[FR] Add screenshot to timeline event descriptions, asset and IOC descriptions

[CyberSpooon]

Is your feature request related to a problem? Please describe. Similar to the functionality implemented in issue #30, it would be great to add screenshots from the clipboard to timeline event descriptions. This would, a) potentially reduce time spent on creating and typing out descriptions for individual events and b) allow analysts to provide more context to existing event descriptions since screenshots can be excellent forms of supplementary evidence. While this specific issue highlights the need to add screenshots to event timeline descriptions specifically, it would be extremely helpful to be able to include screenshots from the clipboard in all description fields across the entire DFIR IRIS platform.

Describe the solution you'd like Ability to upload screenshots from clipboard or from disk in to the timeline event description, asset description, and IOC description. It would also be helpful to upload a screenshot/picture saved on disk as a single evidence item in the evidence tab.

[whikernel]

Hi @CyberSpooon -

All description fields of the case objects are MD enabled and can thus render images. These images might need to be uploaded to the datastore first if the copy/paste isn't working. You need to click on the eye icon on the description fields to render the MD. This is mostly due to the lack of space in the modals. We're open to any suggestions to make this better 👍

[CyberSpooon]

Hi @whikernel,

Thanks for the quick reply! I did notice that I could add screenshots by first uploading them to the datastore and entering the MD into the desired description. However, I am hoping for a more seamless way to enter screenshots by simply copy/pasting them from the clipboard to the IOC, asset, or timeline description fields. That is how it works in the case summary field which is fantastic! Hoping to see that same screenshot copy/paste functionality in the case summary field also built into other description fields on the platform (see screenshot below). Hope that clarifies things!

Screenshot copy/paste functionality to potentially be implemented across all description fields in IRIS.

Thanks!

[YouBaxter]

100% on this!
in the timeline, pasting images/snippits would be a HUGE benefit. Simply for context adds and not necessarily IOCs.

[elsid2020]

I'd like to add my support for this enhancement. The image paste functionality in the case summary editor works perfectly. Extending this to the other description fields (Timeline, IOC, assets, etc) would be a great benefit.