Skip to main content

Collections Screens

This page documents every screen under /analyst/collections: the list, the detail page, all four sub-pages (Files, API Logs, Chain of Custody, Sign Off), and the New Collection wizard. Together they cover the full lifecycle of a forensic collection from creation through delivery.

Collections list​

Route: /analyst/collections

The list loads up to 100 collections (capped to keep the page fast), ordered by priority then creation date. Collections are grouped into four sections, each with a coloured status dot and a count; empty sections are hidden:

SectionDotStatuses
Active Collectionsblue (pulsing)pending, validating_creds, queued, in_progress, paused
Needs Reviewyellowcompleted, partial, reviewing
Completedgreensigned_off, delivered
Errors & Cancelledrederror, cancelled

If there are no collections at all, an empty-state card is shown instead of the sections.

Header actions​

  • Kill N active? — only appears when there are active collections. Cancels all of them at once (POSTs to /api/collections/cancel-all). This is a bulk-cancel; use with care.
  • Upload Credential — opens the credential upload form.
  • New Collection — opens the New Collection wizard.

Collection card​

Each card shows the platform name, a status badge, a priority pill, the last 8 characters of the collection ID (monospace), the customer company, the creation date, and the case reference if set. For in_progress or queued collections a progress bar is shown (completed/total endpoints plus files collected). The View button opens the detail page.

Collection detail page​

Route: /analyst/collections/{id}

The hub for a single collection. The layout is: header, full-width status cards, then a two-column body (details on the left, actions + activity timeline on the right).

  • Back to Collections link
  • Title: "{Platform} Collection", with the customer company and case reference beneath
  • Right side badges: a purple Test Collection pill (if it is an analyst test), a priority pill, and the status badge

Conditional status cards​

These appear at the top depending on the collection's state:

  • Live Progress card — shown while the collection is active (pending/validating_creds/queued/in_progress/paused). Polls the server and updates endpoint/file/byte counts live.
  • Delivery Progress — shown when signed_off; polls until the collection flips to delivered.
  • Paused notice (yellow) — shown when paused; states how many endpoints completed before the pause and when it was paused.
  • Error card (red) — shown whenever an errorMessage is set. Displays the message and error count. If the collection is signed_off, this card also carries a Retry ZIP button (re-attempts ZIP packaging/delivery).

Left column — details​

A stack of cards:

  • Assigned Analyst — a dropdown to assign/reassign the collection (see below).
  • Progress Statistics — endpoints completed/total, files collected, data size in MB. Shows a progress bar and a pulsing "In Progress" pill while active.
  • Customer — company, contact name, email. For test collections this becomes a "Test Collection" card.
  • Connector — platform name and version.
  • Credential — credential type (e.g. "OAuth 2.0", "API Key") and a validation-status pill (valid / invalid / other).
  • Dates — created, started, paused, completed (whichever apply).
  • On-Behalf-Of Action (blue) — only if an analyst initiated the collection on a customer's behalf; names that analyst.
  • Business Context — the free-text context entered at creation.
  • Scope Configuration — a JSON dump of the scope filters, only shown if a non-empty scope was set.

Assigned Analyst dropdown​

Loads the list of analysts on mount. Selecting a name (or Unassigned) immediately PATCHes the assignment and shows a toast; admins are tagged with an "Admin" pill. On error the selection reverts.

Right column — actions​

A wrap of buttons whose availability depends on status:

ButtonWhen it showsWhat it does
View Files (N)alwaysOpens the Files sub-page
API LogsalwaysOpens the API Logs sub-page
Chain of CustodyalwaysOpens the Chain of Custody sub-page
Sign Offcompleted/partial/reviewing, and not a test collectionOpens the Sign Off page
Pause Collectionin_progressPauses after the current endpoint (confirmation dialog)
Resume CollectionpausedResumes from where it left off (confirmation dialog)
Cancel Collectionactive statusesCancels the collection
Rerun Collectionterminal statuses (completed/partial/error/cancelled)Creates a new collection with the same configuration and starts it; the original is untouched
ZIP PassworddeliveredOpens the ZIP password dialog
Download Collectiondelivered with a signed URLDownloads the delivered ZIP via the SAS URL

Pause / Resume dialogs​

Both are confirmation dialogs. Pause notes that progress is saved and can be resumed; Resume notes it continues processing remaining endpoints. Both show a spinner while the request is in flight and refresh the page on success.

Rerun dialog​

Confirms before creating the rerun. The new collection's business context is suffixed with "(rerun)". If the original was an on-behalf-of collection, the rerun carries the reason "Rerun of previous collection".

