Create, sort, and filter notes in Splunk SOAR (On-premises)

To create a note, follow these steps:

1. Navigate to an event, task, or case in Splunk SOAR (On-premises).
2. Select the Notes tab.
3. Enter a title and body text for your note.
4. (Optional) Select the paper clip icon ( ) to add an attachment. You can upload a new attachment of up to 20 MB. To upload a larger attachment, first upload it using the Files tab. You can then add the larger file to the note as an existing file, using the paper clip icon.
5. (Optional) Select the image icon ( ) to add a new or existing image of up to 2 MB. Supported image file types added through the image icon include JPG, JPEG, PNG, GIF, BMP, and ICO. Alternatively, copy an image or screenshot and paste the JPG or PNG file directly into the note. Images added either with the image icon or by pasting appear inline in the body of the note after you save the note.
6. Select Save.

To edit, delete, or mark a note as evidence, select the more icon . After your note is marked as evidence, it appears in the Evidence tab.

To filter notes by the type of note, use the drop-down list in the Show field to select Task Notes, General Notes, or Artifact Notes.

To sort notes by recency, use the drop-down list in the Sort field to select Newest or Oldest.

Notes can include a limited set of HTML and Markdown.

Splunk SOAR (On-premises) supports most common Markdown elements. For details, see "Markdown Reference" on the CommonMark website. The following table provides examples of HTML and Markdown elements and states whether or not Splunk SOAR (On-premises) supports it.