On page 12 of 122 on the documentation of "Splunk Security Analyst Workflows 7.1.0" it says and I quote:
"If you added notable events to investigations, or generated short IDs for notable events to share them with other analysts,
you can filter by the Associations filter to quickly view the notable events associated with a specific investigation or the
notable event represented by a short identifier.
However, the short ID filter dropdown lists all short IDs, including notable
events that are suppressed."
I am confused by the statement: "If the notable event is suppressed, you will not be able to see it on the Incident Review page when filtering on short ID." when just before it, it says that : "However, the short ID filter dropdown lists all short IDs, including notable events that are suppressed."
Which one is true or correct. Does filtering using short IDS show the suppressed notable events or does it not on the incident review page?
Thank You
Kind Regards,
