@cccsaurora/howler-ui 2.18.0-dev.705 → 2.18.0-dev.710

package/api/search/facet/hit.d.ts

@@ -1,5 +1,3 @@
 import type { HowlerFacetSearchRequest, HowlerFacetSearchResponse } from '@cccsaurora/howler-ui/api/search/facet';
 export declare const uri: () => string;
-export declare const post: (request?: HowlerFacetSearchRequest) => Promise<{
-    [index: string]: HowlerFacetSearchResponse;
-}>;
+export declare const post: (request?: HowlerFacetSearchRequest) => Promise<HowlerFacetSearchResponse>;

package/api/search/facet/index.d.ts

@@ -8,6 +8,8 @@ export type HowlerFacetSearchRequest = {
     filters?: string[];
 };
 export type HowlerFacetSearchResponse = {
-    [value: string]: number;
+    [field: string]: {
+        [value: string]: number;
+    };
 };
 export { hit };

package/components/app/App.js

@@ -29,6 +29,7 @@ import CaseViewer from '@cccsaurora/howler-ui/components/routes/cases/CaseViewer
 import Cases from '@cccsaurora/howler-ui/components/routes/cases/Cases';
 import CaseAssets from '@cccsaurora/howler-ui/components/routes/cases/detail/CaseAssets';
 import CaseDashboard from '@cccsaurora/howler-ui/components/routes/cases/detail/CaseDashboard';
+import CaseTimeline from '@cccsaurora/howler-ui/components/routes/cases/detail/CaseTimeline';
 import ItemPage from '@cccsaurora/howler-ui/components/routes/cases/detail/ItemPage';
 import DossierEditor from '@cccsaurora/howler-ui/components/routes/dossiers/DossierEditor';
 import Dossiers from '@cccsaurora/howler-ui/components/routes/dossiers/Dossiers';
@@ -207,6 +208,10 @@ const router = createBrowserRouter([
                         path: 'assets',
                         element: _jsx(CaseAssets, {})
                     },
+                    {
+                        path: 'timeline',
+                        element: _jsx(CaseTimeline, {})
+                    },
                     {
                         path: '*',
                         element: _jsx(ItemPage, {})

package/components/elements/observable/ObservableCard.js

@@ -1,6 +1,5 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { CardContent, Skeleton } from '@mui/material';
-import { hit } from '@cccsaurora/howler-ui/api/search';
 import { RecordContext } from '@cccsaurora/howler-ui/components/app/providers/RecordProvider';
 import HowlerCard from '@cccsaurora/howler-ui/components/elements/display/HowlerCard';
 import { memo, useEffect } from 'react';
@@ -15,7 +14,7 @@ const ObservableCard = ({ id, observable: _observable }) => {
         }
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [id]);
-    if (!hit) {
+    if (!observable) {
         return _jsx(Skeleton, { variant: "rounded", height: "200px" });
     }
     return (_jsx(HowlerCard, { sx: { position: 'relative' }, children: _jsx(CardContent, { children: _jsx(ObservablePreview, { observable: observable }) }) }));

package/components/routes/cases/detail/CaseAssets.d.ts

@@ -1,12 +1,11 @@
 import type { Case } from '@cccsaurora/howler-ui/models/entities/generated/Case';
 import type { Hit } from '@cccsaurora/howler-ui/models/entities/generated/Hit';
 import type { Observable } from '@cccsaurora/howler-ui/models/entities/generated/Observable';
-import { type FC } from 'react';
 import { type AssetEntry } from './assets/Asset';
 /** Deduplicate and merge seenIn lists into a map keyed by `type:value` */
 export declare const buildAssetEntries: (records: Partial<Hit | Observable>[]) => AssetEntry[];
-declare const CaseAssets: FC<{
+declare const _default: import("react").NamedExoticComponent<{
     case?: Case;
     caseId?: string;
 }>;
-export default CaseAssets;
+export default _default;

