@cccsaurora/howler-ui 2.19.0-dev.1181 → 2.19.0-dev.1264

package/components/routes/views/ViewComposer.js

@@ -7,9 +7,9 @@ import api from '@cccsaurora/howler-ui/api';
 import AppListEmpty from '@cccsaurora/howler-ui/commons/components/display/AppListEmpty';
 import PageCenter from '@cccsaurora/howler-ui/commons/components/pages/PageCenter';
 import { GridColumnsContext } from '@cccsaurora/howler-ui/components/app/providers/GridColumnsProvider';
-import { HitContext } from '@cccsaurora/howler-ui/components/app/providers/HitProvider';
-import { HitSearchContext } from '@cccsaurora/howler-ui/components/app/providers/HitSearchProvider';
 import { ParameterContext } from '@cccsaurora/howler-ui/components/app/providers/ParameterProvider';
+import { RecordContext } from '@cccsaurora/howler-ui/components/app/providers/RecordProvider';
+import { RecordSearchContext } from '@cccsaurora/howler-ui/components/app/providers/RecordSearchProvider';
 import { ViewContext } from '@cccsaurora/howler-ui/components/app/providers/ViewProvider';
 import CustomButton from '@cccsaurora/howler-ui/components/elements/addons/buttons/CustomButton';
 import FlexOne from '@cccsaurora/howler-ui/components/elements/addons/layout/FlexOne';
@@ -19,8 +19,9 @@ import VSBoxContent from '@cccsaurora/howler-ui/components/elements/addons/layou
 import VSBoxHeader from '@cccsaurora/howler-ui/components/elements/addons/layout/vsbox/VSBoxHeader';
 import SearchTotal from '@cccsaurora/howler-ui/components/elements/addons/search/SearchTotal';
 import ChipPopper from '@cccsaurora/howler-ui/components/elements/display/ChipPopper';
+import EventCard from '@cccsaurora/howler-ui/components/elements/event/EventCard';
 import AddColumnModal from '@cccsaurora/howler-ui/components/elements/hit/grid/AddColumnModal';
-import HitTable from '@cccsaurora/howler-ui/components/elements/hit/grid/HitTable';
+import RecordTable from '@cccsaurora/howler-ui/components/elements/hit/grid/RecordTable';
 import HitCard from '@cccsaurora/howler-ui/components/elements/hit/HitCard';
 import { HitLayout } from '@cccsaurora/howler-ui/components/elements/hit/HitLayout';
 import LayoutToggle, {} from '@cccsaurora/howler-ui/components/elements/view/LayoutToggle';
@@ -34,8 +35,9 @@ import { DEFAULT_QUERY, StorageKey } from '@cccsaurora/howler-ui/utils/constants
 import { convertDateToLucene } from '@cccsaurora/howler-ui/utils/utils';
 import { buildViewUrl } from '@cccsaurora/howler-ui/utils/viewUtils';
 import ErrorBoundary from '../ErrorBoundary';
-import HitQuery from '../hits/search/HitQuery';
+import RecordQuery from '../hits/search/RecordQuery';
 import HitSort from '../hits/search/shared/HitSort';
+import IndexPicker from '../hits/search/shared/IndexPicker';
 import SearchSpan from '../hits/search/shared/SearchSpan';
 const ViewComposer = () => {
     const { t } = useTranslation();
@@ -46,8 +48,10 @@ const ViewComposer = () => {
     const addView = useContextSelector(ViewContext, ctx => ctx.addView);
     const editView = useContextSelector(ViewContext, ctx => ctx.editView);
     const getCurrentViews = useContextSelector(ViewContext, ctx => ctx.getCurrentViews);
+    const indexes = useContextSelector(ParameterContext, ctx => ctx.indexes);
+    const setIndexes = useContextSelector(ParameterContext, ctx => ctx.setIndexes);
     const pageCount = useMyLocalStorageItem(StorageKey.PAGE_COUNT, 25)[0];
-    const loadHits = useContextSelector(HitContext, ctx => ctx.loadHits);
+    const loadRecords = useContextSelector(RecordContext, ctx => ctx.loadRecords);
     // view state
     const [title, setTitle] = useState('');
     const [type, setType] = useState('global');
@@ -65,8 +69,9 @@ const ViewComposer = () => {
     const [searching, setSearching] = useState(false);
     const [error, setError] = useState(null);
     const [response, setResponse] = useState();
-    const displayType = useContextSelector(HitSearchContext, ctx => ctx.displayType);
-    const setDisplayType = useContextSelector(HitSearchContext, ctx => ctx.setDisplayType);
+    const [isLoadingView, setIsLoadingView] = useState(!!routeParams.id);
+    const displayType = useContextSelector(RecordSearchContext, ctx => ctx.displayType);
+    const setDisplayType = useContextSelector(RecordSearchContext, ctx => ctx.setDisplayType);
     const onSave = useCallback(async () => {
         setLoading(true);
