We use links to events and detections in our case management platform for analysts to navigate to the original JSON data in the LC web app. These links contain the embedded atom ID which indicates to the web app which event or detection to present. We are observing the following issues:
When navigating to a direct link to a telemetry event, the event JSON is shown but the timeline does not highlight the event. Clicking “Scroll into view” has no impact.
The detections list populates but the specific detection requested in the URL parameters is not shown unless the timeline has already loaded the detection. Otherwise, you must scroll through the timeline until the detection comes into view, in which case the event is then highlighted and shown in the view pane.
thanks for reporting, legit case. the 1st is a bug, scroll into view should work. On the second, would it be sufficient to implement a working “scroll into view” there?
Understandably, having an arbitrary event in infinite timelines ready in a browser is hard and unlikely route for the folks to take.
Yes, if that is the solution that will resolve the problem. What I am running into is that the detection JSON isn’t shown at all if it is not within the timeline’s view, thus having to scroll through the list until the detection is loaded.
We’ve done some improvements; there are corner cases where this still likely manifests, they’ll require more work that we’'ve planned to do but not immediately. Hope the current improvements will hold for some time. Thanks again for reporting.
Thank you. Have these changes been rolled into a new release that has yet to be announced? Appears both issues still exist in the current web app version.