package/components/routes/cases/detail/CaseAssets.js

@@ -2,7 +2,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Chip, Grid, Skeleton, Stack, Typography } from '@mui/material';
 import api from '@cccsaurora/howler-ui/api';
 import useMyApi from '@cccsaurora/howler-ui/components/hooks/useMyApi';
-import { useEffect, useMemo, useState } from 'react';
+import { memo, useEffect, useMemo, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { useOutletContext } from 'react-router-dom';
 import useCase from '../hooks/useCase';
@@ -101,4 +101,4 @@ const CaseAssets = ({ case: providedCase, caseId }) => {
     }
     return (_jsxs(Grid, { container: true, spacing: 2, px: 2, children: [_jsx(Grid, { item: true, xs: 12, children: _jsxs(Stack, { direction: "row", alignItems: "center", spacing: 1, flexWrap: "wrap", children: [_jsx(Typography, { variant: "subtitle2", color: "text.secondary", children: t('page.cases.assets.filter_by_type') }), records === null ? (_jsx(Skeleton, { width: 240, height: 32 })) : (assetTypes.map(type => (_jsx(Chip, { label: t(`page.cases.assets.type.${type}`), size: "small", onClick: () => toggleFilter(type), color: activeFilters.has(type) ? 'primary' : 'default', variant: activeFilters.has(type) ? 'filled' : 'outlined' }, type))))] }) }), records === null ? (Array.from({ length: 6 }, (_, i) => (_jsx(Grid, { item: true, xs: 12, sm: 6, md: 4, xl: 3, children: _jsx(Skeleton, { height: 100 }) }, `skeleton-${i}`)))) : filteredAssets.length === 0 ? (_jsx(Grid, { item: true, xs: 12, children: _jsx(Typography, { color: "text.secondary", children: t('page.cases.assets.empty') }) })) : (filteredAssets.map(asset => (_jsx(Grid, { item: true, xs: 12, md: 6, xl: 4, children: _jsx(Asset, { asset: asset, case: _case }) }, `${asset.type}:${asset.value}`))))] }));
 };
-export default CaseAssets;
+export default memo(CaseAssets);

