he search options in the investigate view would be very nice to collapse independently of the ticket listing. as when we are working the alerts we do not need constant view of the search parameters but will need constant view of the incident list. additionally this would help us a lot on smaller resolution displays as this item takes up a moderate portion of the view.

The search box should allow the user to search for a specific incident by Incident ID number.

Several UI improvements are included in the attached picture. In addition to that, It is also worth noting that the UI scales horribly on lower resolution displays such as this user’s laptop.

If a particular lead doesn’t include a reference to total bytes transferred (quite common), label that Bytes field as N/A, rather than 0 (zero). The latter can be misleading and make investigators dismiss the incident under the belief that no data was transferred at all.

It would be very useful to have a way to export an incident for review by parties without access to the WitFoo investigative interface. A simple export/print to PDF would be more than fine.