Expand histogram timeline dimensions and category display#658
Merged
Conversation
Add ProcessImage and ParentProcessImage histogram and timeline group-by dimensions that group events by the short process-image name from EventData string fields (NewProcessName/Image and ParentProcessName/ParentImage, tried in order). This activates a process-image timeline for the LOLBin, Office-spawned-process, and Sysmon threat scenarios. The column store gains alloc-free, survivor-scoped CountEventDataStringValues and BucketTimeTicksByEventDataString that select the first usable native-string candidate per row. Pending and sealed rows use a structural gate - pending EventProperty.Reference is string versus sealed StoredFieldKind.String - so a field counts only when it is a genuine native string, keeping the live and sealed views in exact lockstep. The builder folds raw full paths to short image names, keeps the top categories plus Other, and maps each raw value to its slot.
Re-pick all 128 built-in scenario filter-row highlight colors from the saturated NORMAL and DARK tiers to the softer LIGHT (pastel) tier, preserving each row's semantic hue. Severity ladders anchored by DarkRed use a warm pastel gradient (LightRed, LightOrange, LightYellow) so the tiers stay distinguishable while calm; categorical scenarios keep distinct pastels. This removes the blinding saturated row backgrounds without losing outcome meaning. Update the 15 scenario purpose legends that named specific colors so the text matches the new pastel swatches, and update the catalog color-assertion tests. The light-tier [data-highlight] CSS already existed, so no style changes were needed.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds scenario-driven “timeline group-by dimension” support to the histogram, including new process-image dimensions, and updates categorical rendering to better match highlight colors and handle overflow categories via an “Other” bucket.
Changes:
- Introduces
ScenarioTimelineDimension+ scenario JSONtimelineDimensionparsing, and dispatches histogram dimension requests when launching timeline-activating scenarios. - Expands histogram dimensions (ProcessImage / ParentProcessImage), categorical palette capacity, and adds tie-aware highlight coloring + “Other” overflow labeling.
- Adds/updates extensive unit test coverage across Runtime/UI/Eventing/Filtering/Scenarios to validate the new behavior.
Reviewed changes
Copilot reviewed 61 out of 61 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/Unit/EventLogExpert.UI.Tests/LogTable/Histogram/HistogramPaneTests.cs | New UI tests for dimension requests, legend truncation, and tie-highlight rendering. |
| tests/Unit/EventLogExpert.Scenarios.Tests/ScenarioCatalogLoaderTests.cs | Tests ignoring invalid timelineDimension values. |
| tests/Unit/EventLogExpert.Scenarios.Tests/BuiltInCatalogValidationTests.cs | Validates built-in timeline scenarios’ expected dimensions and updated highlight color names. |
| tests/Unit/EventLogExpert.Runtime.Tests/Scenarios/ScenarioLaunchServiceTests.cs | Tests dimension-request dispatch during scenario launch + mapping coverage. |
| tests/Unit/EventLogExpert.Runtime.Tests/LogTable/TestSupport/LegacyEventColumnView.cs | Test view support for tie bucketing + highlight-winner caching. |
| tests/Unit/EventLogExpert.Runtime.Tests/Histogram/HistogramStateTests.cs | Tests for dimension-request reducer behavior + token handling. |
| tests/Unit/EventLogExpert.Runtime.Tests/Histogram/HistogramHighlightTieTests.cs | New tests covering highlight tie bucketing/masks behavior across dimensions/views. |
| tests/Unit/EventLogExpert.Runtime.Tests/Histogram/HistogramGroupsTests.cs | Tests conditional inclusion/labeling of the “Other” group. |
| tests/Unit/EventLogExpert.Runtime.Tests/Histogram/HistogramEffectsTests.cs | New effects tests for clearing dimension requests when logs close. |
| tests/Unit/EventLogExpert.Runtime.Tests/FilterPane/HighlightSelectorTests.cs | Tests for predicate-plan key stability vs. color-only changes. |
| tests/Unit/EventLogExpert.Filtering.Tests/Compilation/FilterServiceHighlightWinnerTests.cs | New tests for highlight-winner classification semantics. |
| tests/Unit/EventLogExpert.Eventing.Tests/Common/Events/EventColumnStoreHighlightTieBucketTests.cs | New tests for tie-aware bucketing variants. |
| tests/Unit/EventLogExpert.Eventing.Tests/Common/Events/EventColumnStoreEventDataTests.cs | Tests for EventData string counting/bucketing consistency. |
| tests/Shared/EventLogExpert.Eventing.TestUtils/Common/Events/LegacyEventColumnReader.cs | Adds tie-aware bucketing + EventData string counting/bucketing in legacy reader. |
| src/EventLogExpert.UI/LogTable/Histogram/HistogramPane.razor.css | Adds legend truncation styling, segment strokes, expanded palette + forced-color hatches. |
| src/EventLogExpert.UI/LogTable/Histogram/HistogramPane.razor.cs | Implements dimension requests, tie-highlighting, new dimension labels, and tie rescan logic. |
| src/EventLogExpert.UI/LogTable/Histogram/HistogramPane.razor | Adds new dimensions to selector; adds highlight metadata attributes and legend label truncation. |
| src/EventLogExpert.Scenarios/Serialization/ScenarioDto.cs | Adds TimelineDimension field to scenario DTO. |
