diff --git a/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md
index 29c88a054a..dc1a7cb09a 100644
--- a/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md
@@ -265,6 +265,8 @@ Field numbers match the numbers in the images below.
 
 ![Image of alert with numbers](images/atp-siem-mapping1.png)
 
+![Image of alert with numbers](images/1.png)
+
 ![Image of alert details pane with numbers](images/atp-siem-mapping13.png)
 
 ![Image of alert timeline with numbers](images/atp-siem-mapping3.png)
diff --git a/windows/threat-protection/windows-defender-atp/images/1.png b/windows/threat-protection/windows-defender-atp/images/1.png
new file mode 100644
index 0000000000..70ce314c00
Binary files /dev/null and b/windows/threat-protection/windows-defender-atp/images/1.png differ