feat: Add Playbook Manager, Saved Searches, and Timeline View components

- Implemented PlaybookManager for creating and managing investigation playbooks with templates. - Added SavedSearches component for managing bookmarked queries and recurring scans. - Introduced TimelineView for visualizing forensic event timelines with zoomable charts. - Enhanced backend processing with auto-queued jobs for dataset uploads and improved database concurrency. - Updated frontend components for better user experience and performance optimizations. - Documented changes in update log for future reference.
2026-03-01 14:00:20 -05:00 · 2026-02-23 14:23:07 -05:00
parent 37a9584d0c
commit 5a2ad8ec1c
110 changed files with 10537 additions and 1185 deletions
--- a/backend/alembic/versions/b2c3d4e5f6a7_add_playbooks_saved_searches.py
+++ b/backend/alembic/versions/b2c3d4e5f6a7_add_playbooks_saved_searches.py
@@ -0,0 +1,78 @@
+"""add playbooks, playbook_steps, saved_searches tables
+
+Revision ID: b2c3d4e5f6a7
+Revises: a1b2c3d4e5f6
+Create Date: 2026-02-21 10:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = "b2c3d4e5f6a7"
+down_revision: Union[str, Sequence[str], None] = "a1b2c3d4e5f6"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # Add display_name to users table
+    with op.batch_alter_table("users") as batch_op:
+        batch_op.add_column(sa.Column("display_name", sa.String(128), nullable=True))
+
+    # Create playbooks table
+    op.create_table(
+        "playbooks",
+        sa.Column("id", sa.String(32), primary_key=True),
+        sa.Column("name", sa.String(256), nullable=False, index=True),
+        sa.Column("description", sa.Text(), nullable=True),
+        sa.Column("created_by", sa.String(32), sa.ForeignKey("users.id"), nullable=True),
+        sa.Column("is_template", sa.Boolean(), server_default="0"),
+        sa.Column("hunt_id", sa.String(32), sa.ForeignKey("hunts.id"), nullable=True),
+        sa.Column("status", sa.String(20), server_default="active"),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+    )
+
+    # Create playbook_steps table
+    op.create_table(
+        "playbook_steps",
+        sa.Column("id", sa.Integer(), primary_key=True, autoincrement=True),
+        sa.Column("playbook_id", sa.String(32), sa.ForeignKey("playbooks.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("order_index", sa.Integer(), nullable=False),
+        sa.Column("title", sa.String(256), nullable=False),
+        sa.Column("description", sa.Text(), nullable=True),
+        sa.Column("step_type", sa.String(32), server_default="manual"),
+        sa.Column("target_route", sa.String(256), nullable=True),
+        sa.Column("is_completed", sa.Boolean(), server_default="0"),
+        sa.Column("completed_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("notes", sa.Text(), nullable=True),
+    )
+    op.create_index("ix_playbook_steps_playbook", "playbook_steps", ["playbook_id"])
+
+    # Create saved_searches table
+    op.create_table(
+        "saved_searches",
+        sa.Column("id", sa.String(32), primary_key=True),
+        sa.Column("name", sa.String(256), nullable=False, index=True),
+        sa.Column("description", sa.Text(), nullable=True),
+        sa.Column("search_type", sa.String(32), nullable=False),
+        sa.Column("query_params", sa.JSON(), nullable=False),
+        sa.Column("threshold", sa.Float(), nullable=True),
+        sa.Column("created_by", sa.String(32), sa.ForeignKey("users.id"), nullable=True),
+        sa.Column("hunt_id", sa.String(32), sa.ForeignKey("hunts.id"), nullable=True),
+        sa.Column("last_run_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("last_result_count", sa.Integer(), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+    )
+    op.create_index("ix_saved_searches_type", "saved_searches", ["search_type"])
+
+
+def downgrade() -> None:
+    op.drop_table("saved_searches")
+    op.drop_table("playbook_steps")
+    op.drop_table("playbooks")
+    with op.batch_alter_table("users") as batch_op:
+        batch_op.drop_column("display_name")
--- a/backend/alembic/versions/c3d4e5f6a7b8_add_processing_tasks_table.py
+++ b/backend/alembic/versions/c3d4e5f6a7b8_add_processing_tasks_table.py
@@ -0,0 +1,48 @@
+"""add processing_tasks table
+
+Revision ID: c3d4e5f6a7b8
+Revises: b2c3d4e5f6a7
+Create Date: 2026-02-22 00:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = "c3d4e5f6a7b8"
+down_revision: Union[str, Sequence[str], None] = "b2c3d4e5f6a7"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "processing_tasks",
+        sa.Column("id", sa.String(32), primary_key=True),
+        sa.Column("hunt_id", sa.String(32), sa.ForeignKey("hunts.id", ondelete="CASCADE"), nullable=True),
+        sa.Column("dataset_id", sa.String(32), sa.ForeignKey("datasets.id", ondelete="CASCADE"), nullable=True),
+        sa.Column("job_id", sa.String(64), nullable=True),
+        sa.Column("stage", sa.String(64), nullable=False),
+        sa.Column("status", sa.String(20), nullable=False, server_default="queued"),
+        sa.Column("progress", sa.Float(), nullable=False, server_default="0.0"),
+        sa.Column("message", sa.Text(), nullable=True),
+        sa.Column("error", sa.Text(), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+        sa.Column("started_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("completed_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+    )
+    op.create_index("ix_processing_tasks_hunt_stage", "processing_tasks", ["hunt_id", "stage"])
+    op.create_index("ix_processing_tasks_dataset_stage", "processing_tasks", ["dataset_id", "stage"])
+    op.create_index("ix_processing_tasks_job_id", "processing_tasks", ["job_id"])
+    op.create_index("ix_processing_tasks_status", "processing_tasks", ["status"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_processing_tasks_status", table_name="processing_tasks")
+    op.drop_index("ix_processing_tasks_job_id", table_name="processing_tasks")
+    op.drop_index("ix_processing_tasks_dataset_stage", table_name="processing_tasks")
+    op.drop_index("ix_processing_tasks_hunt_stage", table_name="processing_tasks")
+    op.drop_table("processing_tasks")