         const _columnData = columns.map(column => ({
@@ -74,11 +79,13 @@ const ViewComposer = () => {
             width: columnWidths[column] ?? null
         }));
         try {
+            const normalizedIndexes = indexes?.length > 0 ? indexes : ['hit'];
             if (!routeParams.id) {
                 const newView = await addView({
                     title,
                     type,
                     query,
+                    indexes: normalizedIndexes,
                     sort: sort || null,
                     span: span || null,
                     settings: {
@@ -94,6 +101,7 @@ const ViewComposer = () => {
                     title,
                     type,
                     query,
+                    indexes: normalizedIndexes,
                     sort,
                     span,
                     settings: {
@@ -122,6 +130,7 @@ const ViewComposer = () => {
         sort,
         span,
         advanceOnTriage,
+        indexes,
         displayType,
         columns,
         navigate,
@@ -129,19 +138,19 @@ const ViewComposer = () => {
         editView,
         showErrorMessage
     ]);
-    const search = useCallback(async (_query) => {
-        setQuery(_query);
+    const performSearch = useCallback(async (searchQuery, searchIndexes, searchSort, searchSpan) => {
         setSearching(true);
         setError(null);
         try {
-            const _response = await dispatchApi(api.search.hit.post({
+            const normalizedIndexes = searchIndexes?.length > 0 ? searchIndexes : ['hit'];
+            const _response = await dispatchApi(api.v2.search.post(normalizedIndexes, {
                 rows: pageCount,
-                query: _query,
-                sort,
-                filters: span ? [`event.created:${convertDateToLucene(span)}`] : [],
+                query: searchQuery,
+                sort: searchSort,
+                filters: searchSpan ? [`event.created:${convertDateToLucene(searchSpan)}`] : [],
                 metadata: ['template', 'analytic']
             }), { showError: false, throwError: true });
-            loadHits(_response.items);
+            loadRecords(_response.items);
             setResponse(_response);
         }
         catch (e) {
@@ -150,18 +159,25 @@ const ViewComposer = () => {
         finally {
             setSearching(false);
         }
-    }, [dispatchApi, loadHits, pageCount, setQuery, sort, span]);
+    }, [dispatchApi, loadRecords, pageCount]);
+    const search = useCallback(async (_query) => {
+        setQuery(_query);
+        await performSearch(_query, indexes, sort, span);
+    }, [performSearch, indexes, sort, span, setQuery]);
     useEffect(() => {
-        search(query || DEFAULT_QUERY);
+        // Only run initial search if we're NOT editing an existing view
+        if (!routeParams.id) {
+            search(query || DEFAULT_QUERY);
+        }
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, []);
+    }, [routeParams.id]);
     // We only run this when ancillary properties (i.e. filters, sorting) change
     useEffect(() => {
-        if (query) {
+        if (query && !isLoadingView) {
             search(query);
         }
         // eslint-disable-next-line react-hooks/exhaustive-deps
-    }, [sort, span]);
+    }, [sort, span, indexes, isLoadingView]);
     useEffect(() => {
         if (!routeParams.id) {
             return;
@@ -177,15 +193,25 @@ const ViewComposer = () => {
             }
             setTitle(viewToEdit.title);
             setAdvanceOnTriage(viewToEdit.settings?.advance_on_triage ?? false);
-            setQuery(viewToEdit.query);
             setDisplayType((viewToEdit.settings?.display ?? null));
             setType(viewToEdit.type);
+            const loadedQuery = viewToEdit.query || DEFAULT_QUERY;
+            const loadedIndexes = viewToEdit.indexes || indexes;
+            const loadedSort = viewToEdit.sort || sort;
+            const loadedSpan = viewToEdit.span || span;
+            setQuery(loadedQuery);
+            if (viewToEdit.indexes) {
+                setIndexes(loadedIndexes);
+            }
             if (viewToEdit.sort) {
-                setSort(viewToEdit.sort);
+                setSort(loadedSort);
             }
             if (viewToEdit.span) {
-                setSpan(viewToEdit.span);
+                setSpan(loadedSpan);
             }
