diff --git a/windows/security/threat-protection/microsoft-defender-atp/techniques-device-timeline.md b/windows/security/threat-protection/microsoft-defender-atp/techniques-device-timeline.md
index 2ac8d5be67..baa3deac5f 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/techniques-device-timeline.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/techniques-device-timeline.md
@@ -78,7 +78,7 @@ You can customize which columns to expose. You can also filter for flagged event
 ### Choose columns to expose
 You can choose which columns to expose in the timeline by selecting the **Choose columns** button.
 
-![Customize columns](images/filter-customize-columns.png)
+![Customize columns](images/timeline-columns.png)
 
 From there you can select which information set to include.