💡 Still using the classic Drata experience? Refer to Annotate an Event for the original UI.
Why add event notes
Event notes help you:
Explain why an event occurred
Document investigation or remediation details
Add auditor-facing context to automated activity
Attach supporting documentation to system events
Who can annotate events
The following Drata roles can add, edit, or remove event notes:
Admin
Information Security Lead
Add a note to an event
Go to Events.
Select an event in the table.
Select the sidebar arrow.
Enter your note.
(Optional) Upload a supporting file.
Save the note.
The note is saved immediately and is visible to other authorized users.
Manage event notes
You can also:
View the full history of notes for the event
Edit or delete notes you created
Upload files to provide additional evidence or context
Only the user who uploaded a file can delete that file.
How notes appear in audit evidence
Notes are included in the event PDF under the Notes section.
If files are attached, the download is provided as a ZIP file that includes:
The event PDF
All attached files
This ensures annotations and attachments are preserved for audit review.
Key behaviors to understand
Events remain read-only and cannot be modified
Notes are timestamped and attributed to the author
Notes do not affect monitoring results or control status
Notes persist with the event for audit history