Hyperlinks to Events and Detections

Feature Requests
1

We use links to events and detections in our case management platform for analysts to navigate to the original JSON data in the LC web app. These links contain the embedded atom ID which indicates to the web app which event or detection to present. We are observing the following issues:

Telemetry Events:

URL: https[://]app[.]limacharlie[.]io/orgs/{oid}/sensors/{sid}/timeline?selected={atom}

When navigating to a direct link to a telemetry event, the event JSON is shown but the timeline does not highlight the event. Clicking “Scroll into view” has no impact.

Detection Events:

URL: https[://]app[.]limacharlie[.]io/orgs/{oid}/detections?lastDetection={atom}

The detections list populates but the specific detection requested in the URL parameters is not shown unless the timeline has already loaded the detection. Otherwise, you must scroll through the timeline until the detection comes into view, in which case the event is then highlighted and shown in the view pane.

2

thanks for reporting, legit case. the 1st is a bug, scroll into view should work. On the second, would it be sufficient to implement a working “scroll into view” there?

Understandably, having an arbitrary event in infinite timelines ready in a browser is hard and unlikely route for the folks to take.

3

Yes, if that is the solution that will resolve the problem. What I am running into is that the detection JSON isn’t shown at all if it is not within the timeline’s view, thus having to scroll through the list until the detection is loaded.