Add a note in Splunk SOAR (On-premises)

Add a general note using the /note command in Splunk SOAR (On-premises). Only general notes are supported. Use the following format: 

/note "<title>" <note body>

You can use a datapath with a note to add additional information to a note. See Use a datapath in Splunk SOAR (On-premises). This is shown in the following example: 

/note "Attackers" Based on geolocate ip, attacks originated from artifact:*.ip

The above example results in a note added with the title "Attackers" and a body that looks like the following: 

Based on geolocate ip, attacks originated from [2.2.2.2, 1.1.1.1]

Notes and datapaths

You can use a datapath anywhere in a note title or body. The datapath is evaluated as a Python style list, and creates a single note with the results listed in it.

See Use a datapath in Splunk SOAR (On-premises).