Hi, Thanks for your help in solving this issue. Here is my solution : Create the lookup definition in missioncontrol/local/transforms.conf for mc_notes : [mc_notes_lookup] collection = mc_notes external_type = kvstore fields_list = ai_generated,content,create_time,files,incident_id,last_edited_by,source,source_type,title,update_time,_key   Comments can then be corelated with notables : `notable` |eval `get_event_id_meval`,rule_id=event_id |lookup mc_findings_lookup notable_id AS event_id OUTPUT _key AS incident_id |lookup mc_notes_lookup incident_id OUTPUT content AS comment   Hope this helps. ... View more