+            // Perform search with the loaded values to avoid using stale state
+            await performSearch(loadedQuery, loadedIndexes, loadedSort, loadedSpan);
+            setIsLoadingView(false);
         })();
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [routeParams.id]);
@@ -198,6 +224,6 @@ const ViewComposer = () => {
                                             fontSize: '0.9em',
                                             fontStyle: 'italic',
                                             mb: 0.5
-                                        }), variant: "body2", children: t('hit.search.prompt') }), _jsx(Stack, { direction: "row", width: "100%", spacing: 2, alignItems: "flex-start", paddingBottom: 1, children: _jsxs(Stack, { direction: "column", width: "100%", spacing: 1, children: [_jsx(HitQuery, { triggerSearch: search, searching: searching, onChange: (_query, isDirty) => setIsSearchDirty(isDirty) }), _jsxs(Stack, { direction: "row", spacing: 1, children: [_jsx(HitSort, {}), _jsx(SearchSpan, { omitCustom: true }), _jsx("div", { style: { flex: 1 } }), _jsx(ChipPopper, { label: _jsx(Typography, { variant: "body2", children: t('view.settings') }), deleteIcon: _jsx(Settings, {}), toggleOnDelete: true, slotProps: { chip: { size: 'small' } }, placement: "bottom-end", children: _jsxs(Stack, { direction: "column", spacing: 1, children: [_jsxs(Stack, { spacing: 1, direction: "row", alignItems: "center", sx: { flex: '0 !important', minWidth: '300px' }, children: [_jsx(Typography, { component: "span", children: t('view.settings.advance_on_triage') }), _jsx(Tooltip, { title: t('view.settings.advance_on_triage.description'), children: _jsx(HelpOutline, { sx: { fontSize: '16px' } }) }), _jsx(FlexOne, {}), _jsx(Checkbox, { size: "small", checked: advanceOnTriage, onChange: (_event, checked) => setAdvanceOnTriage(checked) })] }), _jsxs(Stack, { direction: "row", spacing: 1, alignItems: "center", justifyContent: "space-between", children: [_jsx(Typography, { component: "span", children: t('view.settings.layout') }), _jsx(LayoutToggle, { displayType: displayType, setDisplayType: setDisplayType, size: "small", allowNullValue: true })] })] }) })] })] }) }), _jsxs(Stack, { direction: "row", spacing: 1, alignItems: "flex-end", justifyContent: "space-between", children: [response && (_jsx(SearchTotal, { total: response.total, pageLength: response.items.length, offset: response.offset, sx: theme => ({ color: theme.palette.text.secondary, fontSize: '0.9em', fontStyle: 'italic' }) })), _jsx(FlexOne, {}), displayType === 'grid' && (_jsx(AddColumnModal, { columns: columns, addColumn: key => isReady && setColumns(uniq([...columns, key])) }))] }), _jsx(LinearProgress, { sx: [!searching && { opacity: 0 }] })] }) }), _jsx(VSBoxContent, { children: displayType === 'grid' ? (_jsx(Stack, { component: Paper, spacing: 1, width: "100%", height: "100%", sx: { overflow: 'auto', flex: 1 }, children: _jsx(HitTable, { query: query, items: response?.items }) })) : (_jsxs(Stack, { spacing: 1, children: [!response?.total && _jsx(AppListEmpty, {}), response?.items.map(hit => (_jsx(HitCard, { id: hit.howler.id, layout: HitLayout.DENSE }, hit.howler.id)))] })) })] }) }) }) }));
+                                        }), variant: "body2", children: t('hit.search.prompt') }), _jsx(Stack, { direction: "row", width: "100%", spacing: 2, alignItems: "flex-start", paddingBottom: 1, children: _jsxs(Stack, { direction: "column", width: "100%", spacing: 1, children: [_jsx(RecordQuery, { triggerSearch: search, searching: searching, onChange: (_query, isDirty) => setIsSearchDirty(isDirty) }), _jsxs(Stack, { direction: "row", spacing: 1, children: [_jsx(IndexPicker, {}), _jsx(HitSort, {}), _jsx(SearchSpan, { omitCustom: true }), _jsx("div", { style: { flex: 1 } }), _jsx(ChipPopper, { label: _jsx(Typography, { variant: "body2", children: t('view.settings') }), deleteIcon: _jsx(Settings, {}), toggleOnDelete: true, slotProps: { chip: { size: 'small' } }, placement: "bottom-end", children: _jsxs(Stack, { direction: "column", spacing: 1, children: [_jsxs(Stack, { spacing: 1, direction: "row", alignItems: "center", sx: { flex: '0 !important', minWidth: '300px' }, children: [_jsx(Typography, { component: "span", children: t('view.settings.advance_on_triage') }), _jsx(Tooltip, { title: t('view.settings.advance_on_triage.description'), children: _jsx(HelpOutline, { sx: { fontSize: '16px' } }) }), _jsx(FlexOne, {}), _jsx(Checkbox, { size: "small", checked: advanceOnTriage, onChange: (_event, checked) => setAdvanceOnTriage(checked) })] }), _jsxs(Stack, { direction: "row", spacing: 1, alignItems: "center", justifyContent: "space-between", children: [_jsx(Typography, { component: "span", children: t('view.settings.layout') }), _jsx(LayoutToggle, { displayType: displayType, setDisplayType: setDisplayType, size: "small", allowNullValue: true })] })] }) })] })] }) }), _jsxs(Stack, { direction: "row", spacing: 1, alignItems: "flex-end", justifyContent: "space-between", children: [response && (_jsx(SearchTotal, { total: response.total, pageLength: response.items.length, offset: response.offset, sx: theme => ({ color: theme.palette.text.secondary, fontSize: '0.9em', fontStyle: 'italic' }) })), _jsx(FlexOne, {}), displayType === 'grid' && (_jsx(AddColumnModal, { columns: columns, addColumn: key => isReady && setColumns(uniq([...columns, key])) }))] }), _jsx(LinearProgress, { sx: [!searching && { opacity: 0 }] })] }) }), _jsx(VSBoxContent, { children: displayType === 'grid' ? (_jsx(Stack, { component: Paper, spacing: 1, width: "100%", height: "100%", sx: { overflow: 'auto', flex: 1 }, children: _jsx(RecordTable, { query: query, items: response?.items }) })) : (_jsxs(Stack, { spacing: 1, children: [!response?.total && _jsx(AppListEmpty, {}), response?.items.map(record => record.__index === 'hit' ? (_jsx(HitCard, { id: record.howler.id, layout: HitLayout.DENSE }, record.howler.id)) : (_jsx(EventCard, { event: record }, record.howler.id)))] })) })] }) }) }) }));
 };
 export default ViewComposer;

package/locales/en/translation.json

@@ -15,6 +15,7 @@
     "analytic.notebook.error.minFields": "Name and link are required.",
     "analytic.notebook.link": "Link",
     "analytic.notebook.name": "Name",
+    "analytic.open": "Open Analytic",
     "any": "Any",
     "api.user.apikey.removed": "API key removed successfully.",
     "api.user.apikey.updated": "New API key added successfully.",
@@ -86,6 +87,8 @@
     "comments.edit.stop": "Stop Editing",
     "comments.edited": "Edited",
     "comments.quote": "Quote Reply",
+    "complete": "Complete",
+    "crisis": "Crisis",
     "custom": "Custom",
     "date.range.1.day": "The last day",
     "date.range.1.month": "The last month",
@@ -111,8 +114,13 @@
     "drawer.expand": "Expand Menu",
     "duplicates.omitted": "Some duplicate entries have been omitted.",
     "edit": "Edit",
+    "enabled": "Enabled",
+    "event.module": "Event Module",
+    "event.open": "Open Event",
+    "event.type": "Event Type",
     "features.warning.description": "This feature is undergoing active development, and is not yet in a finished state. You may encounter bugs or instability.",
     "features.warning.title": "Feature In Active Development",
+    "focus": "Main focus",
     "global": "Global",
     "help.actions.introduction": "Introduction to Actions",
     "help.hit.banner.description": "See the below hit banner example for the hit keys necessary to properly populate it. If you have any additional questions, ask in the HOWLER support channel.",
@@ -169,17 +177,21 @@
     "hit.header.assignment": "Assignment: {{user}}",
     "hit.header.assignment.add": "Assign to a user",
     "hit.header.assignment.change": "Change assignment",
-    "hit.header.bundlesize": "{{hits}} hits",
     "hit.header.escalation": "Escalation Level: ",
     "hit.header.indicators": "Indicators",
     "hit.header.link": "Open Link",
     "hit.header.rationale": "Rationale",
+    "hit.header.related": "{{count}} related records",
     "hit.header.scrutiny": "Scrutiny: ",
     "hit.header.status": "Status: ",
     "hit.header.summary": "Summary",
     "hit.header.target": "Target",
     "hit.header.threat": "Threat",
+    "hit.header.view.case": "View case {{id}}",
+    "hit.header.view.event": "View event {{id}}",
+    "hit.header.view.hit": "View hit {{id}}",
     "hit.header.votes": "Votes: ",
+    "hit.howler.related": "{{count}} related records",
     "hit.label": "Labels",
     "hit.label.category.assignments": "Category: Assignments - Specifies what analyst or team of analysts is assigned to triaging this hit.",
     "hit.label.category.campaign": "Catergory: Campaign - Identifies ongoing campaigns from specific malware families or phishing initiatives. They should only be considered correct attributions if the hit is promoted to evidence.",
