Skip to main content
Card Annotations lets you tag and add notes to individual search results, transforming raw findings into actionable intelligence. The real-time Team annotation flow described here applies to legacy Team projects.
Organization searches are shared through organization history and can be grouped in organization investigations. The legacy Team annotation flow described here remains separate.
This feature is available on full result pages across paid app plans. Limited free previews do not include annotations.

​
Core capabilities

Tag each result with a status:
  • Verified — Confirmed finding, ready for action
  • Investigate — Needs further research or validation
  • False Positive — Not relevant, can be ignored
  • Custom tags — Create your own labels (Follow-up, High Priority, Duplicate, etc.)
Tags are color-coded for quick scanning. Each user maintains independent tags per result.
Attach notes (up to 1,000 characters) to any result:
Use notes for investigation updates, action items, decision rationale, or ticket links.
Use the Filter panel to narrow results by tags:
  • Show only “Verified” findings
  • Focus on “Investigate” items for next sprint
  • Hide “False Positive” results
Filters apply across your team’s annotations.
Use the search bar to find results by tag or note content:
  • Search “HIPAA” finds all tagged/noted HIPAA references
  • Search “Follow-up” finds custom tags and notes mentioning follow-up

​
Legacy Team collaboration

When working on a team search, annotations sync instantly across all members. Benefits:
  • See teammates’ tags and notes in real-time (no refresh needed)
  • Hover over tags to see who added them
  • One person tags as “Verified”, the whole team sees it immediately
  • Avoid duplicate investigations
From the result page header, use Collaborate to:
  • Link the search to a team project
  • Invite team members to contribute
  • View active team members and their activity in the Collaborate panel
Legacy Team collaboration requires an active Team workspace. See Organizations & workspaces for the current shared-workspace model.

​
Getting started

​
Individual use

1

Run a search

Execute any search for an identifier (email, domain, IP, etc.)
2

Hover and click the tag icon

Hover over a result card and click the tag icon in the top-right
3

Choose or create a tag

Select a preset tag (Verified, Investigate, False Positive) or enter a custom label
4

Add a note (optional)

Type investigation notes or context for this result (up to 1,000 characters)
5

Save

Click Save. The tag now appears on the card with your chosen color.
From the card, you can:
  • Click the tag again to edit
  • Click the X to remove

​
Legacy Team collaboration

1

Click Collaborate

From the result page header, click Collaborate
2

Select or create a team project

Choose an existing team project or create a new one
3

Share with your team

Team members now see all results and your annotations in real-time
4

Tag and discuss

Add tags and notes. Team members see them instantly and can add their own.

​
Use cases

  • Tag confirmed threats as “Verified”
  • Add remediation steps in notes
  • Filter to “Verified” for incident reporting
  • Create custom tags (“Account Takeover”, “Credential Stuffing”)
  • Track progress with notes
  • Filter by status to track next review items
  • Team members collaborate without duplicating work
  • Tag counterfeit or unauthorized use with custom labels
  • Track takedown requests in notes
  • Filter for legal team review

​
Limitations

  • One tag per result per user (everyone maintains independent tags)
  • Notes limited to 1,000 characters
  • Tags are scoped to the current search (create projects for long-term tracking)
  • Real-time sync requires active team collaboration mode

​
Next steps

Organize findings in projects

Use an organization investigation for long-term search, note, and file organization. Legacy Team annotations remain a separate historical flow.

Share and export results

Export annotated results and share them with stakeholders.

Organizations & workspaces

Understand the current shared-workspace model and its data boundaries.