ES Incident review Contextualize and Investigate returns blank results page

[srickermartin]

ES Incident review Contextualize and Investigate returns blank results page. This looks like it would be a nice addition for my guys if it worked. If anyone has this working please share.

[srickermartin · Accepted solution]

I believe I have answered my own question. The issue appears to be the lack of data for the leveraged data models in the underlying searches that are used for this feature. All that needs to be done is to provide the data in a CIM format and let the model build.