Enterprise Security -> Customizing Incident Review -> Adding Short ID


I'm wanting to add the short ID that one can generate for a notable in IR. 



To the columns in Incident Review for our SOC to use. 


However, I can't find the proper attribute name for this and it's not in the notable index, or in notable_xref_lookup or es_notable_events lookup. 

Hoping someone can tell me what the correct "Short ID" attribute name is.

Also hoping someone can tell me how to force ES to create a Short ID for EVERY notable. 

Thanks in Advance!


Labels (2)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!