Extract attachments/notes from Findings (Mission Control) in Splunk ES 8.3 using SPL

[Kobi998]

Hi,

I’d appreciate your help extracting attachments/notes that users add to Findings (Mission Control) for reporting purposes using SPL in Splunk Cloud Platform.

Until recently, I was using a custom SPL query based on _audit logs (mc_generic_kv_update) to retrieve this data, but after upgrading to Enterprise Security 8.3 it stopped working. From Splunk Support I understand that this method is no longer supported and that notes/attachments are no longer exposed via KV store or _audit, and that the recommended approach is via the Enterprise Security API.

Is there still any supported way to extract this data using SPL only (for example via | rest) in Splunk Cloud, or is the only supported option to use external REST API calls (port 8089 with IP allowlisting)?

If anyone has successfully implemented this (either via SPL or API), I’d appreciate an example or guidance.

[livehybrid]

Hi @Kobi998 

Have you see this endpoint? 

https://{stack}:{port}/servicesNS/nobody/missioncontrol/public/v2/investigations/{id}/notes

https://help.splunk.com/en/splunk-enterprise-security-8/api-reference/8.5/splunk-enterprise-security...

Also this might help: https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-8-2-API-note-management/td-p/75...

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing