Splunk® SOAR (On-premises)

Use Splunk SOAR (On-premises)

As of version 6.4.0, the visual editor for classic playbooks is no longer part of Splunk SOAR. Before upgrading, convert your classic playbooks to modern mode. Your classic playbooks will continue to run and you can view and edit them in the SOAR Python code editor.
For details, see:
This documentation does not apply to the most recent version of Splunk® SOAR (On-premises). For documentation on the most recent version, go to the latest release.

Create, sort, and filter notes in

Select the Notes tab to view all notes, regardless of who created them. You can create, sort, and filter notes in when working with events, tasks, and cases.

Create a note

To create a note, follow these steps:

  1. Navigate to an event, task, or case in .
  2. Select the Notes tab.
  3. Enter a title and body text for your note.
  4. (Optional) Select the paper clip icon ( This image shows the paper clip icon. ) to add an attachment. You can upload a new attachment of up to 20 MB. To upload a larger attachment, first upload it using the Files tab. You can then add the larger file to the note as an existing file, using the paper clip icon.
  5. (Optional) Select the image icon ( This image shows the paper clip icon. ) to add a new or existing image of up to 2 MB. Supported image file types added through the image icon include JPG, JPEG, PNG, GIF, BMP, and ICO. Alternatively, copy an image or screenshot and paste the JPG or PNG file directly into the note. Images added either with the image icon or by pasting appear inline in the body of the note after you save the note.
  6. Select Save.

To edit, delete, or mark a note as evidence, select the more icon This image shows the more icon.. After your note is marked as evidence, it appears in the Evidence tab.

Sort and filter notes

To filter notes by the type of note, use the drop-down list in the Show field to select Task Notes, General Notes, or Artifact Notes.

To sort notes by recency, use the drop-down list in the Sort field to select Newest or Oldest.

Using HTML and Markdown in notes

Notes can include a limited set of HTML and Markdown.

supports most common Markdown elements. For details, see "Markdown Reference" on the CommonMark website. The following table provides examples of HTML and Markdown elements and states whether or not supports it.

Element Supported?
HTML table No
HTML hyperlink No
HTML inline image No
Markdown hyperlink Yes
Markdown inline image Yes
Last modified on 17 September, 2024
View recommended playbooks, actions, and mission experts for resolving an event   Search within

This documentation applies to the following versions of Splunk® SOAR (On-premises): 6.1.0, 6.1.1, 6.2.0, 6.2.1, 6.2.2


Please expect delayed responses to documentation feedback while the team migrates content to a new system. We value your input and thank you for your patience as we work to provide you with an improved content experience!

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters