{% extends "base.html" %}

{% block title %}Overview & Killchain{% endblock %}

{% block content %}
<div class="dashboard-grid">
    <!-- Top KPI Metric Cards -->
    <div class="kpi-row">
        <div class="kpi-card">
            <div class="kpi-title">Decoy Sensors Active</div>
            <div class="kpi-value text-success">4 / 4</div>
            <div class="kpi-meta">100% Subnet Coverage • 55 Canary Tokens</div>
        </div>
        <div class="kpi-card">
            <div class="kpi-title">24h Deception Hits</div>
            <div class="kpi-value text-warning">{{ threats|length }}</div>
            <div class="kpi-meta">0 False Positives • 100% High Fidelity</div>
        </div>
        <div class="kpi-card">
            <div class="kpi-title">Critical Ransomware Traps</div>
            <div class="kpi-value text-danger">3</div>
            <div class="kpi-meta">High Entropy &amp; Shadow Copy Tamper Intercepted</div>
        </div>
        <div class="kpi-card">
            <div class="kpi-title">Quarantined Hosts</div>
            <div class="kpi-value text-cyan">{{ containment|length }}</div>
            <div class="kpi-meta">Mean Time to Contain: &lt; 8.0s</div>
        </div>
    </div>

    <!-- Middle Section: Attack Killchain & MITRE ATT&CK Mapping -->
    <div class="section-card">
        <div class="card-header">
            <h3>🎯 Intercepted Ransomware Lateral Movement Killchain</h3>
            <span class="badge badge-danger">Live Incident DG-CORR-INCIDENT-9942</span>
        </div>
        <div class="killchain-stepper">
            <div class="step-box completed">
                <div class="step-num">1</div>
                <div class="step-title">Reconnaissance</div>
                <div class="step-desc">T1046 SYN Sweep &amp; MSRPC EPM Probe</div>
                <div class="step-badge">10.240.12.84</div>
            </div>
            <div class="step-connector active"></div>
            <div class="step-box completed">
                <div class="step-num">2</div>
                <div class="step-title">Credential Abuse</div>
                <div class="step-desc">T1078.002 NTLMv2 Compromised Service Acct</div>
                <div class="step-badge">svc-backup</div>
            </div>
            <div class="step-connector active"></div>
            <div class="step-box completed">
                <div class="step-num">3</div>
                <div class="step-title">Lateral Movement</div>
                <div class="step-desc">T1021.002 SMB ADMIN$ &amp; PsExec Service Creation</div>
                <div class="step-badge">Port 445/TCP</div>
            </div>
            <div class="step-connector active"></div>
            <div class="step-box critical">
                <div class="step-num">4</div>
                <div class="step-title">Canary Tripwire</div>
                <div class="step-desc">T1486 Canary Encryption &amp; Ransom Note</div>
                <div class="step-badge">Entropy 7.98/8.0</div>
            </div>
            <div class="step-connector active"></div>
            <div class="step-box isolated">
                <div class="step-num">5</div>
                <div class="step-title">Autonomous Quarantine</div>
                <div class="step-desc">EDR Host Isolation &amp; QRadar Reference Set</div>
                <div class="step-badge">Containment &lt; 10s</div>
            </div>
        </div>
    </div>

    <!-- Bottom Section: Live Intercept Table -->
    <div class="section-card">
        <div class="card-header">
            <h3>⚡ Live Deception Telemetry Stream (QRadar LEEF 2.0 Normalized)</h3>
            <div class="header-actions">
                <button class="btn btn-sm btn-secondary" onclick="exportLEEF()">Export LEEF Syslog</button>
                <a href="{{ url_for('dentigrid_qapp.threats_view') }}" class="btn btn-sm btn-primary">View All Intercepts</a>
            </div>
        </div>
        <div class="table-responsive">
            <table class="carbon-table">
                <thead>
                    <tr>
                        <th>Time (UTC)</th>
                        <th>Attacker Host / IP</th>
                        <th>Target Decoy</th>
                        <th>Target Port</th>
                        <th>MITRE ATT&amp;CK</th>
                        <th>Severity</th>
                        <th>Deception Signature</th>
                        <th>Actions</th>
                    </tr>
                </thead>
                <tbody>
                    {% for t in threats %}
                    <tr class="threat-row severity-{{ t.severity_id }}">
                        <td class="mono-text">{{ t.timestamp }}</td>
                        <td>
                            <strong>{{ t.src_host or t.src_ip }}</strong><br>
                            <span class="mono-text text-muted">{{ t.src_ip }}</span>
                        </td>
                        <td>
                            <span>{{ t.dest_host or t.dest_ip }}</span><br>
                            <span class="mono-text text-muted">{{ t.node_id }}</span>
                        </td>
                        <td><span class="badge badge-outline">{{ t.dest_port }}/{{ t.protocol|upper }}</span></td>
                        <td>
                            <span class="badge badge-info">{{ t.mitre_technique_id }}</span><br>
                            <small>{{ t.mitre_technique }}</small>
                        </td>
                        <td>
                            {% if t.severity_id >= 9 %}
                            <span class="badge badge-danger">Critical ({{ t.severity_id }})</span>
                            {% elif t.severity_id >= 7 %}
                            <span class="badge badge-warning">High ({{ t.severity_id }})</span>
                            {% else %}
                            <span class="badge badge-primary">Medium ({{ t.severity_id }})</span>
                            {% endif %}
                        </td>
                        <td>
                            <div class="sig-name">{{ t.signature }}</div>
                            <small class="text-muted">{{ t.raw_payload[:60] if t.raw_payload else '' }}...</small>
                        </td>
                        <td>
                            <div class="btn-group">
                                <button class="btn btn-xs btn-danger" onclick="openIsolateModal('{{ t.src_ip }}', '{{ t.src_host or t.src_ip }}')">Isolate</button>
                                <button class="btn btn-xs btn-secondary" onclick="syncXForce('{{ t.src_ip }}')">X-Force</button>
                            </div>
                        </td>
                    </tr>
                    {% endfor %}
                </tbody>
            </table>
        </div>
    </div>
</div>
{% endblock %}