Repository navigation
A short follow-up to 0.4.0. Any page can now move to a window of its own, a Pivot number opens the rows behind it, the Timeline gets the table pages' timeframe filter, and an update can restart Winnow for you. It also fixes a handful of things that went wrong when switching cases.
What's new since 0.4.0
Pages in their own windows. Right-click a page tab (SQL, Timeline, Notes, Watchlist, a plugin tab such as the Pivot, or a pinned dashboard) and pick Open in its own window, or click the ⧉ on its sidebar row. The page sits beside the table it is about instead of taking turns with it. Clicks that open a table or a row from a popped-out page land in the main window, changes made in one window show up in the others, and a pop-out closes with its main window and follows it to another case. With Pages as a dropdown turned on, each row in the list has the same right-click menu.
From a Pivot number to its rows. Right-click a Pivot number, or use the button at the top of its rows list, and Show these rows in the grid opens the table filtered to exactly what the cell counted: its values in the column filter boxes, the Filters area as filter-builder conditions, and its tags as the ribbon's tag filter. The timeframe is turned off on the way, and Winnow says so, because the Pivot counts the whole table.
A timeframe for the Timeline. ⏱ Timeframe in the Timeline header, or R, sets a start and end the same way the table pages do; r turns it off and on, and a chip in the header shows the range. Dragging across the overview strip sets the same range. It is the Timeline's own, so a timeframe set to read one table doesn't take findings off the Timeline. Every Timeline line shows its full ISO timestamp again.
Restart after updating. Installing an update from Settings → Updates now offers Restart Winnow when it’s installed, ticked by default; untick it and Restart now waits until you're ready. Winnow comes back on the same address and the same case with no new window, and every open window reloads on its own. If the new version needs a Python package this machine doesn't have, nothing is stopped and the panel gives the pip command to run. This works when Winnow was started with python server.py, which includes the launchers and file associations.
New case on the two-pane frame. + New case, and the quick look's Save as a case, list the profiles down the side with a one-line summary of each, and the case's name, group and file on the right. Switching profiles keeps what you typed.
Histogram. The strip marks each midnight, or each Monday once its bars are a day or wider, as the Timeline's overview does, and hovering a mark names its day. It charts only the datetime columns the grid shows, so hiding the charted column moves the chart to one you can see.
First/Last picks tags with the same chips as the grid, the Timeline and the Pivot, and can now exclude a tag. Sheets saved with the old tag picker open as the chips that mean the same thing.
Shipped filters. "EVTX — Defender config changes (noisy)" is no longer shipped. An unedited copy is removed from existing workspaces; one you edited or renamed stays.
Fixes
- Switching back and forth between cases no longer shows "This window is out of date" over the case you just opened.
- Clicking another case while one is still opening now opens the one you clicked last, instead of dropping the click.
- A Timeline note typed just before switching cases could be saved into the new case, on whichever row had the same table and row number. It is now saved to its own case.
- A header filter committed with Enter was built twice, and the second build could land after you came back to the table, showing the whole table under a filter box and losing your scroll position.
- In a Pivot "is any of" filter, (blank) now matches empty cells that hold NULL too, as it does in the grid.
- The Pages site's dark mode uses neutral grays instead of a green cast, and the keyboard shortcuts page lists the first-row and last-row jumps once each, with all their keys.
For plugin authors
The plugin API goes from 14 to 15. winnow.openFiltered(sourceId, pairs, opts) takes opts with where, tags and clearTimeframe, so a plugin can hand over a count's whole question, the way the Pivot now does. The tab context's apiVersion is 9. The example plugins ask for API 15. Plugin tabs can be popped out like any other page. The plugin guide was brought up to date with what plugins can do.
Upgrading
Case files from 0.4.0 open as they are, and nothing in requirements.txt changed. Use Settings → Updates or python update.py, or download the archive below. The update from 0.4.0 to 0.4.1 still ends with restarting Winnow yourself, because the running 0.4.0 doesn't know how to restart; from 0.4.1 on, the update can do it.