package/components/routes/cases/detail/CaseSidebar.js

@@ -1,8 +1,8 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { Circle, Dashboard, Dataset } from '@mui/icons-material';
+import { CalendarMonth, Circle, Dashboard, Dataset } from '@mui/icons-material';
 import { alpha, Box, Card, Chip, Divider, Skeleton, Stack, Typography, useTheme } from '@mui/material';
 import dayjs from 'dayjs';
-import {} from 'react';
+import { useCallback } from 'react';
 import { useTranslation } from 'react-i18next';
 import { Link, useLocation } from 'react-router-dom';
 import { ESCALATION_COLOR_MAP } from '../constants';
@@ -11,49 +11,38 @@ const CaseSidebar = ({ case: _case, update }) => {
     const { t } = useTranslation();
     const location = useLocation();
     const theme = useTheme();
+    const navItemSx = useCallback((isActive) => [
+        {
+            cursor: 'pointer',
+            px: 1,
+            py: 1,
+            transition: theme.transitions.create('background', { duration: 100 }),
+            color: `${theme.palette.text.primary} !important`,
+            textDecoration: 'none',
+            background: 'transparent',
+            borderRight: `thin solid ${theme.palette.divider}`,
+            '&:hover': {
+                background: alpha(theme.palette.grey[600], 0.25)
+            }
+        },
+        isActive && {
+            background: alpha(theme.palette.grey[600], 0.15),
+            borderRight: `3px solid ${theme.palette.primary.main}`
+        }
+    ], [
+        theme.palette.divider,
+        theme.palette.grey,
+        theme.palette.primary.main,
+        theme.palette.text.primary,
+        theme.transitions
+    ]);
     return (_jsxs(Box, { sx: {
             flex: 1,
             maxWidth: '350px',
             maxHeight: 'calc(100vh - 64px)',
             display: 'flex',
             flexDirection: 'column'
-        }, children: [_jsxs(Card, { sx: { borderRadius: 0, px: 2, py: 1 }, children: [_case?.title ? _jsx(Typography, { variant: "body1", children: _case.title }) : _jsx(Skeleton, { height: 24 }), _jsxs(Stack, { direction: "row", spacing: 1, alignItems: "center", divider: _jsx(Circle, { color: "disabled", sx: { fontSize: '8px' } }), children: [_jsxs(Typography, { variant: "caption", color: "textSecondary", children: [t('started'), ": ", _case?.created ? dayjs(_case.created).toString() : _jsx(Skeleton, { height: 14 })] }), _case?.escalation ? (_jsx(Chip, { color: ESCALATION_COLOR_MAP[_case.escalation], label: t(_case.escalation) })) : (_jsx(Skeleton, { height: 24 }))] })] }), _jsxs(Stack, { direction: "row", alignItems: "center", sx: [
-                    {
-                        cursor: 'pointer',
-                        px: 1,
-                        py: 1,
-                        transition: theme.transitions.create('background', { duration: 100 }),
-                        color: `${theme.palette.text.primary} !important`,
-                        textDecoration: 'none',
-                        background: 'transparent',
-                        borderRight: `thin solid ${theme.palette.divider}`,
-                        '&:hover': {
-                            background: alpha(theme.palette.grey[600], 0.25)
-                        }
-                    },
-                    location.pathname === `/cases/${_case?.case_id}` && {
-                        background: alpha(theme.palette.grey[600], 0.15),
-                        borderRight: `3px solid ${theme.palette.primary.main}`
-                    }
-                ], component: Link, to: `/cases/${_case?.case_id}`, children: [_jsx(Dashboard, {}), _jsx(Typography, { sx: { userSelect: 'none', pl: 0.5, textWrap: 'nowrap' }, children: t('page.cases.dashboard') })] }), _jsxs(Stack, { direction: "row", alignItems: "center", sx: [
-                    {
-                        cursor: 'pointer',
-                        px: 1,
-                        py: 1,
-                        transition: theme.transitions.create('background', { duration: 100 }),
-                        color: `${theme.palette.text.primary} !important`,
-                        textDecoration: 'none',
-                        background: 'transparent',
-                        borderRight: `thin solid ${theme.palette.divider}`,
-                        '&:hover': {
-                            background: alpha(theme.palette.grey[600], 0.25)
-                        }
-                    },
-                    location.pathname === `/cases/${_case?.case_id}/assets` && {
-                        background: alpha(theme.palette.grey[600], 0.15),
-                        borderRight: `3px solid ${theme.palette.primary.main}`
-                    }
-                ], component: Link, to: `/cases/${_case?.case_id}/assets`, children: [_jsx(Dataset, {}), _jsx(Typography, { sx: { userSelect: 'none', pl: 0.5, textWrap: 'nowrap' }, children: t('page.cases.assets') })] }), _jsx(Divider, {}), _case && (_jsx(Box, { flex: 1, overflow: "auto", width: "100%", sx: {
+        }, children: [_jsxs(Card, { sx: { borderRadius: 0, px: 2, py: 1 }, children: [_case?.title ? _jsx(Typography, { variant: "body1", children: _case.title }) : _jsx(Skeleton, { height: 24 }), _jsxs(Stack, { direction: "row", spacing: 1, alignItems: "center", divider: _jsx(Circle, { color: "disabled", sx: { fontSize: '8px' } }), children: [_jsxs(Typography, { variant: "caption", color: "textSecondary", children: [t('started'), ": ", _case?.created ? dayjs(_case.created).toString() : _jsx(Skeleton, { height: 14 })] }), _case?.escalation ? (_jsx(Chip, { color: ESCALATION_COLOR_MAP[_case.escalation], label: t(_case.escalation) })) : (_jsx(Skeleton, { height: 24 }))] })] }), _jsxs(Stack, { direction: "row", alignItems: "center", sx: navItemSx(location.pathname === `/cases/${_case?.case_id}`), component: Link, to: `/cases/${_case?.case_id}`, children: [_jsx(Dashboard, {}), _jsx(Typography, { sx: { userSelect: 'none', pl: 0.5, textWrap: 'nowrap' }, children: t('page.cases.dashboard') })] }), _jsxs(Stack, { direction: "row", alignItems: "center", sx: navItemSx(location.pathname === `/cases/${_case?.case_id}/assets`), component: Link, to: `/cases/${_case?.case_id}/assets`, children: [_jsx(Dataset, {}), _jsx(Typography, { sx: { userSelect: 'none', pl: 0.5, textWrap: 'nowrap' }, children: t('page.cases.assets') })] }), _jsxs(Stack, { direction: "row", alignItems: "center", sx: navItemSx(location.pathname === `/cases/${_case?.case_id}/timeline`), component: Link, to: `/cases/${_case?.case_id}/timeline`, children: [_jsx(CalendarMonth, {}), _jsx(Typography, { sx: { userSelect: 'none', pl: 0.5, textWrap: 'nowrap' }, children: t('page.cases.timeline') })] }), _jsx(Divider, {}), _case && (_jsx(Box, { flex: 1, overflow: "auto", width: "100%", sx: {
                     position: 'relative',
                     borderRight: `thin solid ${theme.palette.divider}`
                 }, children: _jsx(Box, { position: "absolute", sx: { left: 0, right: 0 }, children: _jsx(CaseFolder, { case: _case, onItemUpdated: update }) }) }))] }));

package/components/routes/cases/detail/CaseTimeline.d.ts

@@ -0,0 +1,12 @@
+import type { Case } from '@cccsaurora/howler-ui/models/entities/generated/Case';
+interface MitreOption {
+    id: string;
+    name: string;
+    kind: 'tactic' | 'technique';
+}
+export declare const buildFilters: (mitre: MitreOption[], escalations: string[]) => string[];
+declare const _default: import("react").NamedExoticComponent<{
+    case?: Case;
+    caseId?: string;
+}>;
+export default _default;