@@ -202,9 +214,9 @@
     "hit.notebook.goTo": "Go to Jupyterhub",
     "hit.notebook.select": "Please Select a notebook",
     "hit.notebook.tooltip": "Open in Jupyterhub",
+    "hit.open": "Open Hit",
     "hit.overview.missing": "No overview has been created for this hit. In order to create an overview, press the add button to the right.",
     "hit.panel.aggregation.run": "Create Summary",
-    "hit.panel.analytic.open": "Open Analytic",
     "hit.panel.bundles.open": "Parent Bundles",
     "hit.panel.bundles.open.prompt": "Open Parent Bundle",
     "hit.panel.close": "Close",
@@ -217,9 +229,12 @@
     "hit.panel.exclude": "Exclude By",
     "hit.panel.hit.noselection": "No hit has been selected",
     "hit.panel.include": "Include By",
-    "hit.panel.open": "Open Hit Viewer",
     "hit.panel.view.layout": "Change View Panel",
     "hit.quicksearch": "Search by assignment, analytic, detection or status",
+    "hit.related.tab.case": "Cases",
+    "hit.related.tab.event": "Events",
+    "hit.related.tab.hit": "Hits",
+    "hit.related.tab.links": "Links",
     "hit.search.aggregate.button": "Create Summary",
     "hit.search.button": "Perform search",
     "hit.search.custom": "Custom Sort",
@@ -228,6 +243,10 @@
     "hit.search.filter.fields": "Fields",
     "hit.search.filter.label": "Lookup Filters",
     "hit.search.filter.values": "Values",
+    "hit.search.index": "Indexes",
+    "hit.search.index.case": "Cases",
+    "hit.search.index.event": "Events",
+    "hit.search.index.hit": "Hits",
     "hit.search.invalid": "Invalid Query",
     "hit.search.keyboard": "Keyboard shortcuts",
     "hit.search.keyboard.no_shortcuts": "No shortcuts",
@@ -301,6 +320,44 @@
     "modal.action.empty": "Action Name cannot be empty.",
     "modal.action.label": "Action Name",
     "modal.action.title": "Save Action",
+    "modal.cases.add_item": "Add item",
+    "modal.cases.add_item.content": "Content",
+    "modal.cases.add_item.folder": "Folder",
+    "modal.cases.add_item.markdown_placeholder": "Describe the alert and any important context",
+    "modal.cases.add_item.root": "Root",
+    "modal.cases.add_item.title": "Title",
+    "modal.cases.add_item.type": "Item Type",
+    "modal.cases.add_item.type.link": "Link",
+    "modal.cases.add_item.type.markdown": "Markdown",
+    "modal.cases.add_item.url": "URL",
+    "modal.cases.add_to_case": "Add to Case",
+    "modal.cases.add_to_case.full_path": "Full path: {{path}}",
+    "modal.cases.add_to_case.items_section": "Alert Placement",
+    "modal.cases.add_to_case.path_invalid": "Path must not start or end with a /",
+    "modal.cases.add_to_case.select_case": "Search Cases",
+    "modal.cases.add_to_case.select_path": "Select Folder Path",
+    "modal.cases.add_to_case.title": "Item Title",
+    "modal.cases.alerts.assess": "Assess Alerts",
+    "modal.cases.alerts.resolved": "Resolved Alerts",
+    "modal.cases.create_case": "Create Case",
+    "modal.cases.create_case.escalation": "Escalation",
+    "modal.cases.create_case.full_path": "Full path: {{path}}",
+    "modal.cases.create_case.item.path": "Folder Path (optional)",
+    "modal.cases.create_case.item.title": "Item Title",
+    "modal.cases.create_case.items_section": "Alert Placement",
+    "modal.cases.create_case.overview": "Case Overview (Markdown, optional)",
+    "modal.cases.create_case.summary": "Short Case Summary",
+    "modal.cases.create_case.title": "Case Title",
+    "modal.cases.rename_item": "Rename Item",
+    "modal.cases.rename_item.error.empty": "Name cannot be empty",
+    "modal.cases.rename_item.error.slash": "Name cannot contain '/'",
+    "modal.cases.rename_item.error.taken": "An item already exists at this path",
+    "modal.cases.rename_item.folder_path": "Folder: {{path}}",
+    "modal.cases.rename_item.new_name": "New Name",
+    "modal.cases.resolve": "Resolve Case",
+    "modal.cases.resolve.allow_unresolved": "Resolve this case even if some alerts remain unresolved.",
+    "modal.cases.resolve.allow_unresolved.aria_label": "Allow unresolved alerts",
+    "modal.cases.resolve.description": "When resolving a case, you must either assess all open alerts, or add an assessment to the alerts.",
     "modal.confirm.delete.description": "Are you sure you want to delete this item?",
