bbb6a3f..280e52d86c 100644
--- a/windows/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md
@@ -13,7 +13,7 @@ ms.localizationpriority: high
 ms.date: 09/01.2017
 ---
 
-# Get MachineAction object
+# Get FileMachineAction object
 Get MachineAction object
 
 ## Permissions
@@ -54,14 +54,21 @@ Here is an example of the response.
 
 
 ```
-HTTP/1.1 200 Ok
+HTTP/1.1 201 Created
 Content-type: application/json
 {
-    "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
-    "id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
-    "type": "stopAndQuarantineFile",
-    "status": "Success",
-    "error": "Unknown"
+    "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#FileMachineActions/$entity",
+    "id": " 7327b54fd718525cbca07dacde913b5ac3c85673",
+    "sha1": “1163788484e3258ab9fcf692f7db7938f72ddfc2”,
+    "type": "StopAndQuarantineFile",
+    "status": "Succeeded",
+    "machineId": "970a58d5f61786bb7799dfdb5395ec364ffceace",
+    "fileInstances": [
+        {
+            "filePath": "C:\\Users\\alex\\AppData\\Local\\AppFetch\\Temp\\3324bcb\\AppDownloader\\AnApp.appfetch.zip",
+            "status": "Succeeded"
+        }
+    ]
 }
 
 ```
diff --git a/windows/threat-protection/windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md
index 0dfc9214cd..66da51153b 100644
--- a/windows/threat-protection/windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/request-sample-windows-defender-advanced-threat-protection.md
@@ -37,7 +37,7 @@ In the request body, supply a JSON object with the following parameters:
 Parameter |	Type	| Description
 :---|:---|:---
 Comment |	String |	Comment to associate with the action. **Required**.
-SHA1 |	String	 | SHA1 of the file to upload to the secure storage. **Required**.
+SHA1 |	String	 | Sha1 of the file to upload to the secure storage. **Required**.
 
 ## Response
 If successful, this method returns 201, Created response code and *FileMachineAction*  object in the response body.
@@ -50,10 +50,9 @@ Request
 Here is an example of the request.
 
 ```
-POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/unrestrictCodeExecution 
+POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/requestSample 
 Content-type: application/json
 {
-  "Comment": "Stop and quarantine file on machine due to alert 32123",
   “Sha1�: “7327b54fd718525cbca07dacde913b5ac3c85673�
 }
 ```
diff --git a/windows/threat-protection/windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md
index 3fb1a64c19..6b46dbda48 100644
--- a/windows/threat-protection/windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md
@@ -37,7 +37,7 @@ In the request body, supply a JSON object with the following parameters:
 Parameter |	Type	| Description
 :---|:---|:---
 Comment |	String |	Comment to associate with the action. **Required**.
-SHA1 |	String	 | SHA1 of the file to stop and quarantine on the machine. **Required**.
+SHA1 |	String	 | Sha1 of the file to stop and quarantine on the machine. **Required**.
 
 ## Response
 If successful, this method returns 201, Created response code and _FileMachineAction_ object in the response body.
@@ -66,13 +66,20 @@ Here is an example of the response.
 
 ```
 HTTP/1.1 201 Created
-HTTP/1.1 201 Created
 Content-type: application/json
 {
     "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#FileMachineActions/$entity",
-    "id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
+    "id": "5841901d-6d04-4278-b0b3-8dd6a2acc8a5",
+    "sha1": “1163788484e3258ab9fcf692f7db7938f72ddfc2�,
     "type": "StopAndQuarantineFile",
-    "status": "InProgress",
-    "error": "Unknown"
+    "status": "Succeeded",
+    "machineId": "970a58d5f61786bb7799dfdb5395ec364ffceace",
+    "fileInstances": [
+        {
+            "filePath": "C:\\Users\\alex\\AppData\\Local\\AppFetch\\Temp\\3324bcb\\AppDownloader\\AnApp.appfetch.zip",
+            "status": "Succeeded"
+        }
+    ]
 }
+
 ```