package/components/routes/cases/detail/CaseTimeline.js

@@ -0,0 +1,106 @@
+import { createElement as _createElement } from "react";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { FilterList } from '@mui/icons-material';
+import { Autocomplete, Box, Chip, Divider, Skeleton, Stack, TextField, Tooltip, Typography } from '@mui/material';
+import api from '@cccsaurora/howler-ui/api';
+import { ApiConfigContext } from '@cccsaurora/howler-ui/components/app/providers/ApiConfigProvider';
+import { RecordContext } from '@cccsaurora/howler-ui/components/app/providers/RecordProvider';
+import HitCard from '@cccsaurora/howler-ui/components/elements/hit/HitCard';
+import { HitLayout } from '@cccsaurora/howler-ui/components/elements/hit/HitLayout';
+import ObservableCard from '@cccsaurora/howler-ui/components/elements/observable/ObservableCard';
+import useMyApi from '@cccsaurora/howler-ui/components/hooks/useMyApi';
+import dayjs from 'dayjs';
+import { capitalize } from 'lodash-es';
+import { memo, useContext, useEffect, useMemo, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { Link, useOutletContext } from 'react-router-dom';
+import { useContextSelector } from 'use-context-selector';
+import { ESCALATION_COLORS } from '@cccsaurora/howler-ui/utils/constants';
+import { isHit } from '@cccsaurora/howler-ui/utils/typeUtils';
+import useCase from '../hooks/useCase';
+// builds the additional filters for the lucene query
+export const buildFilters = (mitre, escalations) => {
+    const filters = [];
+    const tacticIds = mitre.filter(o => o.kind === 'tactic').map(o => o.id);
+    const techniqueIds = mitre.filter(o => o.kind === 'technique').map(o => o.id);
+    if (tacticIds.length) {
+        filters.push(`threat.tactic.id:(${tacticIds.join(' OR ')})`);
+    }
+    if (techniqueIds.length) {
+        filters.push(`threat.technique.id:(${techniqueIds.join(' OR ')})`);
+    }
+    if (escalations.length) {
+        filters.push(`howler.escalation:(${escalations.join(' OR ')})`);
+    }
+    return filters;
+};
+const CaseTimeline = ({ case: providedCase, caseId }) => {
+    const { t } = useTranslation();
+    const { dispatchApi } = useMyApi();
+    const { config } = useContext(ApiConfigContext);
+    const routeCase = useOutletContext();
+    const { case: _case } = useCase({ case: providedCase ?? routeCase, caseId });
+    const loadRecords = useContextSelector(RecordContext, ctx => ctx.loadRecords);
+    const [mitreOptions, setMitreOptions] = useState([]);
+    const [escalationOptions, setEscalationOptions] = useState([]);
+    const [displayedEntries, setDisplayedEntries] = useState([]);
+    const [loading, setLoading] = useState(false);
+    const [selectedMitres, setSelectedMitres] = useState([]);
+    const [selectedEscalations, setSelectedEscalations] = useState(['evidence']);
+    const ids = useMemo(() => (_case?.items ?? [])
+        .filter(item => ['hit', 'observable'].includes(item.type))
+        .map(item => item.value)
+        .filter(Boolean), [_case]);
+    const getPath = (value) => _case.items.find(item => item.value === value)?.path;
+    useEffect(() => {
+        if (ids.length < 1) {
+            return;
+        }
+        dispatchApi(api.v2.search.facet.post(['hit', 'observable'], {
+            fields: ['threat.tactic.id', 'threat.technique.id', 'howler.escalation'],
+            filters: [`howler.id:(${ids.join(' OR ')})`]
+        }), { throwError: false }).then(result => {
+            if (!result) {
+                return;
+            }
+            setEscalationOptions(Object.keys(result['howler.escalation'] ?? {}));
+            const tactics = Object.keys(result['threat.tactic.id'] ?? {}).map(tactic => ({
+                id: tactic,
+                name: config.lookups?.tactics?.[tactic].name ?? tactic,
+                kind: 'tactic'
+            }));
+            const techniques = Object.keys(result['threat.technique.id'] ?? {}).map(technique => ({
+                id: technique,
+                name: config.lookups?.techniques?.[technique].name ?? technique,