     "modal.confirm.delete.title": "Confirm Deletion",
     "modal.rationale.description": "Provide a rationale that succinctly explains to other analysts why you are confident in this assessment.",
@@ -309,19 +366,9 @@
     "modal.rationale.type.analytic": "This rationale was used when assessing alerts with the same analytic name.",
     "modal.rationale.type.assignment": "This is a rationale you have recently used when assessing an alert.",
     "modal.rationale.type.preset": "This is a preset rationale configured for the associated analytic.",
-    "modal.rule.description": "Create a new rule by giving it a name, markdown description and submitting.",
-    "modal.rule.description.title": "Rule Description",
-    "modal.rule.disabled.analytic": "You must provide a rule name.",
-    "modal.rule.disabled.description": "You must provide a useful markdown description for your rule.",
-    "modal.rule.file.title": "Query",
-    "modal.rule.markdown.placeholder": "Your *markdown* **description** will be ~~rendered~~ here.\n\n![](/images/doggie.png)",
-    "modal.rule.markdown.title": "Markdown Preview",
-    "modal.rule.name": "Rule Name",
-    "modal.rule.name.warn": "In general, analytic name should only contain letters and spaces, preferablly 'In Pascal Case'.",
-    "modal.rule.success": "Rule Created!",
-    "modal.rule.title": "Create a New Rule",
     "no.data": "No Data",
     "none": "None",
+    "normal": "Normal Priority",
     "notebook.opens.panel": "Opens notebook panel",
     "notebook.title": "Notebook",
     "on": "on",
@@ -345,6 +392,94 @@
     "page.403.title": "403: Access Forbidden",
     "page.404.description": "The page you are looking for cannot be found...",
     "page.404.title": "404: Not found",
+    "page.cases.created": "Created",
+    "page.cases.dashboard": "Dashboard",
+    "page.cases.dashboard.alerts": "Alerts",
+    "page.cases.dashboard.cases": "Related Cases",
+    "page.cases.dashboard.duration": "Duration",
+    "page.cases.dashboard.indicators": "Indicators",
+    "page.cases.dashboard.target": "Targets",
+    "page.cases.dashboard.tasks": "Tasks",
+    "page.cases.dashboard.tasks.add": "Add Task",
+    "page.cases.dashboard.tasks.child.empty": "No tasks in this child case.",
+    "page.cases.dashboard.tasks.child_cases": "Child Cases",
+    "page.cases.dashboard.tasks.filter_cases": "Filter child cases",
+    "page.cases.dashboard.tasks.hide_child": "Hide child case tasks",
+    "page.cases.dashboard.tasks.show_child": "Show child case tasks",
+    "page.cases.dashboard.threat": "Threats",
+    "page.cases.detail.escalation": "Escalation",
+    "page.cases.detail.participants": "Participants",
+    "page.cases.detail.properties": "Properties",
+    "page.cases.detail.status": "Status",
+    "page.cases.detail.viewers": "Active Viewers",
+    "page.cases.escalation": "Escalation",
+    "page.cases.folder.drop.root": "Place here to move to root",
+    "page.cases.observables": "Observables",
+    "page.cases.observables.columns.escalation": "Escalation",
+    "page.cases.observables.columns.role": "Role",
+    "page.cases.observables.columns.seen_in": "Seen In",
+    "page.cases.observables.columns.sources": "Sources",
+    "page.cases.observables.columns.type": "Type",
+    "page.cases.observables.columns.value": "Value",
+    "page.cases.observables.empty": "No observables found.",
+    "page.cases.observables.filter_by_escalation": "Escalation",
+    "page.cases.observables.filter_by_origin": "Origin",
+    "page.cases.observables.filter_by_role": "Role",
+    "page.cases.observables.filter_by_type": "Filter by type:",
+    "page.cases.observables.origin.event": "Event",
+    "page.cases.observables.origin.hit": "Hit",
+    "page.cases.observables.role.indicator": "Indicator",
+    "page.cases.observables.role.target": "Target",
+    "page.cases.observables.role.threat": "Threat",
+    "page.cases.observables.search": "Search observables...",
+    "page.cases.observables.seen_in": "Seen in",
+    "page.cases.observables.type.hash": "Hash",
+    "page.cases.observables.type.hosts": "Host",
+    "page.cases.observables.type.id": "ID",
+    "page.cases.observables.type.ids": "ID",
+    "page.cases.observables.type.ip": "IP",
+    "page.cases.observables.type.signature": "Signature",
+    "page.cases.observables.type.uri": "URI",
+    "page.cases.observables.type.user": "User",
