dfir-iris / iris-web

Collaborative Incident Response platform
GNU Lesser General Public License v3.0
1.08k stars 184 forks source link

[BUG] Nested timeline items are not shown #594

Open 59e5aaf4 opened 1 month ago

59e5aaf4 commented 1 month ago

Describe the bug

Timeline events whose parent also have a parent are NOT SHOWN in the timeline. Related to #492 and the overall parent-child system of timeline events.

To Reproduce Steps to reproduce the behavior:

  1. Create a timeline event A
  2. Create a timeline event B , set parent = A
  3. Create a timeline event C , set parent = B
  4. Show the timeline
  5. Only A & B are shown, no way to see C.

Expected behavior

Either infinite nesting of events work and we can see several layers of events, or a system to prevent having child-child events.

Screenshots

image

Desktop (please complete the following information):

Additional context Don't mind our fancy colors & ISO timestamps & title formatting, it's a local internal fork based on iris-2.4.7 :P

whikernel commented 1 month ago

Hello!

I can't replicate the issue - the nesting can be done. For UI reasons there are no more tabs after the first levels, but the folding still works.

image
whikernel commented 1 month ago

Maybe you changed something in your fork?

59e5aaf4 commented 1 month ago

Hm, curious. When creating sample items in the proper order with a pristine 2.4.7 ( 79cc64ffdff056d7505f189c0964b085710f2a76 ) they are shown , but not my own “buggy” events.

$ jq '.data.tim[]|[.event_id, .parent_event_id, .event_title, .event_in_summary, .event_in_graph]|map(tostring)|join("\t")' events.json -r | column -s$'\t' -t
2   null  another one    true   true
3   null  testing        true   true
1   3     test           true   true
5   null  testset        true   true
4   null  somelog event  true   true
6   1     completelynew  true   true
7   null  finaleevnet    true   true
8   null  level1         false  true
9   8     level2         false  true
10  9     level3         false  true

image

I could tie my « level3” new event to the “test” buggy level2 item, and it would not be shown until that “test” level2 item lost its parent ,effectively becoming a level1 item :

image

As soon as it has a parent, we can’t see the childs. See how it has that “child happens after parent” warning, yet no child visible :

image

Testing around with new events, it seems that it’s just that “test” event id=1 in my data that can’t have shown children when it’s not a level1 item. I took a peek at the js code responsible to timeline ordering of parents & children. I then came back to our fork (it’s really just minor color hardcoding changes) and could pin down a working reproduction : • If event_id=1 has a parent, none of his children are shown • If event_id=1 has no parent, all his children are shown • Argh there are other cases where no children are shown, that is for event_id=2. But not if event_id_2.parent = 1. As such, my hypothesis is that if children ID < parent_id, no children are shown. This is inline with consecutively created items appearing correctly, and with my weird local behaviors.

image

Aha !

I could indeed pin it down to nested conditions where child_id < parent_id. Try reverting the parent order in consecutively created events. Level3_id10 would be parent of level2_id9 itself parent of level1_id8. In my case, the level1_id8, in this case third-level child (“level3”:P) did not appear :

image