Apparently it is possible to handle note ,that was created before under findings . An example:   curl --location 'https://<splunk>:8089/servicesNS/nobody/missioncontrol/public/v2/investigations/6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde/notes/84db8262-c447-4a90-bbc1-96f8d5b2a1d2' \ --header 'Content-Type: application/json' \ --header 'Accept: application/json' \ --header 'Authorization: Bearer {{sessionKey}}' \ --data '{ "title": "Test finding4 for ES 8.2 - new note 19 - updated ", "content": "Comment for Test finding4 for ES 8.2 - via new API" }' In this example  the first id in the url is finding id and the second one is note id.     ... View more

This specific API is working fine, yes. But the problem comes  when you try to get notes or update specific note. The response in most cases will be :   {     "code": "MC_01202",     "message": "No investigation found mapped to this display id: 6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde",     "request_id": "3d497390-1472-41d5-b702-19cf60750d60" }   I suspect the the reason is following . When we are looking at response from my example we can see following :  "source_type": "Incident",   But when we are looking on documentation example here : https://help.splunk.com/en/splunk-enterprise-security-8/api-reference/8.2/splunk-enterprise-security-api-reference/investigation/public_v2_create_note_in_investigation   we see "source_type": "Task"   INHO this is a bug : 1 . "type": "Task" in request is not documented and has no affect 2. Apparently Splunk considered new note connected to an investigation  and not to the finding and  that't why I see an error for any other note-related API           ... View more

Hi @livehybrid and thank you for an answer.  The example you provided doesn't work :   request : curl --location 'https://<mysplunk>:8089/servicesNS/nobody/missioncontrol/public/v2/investigations/6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde/notes' \ --header 'Content-Type: application/json' \ --header 'Accept: application/json' \ --header 'Authorization: Bearer XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' \ --data '{ "title": "Test finding4 for ES 8.2 - new note 8", "content": "Comment for Test finding4 for ES 8.2 - via new API", "type": "Task" }' response: { "code": "MC_01202", "message": "No investigation found mapped to this display id: 6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde", "request_id": "b7e6edd4-498e-45f6-a344-96086203768e" } The example that worked for me : request 2 curl --location 'https://<mysplunk>/servicesNS/nobody/missioncontrol/public/v2/investigations/6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde/notes?notable_time=-3m' \ --header 'Content-Type: application/json' \ --header 'Accept: application/json' \ --header 'Authorization: Bearer XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX' \ --data '{ "title": "Test finding4 for ES 8.2 - new note 16", "content": "Comment for Test finding4 for ES 8.2 - via new API " }' response 2: { "id": "e258bd11-5e59-491a-b070-5d5d1af7cedd", "create_time": 1761639950.3005178, "update_time": 1761639950.3005178, "title": "Test finding4 for ES 8.2 - new note 16", "content": "Comment for Test finding4 for ES 8.2 - via new API ", "author": { "username": "developer" }, "ai_generated": false, "files": [], "last_edited_by": null, "response_plan_info": null, "source": null, "source_type": "Incident", "incident_id": null, "notable_id": "6237136d-044b-4dd6-9a70-229af0f55bde@@notable@@6237136d044b4dd69a70229af0f55bde" }   The note is created correctly and can be seen in UI.           ... View more