+    "page.cases.rules": "Rules",
+    "page.cases.rules.author": "Author",
+    "page.cases.rules.create": "Create Rule",
+    "page.cases.rules.delete.confirm": "Delete this rule?",
+    "page.cases.rules.destination": "Alert Destination Path",
+    "page.cases.rules.destination.help": "Handlebars template for the case item path (e.g. alerts/{{howler.analytic}})",
+    "page.cases.rules.empty": "No correlation rules configured.",
+    "page.cases.rules.expire_after_resolved": "Start expiry after case is resolved",
+    "page.cases.rules.indexes": "Indexes",
+    "page.cases.rules.no_expiry": "No expiry",
+    "page.cases.rules.query": "Match Query",
+    "page.cases.rules.timeframe": "Rule Expiry",
+    "page.cases.rules.timeframe.after_resolved": "{{days}} day(s) after resolved",
+    "page.cases.rules.timeframe.days": "{{days}} day(s)",
+    "page.cases.rules.timeframe.help": "Number of days before the rule expires",
+    "page.cases.search": "Search",
+    "page.cases.sidebar.add_folder": "Add folder",
+    "page.cases.sidebar.add_item": "Add item",
+    "page.cases.sidebar.collapse_all": "Collapse all folders",
+    "page.cases.sidebar.folder.remove": "Remove folder",
+    "page.cases.sidebar.folder.rename": "Rename folder",
+    "page.cases.sidebar.item.open": "Open item",
+    "page.cases.sidebar.item.remove": "Remove item",
+    "page.cases.sidebar.item.rename": "Rename item",
+    "page.cases.sidebar.new_folder": "New Folder",
+    "page.cases.sidebar.refresh": "Refresh case",
+    "page.cases.sources": "Sources",
+    "page.cases.status.in-progress": "In Progress",
+    "page.cases.status.on-hold": "On Hold",
+    "page.cases.status.open": "Open",
+    "page.cases.status.resolved": "Resolved",
+    "page.cases.timeline": "Timeline",
+    "page.cases.timeline.empty": "No events match the selected filters.",
+    "page.cases.timeline.filter.escalation": "Escalation",
+    "page.cases.timeline.filter.escalation.empty": "No escalation levels found.",
+    "page.cases.timeline.filter.label": "Show only",
+    "page.cases.timeline.filter.mitre": "MITRE ATT&CK",
+    "page.cases.timeline.filter.mitre.empty": "No tactics or techniques found.",
+    "page.cases.updated": "Updated",
     "page.dashboard.settings.edit": "Edit Dashboard",
     "page.dashboard.settings.refreshRate": "Refresh Rate",
     "page.dashboard.title": "Dashboard",
@@ -417,6 +552,8 @@
     "page.user.search.column.groups": "Groups",
     "page.user.search.column.username": "Username",
     "page.user.search.prompt": "Search by username, fullname, email or group",
+    "pages.cases.detail.participants": "Participants",
+    "pages.cases.detail.status": "Status",
     "password": "New Password",
     "password.confirm": "Confirm Password",
     "password.match": "Password and Confirm Password must match",
@@ -480,8 +617,6 @@
     "route.admin.user.details": "User Details",
     "route.admin.user.search": "User Search",
     "route.advanced": "Advanced Search",
-    "route.advanced.create.rule": "Create Rule",
-    "route.advanced.create.rule.disabled": "You must run your search to ensure it is valid first.",
     "route.advanced.error": "Search Error",
     "route.advanced.execute.query": "Execute Query",
     "route.advanced.fields": "Hit Fields to Show",
@@ -507,7 +642,6 @@
     "route.advanced.result.description": "Execute a query to show results here.",
     "route.advanced.result.title": "Howler Advanced Search",
     "route.advanced.rows": "Number of Rows to Return",
-    "route.advanced.rule.type": "Rule Type",
     "route.analytics": "Analytics",
     "route.analytics.assessment.title": "Assessment Result of Created Hits",
     "route.analytics.contributors": "Contributors",
@@ -516,7 +650,6 @@
     "route.analytics.detections": "Detections:",
     "route.analytics.dropdown.detection": "Detection",
     "route.analytics.escalation.title": "Escalation of Created Hits",
-    "route.analytics.filter.rule": "Filter on Rules",
     "route.analytics.ingestion.title": "Number of Hits Created",
     "route.analytics.manager.search": "Search Analytics",
     "route.analytics.overview.description": "Description",
@@ -526,11 +659,6 @@
     "route.analytics.overview.statistics": "Statistics",
     "route.analytics.pinned": "Pinned Analytics",
     "route.analytics.rationales.new": "New Rationale",
-    "route.analytics.rule": "Rule",
