I'd like to propose a simplification to the UI that will reduce the number of controls displayed and clicks that a user needs to do. It will also help focus attention on a single rule match at time, which can help the page from feeling overwhelming.
With the current implementation, there are a lot of clicks needed to expand the logic for a rule match. As a user, if I want to see the details of a rule match, given that the rules aren't typically very large (up to a dozen lines), I just want to see all the logic, not hunt through all the levels of the logic tree. Therefore, I don't think we should have the ability to hide portions of a rule's logic. Instead, as a rule match is inspecting, we should toggle showing all/none of it.
It's also important to know where the rule matches occurred (#2189). So, when there are multiple matches for a rule, its ok to only show one match's worth of logic at a time.
Implementation-wise, I think this means that the rule logic can be rendered as nested ul lists (with appropriate padding/margins), rather than needing an interactive javascript tree widget. The lines within the rule logic can also be spaced more closely together, increasing the visual density and better indicating how data is grouped.
I'd like to propose a simplification to the UI that will reduce the number of controls displayed and clicks that a user needs to do. It will also help focus attention on a single rule match at time, which can help the page from feeling overwhelming.
Mockup (multiple pages here): https://www.tldraw.com/ro/3xqHSWNIKia10RQwkSOzU?v=0,0,1567,1265&p=page
With the current implementation, there are a lot of clicks needed to expand the logic for a rule match. As a user, if I want to see the details of a rule match, given that the rules aren't typically very large (up to a dozen lines), I just want to see all the logic, not hunt through all the levels of the logic tree. Therefore, I don't think we should have the ability to hide portions of a rule's logic. Instead, as a rule match is inspecting, we should toggle showing all/none of it.
It's also important to know where the rule matches occurred (#2189). So, when there are multiple matches for a rule, its ok to only show one match's worth of logic at a time.
Implementation-wise, I think this means that the rule logic can be rendered as nested ul lists (with appropriate padding/margins), rather than needing an interactive javascript tree widget. The lines within the rule logic can also be spaced more closely together, increasing the visual density and better indicating how data is grouped.
When no rules are shown:![image](https://github.com/mandiant/capa/assets/156560/c094bef3-4ea7-4a29-9a56-bf8fb68740f1)
When a rule with a single match is shown:![image](https://github.com/mandiant/capa/assets/156560/b672cc71-5345-4ecf-9084-c0d38c0f3c81)
(commentary)![image](https://github.com/mandiant/capa/assets/156560/a231829e-88f8-45a1-b708-f1e5d03b8eec)
When a rule with multiple matches is shown:![image](https://github.com/mandiant/capa/assets/156560/0bbcec57-dd03-46e8-a1f9-7a1b04cb46e0)
(commentary)![image](https://github.com/mandiant/capa/assets/156560/5c47c9cf-8511-4dbb-98fd-b4e994096af7)