Velociraptor: the notebook text is not the flow

The notebook is the current text

A notebook cell shows the query as it is saved now. Someone can edit that cell after a collection finishes. The cell is then a new text. It is not a recording of the older run.

If you only have the notebook, write “flow definition not opened.” Do not assume the cell still matches the run.

The flow keeps what it ran

A finished flow has its own record of the artifact and the request that produced the rows. That record is what the rows answer. Editing the notebook does not rewrite the rows and does not rewrite the flow.

If the flow’s stored text and the notebook differ, cite both and say they differ. The rows belong to the flow.

What to file

File the flow id and a short note of the query the flow stored, or say you did not open it. File the notebook text only as the current cell. Do not paste today’s cell under yesterday’s flow id without saying they were compared.

Worked case: a cell edited after the rows existed

Flow F.410 on client C.333 finished yesterday and stored a query that selected process name and pid. This morning the notebook cell also selects the command line. A draft explains yesterday’s three rows as if they included command lines.

The note says the flow’s stored query had name and pid. The notebook now has a command line column. The three rows do not gain that column. The draft’s command-line sentences are removed.

Snippet

flow: F.410  client: C.333
stored query columns: name, pid
notebook today: also command line
rows: 3, from the flow
write: rows match the stored query
not: the rows include command lines

Diagram

Match the rows to the query that ran

Flow
The finished collection.
Id
```
F.410
```
Stored query
What that flow kept.
Text
```
name and pid
```
Notebook now
The cell as edited later.
Text
```
also command line
```
Rows
Answer the stored query.
Result
```
3 rows, no new column
```

Check yourself

1. A notebook cell was edited after flow F.410 finished. Which text explains F.410’s rows?

2. The stored query selected name and pid, and the notebook now also selects command line. What do the old rows contain?

3. You have not opened the flow’s stored query. What do you write?