Can you customize Additional Fields in Notable Events?

[JD_Sample]

Is there a way to customize which additional fields to show for which Notable event /Co-relation search without affecting other notable events that may be displaying the same additional fields? If so, please help.

[JD_Sample]

kkrises,

i figured there were no other magic ways without it affecting other notable events. Thank you for responding!

[kkrises]

You're welcome.

[kkrises]

Firstly, we need to make sure that the correlation search results include the field and then make sure that Incident Review can display the field.

Some fields are consistent for all notable events and each notable event returns different additional fields depending on the syntax of the correlation search.  To be specific on your question, we can't customize the fields for each notables, any changes that you make to notable event fields affect all notable events.

The best you can do is remove the unwanted annotations fields and consider displaying important fields like user/srcip,destip,port, filepath etc.

To add the field to the list of additional fields for a notable, you can follow the below steps.

• From the Splunk Enterprise Security menu bar, select Configure > Incident Management > Incident Review Settings.
• Click Add new entry to add the new field to the Additional Fields section of the notable event details.
• Type a Label to use as the display name of the field in the notable event details.
• Type a Field to match the field that you want to appear in the notable event details.
• Click Done & Save.

Hope this helps and trying to assist you with what I know. 

For reference : 

Customize notable event settings in Splunk Enterprise Security - Splunk Documentation