you can start by checking out the itsi_grouped_alerts. This is the index for episodes.  If you want to check the notables, go to itsi_tracked_alerts. If you want to get the information that you see in the Episode Review, you might want to use the itsi_grouped_alerts index=itsi_grouped_alerts sourcetype="itsi_notable:group" | table itsi_group_id itsi_group_title itsi_group_description owner itsi_group_count This is a starting point, you can go further and adding more fields as you like.  ... View more