diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md
index 6e3bca670d..e0ff5a7be1 100644
--- a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md
+++ b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md
@@ -64,7 +64,7 @@ Use the following table to understand what the columns represent, its data type,
 | InitiatingProcessParentId           | int         | Process ID (PID) of the parent process that spawned the process responsible for the event.                                                                                                                                                                     |
 | InitiatingProcessParentName         | string      | Name of the parent process that spawned the process responsible for the event.                                                                                                                                                                                 |
 | InitiatingProcessSha1               | string      | SHA-1 of the process (image file) that initiated the event.                                                                                                                                                                                                    |
-| InitiatingProcessSha256             | string      | SHA-256 of the process (image file) that initiated the event. This field is usually not populated - please use the SHA-1 field when available.                                                                                                                                                                                                 |
+| InitiatingProcessSha256             | string      | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available.                                                                                                                                                                                                |
 | InitiatingProcessTokenElevation     | string      | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event.                                                                                                                |
 | IsAzureADJoined                     | boolean     | Boolean indicator of whether machine is joined to the Azure Active Directory.                                                                                                                                                                                  |
 | LocalIP                             | string      | IP address assigned to the local machine used during communication.                                                                                                                                                                                            |