| src/EventLogExpert.Scenarios/Serialization/ScenarioCatalogLoader.cs | Parses timelineDimension into ScenarioTimelineDimension?. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/web-and-iis.json | Adds activatesTimeline + timelineDimension and updates highlight colors. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/virtualization-and-clustering.json | Adds activatesTimeline + timelineDimension and updates highlight colors/text. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/updates-and-policy.json | Adds activatesTimeline + timelineDimension and updates highlight colors. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/threats-and-incident-response.json | Adds timeline activation/dimensions for relevant scenarios; updates highlight colors/text. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/system-health.json | Adds activatesTimeline + timelineDimension and updates highlight colors. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/storage.json | Adds activatesTimeline + timelineDimension and updates highlight colors. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/sql-server.json | Adds activatesTimeline + timelineDimension and updates highlight colors. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/security.json | Adds activatesTimeline + timelineDimension and updates highlight colors/text. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/nps-and-rras.json | Adds activatesTimeline + timelineDimension and updates highlight colors/text. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/network.json | Adds activatesTimeline + timelineDimension. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/file-print-and-storage.json | Adds activatesTimeline + timelineDimension and updates highlight colors/text. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/exchange.json | Adds activatesTimeline + timelineDimension and updates highlight colors. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/dns-server.json | Adds activatesTimeline + timelineDimension and updates highlight colors. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/defender-for-endpoint.json | Adds activatesTimeline + timelineDimension and updates highlight colors. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/capi2.json | Updates highlight color names in text/filters. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/applications.json | Adds activatesTimeline + timelineDimension. |
| src/EventLogExpert.Scenarios/Scenarios/built-in/active-directory.json | Adds activatesTimeline + timelineDimension and updates highlight colors. |
| src/EventLogExpert.Scenarios/Catalog/ScenarioTimelineDimension.cs | New enum for scenario-driven timeline dimension selection. |
| src/EventLogExpert.Scenarios/Catalog/ScenarioDefinition.cs | Adds TimelineDimension to scenario definition. |
| src/EventLogExpert.Runtime/Scenarios/ScenarioLaunchService.cs | Dispatches dimension request on launch; maps scenario dimension to histogram dimension. |
| src/EventLogExpert.Runtime/LogTable/IEventColumnView.cs | Extends view interface for string bucketing + tie-aware APIs + highlight-winner capture. |
| src/EventLogExpert.Runtime/LogTable/EventColumnView.cs | Implements tie-aware bucketing and highlight-winner caching; preserves cache across contexts. |
| src/EventLogExpert.Runtime/LogTable/CombinedColumnView.cs | Implements tie-aware bucketing for combined views + highlight-winner handle routing. |
| src/EventLogExpert.Runtime/Histogram/RequestHistogramDimensionAction.cs | New action to request a histogram dimension selection. |
| src/EventLogExpert.Runtime/Histogram/Reducers.cs | Adds reducers for dimension requests and preserves state on visibility changes. |
| src/EventLogExpert.Runtime/Histogram/HistogramState.cs | Adds DimensionRequest + NextDimensionToken. |
| src/EventLogExpert.Runtime/Histogram/HistogramGroups.cs | Makes “Other” group conditional + supports custom “Other (…)” labels. |
| src/EventLogExpert.Runtime/Histogram/HistogramDimensionRequest.cs | New tokenized request record. |
| src/EventLogExpert.Runtime/Histogram/HistogramDimension.cs | Adds ProcessImage and ParentProcessImage dimensions. |
| src/EventLogExpert.Runtime/Histogram/HistogramData.cs | Adds optional GroupHighlightMasks. |
| src/EventLogExpert.Runtime/Histogram/HistogramConstants.cs | Increases max categories and introduces grace limit. |
| src/EventLogExpert.Runtime/Histogram/HistogramBuilder.cs | Adds process-image dimension scanning; adds tie-aware builds and “Other” labeling logic. |
| src/EventLogExpert.Runtime/Histogram/Effects.cs | Clears pending dimension requests when logs are closed. |
| src/EventLogExpert.Runtime/Histogram/ClearHistogramDimensionRequestAction.cs | New action to clear a pending dimension request. |
| src/EventLogExpert.Runtime/FilterPane/IHighlightSelector.cs | Adds predicate-plan key API. |
| src/EventLogExpert.Runtime/FilterPane/HighlightSelector.cs | Computes predicate-plan keys ignoring highlight color changes. |
| src/EventLogExpert.Filtering/Compilation/FilterService.cs | Adds column-based highlight-winner classification helper. |
| src/EventLogExpert.Eventing/Common/Events/IEventColumnReader.cs | Adds tie-aware bucketing and EventData string APIs. |
| src/EventLogExpert.Eventing/Common/Events/EventDataView.cs | Adds raw property access for EventData fields (TryGetRawValue). |
| src/EventLogExpert.Eventing/Common/Events/EventColumnStoreReader.cs | Implements new tie-aware bucketing + EventData string counting/bucketing. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
jschick04
force-pushed
the
feat/histogram-enhancements
branch
from
July 20, 2026 20:36
45175a1 to
cfc6387
Compare
jschick04
marked this pull request as ready for review
July 20, 2026 21:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds timeline "group-by dimension" support to the histogram: scenarios can auto-select a dimension on launch, plus a new process-image dimension. Ties timeline bar colors to the log-table highlight palette (softened to pastels), and expands the category display with a tie-gated grace limit and an overflow "Other" bucket.
Stacked on top of the folder-launch feature (now merged). Base is main.
Tests: Runtime 1983, Scenarios 674, UI 1148 green.