ZIP password dialog​

Fetches the ZIP password on open. The value is masked by default with a show/hide eye toggle and a copy-to-clipboard button. The password is cleared from the dialog when you close it (security), and retrieving it is logged for audit. Share it securely with the customer.

Activity Timeline​

Below the action buttons. Shows chain-of-custody and API-call events newest-first, paged 10 at a time. While the collection is active it polls for new events. For the full, detailed event log use the dedicated Chain of Custody sub-page.

Files sub-page​

Route: /analyst/collections/{id}/files

Four stat cards at the top: Total Files, Total Size, Hash Validated (count of files whose SHA-256 was verified), and Errors (files in error status). Below is a searchable table of every collected file with its filename, size, MIME type, SHA-256 hash, validation status, status, and collection time. A search query parameter pre-filters the table.

API Logs sub-page​

Route: /analyst/collections/{id}/logs

The complete forensic record of every HTTP request made during collection. Four stat cards: Total Requests, Avg Latency, Data Transferred, and Errors (4xx/5xx).

The table loads 50 rows per page and supports filtering by response code and endpoint category. Each log row carries the full forensic detail captured per request — request method/URL, sanitized headers, request/response body hashes, source and destination IPs, DNS resolution, TLS certificate fingerprint, a per-phase latency breakdown (DNS / TCP / TLS / TTFB / download / total), retry attempt, pagination cursor, and how many files that call produced.

Chain of Custody sub-page​

Route: /analyst/collections/{id}/chain-of-custody

The legally significant audit trail. Four stat cards: Total Events, Unique Actors, State Changes, and Errors.

Below is a vertical timeline, newest first. Each event has a colour-coded icon by event type (collection created, credentials validated, started, paused, resumed, completed, analyst assigned/ reviewed/signed off, ZIP created, SAS URL generated, customer notified, delivered, archived, error, credentials revoked, cancelled). Each entry shows:

  • The event label and an actor icon by actor type (system, analyst, customer, automated/worker)
  • The actor's name and IP address (if recorded)
  • The timestamp
  • A state transition (previous → new), when the event changed the collection's status
  • A Details block expanding any structured event data

System actors render as "System"; automated worker events render as "Worker Process".

Sign Off page​

Route: /analyst/collections/{id}/sign-off

Where an analyst formally approves a collection for delivery. Only reachable for completed, partial, or reviewing collections that are not test collections. If the collection is already signed_off or delivered, you're redirected back to the detail page. If it's in any other state, a "Cannot Sign Off" warning is shown.

Review checklist​

Four items, each with a description and a live stat pulled from the collection. All four must be checked before sign-off is enabled:

ItemStat shown
Files CollectedN files collected
Hashes Verifiedverified / total verified
API Logs ReviewedN API calls logged
Chain of Custody CompleteN events recorded

Checked items turn green. An amber reminder shows until all are confirmed.

Notes and signature​

  • Analyst Notes — an optional free-text field for observations.
  • Analyst Signature — a signature pad (draw with mouse or touch). A Clear button resets it.

Submitting​

The Sign Off Collection button is disabled until all checklist items are ticked. On submit, the form also requires a non-empty signature. Validation failures raise an alert; success shows a toast ("queued for delivery") and returns you to the detail page. After sign-off the collection moves toward delivered.

New Collection wizard​

Route: /analyst/collections/new

A six-step stepper for creating a collection. Analysts create collections on behalf of a customer by default. Navigation is via the Back / Next buttons at the bottom; Next is disabled until the current step's requirements are met.

StepNameWhat you doRequired to continue
1CustomerToggle "Create on behalf of customer" (on by default) and pick the customer. A yellow notice explains the customer will be emailed and the action recorded in chain of custody.A customer must be selected (when on-behalf-of is on)
2ConnectorPick the platform from a grid. If the connector has unpublished changes in local storage, an amber warning notes the collection will use the published version.A connector must be selected
3CredentialsChoose from the customer's stored credentials for that connector. If none exist, a prompt links to the credential upload form.A credential must be selected
4ScopeOptional filters: date range, users, channels, file types, plus any connector-specific runtime parameters.Any required runtime parameters must be filled
5DetailsCase reference, business context, priority, and — for on-behalf-of — a reason (minimum 10 characters, included in the customer email).—
6ReviewSummary of everything, with the on-behalf-of and unpublished-change warnings repeated.—

Submitting POSTs to /api/collections, shows a success toast, and navigates to the new collection's detail page. Selecting a different customer in step 1 resets the connector and credential choices; selecting a different connector resets the credential choice.