mandiant / mandiant/capa

webui: dynamic view group by process and hierarchical ordering

Open
#2,237 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement webui
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

This issue tracks the discussion and implementation of https://github.com/mandiant/capa/issues/1866 for the webui. Please chime in here or let's discuss in our next sync.

## Hierarchical ordering
Each call address has 4 values with the last one being the ID. A higher ID means the call occurred later. This is easy to sort by.

I'd propose the default rendering to use this ID for ordering (e.g. in a separate column).

Sidenote: We may only run into issues here if there are hits that don't contain this level of detail but only the TID, PID, and PPID. From what I can tell all sandbox results contain timestamp values for relevant events but we do not currently store them. It may make sense to store these if needed.

## Group processes
Currently processes are indicated like this: `id:364 ← tid:3064 ← pid:3052 ← ppid:2456`. I think to make results much clearer we can group all events under the respective PID and name that PID according to the process information.

## Mockup
Here's a mockup of the combined results.

**` PID / PPID`**
rule name | Call ID | Namespace | ...
| - | - | - | - |
rule 1 | `` | namespace 1 | ...

**` PID / PPID`**
rule x | `` | namespace x | ...
| - | - | - | - |

## Process overview
In a later stage we could show a process tree view at the top or to the right of the page to visualize the process layout and relationships.

Alternatively, this view could allow to enable to disable certain processes to include in the results rendering via check-boxes.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the linked capa issue #1866 and this issue's web UI mockup. Define the scope with maintainers before locating the relevant web UI entry points; done would need process grouping, hierarchical call ordering, and an agreed presentation of process information.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
frontend, web-dev
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.