Notable Comments are no longer found in index=_audit or in |'incident review'

Applicability

Description

After the upgrade from Splunk Enterprise Security from 7.x to 8.x the Notable Comments are no longer found when searching for them.

Investigation

According to the Splunk ES Release Notes, the 'Comments' feature is replaced by an enhanced capability to add notes. In Splunk Enterprise Security version 7.3, admins can turn on a setting to require analysts to leave a comment with a minimum character length after updating a notable event. In Splunk Enterprise Security version 8.x, this can no longer require a note when an analyst updates a finding in the analyst queue.

 Additionally, according to the Splunk ES Limitations, the 'Comments' feature available in prior versions of Splunk Enterprise Security is now replaced by an enhanced capability to add notes. So, looks like it was only replaced, and improved: Improvements to the 'Comments' feature available in prior versions of Splunk Enterprise Security. 

 Since the 'Notable Comments' do not exist in ES8.x, and since they are replaced by the 'Notes' feature and are not accessible from the macros that is referenced, then there is no easy workaround and there is not a supported API.

 Based on my research, this link might be helpful.

It says the following: All changes to the notes can be tracked in the audit logs. For example, the following search can be used to identify any modifications to notes included in an investigation:

index=_audit source=mc_notes | rex "(?<timestamp>[\d.]+),(?<incident_id>[\w-]+),(?<user>[\w_]+),(?<model>[\w]+),(?<command>[\w]+),(?<diff>.+)" | eval time=_time | table time, user, source, incident_id, diff, command 

 The Notes were under title, however the spaces were replaced by a '%20' and this is not accurate. For example:

 

Resolution

After researching this, one of the following searches should work. In the current search, add the following:

... | eval title=replace(title, "%20", " ") -> This one should replace that for spaces.

Or,

... | eval title=urldecode(title) -> This one should clean any encrypted character.

This will work as long as the value is already a extracted field.

Or,

... | spath output=note_title path=title
| eval note_title=urldecode(note_title)
| table note_title

Or,

... | spath output=note_title path=annotations.notes{}.title
| eval note_title=urldecode(note_title)
| table note_title