dfir-iris/iris-web

[FR] Add button to show "raw event data" directly from Timeline page

cybiosity-syn opened this issue · 0 comments

Please ensure your feature request is not already on the roadmap or associated with an issue. This can be checked here.

Is your feature request related to a problem? Please describe.
I structure my investigations in timeline in the following way :

  • title for an overview
  • event description : some important details / precisions about the event
  • raw event data : dump of unstructured event data, for quick reference

When I browse the timeline in search for an information, I'd like to quickly browse the raw event data without having to click on "Edit" > "Edit raw event data", as it can get frustrating having to do it too often.

Describe the solution you'd like
I'd like a button on each event in the timeline view. Ideally, this button would only be shown for events that have data in the "raw event data".

Clicking on the button would extend the event's box up to a maximum size, a bit like "See more" does. There would be a maximum size, because the "raw event data" is supposed to contain very verbose data.

If the data in "raw event data" is too big to fit into this maximum size, there would be a slider on the right, like Markdown data in the notes.

Ideally, this data would be shown in monospace font that differentiates l, I and 1, because "raw event data" is supposed to be raw.

Describe alternatives you've considered
Just using the description for dumping raw data. But this seems like a wrong use of the description field, and it feels like the "raw event data" is not used enough.