+                kind: 'technique'
+            }));
+            setMitreOptions([...tactics, ...techniques]);
+        });
+    }, [config.lookups?.tactics, config.lookups?.techniques, dispatchApi, ids]);
+    useEffect(() => {
+        if (!ids.length) {
+            setDisplayedEntries([]);
+            return;
+        }
+        setLoading(true);
+        const filters = buildFilters(selectedMitres, selectedEscalations);
+        dispatchApi(api.v2.search.post(['hit', 'observable'], {
+            query: `howler.id:(${ids.join(' OR ')})`,
+            sort: 'event.created asc',
+            rows: ids.length,
+            filters
+        }), { throwError: false }).then(response => {
+            setLoading(false);
+            if (!response) {
+                return;
+            }
+            loadRecords(response.items);
+            setDisplayedEntries(response.items);
+        });
+    }, [ids, selectedMitres, selectedEscalations, dispatchApi, loadRecords]);
+    if (!_case) {
+        return null;
+    }
+    return (_jsxs(Stack, { spacing: 0, sx: { height: '100%' }, children: [_jsxs(Stack, { direction: "row", spacing: 1, alignItems: "center", flexWrap: "wrap", sx: { p: 1, gap: 1 }, children: [_jsx(Tooltip, { title: t('page.cases.timeline.filter.label'), children: _jsx(FilterList, { fontSize: "small", color: "action" }) }), _jsx(Autocomplete, { multiple: true, size: "small", options: mitreOptions, value: selectedMitres, onChange: (_e, values) => setSelectedMitres(values), getOptionLabel: opt => `${opt.id} - ${opt.name}`, isOptionEqualToValue: (opt, val) => opt.id === val.id, groupBy: opt => capitalize(opt.kind), renderTags: (value, getTagProps) => value.map((opt, index) => (_createElement(Chip, { ...getTagProps({ index }), key: opt.id, size: "small", label: opt.id, color: "primary" }))), renderInput: params => (_jsx(TextField, { ...params, label: t('page.cases.timeline.filter.mitre'), sx: { minWidth: 260 } })), noOptionsText: t('page.cases.timeline.filter.mitre.empty') }), _jsx(Autocomplete, { multiple: true, size: "small", options: escalationOptions, value: selectedEscalations, onChange: (_e, value) => setSelectedEscalations(value), getOptionLabel: opt => t(`howler.escalation.${opt}`, opt), renderTags: (value, getTagProps) => value.map((opt, index) => (_createElement(Chip, { ...getTagProps({ index }), key: opt, size: "small", label: opt, color: ESCALATION_COLORS[opt] }))), renderInput: params => (_jsx(TextField, { ...params, label: t('page.cases.timeline.filter.escalation'), sx: { minWidth: 220 } })), noOptionsText: t('page.cases.timeline.filter.escalation.empty') })] }), _jsx(Divider, {}), loading ? (_jsx(Stack, { spacing: 2, sx: { px: 2, py: 1 }, children: [0, 1, 2].map(i => (_jsxs(Stack, { direction: "row", width: "100%", spacing: 1, children: [_jsx(Skeleton, { variant: "text", width: 120, height: 24 }), _jsx(Skeleton, { variant: "rounded", height: 120, sx: { flex: 1 } })] }, i))) })) : displayedEntries.length === 0 ? (_jsx(Box, { sx: { pt: 4, textAlign: 'center' }, children: _jsx(Typography, { color: "textSecondary", children: t('page.cases.timeline.empty') }) })) : (_jsx(Stack, { component: "ol", spacing: 0, sx: { px: 2, py: 1, listStyle: 'none', m: 0, overflow: 'auto' }, children: displayedEntries.map(entry => (_jsxs(Stack, { component: "li", spacing: 1, sx: { pb: 1 }, children: [_jsxs(Stack, { direction: "row", spacing: 2, alignItems: "flex-start", children: [_jsx(Typography, { variant: "caption", color: "textSecondary", sx: { whiteSpace: 'nowrap' }, children: dayjs(entry.event?.created ?? entry.timestamp).format('YYYY-MM-DD HH:mm:ss') }), _jsx(Box, { component: Link, to: `/cases/${_case.case_id}/${getPath(entry.howler.id)}`, sx: { flex: 1, minWidth: 0, textDecoration: 'none' }, children: isHit(entry) ? (_jsx(HitCard, { id: entry.howler.id, layout: HitLayout.DENSE, readOnly: true })) : (_jsx(ObservableCard, { id: entry.howler.id })) })] }), _jsx(Divider, { flexItem: true })] }, entry.howler.id))) }))] }));
+};
+export default memo(CaseTimeline);

