Additional editable timestamp property on Evidence about ashirt-server

[audibleblink]

I just looked through the code to gauge the lift and saw you already use occurred_at as the default timestamp by which the timeline is sorted. I'm struggling to think of a different name for the editable field but wanted to clear up the confusion since my proposed property name already exists.

[jrozner]

We're open to discussion about this. It's designed as is to prevent tampering with data and preserve the data. We've definitely run into issues where evidence had to be captured later and the timeline ends up being out of order. Like you mentioned there is an occurred_at field which is what we currently use for sorted evidence. When evidence is created in the web UI that defaults to the same value as created_at (the current time). When using a client like ASHIRT, the occurred_at timestamp is the timestamp that the client records and the created_at is the time the server creates the evidence. We probably want to be able to maintain that. Maybe we can add another adjusted_timestamp field that is user controllable and we can sort by that; defaulting to the value in occurred_at if adjusted_timestamp isn't set?

1. Would you want everyone with write permissions to be able to adjust a timestamp or only admins of an operation?
2. Would you want to see some sort of UI icon or other denotation that the timestamp for a specific evidence has been adjusted in the timeline?

[audibleblink]

Anyone with write should be able to modify the adjusted_at timestamp.

I think when viewing a single piece of evidence where the timestamps differ, a subdued timestamp or marker could appear under the description.

Having a button or toggle in the menu bar (or some other prominent place) that states whether the current view is being sorted by occurrence/adjusted date would be ideal.