Feature Request: Notify user if Assemblyline has already seen a sample

[ociappara]

Is your feature request related to a problem? Please describe.

Our analysts frequently encounter the issue of redundancy, submitting a malware sample to Assemblyline that has already been analysed. While the current system allows users to query and identify such instances, it is not proving to be an intuitive or streamlined process. As a result, our team often misses opportunities for collaboration and shared learning with analysts who have previously studied the same sample.

To address this issue, we propose an automatic alert system in Assemblyline similar to the functionality offered by VirusTotal. Upon submission of a sample, if Assemblyline recognizes the sample as one that has been analysed previously, it should immediately trigger a notification. This alert would inform the user about the sample's existing presence in the system.

[eljeffeg]

Implementation could tie into #52

[cccs-sgaron]

How would you implement this?

1. Dialog box before actually performing the submission to give the user the chance not to submit the file and only view the old results?
2. Submit anyway but in the submission view have a list of other ppl that have submitted the file (This is somewhat already implemented because this is in the file detail view already)
3. Full blown notification system that would notify all affected user that are logged in that someone is looking at a file they've previously submitted with notification popups?

[eljeffeg]

From a notification perspective, I was thinking email.

[ociappara]

Email, and a popup would be ideal. As you said #2 is somewhat already implemented, but has been our experience that users do not really look at this.