webui: dynamic view group by process and hierarchical ordering
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 6.2k
- Forks
- 726
- Avg merge
- 11d 11h
- Merged PRs (30d)
- 7
Description
This issue tracks the discussion and implementation of https://github.com/mandiant/capa/issues/1866 for the webui. Please chime in here or let's discuss in our next sync.
## Hierarchical ordering
Each call address has 4 values with the last one being the ID. A higher ID means the call occurred later. This is easy to sort by.
I'd propose the default rendering to use this ID for ordering (e.g. in a separate column).
Sidenote: We may only run into issues here if there are hits that don't contain this level of detail but only the TID, PID, and PPID. From what I can tell all sandbox results contain timestamp values for relevant events but we do not currently store them. It may make sense to store these if needed.
## Group processes
Currently processes are indicated like this: `id:364 ← tid:3064 ← pid:3052 ← ppid:2456`. I think to make results much clearer we can group all events under the respective PID and name that PID according to the process information.
## Mockup
Here's a mockup of the combined results.
**` PID / PPID`**
rule name | Call ID | Namespace | ...
| - | - | - | - |
rule 1 | `` | namespace 1 | ...
**` PID / PPID`**
rule x | `` | namespace x | ...
| - | - | - | - |
## Process overview
In a later stage we could show a process tree view at the top or to the right of the page to visualize the process layout and relationships.
Alternatively, this view could allow to enable to disable certain processes to include in the results rendering via check-boxes.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the linked capa issue #1866 and this issue's web UI mockup. Define the scope with maintainers before locating the relevant web UI entry points; done would need process grouping, hierarchical call ordering, and an agreed presentation of process information.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- frontend, web-dev
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100