I'm wanting to add the short ID that one can generate for a notable in IR.
To the columns in Incident Review for our SOC to use.
However, I can't find the proper attribute name for this and it's not in the notable index, or in notable_xref_lookup or es_notable_events lookup.
Hoping someone can tell me what the correct "Short ID" attribute name is.
Also hoping someone can tell me how to force ES to create a Short ID for EVERY notable.
Thanks in Advance!