Get processing timeline events

timesketch/api/v1/resources/aggregation.py

@@ -468,7 +468,7 @@ def post(self, sketch_id):
         sketch_indices = {
             t.searchindex.index_name
             for t in sketch.timelines
-            if t.get_status.status.lower() == "ready"
+            if t.get_status.status.lower() in ["ready", "processing"]
         }
 
         aggregation_dsl = form.aggregation_dsl.data

timesketch/frontend-ng/src/components/Explore/TimelineChip.vue

@@ -50,7 +50,7 @@ limitations under the License.
             <template v-slot:activator="{ on: onTooltip, attrs }">
               <span
                 class="timeline-name-ellipsis"
-                :class="{ disabled: !isSelected && slotProps.timelineStatus === 'ready' }"
+                :class="{ disabled: !isSelected && (slotProps.timelineStatus === 'processing' || slotProps.timelineStatus === 'ready') }"
                 v-bind="attrs"
                 v-on="onTooltip"
                 >{{ timeline.name }}</span
@@ -88,7 +88,7 @@ export default {
   },
   methods: {
     timelineStyle(timelineStatus) {
-      const greyOut = timelineStatus === 'ready' && !this.isSelected
+      const greyOut = (timelineStatus === 'processing' || timelineStatus === 'ready') && !this.isSelected
       return {
         opacity: greyOut ? '50%' : '100%',
         backgroundColor: this.$vuetify.theme.dark ? '#303030' : '#f5f5f5',

timesketch/frontend-ng/src/components/Explore/TimelineComponent.vue

@@ -20,7 +20,7 @@ limitations under the License.
 -->
 <template>
   <span>
-    <v-dialog v-if="timelineStatus === 'processing'" v-model="dialogStatus" width="600">
+    <v-dialog v-if="!timelineAvailable" v-model="dialogStatus" width="600">
       <template v-slot:activator="{ on, attrs }">
         <slot
           name="processing"
@@ -155,7 +155,7 @@ limitations under the License.
             </v-card>
           </v-dialog>
 
-          <v-list-item v-if="timelineStatus === 'ready'" @click="$emit('toggle', timeline)">
+          <v-list-item v-if="timelineAvailable" @click="$emit('toggle', timeline)">
             <v-list-item-action>
               <v-icon v-if="isSelected">mdi-eye-off</v-icon>
               <v-icon v-else>mdi-eye</v-icon>
@@ -164,7 +164,7 @@ limitations under the License.
             <v-list-item-subtitle v-else>Re-enable</v-list-item-subtitle>
           </v-list-item>
 
-          <v-list-item v-if="timelineStatus === 'ready'" @click="$emit('disableAllOtherTimelines', timeline)">
+          <v-list-item v-if="timelineAvailable" @click="$emit('disableAllOtherTimelines', timeline)">
             <v-list-item-action>
               <v-icon>mdi-checkbox-marked-circle-minus-outline</v-icon>
             </v-list-item-action>
@@ -245,7 +245,7 @@ limitations under the License.
             <v-list-item-subtitle>Run Analyzers</v-list-item-subtitle>
           </v-list-item>
 
-          <v-list-item style="cursor: pointer" @click="deleteConfirmation = true">
+          <v-list-item v-if="timelineAvailable" style="cursor: pointer" @click="deleteConfirmation = true">
             <v-list-item-action>
               <v-icon>mdi-trash-can-outline</v-icon>
             </v-list-item-action>
@@ -399,12 +399,18 @@ export default {
     timelineFailed() {
       return this.timelineStatus === 'fail'
     },
+    timelineAvailable() {
+      return this.timelineStatus === 'ready' || (this.showProcessingTimelineEvents && this.timelineStatus === 'processing')
+    },
     timelineChipColor() {
       if (!this.timeline.color.startsWith('#')) {
         return '#' + this.timeline.color
       }
       return this.timeline.color
     },
+    showProcessingTimelineEvents() {
+      return this.$store.state.settings.showProcessingTimelineEvents
+    },
   },
   methods: {
     openDialog() {

timesketch/frontend-ng/src/components/SettingsDialog.vue

@@ -40,6 +40,17 @@ limitations under the License.
           >
         </v-list-item-content>
       </v-list-item>
+      <v-list-item>
+        <v-list-item-action>
+          <v-switch v-model="settings.showProcessingTimelineEvents" color="primary" @change="saveSettings()"></v-switch>
+        </v-list-item-action>
+        <v-list-item-content>
+          <v-list-item-title>Show processing timeline events</v-list-item-title>
+          <v-list-item-subtitle
+          >Select to include events from timelines in <strong>processing</strong> state</v-list-item-subtitle
+          >
+        </v-list-item-content>
+      </v-list-item>
     </v-list>
   </v-card>
 </template>
@@ -49,6 +60,7 @@ import ApiClient from '../utils/RestApiClient'
 
 const DEFAULT_SETTINGS = {
   showLeftPanel: true,
+  showProcessingTimelineEvents: false,
 }
 
 export default {
@@ -57,6 +69,7 @@ export default {
       settings: {
         showLeftPanel: true,
         generateQuery: true,
+        showProcessingTimelineEvents: false,
       },
     }
   },

timesketch/lib/utils.py

@@ -540,7 +540,7 @@ def get_validated_indices(indices, sketch):
     """
     sketch_structure = {}
     for timeline in sketch.timelines:
-        if timeline.get_status.status.lower() != "ready":
+        if timeline.get_status.status.lower() not in ["ready", "processing"]:
             continue
         index_ = timeline.searchindex.index_name
         sketch_structure.setdefault(index_, [])

timesketch/models/sketch.py

@@ -144,7 +144,7 @@ def active_timelines(self):
         for timeline in self.timelines:
             timeline_status = timeline.get_status.status
             index_status = timeline.searchindex.get_status.status
-            if (timeline_status or index_status) in ("processing", "fail", "archived"):
+            if (timeline_status or index_status) in ("fail", "archived"):
                 continue
             _timelines.append(timeline)
         return _timelines