mquery icon indicating copy to clipboard operation
mquery copied to clipboard

[META] Results view improvements

Open msm-code opened this issue 5 years ago • 1 comments

Description Right now, results view is pretty basic. Since it's one of the most important views in the system, we should work on improving it

Required Features

  • [x] #78 Filter query results based on rule-name
  • [ ] #38 Show matched strings
  • [x] #81 Bugfix for query updater
  • [x] #64 Show query duration
  • [x] #37 Display number of results immediately (both here and in /recent)
  • [x] #34 Add a copy button for all hashes, and for every single hash
  • [x] #16 Display hash values along with samples

We should also consider making the query-view and results-view separate subpages (querying and looking at the results are different use-cases)

msm-code avatar Apr 10 '20 16:04 msm-code

Copying this nice writeup by @ITAYC0HEN here (source: https://github.com/CERT-Polska/mquery/issues/78#issuecomment-612114150):

Absolutely. I agree. I think it should be carefully planned, even discussing with a UX personnel or at least an experienced front-end dev.

Keep this in mind:

  • How should mquery used in your opinion
    • Should it used mostly via API or from the website
    • Should it be used for hunting? For testing?
    • How familiar is the user with the dataset?
  • The table can be expanded with more metadata about the samples
    • Hash(es), mime type, size, VT detection rate, MWDB link
    • Is it the desired outcome at all? Or do you want it to only be limited to hash+matched rule(s)
  • How useful is the query textarea after a query is executed? should it be collapsed maybe, to free more screen space? Can be un-collapsed upon demand
  • Should you even invest time in MQuery's front end? Maybe it can be narrowed to a simple one, as it is now, and let MWDB integration provide the rich tables, the filtering, the metadata (hashes, mime types, size, more labels)

msm-code avatar Apr 10 '20 16:04 msm-code