Notes

[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

Incorporate notes into your investigative workflows to coordinate responses, conduct threat hunting, and share investigative findings. You can attach notes to alerts, events, and Timelines and manage them from the Notes page.

Open the alert or event details flyout to access the Notes tab, where you can view existing notes and add new ones. To quickly open the tab, click the Add note action () in the Alerts or Events table. Then, enter a note into the text box, and click Add note to create it.

After notes are created, the Add note icon displays a notification dot. In the details flyout for alerts, the alert summary in the right panel also shows how many notes are attached to the alert.

Open the Notes Timeline tab, where you can view existing notes for the Timeline and add new ones. Alternatively, use the details flyout for alerts and events that you’re investigating from Timeline. Be aware that notes added this way are automatically attached to the alert or event and the Timeline unless you deselect the Attach to current Timeline option.

After notes are created, the Notes Timeline tab displays the total number of notes attached to the Timeline.

Use the Notes page to view and interact with all existing notes. To access the page, navigate to Investigations in the main navigation menu or by using the global search field, then go to Notes. From the Notes page, you can: