tables: timestamp formats, mid-value wrapping, and bulk actions across data pages

[Xore]

Cross-page table findings (live click-through, 1854px viewport):

Timestamps are inconsistent and wrap destructively

• /ml-anomalies: raw ISO with millis ("2026-08-11T12:35:43.666Z")
• /auth-events: microseconds + offset ("2026-08-11T15:23:03.350000+00:00")
• /attackers: ISO wraps mid-CHARACTER across three lines ("2026-08-1␤6T23:17:0␤1Z")
• /campaigns, /commands, /ips: "2026-␤08-16" / "2026-08-16␤21:55" two-line wraps
• Overview/events use "YYYY-MM-DD HH:MM:SS". Pick one display format (server already ships data-hp-utc for client-side reformatting; user pref "timestamps: relative" exists and is ignored by most tables) and set white-space:nowrap + min-width on time columns.

Column crush / mid-value wrapping

• /campaigns is the worst: network CIDR wraps mid-value ("169.58.1␤70.0/24"), provider wraps "networ␤k", trailing "ES →" column clipped by the card edge; 15 columns don't fit. Needs column priorities (hide/collapse secondary cols), nowrap on identifiers, or a two-line row design.
• /ips, /commands: same at smaller scale (source-ip and date wrapping; sources column crams 5 IPs + "+15").

Repetition / missing bulk actions

• /ml-anomalies: explanation column repeats "Statistical outlier (composite score X)" on every row; ~40 identical per-row "acknowledge" buttons with no bulk-ack; near-duplicate rows (same second/IP, ±0.01 score) could be grouped.
• /alerts: 200 same-class YARA alerts flood the New tab and pin the header badge at "99+" forever — group by rule with counts (the per-row key is a full sha256+rule string, mostly noise); "acknowledge all (200)" exists but grouping would prevent the flood from returning.
• KPI tiles that say "0 … in 24h" directly above tables full of week-old OPEN items (/ml-anomalies "0 Anomalies, 24h", /auth-events "0 Failed logins, 24h") — lead with the open-backlog count too.

Misc

• /clusters: "1 sensors:" grammar; twin "investigate →" + "ES →" link columns could be one action cell.
• /attackers: ~10s skeleton with no progress hint; "verdict" badge appears on some rows only, unexplained.
• Page title casing varies: "event explorer" vs "Source IPs" vs "ML anomaly detection".

🤖 Generated with Claude Code