diff --git a/docs/getting-started/configure-integration-policy.asciidoc b/docs/getting-started/configure-integration-policy.asciidoc
index 9ef4e7796e..6feb071e81 100644
--- a/docs/getting-started/configure-integration-policy.asciidoc
+++ b/docs/getting-started/configure-integration-policy.asciidoc
@@ -212,7 +212,9 @@ register {elastic-sec} as your hosts' antivirus software by enabling **Register
 
 NOTE: Windows Server versions are not supported. Antivirus registration requires Windows Security Center, which is not included in Windows Server operating systems.
 
-You can also choose **Sync with malware protection level** to automatically set antivirus registration based on how you've configured {elastic-defend}'s <<malware-protection,malware protection>>. If malware protection is turned on and set to **Prevent**, antivirus registration will also be enabled; in any other case, antivirus registration will be disabled.
+By default, the **Sync with malware protection level** is selected to automatically set antivirus registration to match how you've configured {elastic-defend}'s <<malware-protection,malware protection>>. If malware protection is turned on _and_ set to **Prevent**, antivirus registration will also be enabled; in any other case, antivirus registration will be disabled.
+
+If you don't want to sync antivirus registration, you can set it manually with the **Enabled** or **Disabled** option.
 
 [role="screenshot"]
 image::images/register-as-antivirus.png[Detail of Register as antivirus option.]
diff --git a/docs/getting-started/images/register-as-antivirus.png b/docs/getting-started/images/register-as-antivirus.png
index 25a12eea74..61fb3d2fa6 100644
Binary files a/docs/getting-started/images/register-as-antivirus.png and b/docs/getting-started/images/register-as-antivirus.png differ