rekall-agent-server icon indicating copy to clipboard operation
rekall-agent-server copied to clipboard

Delete Flow doesn't do anything

Open kevthehermit opened this issue 8 years ago • 1 comments

From the flow page inspect_list

Select one or many flows and click the Delete icon and nothing happens.

kevthehermit avatar Nov 06 '17 14:11 kevthehermit

Yes :-). I didn't implement this. I was thinking about how it should work. In GRR you can not delete flows because it is an auditing trail - it is important to know that someone ran the flow and the data that was collected. But the downside is that the flows UI becomes very crowded - especially when the flows were a mistake (e.g. someone ran with the wrong parameters and it did not work) then it is important to remove it from the UI.

I think in Rekall we should just mark them as deleted but not really delete them - just hide from the UI. We also need to add a button to "show deleted flows".

This means we also need to have a reasonable story about archiving and data retention. but that is a different issue.

scudette avatar Nov 06 '17 17:11 scudette