Suggestions for improvements to WebUI column customisation

[J-A-Sec]

Is your feature request related to a problem? Please describe.
It's very useful to have timestamp_desc as a visible column, but it's not enabled by default. You also can't reorder any column in front of the message column, which for looking at Plaso MFT output, for example, is much easier to parse when timestamp_desc is before the message.

You can customise what columns are shown, but these do not persist across sessions, and you can't choose the order of columns aside from selecting them top to bottom (corresponding to left-to-right) order.

The ticked columns in the Select Columns dialog are spread throughout the entire column list, making it difficult to find the ticked columns and to make changes, for example to remove a single column, or to swap columns around.

Columns cannot be resized manually, which sometimes results in unnecessary blank space between fields.

Describe the solution you'd like
For my workflows, it would be a huge improvement to have the ability to:

• Set the default columns shown alongside datetime and message. Considering these columns, plus timestamp_desc, are the only mandatory fields, this might mean just including timestamp_desc by default as well.
• Reorder columns in any order (aside from datetime).
• (In the Select Columns dialog) Show all currently selected columns at the top, and ideally the ability to drag and drop columns around to reorder them.
• Manually resize columns
• Bonus: Set "views", e.g. customise a set of columns that are useful when looking at Event Logs, then a different set for looking at MFT, etc.

Thanks!

[jkppr]

Hi @J-A-Sec ,

Thanks for the detailed UI feedback and suggestions for the explore table! We appreciate you taking the time to outline the challenges and propose solutions.

Improving the explore table is definitely on our radar, and we're aiming to tackle it next year. Your feedback will be valuable as we plan those improvements.