diff --git a/windows/security/threat-protection/auditing/audit-process-creation.md b/windows/security/threat-protection/auditing/audit-process-creation.md
index b61b00d478..538a1b7fa9 100644
--- a/windows/security/threat-protection/auditing/audit-process-creation.md
+++ b/windows/security/threat-protection/auditing/audit-process-creation.md
@@ -11,7 +11,7 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.localizationpriority: none
 author: dansimp
-ms.date: 09/06/2021
+ms.date: 03/16/2022
 ms.technology: windows-sec
 ---
 
@@ -22,7 +22,7 @@ Audit Process Creation determines whether the operating system generates audit e
 
 These audit events can help you track user activity and understand how a computer is being used. Information includes the name of the program or the user that created the process.
 
-**Event volume**: Low to Medium, depending on system usage.
+**Event volume**: Medium to High, depending on the process activity on the computer.
 
 This subcategory allows you to audit events generated when a process is created or starts. The name of the application and user that created the process is also audited.