# Security alerts notes

**URL:** <https://discuss.elastic.co/t/security-alerts-notes/385113>\
**Category:** Elastic Security\
**Created:** [February 19, 2026, 11:52am UTC](https://discuss.elastic.co/t/security-alerts-notes/385113 "2026-02-19T11:52:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cristina\_Marletta\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cristina_marletta_li/32/137793_2.png) [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\
**Post date:** [February 19, 2026, 11:52am UTC](https://discuss.elastic.co/t/security-alerts-notes/385113/1 "2026-02-19T11:52:56Z")

</div>

_Hi all,_

I added a note to a security alert. The document associated with the alert is viewable in Discover, but I don't see any fields containing my note. In which index is the note stored?

I read that it is stored in the kibana.alert.workflow\_reason field but I can't find this field among those populated in the document corresponding to the alert.

Thank you for any help you can give me.

---

<div class="post-metadata">

**Author:** ![Jatin\_Kathuria](https://avatars.discourse-cdn.com/v4/letter/j/d6d6ee/32.png) [@Jatin\_Kathuria](https://discuss.elastic.co/u/Jatin_Kathuria)\
**Post date:** [February 19, 2026, 1:25pm UTC](https://discuss.elastic.co/t/security-alerts-notes/385113/2 "2026-02-19T13:25:36Z")

</div>

Hello @Cristina_Marletta_Li ,

Notes cannot be accessed in Discover since they are not part of the alert document. There are plans in future to add notes capability in discover but for now it is only Security Solution feature.

---

<div class="post-metadata">

**Author:** ![Cristina\_Marletta\_Li](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cristina_marletta_li/32/137793_2.png) [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\
**Post date:** [February 19, 2026, 2:20pm UTC](https://discuss.elastic.co/t/security-alerts-notes/385113/3 "2026-02-19T14:20:05Z")

</div>

> [@Jatin\_Kathuria](#):
>
> Hello @Cristina_Marletta_Li ,
> 
> Notes cannot be accessed in Discover since they are not part of the alert document. There are plans in future to add notes capability in discover but for now it is only Security Solution feature.

Hi,

but other field like kibana.alert.workflow\_status are visible…

What field can I use to add variable information (e.g. a TT number) to the alert that is discoverable?