package/components/routes/cases/detail/CaseTimeline.test.d.ts

@@ -0,0 +1 @@
+export {};

package/components/routes/cases/detail/CaseTimeline.test.js

@@ -0,0 +1,227 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/* eslint-disable react/no-children-prop */
+/// <reference types="vitest" />
+import { act, render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { ApiConfigContext } from '@cccsaurora/howler-ui/components/app/providers/ApiConfigProvider';
+import { RecordContext } from '@cccsaurora/howler-ui/components/app/providers/RecordProvider';
+import { createElement } from 'react';
+import { MemoryRouter } from 'react-router-dom';
+import { createMockHit, createMockObservable } from '@cccsaurora/howler-ui/tests/utils';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { buildFilters } from './CaseTimeline';
+// ---------------------------------------------------------------------------
+// Pure logic tests
+// ---------------------------------------------------------------------------
+describe('buildFilters', () => {
+    it('returns an empty array when both lists are empty', () => {
+        expect(buildFilters([], [])).toEqual([]);
+    });
+    it('builds a tactic filter', () => {
+        const result = buildFilters([{ id: 'TA0001', name: 'Initial Access', kind: 'tactic' }], []);
+        expect(result).toEqual(['threat.tactic.id:(TA0001)']);
+    });
+    it('builds a technique filter', () => {
+        const result = buildFilters([{ id: 'T1059', name: 'Command Scripting', kind: 'technique' }], []);
+        expect(result).toEqual(['threat.technique.id:(T1059)']);
+    });
+    it('OR-combines multiple tactics in one clause', () => {
+        const result = buildFilters([
+            { id: 'TA0001', name: 'Initial Access', kind: 'tactic' },
+            { id: 'TA0002', name: 'Execution', kind: 'tactic' }
+        ], []);
+        expect(result).toEqual(['threat.tactic.id:(TA0001 OR TA0002)']);
+    });
+    it('emits separate clauses for tactics and techniques', () => {
+        const result = buildFilters([
+            { id: 'TA0001', name: 'Initial Access', kind: 'tactic' },
+            { id: 'T1059', name: 'Command Scripting', kind: 'technique' }
+        ], []);
+        expect(result).toContain('threat.tactic.id:(TA0001)');
+        expect(result).toContain('threat.technique.id:(T1059)');
+        expect(result).toHaveLength(2);
+    });
+    it('builds an escalation filter', () => {
+        const result = buildFilters([], ['evidence', 'hit']);
+        expect(result).toEqual(['howler.escalation:(evidence OR hit)']);
+    });
+    it('combines mitre and escalation filters', () => {
+        const result = buildFilters([{ id: 'TA0001', name: 'Initial Access', kind: 'tactic' }], ['evidence']);
+        expect(result).toHaveLength(2);
+        expect(result).toContain('threat.tactic.id:(TA0001)');
+        expect(result).toContain('howler.escalation:(evidence)');
+    });
+});
+// ---------------------------------------------------------------------------
+// Component rendering tests
+// ---------------------------------------------------------------------------
+const mockDispatchApi = vi.fn();
+vi.mock('components/hooks/useMyApi', () => ({
+    default: () => ({ dispatchApi: mockDispatchApi })
+}));
+vi.mock('../hooks/useCase', () => ({
+    default: ({ case: c }) => ({ case: c, update: vi.fn(), loading: false, missing: false })
+}));
+vi.mock('react-router-dom', async () => {
+    const actual = await vi.importActual('react-router-dom');
+    return { ...actual, useOutletContext: () => undefined };
+});
+// Stub card components — their internals are irrelevant to timeline tests
+vi.mock('components/elements/hit/HitCard', () => ({
+    default: ({ id }) => _jsx("div", { children: `HitCard:${id}` })
+}));
+vi.mock('components/elements/observable/ObservableCard', () => ({
+    default: ({ id }) => _jsx("div", { children: `ObservableCard:${id}` })
+}));
+// Return the request object rather than a Promise so dispatchApi's first
+// argument is JSON-serialisable (JSON.stringify(Promise) === '{}').
+vi.mock('api', () => ({
+    default: {
+        v2: {
+            search: {
+                post: (_indexes, request) => request ?? {},
+                facet: {
+                    post: (_indexes, request) => request ?? {}
+                }
+            }
+        }
+    }
+}));
+const mockLoadRecords = vi.fn();
+const mockConfig = {
+    lookups: {
+        tactics: { TA0001: { key: 'TA0001', name: 'Initial Access', url: '' } },
+        techniques: { T1059: { key: 'T1059', name: 'Command Scripting', url: '' } }
+    }
+};
+const mockCase = {
+    case_id: 'case-001',
+    items: [
+        { type: 'hit', value: 'hit-1', path: 'hits/hit-1' },
+        { type: 'observable', value: 'obs-1', path: 'observables/obs-1' }
+    ]
+};
+const Wrapper = ({ children }) => (_jsx(ApiConfigContext.Provider, { value: { config: mockConfig, setConfig: vi.fn() }, children: _jsxs(RecordContext.Provider, { value: { records: {}, loadRecords: mockLoadRecords }, children: [_jsx(MemoryRouter, { initialEntries: ['/cases/case-001/timeline'], children: children }), ' '] }) }));
+const CaseTimeline = (await import('./CaseTimeline')).default;
+// Reusable mock response factories
+const mockFacetResponse = {
+    'threat.tactic.id': { TA0001: 1 },
+    'threat.technique.id': { T1059: 1 },
+    'howler.escalation': { evidence: 2, hit: 1 }
+};
+const mockSearchResponse = (items = [
+    createMockHit({ howler: { id: 'hit-1' }, event: { created: '2024-01-01T00:00:00Z' } }),
+    createMockObservable({ howler: { id: 'obs-1' } })
+]) => ({ items, total: items.length, rows: items.length, offset: 0 });
+describe('CaseTimeline component', () => {
+    beforeEach(() => {
+        mockDispatchApi.mockClear();
+        mockLoadRecords.mockClear();
+    });
+    it('renders loading skeletons while the search is pending', () => {
+        mockDispatchApi.mockReturnValue(new Promise(() => { })); // never resolves
