Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support timeevent grouping/clustering #1864

Open
patrickdalla opened this issue Sep 5, 2023 · 4 comments · May be fixed by #2094
Open

Support timeevent grouping/clustering #1864

patrickdalla opened this issue Sep 5, 2023 · 4 comments · May be fixed by #2094

Comments

@patrickdalla
Copy link
Collaborator

Change timeline desing to support event types grouping, like WinEvtx, filesystem MACD , P2P etc.

This could be used for:

  • Filter out unimportant eventtypes that overloads timechart and timeline view.
  • Index/cache based on more important timeevent groups, avoiding memory overload.

So the user could still view all timeevents, but for the more common, the APP would be optimized.

@patrickdalla
Copy link
Collaborator Author

Event type grouping would be declared in a config file, in JSON or XML format.

@patrickdalla
Copy link
Collaborator Author

Hi @lfcnassif,

While waiting processing of big case for ALeappBridgeTask testing, I have done adraft to this issue. It groups time events based on prefix (not prefixed event types goes into BasicProperties). I've made a video to ilustrate it.

The cache/indexing is also done on time event group base, i.e., one index/cache per timeeventgroup, so it keeps in memory only needed info to plot the corresponding time event group chosen.

Although the checkbox on video, it is not yet possible to choose multiple time event groups. And I have a question on this: Could we subdivide this enhancement in others:

  1. Propose this simpler implementation (almost finished) that only allows on selected time event group.
  2. Create other issue to propose multiple time event groups selection
  3. Customize time event groups not by prefix, but by some configurable file
timeeventgroup-2024-02-21_12.59.54.mp4

patrickdalla added a commit that referenced this issue Feb 21, 2024
@lfcnassif
Copy link
Member

Hi @patrickdalla, this seems very useful, thanks!

one index/cache per timeeventgroup

Would this be backwards compatible with old cases? I think this is important.

  1. Propose this simpler implementation (almost finished) that only allows on selected time event group.
  2. Create other issue to propose multiple time event groups selection

Will the user be able to plot arbitrary event types together like he/she is able today? I think it is important to keep.

  1. Customize time event groups not by prefix, but by some configurable file

This is useful, but I agree it can be implemented later.

@patrickdalla
Copy link
Collaborator Author

Hi @lfcnassif ,
Answering the question:"Would this be backwards compatible with old cases?"

The persisted indexes/cache info will be based on group of events (subdir name). So, when opening old cases, the old index with all events won't be changed, but new ones will be created for each group. It will become redundant, consuming space, but will be backward compatible.

patrickdalla added a commit that referenced this issue Feb 22, 2024
never selected its cache is not created/loaded.
patrickdalla added a commit that referenced this issue Feb 22, 2024
patrickdalla added a commit that referenced this issue Feb 22, 2024
@patrickdalla patrickdalla linked a pull request Feb 22, 2024 that will close this issue
@patrickdalla patrickdalla linked a pull request Feb 22, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants