Right now, I’m not fully sure how the mc_investigations_lookup is managed or updated. My goal is simply to build a report that shows both findings and investigations together. The only data sources I’ve been able to identify so far are the `notable`  (raw notable events) and the mc_investigations_lookup (KV store lookup used by Mission Control) I compared the fields between `notable` and mc_investigations_lookup and couldn’t find a key that would link them directly.  Because Mission Control can group findings inside an investigation in the UI, I assumed there must be some relationship stored somewhere — either in another lookup, index, or hidden mapping — but I haven’t been able to locate it yet. Since we’re on Splunk Cloud, I’m also not sure whether we’re allowed to modify the KV store or extend it with our own fields. So at this point, I’m mainly trying to understand: Where the relationship between findings and investigations is actually stored Whether there is any supported way to expose that relationship for reporting Any guidance or pointers would be really appreciated.   ... View more

Hi @yuanliu  Our current practice is: When we configure event detection in ES, we set it up to extract entities and threats. The detection job runs on a schedule, and each time it runs we receive a single email notification that includes all matching cases. However, findings are still generated individually for each entity or threat. During investigation, we usually group all related findings into one investigation so they align with the email alert. But for reporting purposes, we need to submit the list of finding, investigation and include information whether a finding has already been investigated and which investigation it belongs to.  Ideally, after a finding is added to an investigation, there should be a visible link between the two datasets — for example, an investigation ID in the finding details (or vice-versa).  The mission control UI does not have export function so we are trying to write SPL to do the export. However, there isn’t any field that can be used to link the two datasets, `notable` and mc_investigations_lookup. ... View more

Hi @gcusello  Default dashboards such as Security Posture have the button "Add Key Indicator" but the custom dashboard does not have it. security posture custom dashboard Thanks. ... View more