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        expect(document.querySelectorAll('.MuiSkeleton-root').length).toBeGreaterThan(0);
+    });
+    it('shows the empty state when no entries are returned', async () => {
+        mockDispatchApi.mockResolvedValueOnce(mockFacetResponse).mockResolvedValueOnce(mockSearchResponse([]));
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText('page.cases.timeline.empty');
+    });
+    it('renders HitCard for hit entries and ObservableCard for observable entries', async () => {
+        mockDispatchApi.mockResolvedValueOnce(mockFacetResponse).mockResolvedValueOnce(mockSearchResponse());
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        expect(await screen.findByText('HitCard:hit-1')).toBeTruthy();
+        expect(screen.getByText('ObservableCard:obs-1')).toBeTruthy();
+    });
+    it('renders the formatted event.created timestamp for hits', async () => {
+        mockDispatchApi
+            .mockResolvedValueOnce(mockFacetResponse)
+            .mockResolvedValueOnce(mockSearchResponse([createMockHit({ howler: { id: 'hit-1' }, event: { created: '2024-06-15T12:34:56Z' } })]));
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText(/2024-06-15/);
+    });
+    it('falls back to entry.timestamp when event.created is absent', async () => {
+        const entry = createMockHit({ howler: { id: 'hit-1' } });
+        entry.timestamp = '2024-03-10T08:00:00Z';
+        delete entry.event;
+        mockDispatchApi.mockResolvedValueOnce(mockFacetResponse).mockResolvedValueOnce(mockSearchResponse([entry]));
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText(/2024-03-10/);
+    });
+    it('calls loadRecords with the search results', async () => {
+        const items = [createMockHit({ howler: { id: 'hit-1' } })];
+        mockDispatchApi.mockResolvedValueOnce(mockFacetResponse).mockResolvedValueOnce(mockSearchResponse(items));
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText('HitCard:hit-1');
+        expect(mockLoadRecords).toHaveBeenCalledWith(items);
+    });
+    it('renders MITRE autocomplete with options derived from the facet response', async () => {
+        mockDispatchApi.mockResolvedValueOnce(mockFacetResponse).mockResolvedValueOnce(mockSearchResponse());
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText('HitCard:hit-1');
+        expect(screen.getByRole('combobox', { name: /page.cases.timeline.filter.mitre/i })).toBeTruthy();
+    });
+    it('renders escalation autocomplete pre-populated with "evidence"', async () => {
+        mockDispatchApi.mockResolvedValueOnce(mockFacetResponse).mockResolvedValueOnce(mockSearchResponse());
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText('HitCard:hit-1');
+        // "evidence" chip should be pre-selected as a tag
+        expect(screen.getByText('evidence')).toBeTruthy();
+    });
+    it('re-fetches with an escalation filter when a new escalation is selected', async () => {
+        mockDispatchApi
+            .mockResolvedValueOnce(mockFacetResponse)
+            .mockResolvedValueOnce(mockSearchResponse())
+            .mockResolvedValueOnce(mockSearchResponse());
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText('HitCard:hit-1');
+        const escalationInput = screen.getByRole('combobox', { name: /page.cases.timeline.filter.escalation/i });
+        await act(async () => {
+            await userEvent.click(escalationInput);
+        });
+        const option = await screen.findByRole('option', { name: /\bhit\b/i });
+        await act(async () => {
+            await userEvent.click(option);
+        });
+        // The third dispatchApi call should carry a filter containing "hit"
+        const thirdCallArgs = mockDispatchApi.mock.calls[2];
+        expect(JSON.stringify(thirdCallArgs[0])).toContain('hit');
+    });
+    it('re-fetches when a MITRE tactic is selected', async () => {
+        mockDispatchApi
+            .mockResolvedValueOnce(mockFacetResponse)
+            .mockResolvedValueOnce(mockSearchResponse())
+            .mockResolvedValueOnce(mockSearchResponse());
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText('HitCard:hit-1');
+        const mitreInput = screen.getByRole('combobox', { name: /page.cases.timeline.filter.mitre/i });
+        await act(async () => {
+            await userEvent.click(mitreInput);
+        });
+        const tacticOption = await screen.findByRole('option', { name: /TA0001/i });
+        await act(async () => {
+            await userEvent.click(tacticOption);
+        });
+        const thirdCallArgs = mockDispatchApi.mock.calls[2];
+        expect(JSON.stringify(thirdCallArgs[0])).toContain('TA0001');
+    });
+    it('passes the case item ids in the base query on every search call', async () => {
+        mockDispatchApi.mockResolvedValueOnce(mockFacetResponse).mockResolvedValueOnce(mockSearchResponse());
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText('HitCard:hit-1');
+        const searchCallArg = mockDispatchApi.mock.calls[1][0];
+        expect(JSON.stringify(searchCallArg)).toContain('hit-1');
+        expect(JSON.stringify(searchCallArg)).toContain('obs-1');
+    });
+    it('renders nothing when _case is not yet available', () => {
+        const emptyCaseWrapper = ({ children }) => createElement(ApiConfigContext.Provider, { value: { config: mockConfig, setConfig: vi.fn() }, children: null }, createElement(RecordContext.Provider, { value: { records: {}, loadRecords: mockLoadRecords }, children: null }, createElement(MemoryRouter, null, children)));
+        const { container } = render(_jsx(CaseTimeline, {}), { wrapper: emptyCaseWrapper });
+        expect(container.firstChild).toBeNull();
+    });
+    it('renders nothing and skips fetching when the case has no items', () => {
+        mockDispatchApi.mockResolvedValue({});
+        render(_jsx(CaseTimeline, { case: { case_id: 'empty', items: [] } }), { wrapper: Wrapper });
+        expect(mockDispatchApi).not.toHaveBeenCalled();
+    });
+});

