search

Velocidex / velociraptor

Digging Deeper....
https://docs.velociraptor.app/
Other
2.95k stars 486 forks source link

Impossible to delete "broken" event artifact notebook #3854

Open misje opened 3 hours ago

misje commented 3 hours ago

In order to delete a event artifact notebook, you need to first navigate to the notebook tab in the events viewer, then click the delete button:

2024-10-26_12-56

However, if the notebook fails to load for some reason, and the whole page is blank, there is no way to delete the notebook. The only workaround is to delete the notebook files in the datastore. An example of how to break the notebook is to add a timestamp to the first column passed to "LineChart" (as opposed to an epoch value).

I would expect the notebook to be deleted when all of the corresponding event data is deleted using this button: 2024-10-26_12-58

That is when all of it is deleted, not just a small time-limited amount. After all, it is very confusing to get an existing notebook loaded from completely new event data – along with the old StartTime and EndTime. In normal flows, deleting the flow also deletes the notebook (or at least makes it inaccessible, certainly not to be loaded into the next flow from the same artifact).

Having to delete all event data to delete a notebook isn't necessarily a solution for solving an issue with broken notebooks, but I assume those cases are rare. However, also deleting the notebook when all traces of the event artifact is gone, is far less surprising behaviour to the user.

scudette commented 3 hours ago

Can you please check the JavaScript console for any exceptions?

The interfaced should not be crashing

misje commented 3 hours ago

I don't have the same dataset and cannot reproduce it any more, but I remember from the console output that there was a NaN exception of some sort. Definitely related to the plot, as it only crashed when it was attempted rendered.

misje commented 2 hours ago

2024-10-26_13-27

I can't find any invalid numbers in the dataset. It only (occasionally(?)) happens I try to plot the first column as a timestamp instead of an epoch value.

scudette commented 2 hours ago

The javascript is minified so it makes it hard to know where the error occurs. Can you please click on the link in the top right and the pretty print icon (looks like {} ) and attach the screenshot where the error occurs?