rekall-agent-server
rekall-agent-server copied to clipboard
Delete Flow doesn't do anything
From the flow page inspect_list
Select one or many flows and click the Delete icon and nothing happens.
Yes :-). I didn't implement this. I was thinking about how it should work. In GRR you can not delete flows because it is an auditing trail - it is important to know that someone ran the flow and the data that was collected. But the downside is that the flows UI becomes very crowded - especially when the flows were a mistake (e.g. someone ran with the wrong parameters and it did not work) then it is important to remove it from the UI.
I think in Rekall we should just mark them as deleted but not really delete them - just hide from the UI. We also need to add a button to "show deleted flows".
This means we also need to have a reasonable story about archiving and data retention. but that is a different issue.