Chat History & Sidebar
The sidebar on the left lists your analysis sessions and is where you navigate between conversations.- Date-grouped conversations. Sessions are grouped under Today, Yesterday, Previous 7 days, and Older, so your most recent work stays at the top.
- Real-time search. Type in the Search conversations field to filter the list by title as you type. A clear button appears in the field to reset the search.
- New Analysis. The New Analysis button at the top of the sidebar starts a fresh session.
- Responsive and collapsible. The sidebar can be collapsed to an icon-only rail to free up screen space. On narrower screens it collapses automatically and opens as an overlay when you need it.
Managing Chats
Each conversation in the list has its own controls. Hover over an item and select the More options button, or right-click the item, to open its menu.Rename
Double-click a conversation, or choose Rename from its menu, to edit the title inline. Press Enter to save or Escape to cancel. Titles are limited to 200 characters.
Export
Choose Export to download the conversation transcript as Markdown or JSON. This is a copy of the conversation itself, separate from the formatted analysis reports you generate from the inspector.
Chat Sharing
Share an analysis session with colleagues by generating a share link with a configurable expiry. How it works:- Click the share button in the chat header
- Choose an expiry duration for the link (3, 5, 8, or 12 hours)
- Copy the generated URL and send it to your team
What Shared Viewers Can See
Shared links present a sanitised view of the conversation. Before a shared session is rendered, DECODA strips details that should not leave your organisation:- Your display name is shown as Analyst, and user IDs are removed from the messages.
- Internal sandbox paths are stripped from tool call arguments.
- Long tool result output is truncated (to around 2,000 characters) with a note that the output was truncated for the shared view.
Ghidra Project Persistence
When analysing native binaries in Agent mode, the Ghidra project is preserved across messages within the same chat session. This means:- The initial Ghidra import and analysis (which can take minutes for large binaries) only happens once
- Follow-up questions like “decompile the main function” or “show cross-references to CreateRemoteThread” reuse the already-analysed project instantly
- Switching to a new chat session creates a fresh project
Auto-Continue
When an Agent mode analysis requires more steps than fit in a single response, the agent can automatically continue its work. You’ll see an auto-continue banner indicating the agent is still working. This is useful for complex analyses where the agent needs to:- Chain many tools together (e.g., decompile → trace calls → extract IOCs → generate YARA rule)
- Process large outputs that require multiple follow-up tool calls
- Iterate on findings to build a complete picture before reporting back
Reading the Chat Header
The header at the top of each session summarises what is being analysed and where the triage stands.- Attached sample badge. When a sample is attached, a badge shows its filename. Hover over the badge to see the full filename and the sample’s SHA256 hash.
- Detection count badge. A detection count badge (for example, “54/72 detections”) appears once triage data is available.
- Auto Triage indicator. An Auto Triage badge indicates that DECODA ran its automatic triage on the sample.
- Triage status bar. A second row shows the triage status with per-step indicators, marking each step as completed, running, pending, or failed so you can follow progress at a glance.
Inspector Panels
Two optional inspector panels dock to the right of the chat. Open either one from the More options menu in the chat header; only one panel is shown at a time.File Context Panel
Choose Show File Context to open an inspector for the attached sample. It surfaces:- File metadata such as name, type, size, and entropy (including PE header details for native binaries).
- Hashes (MD5, SHA-1, SHA-256, and ssdeep), each copyable with a click.
- The latest verdict and assessment, with links back to the evidence behind it.
- Extracted network indicators and generated reports for the sample.
Artefacts Panel
Choose Show Artefacts to open a panel that indexes the artefacts the agent saves during an analysis. Artefacts are tagged by type - config, payload, yara_rule, ioc_list, decrypted, or other - and each entry shows its filename, size, description, an expiry countdown, and a download link.Working with Messages
Hover over a message to reveal its action buttons:| Action | Available on | What it does |
|---|---|---|
| Copy | All messages | Copies the message content to your clipboard |
| Edit | Your messages | Reopens your message for editing |
| Regenerate | DECODA’s replies | Asks the assistant to produce a new response |
| Thumbs up / down | DECODA’s replies | Sends feedback on the quality of the response |
In-App Notifications
DECODA uses toast notifications in the corner of the screen to keep you informed without interrupting your work.- Confirmation toasts acknowledge actions such as saving your settings.
- Usage and credit warnings appear as you approach your monthly agent limit - at 80% of your allowance, when you reach 100%, and when your credits are running low or exhausted. Where relevant, these toasts include a shortcut to buy more credits.