{% extends "base.html" %}

{% block title %}Deception Intercepts (LEEF){% endblock %}

{% block content %}
<div class="section-card">
    <div class="card-header">
        <div>
            <h3>⚡ Deception Intercepts &amp; QRadar Normalized Event Stream</h3>
            <p class="text-muted">High-fidelity intrusion detection telemetry formatted in LEEF 2.0 with custom property extractions.</p>
        </div>
        <div class="filter-bar">
            <input type="text" id="table-search" class="carbon-input" placeholder="Search IP, MITRE ID, Signature..." onkeyup="filterThreatsTable()">
            <button class="btn btn-secondary" onclick="openAQLModal()">Run AQL Query</button>
        </div>
    </div>

    <div class="table-responsive">
        <table class="carbon-table" id="threats-table">
            <thead>
                <tr>
                    <th>Event Time</th>
                    <th>Source IP / Host</th>
                    <th>Destination Decoy</th>
                    <th>Port/Proto</th>
                    <th>Category</th>
                    <th>MITRE ID</th>
                    <th>Severity</th>
                    <th>Signature &amp; Raw Intercept</th>
                    <th>Actions</th>
                </tr>
            </thead>
            <tbody>
                {% for t in threats %}
                <tr class="threat-row severity-{{ t.severity_id }}">
                    <td class="mono-text">{{ t.timestamp }}</td>
                    <td>
                        <strong class="text-white">{{ t.src_ip }}</strong><br>
                        <small class="mono-text text-muted">{{ t.src_host or 'N/A' }}</small>
                    </td>
                    <td>
                        <span>{{ t.dest_ip }}</span><br>
                        <small class="mono-text text-muted">{{ t.node_id }}</small>
                    </td>
                    <td><span class="badge badge-outline">{{ t.dest_port }}/{{ t.protocol|upper }}</span></td>
                    <td><span class="badge badge-primary">{{ t.category }}</span></td>
                    <td>
                        <span class="badge badge-info">{{ t.mitre_technique_id }}</span><br>
                        <small>{{ t.mitre_tactic }}</small>
                    </td>
                    <td>
                        {% if t.severity_id >= 9 %}
                        <span class="badge badge-danger">Critical ({{ t.severity_id }})</span>
                        {% elif t.severity_id >= 7 %}
                        <span class="badge badge-warning">High ({{ t.severity_id }})</span>
                        {% else %}
                        <span class="badge badge-primary">Medium ({{ t.severity_id }})</span>
                        {% endif %}
                    </td>
                    <td>
                        <strong>{{ t.signature }}</strong>
                        <div class="raw-box mono-text">{{ t.raw_payload if t.raw_payload else 'Raw payload logged' }}</div>
                    </td>
                    <td>
                        <div class="btn-group">
                            <button class="btn btn-xs btn-danger" onclick="openIsolateModal('{{ t.src_ip }}', '{{ t.src_host or t.src_ip }}')">Quarantine</button>
                            <button class="btn btn-xs btn-secondary" onclick="syncXForce('{{ t.src_ip }}')">X-Force</button>
                        </div>
                    </td>
                </tr>
                {% endfor %}
            </tbody>
        </table>
    </div>
</div>
{% endblock %}