feat(engine+ui): Replace lancedb with postgres - Githubissues

TracecatHQ / tracecat

The open source Tines / Splunk SOAR alternative.

https://tracecat.com

GNU Affero General Public License v3.0

2.34k stars 159 forks source link

feat(engine+ui): Replace lancedb with postgres #250

Closed topher-lo closed 1 month ago

topher-lo commented 1 month ago

What changed

Remove lancedb
Add Case table to postgres (via SQLModel)
Migrated all case endpoints list_case, get_case, update_case to SQLModel queries
Removed CaseMetric schema and models
Remove streaming auto label from API and UI
Drop unused events UI component (deprecated version of run history)

Why

LanceDB requires AVX https://github.com/lancedb/lance/issues/2195 and older CPUs can't run Tracecat.

Related to https://github.com/TracecatHQ/tracecat/issues/246

Note

Test pnpm build is failing, but it's just some weird GH cache issue. Tested that it works with pnpm build locally
There's no relation between Case table and other tables e.g. Workflow. This is intentional. Cases should not delete on cascade for audit purposes.

QA

[x] Ran AWS GuardDuty to cases playbook
[x] Cases created via action
[x] View cases in UI
[x] Select case row and case window opens
[x] Can create comment and update case status and malice / benign classification

Screens

Screenshot 2024-07-18 at 3 53 38 PM

Screenshot 2024-07-18 at 3 53 53 PM