Annotations fields missing in Splunk ES correlation search

Available Languages

Updated:September 29, 2026
Document ID:SPLK048641

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise Security

Description

When creating a new correlation search in Splunk ES, it is noticed that some annotations such as "Impact" and "Confidence" fields are missing.

 


Investigation

Identified that some lines are missing in the following file $SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/lookups/security_framework_annotations.csv by running the following command:

cat $SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/lookups/security_framework_annotations.csv

 


Resolution

  1. To resolve the issue, replace the contents of $SPLUNK_HOME/etc/apps/SA-ThreatIntelligence/lookups/security_framework_annotations.csv with the following default content and save it:
security_framework,security_framework_label,security_framework_color,security_framework_transform,security_framework_transform_key,security_framework_transform_label
cis20,CIS 20,#C2672A,,,
kill_chain_phases,Kill Chain,#389038,,,
mitre_attack,MITRE ATT&CK,#314D75,mitre_attack_lookup,mitre_technique_id,mitre_technique_id,
nist,NIST,#6F261D,,,
confidence,Confidence,#980AEC,,,
impact,Impact,#662D91,,,
analytic_story,Analytic Story,#C83C10,,,
context,Context,#AB006B,,,
  1. After making the changes, navigate to Configure > Content > Content Management in Splunk ES and click on Create New Content > Correlation Search. All the annotations are now visible as expected.

 


Splunk document: Splunk ES Annotations

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

Related Articles