diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md
index 3e56e7babc..3117358a7f 100644
--- a/windows/keep-secure/TOC.md
+++ b/windows/keep-secure/TOC.md
@@ -416,6 +416,9 @@
 ##### [View and organize the Alerts queue](alerts-queue-windows-advanced-threat-protection.md)
 ##### [Investigate alerts](investigate-alerts-windows-advanced-threat-protection.md)
 ##### [Investigate machines](machines-view-windows-advanced-threat-protection.md)
+##### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md)
+##### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md)
+##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md)
 ##### [Submit files to the Deep analysis feature](deep-analysis-windows-advanced-threat-protection.md)
 ##### [Manage alerts](manage-alerts-windows-advanced-threat-protection.md)
 #### [Windows Defender ATP settings](settings-windows-defender-advanced-threat-protection.md)