Mission Control Finding Details Drawer and Notes Section Obscured by Windows Taskbar in Enterprise Security 8.x

Applicability

Description

In Splunk Enterprise Security 8.x, certain Security Operations Center (SOC) analysts report that they cannot view or interact with the entire Mission Control finding details drawer. 

When selecting a finding from the Analyst Queue, the finding details drawer slides out on the right side of the screen. When multiple accordion cards (such as Threat Intelligence, Drilldown and Next Steps, Related Investigations, Activity Log, and Adaptive Responses) are expanded, the drawer extends beyond the lower boundary of the browser viewport. As a result, the Notes card, text entry inputs, and bottom action buttons are obscured behind the docked Windows taskbar and cannot be reached by scrolling. 

The issue typically impacts analysts using laptop displays with high-DPI scaling enabled, while analysts utilizing external monitors at native 100 percent scaling view the full drawer normally.

Investigation

Follow these steps to confirm whether the symptom is caused by client-side display scaling rather than a backend service or KV Store failure:

1. Check Screen and Hardware Variations:

   • Verify whether the truncation is limited to laptop screens while desktop workstations or large external monitors render the drawer properly.

   • If only certain screen form factors exhibit the truncation, the cause is client-side display scaling.

2. Verify Browser Zoom and Operating System Scaling:

   • In the web browser, check the current zoom level. Zoom levels above 100 percent increase element heights and reduce available viewport space.

   • In Microsoft Windows, open Start > Settings > System > Display.

   • Check the Scale setting under Scale & layout. Common laptop defaults of 125 percent or 150 percent reduce vertical pixels available for the web page container.

3. Verify Backend Endpoint Health:

   • If the Notes card is visible but data fails to load, press F12 in your browser to open Developer Tools.

   • Select the Network tab, filter requests by "notes", and select a finding.

   • Confirm that the API requests to the notes endpoint return HTTP status 200 OK. If the endpoint returns HTTP 200, backend data retrieval and storage are fully functional.

Resolution

Apply one or more of the following display adjustments to restore full visibility to the finding details drawer:

Option 1: Adjust Browser Zoom

1. While viewing the Mission Control dashboard in your browser, press Ctrl + 0 (Windows) or Cmd + 0 (macOS) to reset the zoom level to 100 percent.

2. If the bottom of the drawer remains slightly obscured on smaller laptop screens, press Ctrl + Minus (-) to reduce browser zoom to 90 percent. This creates extra vertical clearance above the taskbar.

Option 2: Collapse Preceding Accordion Cards

The finding details drawer contains multiple expandable accordion sections (such as Threat Intelligence, Drilldown and Next Steps, Related Investigations, Activity Log, and Adaptive Responses).

1. Click the header of any expanded sections located above the Notes section to collapse them.

2. Collapsing unused upper sections pulls the Notes section upward into the active visible area of the drawer.

Option 3: Adjust Windows Display Scaling

1. Open Windows Settings (Windows Key + I).

2. Select System, then select Display.

3. Under Scale & layout, locate the Scale dropdown menu.

4. Adjust the scaling value to 100 percent.

Option 4: Enable Full Screen Mode or Auto-Hide the Taskbar

• Full Screen Mode: Press F11 in your web browser to enter full-screen mode. This temporarily hides the browser address bar and the operating system taskbar, providing full vertical space. Press F11 again to exit full-screen mode.

• Auto-Hide Taskbar: Right-click an empty area of the Windows taskbar and select Taskbar settings. Under Taskbar behaviors, enable the setting "Automatically hide the taskbar".

Option 5: Upgrade Enterprise Security

Upgrade Splunk Enterprise Security to version 8.7.2 or later. Enterprise Security 8.7.2 includes client-side viewport and responsive container enhancements that accommodate high-DPI scaling across varying laptop resolutions.

Related Links

• Splunk Enterprise Security: Investigate findings in Mission Control

• Splunk Enterprise Security: Triage findings in the Analyst Queue

• Splunk Enterprise Security: Overview of Mission Control