Problem / What it aims to solve
At the moment, analysts can only interact with quarantined payloads (searching, filtering, and downloading) by querying the REST API directly. This creates friction for users who prefer interacting via a graphical interface.
Suggested approach
Add a dedicated payload browser to GreedyBear's existing web frontend. The UI should allow analysts to:
- Search and filter payloads by hash, MIME type, source honeypot, etc.
- View payload metadata.
- Download the
.vir quarantined samples directly from the browser (respecting the existing RBAC / threat_researcher group permissions).
Additional context
Note: Implementing this feature may require changes across multiple codebases (e.g., both GreedyBear and tpot-payload-server).
Problem / What it aims to solve
At the moment, analysts can only interact with quarantined payloads (searching, filtering, and downloading) by querying the REST API directly. This creates friction for users who prefer interacting via a graphical interface.
Suggested approach
Add a dedicated payload browser to GreedyBear's existing web frontend. The UI should allow analysts to:
.virquarantined samples directly from the browser (respecting the existing RBAC /threat_researchergroup permissions).Additional context
Note: Implementing this feature may require changes across multiple codebases (e.g., both
GreedyBearandtpot-payload-server).