In-console notes let admins record findings, context, and the reasons for their decisions directly on the item under investigation. Anyone who opens the same item later can read the notes, so context isn't lost between admins.
Notes can be added to the following pages:
| Page | Notes attach to |
|---|---|
| Monitor > Detection Center | A detection |
| Investigate > EDR Suspicious Activity | A suspicious activity incident |
| Managed Services > Cases | A Managed Detection and Response (MDR) case |
Each of these pages has a Notes tab that lists all notes for the item.
Add a note
- In Nebula, click on a detection, suspicious activity incident, or MDR case.
- At the bottom, enter a note into the text field, up to 1,000 characters.
- Click Add note.
- The note is saved to the Notes tab.
Notes are plain text. Users can't be @mentioned in notes, and files can't be attached.
View notes
Open the Notes tab on the detection, suspicious activity, or case. Each note shows its author, the date and time it was added, and its full text. Notes are listed in chronological order, newest first.
Edit or delete a note
The author can edit or delete notes.
- In the Notes tab, find the note.
- Click Edit
or Delete
.
- If editing, update the text and click Save.
Audit logging
Every time a note is added, edited, or deleted, Nebula records it under Investigate > Activity Logs > Audit Logs. Each entry shows who made the change, what they did, and when the change occurred.