Hi, I’d appreciate your help extracting attachments/notes that users add to Findings (Mission Control) for reporting purposes using SPL in Splunk Cloud Platform. Until recently, I was using a custom SPL query based on _audit logs (mc_generic_kv_update) to retrieve this data, but after upgrading to Enterprise Security 8.3 it stopped working. From Splunk Support I understand that this method is no longer supported and that notes/attachments are no longer exposed via KV store or _audit, and that the recommended approach is via the Enterprise Security API. Is there still any supported way to extract this data using SPL only (for example via | rest) in Splunk Cloud, or is the only supported option to use external REST API calls (port 8089 with IP allowlisting)? If anyone has successfully implemented this (either via SPL or API), I’d appreciate an example or guidance. ... View more