<?php use App\Core\Csrf; $r=$report; $h=static fn($v):string=>htmlspecialchars((string)$v,ENT_QUOTES,'UTF-8'); $stats=$r['stats']; ?>
<style>
.socx{display:grid;gap:16px}.socx-hero,.socx-card{background:#fff;border:1px solid #dce4ef;border-radius:18px;padding:20px}.socx-hero{background:linear-gradient(135deg,#0b2545,#163f6f);color:#fff;display:flex;justify-content:space-between;gap:20px;align-items:center}.socx-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(165px,1fr));gap:12px}.socx-value{font-size:28px;font-weight:850}.socx-actions{display:flex;gap:8px;flex-wrap:wrap;align-items:end}.socx-btn{border:0;border-radius:10px;padding:10px 13px;background:#eaf1f9;color:#15385d;font-weight:750;text-decoration:none;cursor:pointer}.socx-btn.primary{background:#1d5f9f;color:#fff}.socx-table{width:100%;border-collapse:collapse}.socx-table th,.socx-table td{padding:10px;border-bottom:1px solid #e8edf4;text-align:left;vertical-align:top}.socx-scroll{overflow:auto}.socx-pill{display:inline-block;padding:4px 8px;border-radius:999px;font-size:12px;font-weight:800;background:#edf2f7}.critical{background:#fee2e2;color:#991b1b}.high{background:#ffedd5;color:#9a3412}.medium{background:#fef3c7;color:#92400e}.low{background:#dbeafe;color:#1e40af}.socx-filter{display:grid;grid-template-columns:repeat(auto-fit,minmax(145px,1fr));gap:10px}.socx-filter label{display:grid;gap:5px;font-weight:650}.socx-filter input,.socx-filter select,.socx-filter textarea{width:100%;box-sizing:border-box;padding:9px;border:1px solid #cfd9e6;border-radius:9px}.socx-bars{display:grid;gap:8px}.socx-bar{display:grid;grid-template-columns:110px 1fr 55px;gap:8px;align-items:center}.socx-track{height:10px;background:#e9eef5;border-radius:20px;overflow:hidden}.socx-fill{height:100%;background:#356fa8}.socx-detail{display:grid;grid-template-columns:minmax(0,2fr) minmax(280px,1fr);gap:16px}.socx-meta{display:grid;grid-template-columns:repeat(auto-fit,minmax(150px,1fr));gap:10px}.socx-event{border-left:3px solid #aac2dc;padding:8px 12px;margin:8px 0;background:#f8fafc}@media(max-width:850px){.socx-detail{grid-template-columns:1fr}.socx-hero{align-items:flex-start;flex-direction:column}.socx-table{min-width:850px}}
</style>
<div class="socx">
<div class="socx-actions"><a class="socx-btn" href="/public/administration/securite">← Sécurité</a><a class="socx-btn" href="/public/administration/securite/incidents">Réponse aux incidents</a><a class="socx-btn" href="/public/administration/securite/soc/playbooks">Playbooks SOC</a><a class="socx-btn" href="/public/administration/securite/soc/threat-intelligence">Threat Intelligence</a><a class="socx-btn" href="/public/administration/securite/soc/export.csv?days=<?= (int)$r['days'] ?>">Exporter CSV</a></div>
<section class="socx-hero"><div><small>ENTERPRISE-008.3 · AXIOM 9.8.9</small><h1>SOC Dashboard</h1><p><a class="btn" href="/public/administration/securite/assistant-ia">Assistant IA de sécurité</a></p><p>Supervision opérationnelle des incidents corrélés, scores de risque et chronologies.</p></div><div><div class="socx-value"><?= (int)($stats['max_risk']??0) ?>/100</div><strong>Risque actif maximal</strong><br><small>Actualisé <?= $h($r['generated_at']) ?></small></div><p><a href="/public/administration/securite/soc/zero-trust" style="font-weight:700">Zero Trust Policy Engine →</a></p></section>
<div class="socx-grid"><article class="socx-card"><small>Ouverts</small><div class="socx-value"><?= (int)($stats['open_count']??0) ?></div></article><article class="socx-card"><small>En investigation</small><div class="socx-value"><?= (int)($stats['investigating_count']??0) ?></div></article><article class="socx-card"><small>Critiques actifs</small><div class="socx-value"><?= (int)($stats['critical_active']??0) ?></div></article><article class="socx-card"><small>Résolus</small><div class="socx-value"><?= (int)($stats['resolved_count']??0) ?></div></article><article class="socx-card"><small>Faux positifs</small><div class="socx-value"><?= (int)($stats['false_positive_count']??0) ?></div></article></div>
<section class="socx-card"><h3>Filtres</h3><form method="get" class="socx-filter"><label>Recherche<input name="q" value="<?= $h($r['filters']['query']) ?>" placeholder="Titre ou UUID"></label><label>Statut<select name="status"><option value="">Tous</option><?php foreach(['open'=>'Ouvert','investigating'=>'Investigation','resolved'=>'Résolu','false_positive'=>'Faux positif'] as $k=>$v):?><option value="<?=$k?>" <?= $r['filters']['status']===$k?'selected':'' ?>><?=$v?></option><?php endforeach?></select></label><label>Gravité<select name="severity"><option value="">Toutes</option><?php foreach(['low'=>'Faible','medium'=>'Moyenne','high'=>'Élevée','critical'=>'Critique'] as $k=>$v):?><option value="<?=$k?>" <?= $r['filters']['severity']===$k?'selected':'' ?>><?=$v?></option><?php endforeach?></select></label><label>Module<input name="module" value="<?= $h($r['filters']['module']) ?>"></label><label>Période<select name="days"><?php foreach([1,7,14,30,90] as $d):?><option value="<?=$d?>" <?= $r['days']===$d?'selected':'' ?>><?=$d?> jour<?= $d>1?'s':''?></option><?php endforeach?></select></label><div><button class="socx-btn primary">Appliquer</button></div></form></section>
<section class="socx-card"><h3>Modules les plus exposés</h3><div class="socx-bars"><?php $max=max(1,...array_map(fn($x)=>(int)$x['incident_count'],$r['modules']?:[['incident_count'=>1]])); foreach($r['modules'] as $m):?><div class="socx-bar"><span><?= $h($m['module']) ?></span><div class="socx-track"><div class="socx-fill" style="width:<?= min(100,round(((int)$m['incident_count']/$max)*100)) ?>%"></div></div><strong><?= (int)$m['incident_count'] ?></strong></div><?php endforeach?><?php if(!$r['modules']):?><p>Aucune donnée sur la période.</p><?php endif?></div></section>
<section class="socx-card socx-scroll"><h3>Incidents</h3><table class="socx-table"><thead><tr><th>Risque</th><th>Statut</th><th>Incident</th><th>Module</th><th>Événements</th><th>Dernière activité</th><th></th></tr></thead><tbody><?php foreach($r['incidents'] as $i):?><tr><td><span class="socx-pill <?= $h($i['severity']) ?>"><?= (int)$i['risk_score'] ?> · <?= $h(strtoupper($i['severity'])) ?></span></td><td><?= $h($i['status']) ?></td><td><strong><?= $h($i['title']) ?></strong><br><small><?= $h($i['incident_uuid']) ?></small></td><td><?= $h($i['module'] ?: '—') ?></td><td><?= (int)$i['event_count'] ?></td><td><?= $h($i['last_event_at']) ?></td><td><a class="socx-btn" href="?incident=<?= (int)$i['id'] ?>&days=<?= (int)$r['days'] ?>">Ouvrir</a></td></tr><?php endforeach?><?php if(!$r['incidents']):?><tr><td colspan="7">Aucun incident correspondant.</td></tr><?php endif?></tbody></table></section>
<?php if($incident):?><section class="socx-detail"><article class="socx-card"><h2><?= $h($incident['title']) ?></h2><div class="socx-meta"><div><small>UUID</small><br><?= $h($incident['incident_uuid']) ?></div><div><small>Règle</small><br><?= $h($incident['rule_name']) ?></div><div><small>Score</small><br><strong><?= (int)$incident['risk_score'] ?>/100</strong></div><div><small>Statut</small><br><?= $h($incident['status']) ?></div><div><small>Module</small><br><?= $h($incident['module'] ?: '—') ?></div><div><small>Période</small><br><?= $h($incident['first_event_at']) ?> → <?= $h($incident['last_event_at']) ?></div></div><h3>Chronologie des événements</h3><?php foreach($incident['events'] as $ev):?><div class="socx-event"><strong><?= $h($ev['occurred_at']) ?> · <?= $h($ev['category'].'.'.$ev['action']) ?></strong><br><span><?= $h($ev['result']) ?> · <?= $h($ev['severity']) ?> · <?= $h($ev['module'] ?: '—') ?></span></div><?php endforeach?><?php if(!$incident['events']):?><p>Aucun événement source disponible.</p><?php endif?></article><aside class="socx-card"><h3>Traitement</h3><form method="post" action="/public/administration/securite/soc/incident"><?= Csrf::field() ?><input type="hidden" name="incident_id" value="<?= (int)$incident['id'] ?>"><label>Statut<select name="status"><?php foreach(['open'=>'Ouvert','investigating'=>'En investigation','resolved'=>'Résolu','false_positive'=>'Faux positif'] as $k=>$v):?><option value="<?=$k?>" <?= $incident['status']===$k?'selected':'' ?>><?=$v?></option><?php endforeach?></select></label><label>Note<textarea name="note" rows="5" placeholder="Constat, action menée, justification..."></textarea></label><button class="socx-btn primary">Enregistrer</button></form><h3>Affectation</h3><form method="post" action="/public/administration/securite/soc/affecter"><?= Csrf::field() ?><input type="hidden" name="incident_id" value="<?= (int)$incident['id'] ?>"><label>Responsable<select name="assigned_to"><option value="0">Non affecté</option><?php foreach($incident['assignable_users'] as $u):?><option value="<?= (int)$u['id'] ?>" <?= (int)($incident['assigned_to']??0)===(int)$u['id']?'selected':'' ?>><?= $h(trim(($u['prenom']??'').' '.($u['nom']??''))) ?></option><?php endforeach?></select></label><button class="socx-btn primary">Affecter</button></form><h3>Journal d’intervention</h3><form method="post" action="/public/administration/securite/soc/action"><?= Csrf::field() ?><input type="hidden" name="incident_id" value="<?= (int)$incident['id'] ?>"><label>Type<select name="action_type"><option value="note">Note</option><option value="containment">Confinement</option><option value="eradication">Éradication</option><option value="recovery">Rétablissement</option><option value="evidence">Preuve</option><option value="escalation">Escalade</option></select></label><label>Compte rendu<textarea name="content" rows="5" required></textarea></label><button class="socx-btn primary">Ajouter</button></form><?php foreach($incident['actions'] as $a):?><div class="socx-event"><strong><?= $h($a['created_at']) ?> · <?= $h($a['action_type']) ?></strong><br><?= nl2br($h($a['content'])) ?></div><?php endforeach?><p><a class="socx-btn" target="_blank" href="/public/administration/securite/soc/rapport?incident=<?= (int)$incident['id'] ?>">Rapport HTML</a></p><h3>Réouverture</h3><form method="post" action="/public/administration/securite/soc/rouvrir"><?= Csrf::field() ?><input type="hidden" name="incident_id" value="<?= (int)$incident['id'] ?>"><label>Motif<textarea name="reason" rows="3" required></textarea></label><button class="socx-btn">Rouvrir l’incident</button></form><h3>Historique</h3><?php foreach($incident['history'] as $row):?><div class="socx-event"><strong><?= $h($row['changed_at']) ?></strong><br><?= $h($row['old_status']) ?> → <?= $h($row['new_status']) ?><br><small><?= nl2br($h($row['note'])) ?></small></div><?php endforeach?><?php if(!$incident['history']):?><p>Aucun changement enregistré.</p><?php endif?></aside></section><?php endif?>
</div>

<div style="margin:16px 0"><a href="/public/administration/securite/soc/analytics" style="display:inline-block;padding:10px 14px;border-radius:9px;background:#1d5f9f;color:#fff;text-decoration:none;font-weight:700">SIEM Analytics</a></div>

<div style="margin:16px 0"><a href="/public/administration/securite/audit" style="display:inline-block;padding:10px 14px;border-radius:9px;background:#244f76;color:#fff;text-decoration:none;font-weight:700">Audit & Compliance Center</a></div>

<div style="margin:16px 0"><a href="/public/administration/securite/executive" style="display:inline-block;padding:10px 14px;border-radius:9px;background:#17324d;color:#fff;text-decoration:none;font-weight:700">Executive Security Center</a></div>
