First draft

docs/serverless/investigate/add-manage-notes.mdx

@@ -0,0 +1,40 @@
+---
+slug: /serverless/security/add-manage-notes
+title: Create and manage notes
+description: Create and manage notes for alerts, events, and Timeline.
+tags: ["serverless","security","how-to","manage"]
+---
+
+<DocBadge template="technical preview" />
+<div id="add-manage-notes"></div>
+
+Incorporate notes into your investigative workflows to coordinate responses, conduct threat hunting, and share investigative findings. You can attach notes to individual alerts and events, and leave notes on saved Timelines. You can then manage notes from the **Notes** page, or from individual alerts, events, or Timelines.
+
+## Add notes 
+
+To add a note to an alert: 
+
+1. Find **Alerts** in the main menu or by using the [global search field](((kibana-ref))/introduction.html#kibana-navigation-search).
+1. Scroll down to the Alerts table, go to the alert you want to add a note to, then click the notes icon. The **Notes** tab in the alert details flyout opens.
+1. Enter a note into the text box, then click **Add note**.
+
+To add a note to an event: 
+
+1. Find **Explore** in the main menu or by using the [global search field](((kibana-ref))/introduction.html#kibana-navigation-search), then go to **Hosts**, **Users**, **Network**.
+1. Scroll down to the **Events** tab, go to the event you want to add a note to, then click the notes icon. The **Notes** tab in the events details flyout opens.
+1. Enter a note into the text box, then click **Add note**.
+
+To add a note to a saved Timeline:
+
+1. Do one of the following:
+    * Find **Timeline** in the main menu or by using the [global search field](((kibana-ref))/introduction.html#kibana-navigation-search), then click a Timeline's title. 
+    * Go to the Timeline bar, click the image:images/add-new-timeline-button.png[Click the add new button,20,20] button, then click **Open Timeline**. Click a Timeline's title to open it.
+1. Go to the **Notes** tab.
+1. Enter a note into the text box, then click **Add note**.
+
+## Manage notes 
+
+To manage notes....
+
+
+

docs/serverless/serverless-security.docnav.json

@@ -661,7 +661,11 @@
             {
               "slug": "/serverless/security/cases-settings", 
               "classic-sources": [ "enSecurityCasesSettings" ]
-            }
+            },
+        {
+          "slug": "/serverless/security/add-manage-notes",
+          "classic-sources": [ "enSecurityAddManageNotes" ]
+        }
           ]
         }
       ]