-    "route.analytics.rule.title": "Rule Query",
-    "route.analytics.search.filter.rules.hide": "Hiding Rules Only",
-    "route.analytics.search.filter.rules.show": "Showing Rules Only",
-    "route.analytics.search.filter.rules.toggle": "Toggle Filtering Rule",
     "route.analytics.search.prompt": "Search by name or detections.",
     "route.analytics.set.owner": "Change Ownership",
     "route.analytics.status.title": "Cumulative Status of Hits Created in the Last Three Months",
@@ -539,7 +667,6 @@
     "route.analytics.tab.notebooks": "Notebooks",
     "route.analytics.tab.overview": "Summary",
     "route.analytics.tab.overviews": "Overviews",
-    "route.analytics.tab.rule": "Rule Query",
     "route.analytics.tab.templates": "Templates",
     "route.analytics.tab.triage": "Triage",
     "route.analytics.tags": "Tags:",
@@ -552,6 +679,16 @@
     "route.analytics.triage.title": "Triage Settings",
     "route.analytics.updated": "Analytic Updated!",
     "route.analytics.view": "View Analytic",
+    "route.cases": "Cases",
+    "route.cases.create": "Create Case",
+    "route.cases.filter.assignee": "Assignee",
+    "route.cases.filter.assignees": "Assignees",
+    "route.cases.filter.date": "Date Range",
+    "route.cases.filter.myself": "Myself",
+    "route.cases.filter.status": "Status",
+    "route.cases.manager.search": "Search Cases",
+    "route.cases.search.prompt": "Search cases by title, summary, description, participants or task details",
+    "route.cases.view": "View Case",
     "route.clear": "Clear query",
     "route.dossiers": "Dossiers",
     "route.dossiers.create": "New Dossier",
@@ -569,7 +706,7 @@
     "route.dossiers.manager.icon": "Lead Icon",
     "route.dossiers.manager.icon.description": "Specify an icon using the iconify ID. To browse icons, click the button to the right.",
     "route.dossiers.manager.label.en": "English Title",
-    "route.dossiers.manager.label.fr": "Titre français",
+    "route.dossiers.manager.label.fr": "Titre francais",
     "route.dossiers.manager.lead.create": "Create a new lead by pressing the button to the right.",
     "route.dossiers.manager.openinsearch": "Open in Search",
     "route.dossiers.manager.personal": "Personal",
@@ -577,7 +714,7 @@
     "route.dossiers.manager.pivot.format": "Pivot format",
     "route.dossiers.manager.pivot.icon": "Pivot Icon",
     "route.dossiers.manager.pivot.label.en": "English Title",
-    "route.dossiers.manager.pivot.label.fr": "Titre français",
+    "route.dossiers.manager.pivot.label.fr": "Titre francais",
     "route.dossiers.manager.pivot.mapping.custom": "Custom Value",
     "route.dossiers.manager.pivot.mapping.field": "Hit Field",
     "route.dossiers.manager.pivot.mapping.key": "Key",
@@ -698,7 +835,6 @@
     "route.templates.personal": "Personal",
     "route.templates.prompt": "Activate autocomplete using [ctrl + space].",
     "route.templates.readonly.warning": "This is a built-in template, and cannot be edited. To make changes to it, contact",
-    "route.templates.rule.explanation": "This is a Howler Analytic. There is only one detection, which has been pre-selected.",
     "route.templates.search.prompt": "Search by analytic, detection, or template keys.",
     "route.templates.select": "Select an analytic and detection to view and edit the template.",
     "route.templates.view": "View Template",
@@ -732,11 +868,19 @@
     "rule.interval.thirty.minutes": "Every thirty minutes",
     "rule.interval.three.hours": "Every three hours",
     "save": "Save",
+    "search.fuzzy.no_results": "No results found.",
+    "search.fuzzy.placeholder": "Search by IP, domain, hash, email, or keyword...",
+    "search.fuzzy.results.cases": "Cases",
+    "search.fuzzy.results.events": "Events",
+    "search.fuzzy.results.hits": "Hits",
+    "search.fuzzy.title": "Fuzzy Search",
+    "search.fuzzy.total_results": "results found",
     "search.layout.settings": "Edit search result layout",
     "search.open": "Open Search",
     "search.result.showing": "Showing {{offset}} to {{length}} of {{total}} results",
     "search.result.showing.single": "No results",
     "search.total": "There are a total of {{count}} hits matching this query.",
+    "started": "Started",
     "templates.edit.analytic": "Edit analytic template",
     "templates.edit.detection": "Edit detection template",
     "to": "to",