package/locales/en/translation.json

@@ -395,6 +395,13 @@
     "page.cases.sidebar.item.remove": "Remove item",
     "page.cases.sidebar.item.rename": "Rename item",
     "page.cases.sources": "Sources",
+    "page.cases.timeline": "Timeline",
+    "page.cases.timeline.empty": "No events match the selected filters.",
+    "page.cases.timeline.filter.escalation": "Escalation",
+    "page.cases.timeline.filter.escalation.empty": "No escalation levels found.",
+    "page.cases.timeline.filter.label": "Show only",
+    "page.cases.timeline.filter.mitre": "MITRE ATT&CK",
+    "page.cases.timeline.filter.mitre.empty": "No tactics or techniques found.",
     "page.cases.updated": "Updated",
     "page.dashboard.settings.edit": "Edit Dashboard",
     "page.dashboard.settings.refreshRate": "Refresh Rate",

package/locales/fr/translation.json

@@ -395,6 +395,13 @@
     "page.cases.sidebar.item.remove": "Supprimer l'élément",
     "page.cases.sidebar.item.rename": "Renommer l'élément",
     "page.cases.sources": "Sources",
+    "page.cases.timeline": "Chronologie",
+    "page.cases.timeline.empty": "Aucun événement ne correspond aux filtres sélectionnés.",
+    "page.cases.timeline.filter.escalation": "Escalade",
+    "page.cases.timeline.filter.escalation.empty": "Aucun niveau d'escalade trouvé.",
+    "page.cases.timeline.filter.label": "Afficher uniquement",
+    "page.cases.timeline.filter.mitre": "MITRE ATT&CK",
+    "page.cases.timeline.filter.mitre.empty": "Aucune tactique ou technique trouvée.",
     "page.cases.updated": "Mis à jour",
     "page.dashboard.settings.edit": "Modifier le tableau de bord",
     "page.dashboard.settings.refreshRate": "Fréquence de rafraîchissement",

package/package.json

@@ -101,7 +101,7 @@
     "internal-slot": "1.0.7"
   },
   "type": "module",
-  "version": "2.18.0-dev.705",
+  "version": "2.18.0-dev.710",
   "exports": {
     "./i18n": "./i18n.js",
     "./index.css": "./index.css",