Project

General

Profile

Actions

Feature #7678

closed

Better event view

Added by Jakub Judiny 9 months ago. Updated 2 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
Development - GUI
Target version:
Start date:
09/26/2023
Due date:
% Done:

100%

Estimated time:
(Total: 0.00 h)
To be discussed:
No

Description

Multiple fields from IDEA are not displayed in the event view. It would be great to add at least the most used ones, so users do not have to go to JSON view.

Mainly:
- attachments
- refs
- counts (ConnCount/FlowCount...)
- AggrWin in Nodes


Files


Subtasks 1 (0 open1 closed)

Feature #7685: Implement hostname context search and additional data loading in event viewClosedJakub Judiny09/26/2023

Actions

Related issues

Related to Mentat - Bug #7561: Inconsistent quotation in YAML representation of eventRejected02/16/2022

Actions
Actions #1

Updated by Jakub Judiny 9 months ago

  • Status changed from New to In Progress
Actions #2

Updated by Pavel Kácha 9 months ago

  • Related to Bug #7561: Inconsistent quotation in YAML representation of event added
Actions #3

Updated by Pavel Kácha 9 months ago

Added #7561 as related. We might be actually able to get rid of that YAML altogether and close #7561 after we have nicer and more useful Idea view, as YAML was just a crutch for a bit better Idea view than pure JSON.

Actions #4

Updated by Pavel Kácha 8 months ago

Just note: cz.cesnet.ftas content type is fixed (from text/csv to text/plain)

Actions #5

Updated by Jakub Judiny 8 months ago

  • Status changed from In Progress to Resolved
Actions #6

Updated by Jakub Judiny 7 months ago

  • Related to Feature #7685: Implement hostname context search and additional data loading in event view added
Actions #7

Updated by Rajmund Hruška 7 months ago

  • Target version changed from Backlog to 2.12

In fc7bdcc9, why did you set self.csag = {} in lib/hawat/base.py, when it was already set to an empty dictionary a few lines before that?

Documentation for events blueprint is now (or will be, after merge) outdated - https://713.gitlab-pages.cesnet.cz/mentat/mentat/devel/html/_doclib/hawat_plugin_events.html#section-hawat-plugin-events. But it would be nice to update the documentation in general.

Other than that, LGTM.

Actions #8

Updated by Rajmund Hruška 7 months ago

  • Status changed from Resolved to Feedback
Actions #9

Updated by Jakub Judiny 7 months ago

  • Status changed from Feedback to Resolved

Rajmund Hruska wrote in #note-7:

In fc7bdcc9, why did you set self.csag = {} in lib/hawat/base.py, when it was already set to an empty dictionary a few lines before that?

Documentation for events blueprint is now (or will be, after merge) outdated - https://713.gitlab-pages.cesnet.cz/mentat/mentat/devel/html/_doclib/hawat_plugin_events.html#section-hawat-plugin-events. But it would be nice to update the documentation in general.

Other than that, LGTM.

self.csag = {} was not intentional, so I removed it. I also added some missing fields from FTAS events. I am planning to update the documentation, but it would be great to deploy this on alt before I update it, so we can test it more.

Actions #10

Updated by Jakub Judiny 7 months ago

Also, while working on #7685, I merged branch 'judiny-bugfix-#7683-passivedns-hostname' into 'judiny-feature-#7678-better-event-view', so when you merge this branch into devel, you don't need to merge 'judiny-bugfix-#7683-passivedns-hostname' into devel anymore.

Actions #11

Updated by Rajmund Hruška 7 months ago

  • Status changed from Resolved to In Review
Actions #12

Updated by Rajmund Hruška 7 months ago

In Czech, the Detectors section is translated as "Detektorů". It's the same in the current production version, but I have only noticed now and it makes sense to fix it in this issue.

Actions #13

Updated by Radko Krkoš 7 months ago

As for providing potentially malicious code for download safely (discussed in VC), application/octet-stream is designed for this:
https://www.iana.org/assignments/media-types/application/octet-stream

Actions #14

Updated by Rajmund Hruška 2 months ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF