<?php $r=$report; $e=static fn($v):string=>htmlspecialchars((string)$v,ENT_QUOTES,'UTF-8'); ?>
<style>
.siem{display:grid;gap:16px}.siem-hero,.siem-card{background:#fff;border:1px solid #dce4ef;border-radius:18px;padding:20px}.siem-hero{background:#102f55;color:#fff;display:flex;justify-content:space-between;align-items:center;gap:20px}.siem-actions{display:flex;gap:8px;flex-wrap:wrap}.siem-btn{display:inline-block;padding:10px 13px;border-radius:10px;background:#eef4fb;text-decoration:none;font-weight:700}.siem-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(190px,1fr));gap:12px}.siem-value{font-size:28px;font-weight:800}.siem-table{width:100%;border-collapse:collapse}.siem-table th,.siem-table td{padding:10px;border-bottom:1px solid #e8edf4;text-align:left;vertical-align:top}.siem-pill{padding:4px 8px;border-radius:999px;font-size:12px;font-weight:800;background:#edf2f7}.siem-critical{background:#fee2e2;color:#991b1b}.siem-high{background:#ffedd5;color:#9a3412}.siem-warning{background:#fef3c7;color:#92400e}.siem-info{background:#dbeafe;color:#1e40af}.siem-scroll{overflow:auto}.siem-list{margin:0;padding-left:20px}.siem-bar{height:10px;border-radius:999px;background:#e7edf5;overflow:hidden}.siem-bar>span{display:block;height:100%;background:currentColor}.siem-timeline{display:grid;grid-template-columns:minmax(130px,220px) 1fr 60px;gap:10px;align-items:center;margin:8px 0}.siem-ok{color:#166534}.siem-ko{color:#991b1b}@media(max-width:700px){.siem-hero{align-items:flex-start;flex-direction:column}.siem-timeline{grid-template-columns:1fr}.siem-table{min-width:760px}}
</style>
<div class="siem">
<div class="siem-actions"><a class="siem-btn" href="/public/administration/securite">← Sécurité</a><a class="siem-btn" href="/public/administration/securite/soc">Centre SOC</a><a class="siem-btn" href="/public/administration/securite/ueba">UEBA</a><a class="siem-btn" href="/public/administration/securite/incidents">Incidents</a><a class="siem-btn" href="/public/administration/securite/siem/export.csv?hours=<?= (int)$r['hours'] ?>">Exporter CSV</a></div>
<section class="siem-hero"><div><small>SECURITY-ENTERPRISE-004</small><h2>SIEM & SOC Pro</h2><p>Normalisation, corrélation, règles de détection et visibilité consolidée sur les événements AXIOM.</p></div><div><div class="siem-value"><?= (int)$r['risk_score'] ?>/100</div><strong><?= $e($r['status']) ?></strong></div></section>
<div class="siem-grid">
<article class="siem-card"><small>Événements normalisés</small><div class="siem-value"><?= (int)$r['events'] ?></div><span><?= (int)$r['hours'] ?> dernières heures</span></article>
<article class="siem-card"><small>Détections actives</small><div class="siem-value"><?= count($r['detections']) ?></div></article>
<article class="siem-card"><small>Événements critiques</small><div class="siem-value"><?= (int)$r['severity']['critical'] ?></div></article>
<article class="siem-card"><small>Analyse générée</small><strong><?= $e($r['generated_at']) ?></strong></article>
</div>
<section class="siem-card"><h3>Fenêtre d’analyse</h3><div class="siem-actions"><?php foreach([1,6,24,72,168,720] as $h): ?><a class="siem-btn" href="?hours=<?= $h ?>"><?= $h<24?$h.' h':($h/24).' j' ?></a><?php endforeach; ?></div></section>
<section class="siem-card"><h3>État des sources</h3><div class="siem-grid"><?php foreach($r['source_health'] as $s): ?><article><strong class="<?= $s['available']?'siem-ok':'siem-ko' ?>"><?= $s['available']?'● Disponible':'● Indisponible' ?></strong><div><?= $e($s['label']) ?></div><small><?= (int)$s['events'] ?> événements · dernier : <?= $e($s['last_event_at']??'aucun') ?></small></article><?php endforeach; ?></div></section>
<section class="siem-card"><h3>Recommandations</h3><ul class="siem-list"><?php foreach($r['recommendations'] as $item): ?><li><?= $e($item) ?></li><?php endforeach; ?></ul></section>
<section class="siem-card"><h3>Chronologie</h3><?php $max=max(1,...array_values($r['timeline']?:[1])); foreach($r['timeline'] as $label=>$count): ?><div class="siem-timeline"><span><?= $e($label) ?></span><div class="siem-bar"><span style="width:<?= min(100,(int)round($count/$max*100)) ?>%"></span></div><strong><?= (int)$count ?></strong></div><?php endforeach; ?><?php if(!$r['timeline']): ?><p>Aucun événement dans cette fenêtre.</p><?php endif; ?></section>
<section class="siem-card siem-scroll"><h3>Détections corrélées</h3><table class="siem-table"><thead><tr><th>Niveau</th><th>Règle</th><th>Détection</th><th>Occurrences</th><th>Acteur</th><th>Remédiation</th></tr></thead><tbody><?php if(!$r['detections']): ?><tr><td colspan="6">Aucune règle déclenchée.</td></tr><?php endif; ?><?php foreach($r['detections'] as $d): ?><tr><td><span class="siem-pill siem-<?= $e($d['severity']) ?>"><?= $e(strtoupper($d['severity'])) ?></span></td><td><?= $e($d['rule']) ?></td><td><?= $e($d['title']) ?></td><td><?= (int)$d['count'] ?></td><td><?= $e($d['actor']?:'—') ?></td><td><?= $e($d['recommendation']) ?></td></tr><?php endforeach; ?></tbody></table></section>
<section class="siem-card siem-scroll"><h3>Événements récents normalisés</h3><table class="siem-table"><thead><tr><th>Date</th><th>Niveau</th><th>Catégorie</th><th>Événement</th><th>Acteur</th><th>Chemin</th></tr></thead><tbody><?php if(!$r['recent_events']): ?><tr><td colspan="6">Aucun événement.</td></tr><?php endif; ?><?php foreach($r['recent_events'] as $v): ?><tr><td><?= $e($v['timestamp']) ?></td><td><span class="siem-pill siem-<?= $e($v['severity']) ?>"><?= $e(strtoupper($v['severity'])) ?></span></td><td><?= $e($v['category']) ?></td><td><?= $e($v['event']) ?></td><td><?= $e($v['actor']) ?></td><td><?= $e($v['path']) ?></td></tr><?php endforeach; ?></tbody></table></section>
</div>
