diff --git a/windows/keep-secure/enable-custom-ti-windows-defender-advanced-threat-protection.md b/windows/keep-secure/enable-custom-ti-windows-defender-advanced-threat-protection.md
index 47189ede43..dcc7ec8191 100644
--- a/windows/keep-secure/enable-custom-ti-windows-defender-advanced-threat-protection.md
+++ b/windows/keep-secure/enable-custom-ti-windows-defender-advanced-threat-protection.md
@@ -27,6 +27,8 @@ Before you can create custom threat intelligence (TI) using REST API, you'll nee
 
 1. In the navigation pane, select **Preference Setup** > **Threat intel API**.
 
+  ![Image of threat intel API menu](images/atp-threat-intel-api.png)
+
 2. Select **Enable threat intel API**. This activates the **Azure Active Directory application** setup sections with pre-populated values.
 
 3. Copy the individual values or select **Save details to file** to download a file that contains all the values.
diff --git a/windows/keep-secure/images/atp-sample-custom-ti-alert.png b/windows/keep-secure/images/atp-sample-custom-ti-alert.png
new file mode 100644
index 0000000000..e536f6f4cc
Binary files /dev/null and b/windows/keep-secure/images/atp-sample-custom-ti-alert.png differ
diff --git a/windows/keep-secure/images/atp-simulate-custom-ti.png b/windows/keep-secure/images/atp-simulate-custom-ti.png
new file mode 100644
index 0000000000..2828654c79
Binary files /dev/null and b/windows/keep-secure/images/atp-simulate-custom-ti.png differ
diff --git a/windows/keep-secure/images/atp-threat-intel-api.png b/windows/keep-secure/images/atp-threat-intel-api.png
new file mode 100644
index 0000000000..ef6720b29e
Binary files /dev/null and b/windows/keep-secure/images/atp-threat-intel-api.png differ