Notes

Incorporate notes into your investigative workflows to coordinate responses, conduct threat hunting, and share investigative findings. You can attach notes to alerts, events, and Timelines and manage them from the Notes page.

You can control access to notes by setting the Kibana privileges for the Notes feature under Security.

To add or view notes for a specific alert or event, open its details flyout. Refer to Notes for how to add and view notes from the flyout.

You can also click the Add note action () in the Alerts or Events table to open the Notes flyout directly, without first opening the full details flyout. Enter a note into the text box, then click Add note to create it. After notes are created, the Add note icon displays a notification dot.

Open the Notes Timeline tab, where you can view existing notes for the Timeline and add new ones. Alternatively, use the details flyout for alerts and events that you’re investigating from Timeline. Be aware that notes added this way are automatically attached to the alert or event and the Timeline unless you deselect the Attach to current Timeline option.

After notes are created, the Notes Timeline tab displays the total number of notes attached to the Timeline.

Use the Notes page to view and interact with all existing notes. To access the page, navigate to Investigations in the main navigation menu or by using the global search field, then go to Notes. From the Notes page, you can:

• Search for specific notes
• Filter notes by the user who created them or by the object they’re attached to (notes can be attached to alerts, events, or Timelines)
• Examine the contents of a note (click the text in the Note content column)
• Delete one or more notes
• Examine the alert or event that a note is attached to (click the Expand alert/event details icon)
• Open the Timeline that the note is attached to (click the Open saved timeline icon)