Is there a way to query ES investigations for artifacts? For example, suppose that I have a current notable with a hostile foreign IP address. I would like to query Splunk and find all previous investigations with that IP address so that analyst can review the previous investigations.
