You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/events/add-manage-notes.asciidoc
+9-8Lines changed: 9 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,6 +3,8 @@
3
3
4
4
Incorporate notes into your investigative workflows to coordinate responses, conduct threat hunting, and share investigative findings. You can attach notes to alerts, events, and Timeline and manage them from the **Notes** page.
5
5
6
+
NOTE: Configure the `securitySolution:maxUnassociatedNotes` <<max-notes-alerts-event,advanced setting>> to specify the maximum number of notes that you can attach to alerts and events.
7
+
6
8
[discrete]
7
9
[[add-notes-documents]]
8
10
== Add notes to alerts and events
@@ -16,30 +18,31 @@ Incorporate notes into your investigative workflows to coordinate responses, con
16
18
[role="screenshot"]
17
19
image::images/create-new-note.png[Creating a new note]
18
20
19
-
A notification dot displays on alerts and events with notes. Hover over the **Add note** icon (image:images/create-note-icon.png[Add note,15,15]) to see how many notes are attached to the alert or event.
21
+
In the Alerts or Events tables, a notification dot displays on alerts and events with notes. Hover over the **Add note** icon (image:images/create-note-icon.png[Add note,15,15]) to see how many notes are attached to the alert or event.
20
22
21
23
[role="screenshot"]
22
24
image::images/notes-notification.png[Notes notification marker on Alerts page]
23
25
24
-
NOTE: Configure the `securitySolution:maxUnassociatedNotes` <<max-notes-alerts-event,advanced setting>> to specify the maximum number of <<add-manage-notes,notes>> that you can attach to alerts and events.
25
-
26
26
[discrete]
27
27
[[add-notes-timelines]]
28
28
== Add notes to Timelines
29
29
30
-
There are two ways to add notes to an open Timeline: the **Notes** Timeline tab or the details flyout for alerts and events that you're investigating in Timeline. Also note that you can only add notes to saved Timelines.
30
+
IMPORTANT: You can only add notes to saved Timelines.
31
+
32
+
There are two ways to add notes to an open Timeline: the **Notes** Timeline tab or the details flyout for alerts and events that you're investigating in Timeline.
31
33
32
34
From the **Notes** Timeline tab, you can create a new note that's attached to the entire Timeline. From the details flyout, any notes that you add to alerts and events are automatically attached to the Timeline you're currently working on. If you only want to create a note for the alert or event, deselect the **Attach to current Timeline** option.
//Classic nav view: Manage -> Investigations -> Notes
40
+
//Will need to revisit the navigation instructions below. The nav path to the Notes page differs between the Classic nav view (Manage -> Investigations -> Notes) and the Security solution view (Investigations -> Notes)
40
41
41
42
The **Notes** page allows you to view and interact with all existing notes. To access the page, find **Investigations** in the main menu or look for “Investigations” using the {kibana-ref}/introduction.html#kibana-navigation-search[global search field], then go to **Notes**.
42
43
44
+
TIP: You can also manage notes for alerts, events, and Timelines from the **Notes** <<expanded-notes-view,tab>> in the details flyout or in Timeline.
Incorporate notes into your investigative workflows to coordinate responses, conduct threat hunting, and share investigative findings. You can attach notes to alerts, events, and Timeline and manage them from the **Notes** page.
12
12
13
+
<DocCallOuttitle="Note">
14
+
Configure the `securitySolution:maxUnassociatedNotes` <DocLinkslug="/serverless/security/advanced-settings"section="max-notes-alerts-events">advanced settings</DocLink> to specify the maximum number of notes that you can attach to alerts and events.
15
+
</DocCallOut>
16
+
13
17
<divid="add-notes-documents"></div>
14
18
15
19
## Add notes to alerts and events
@@ -22,19 +26,19 @@ Incorporate notes into your investigative workflows to coordinate responses, con
22
26
23
27
<DocImagesize="xl"url="../images/notes/-notes-create-new-note.png"alt="Creating a new note"/>
24
28
25
-
A notification dot displays on alerts and events with notes. Hover over the **Add note** icon (<DocIcontype="editorComment"title="The icon that lets you to add a new note" />) to see how many notes are attached to the alert or event.
29
+
In the Alerts or Events tables, a notification dot displays on alerts and events with notes. Hover over the **Add note** icon (<DocIcontype="editorComment"title="The icon that lets you to add a new note" />) to see how many notes are attached to the alert or event.
26
30
27
31
<DocImagesize="xl"url="../images/notes/-notes-notification.png"alt="Notes notification marker on Alerts page"/>
28
32
29
-
<DocCallOuttitle="Note">
30
-
Configure the `securitySolution:maxUnassociatedNotes` <DocLinkslug="/serverless/security/advanced-settings"section="max-notes-alerts-events">advanced settings</DocLink> to specify the maximum number of notes that you can attach to alerts and events.
31
-
</DocCallOut>
32
-
33
33
<divid="add-notes-timelines"></div>
34
34
35
35
## Add notes to Timelines
36
36
37
-
There are two ways to add notes to an open Timeline: the **Notes** Timeline tab or the details flyout for alerts and events that you're investigating in Timeline. Also note that you can only add notes to saved Timelines.
37
+
<DocCallOuttitle="Important"color="warning">
38
+
You can only add notes to saved Timelines.
39
+
</DocCallOut>
40
+
41
+
There are two ways to add notes to an open Timeline: the **Notes** Timeline tab or the details flyout for alerts and events that you're investigating in Timeline.
38
42
39
43
From the **Notes** Timeline tab, you can create a new note that's attached to the entire Timeline. From the details flyout, any notes that you add to alerts and events are automatically attached to the Timeline you're currently working on. If you only want to create a note for the alert or event, deselect the **Attach to current Timeline** option.
40
44
@@ -44,6 +48,10 @@ From the **Notes** Timeline tab, you can create a new note that's attached to th
44
48
45
49
The **Notes** page allows you to view and interact with all existing notes. To access the page, find **Investigations** in the main menu, then go to **Notes**.
46
50
51
+
<DocCallOuttitle="Tip">
52
+
You can manage notes for alerts, events, and Timelines from the **Notes** <DocLinkslug="/serverless/security/view-alert-details"section="expanded-notes-view">tab</DocLink> in the details flyout or in Timeline.
0 commit comments