<?php $r=$report; $e=static fn($v):string=>htmlspecialchars((string)$v,ENT_QUOTES,'UTF-8'); ?>
<style>
.ueba{display:grid;gap:16px}.ueba-card,.ueba-hero{background:#fff;border:1px solid #dce4ef;border-radius:18px;padding:20px}.ueba-hero{background:#102f55;color:#fff;display:flex;justify-content:space-between;align-items:center;gap:20px}.ueba-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(190px,1fr));gap:12px}.ueba-value{font-size:28px;font-weight:800}.ueba-actions{display:flex;gap:8px;flex-wrap:wrap}.ueba-btn{display:inline-block;padding:10px 13px;border-radius:10px;background:#eef4fb;text-decoration:none;font-weight:700}.ueba-table{width:100%;border-collapse:collapse}.ueba-table th,.ueba-table td{padding:10px;border-bottom:1px solid #e8edf4;text-align:left;vertical-align:top}.ueba-scroll{overflow:auto}.ueba-pill{padding:4px 8px;border-radius:999px;font-size:12px;font-weight:800;background:#edf2f7}.ueba-critical{background:#fee2e2;color:#991b1b}.ueba-high{background:#ffedd5;color:#9a3412}.ueba-warning{background:#fef3c7;color:#92400e}.ueba-info{background:#dbeafe;color:#1e40af}.ueba-list{margin:4px 0;padding-left:18px}
</style>
<div class="ueba">
<div class="ueba-actions"><a href="/public/administration/securite" class="ueba-btn">← Sécurité</a><a href="/public/administration/securite/soc" class="ueba-btn">Centre SOC</a><a href="/public/administration/securite/incidents" class="ueba-btn">Réponse aux incidents</a></div>
<section class="ueba-hero"><div><small>SECURITY-ENTERPRISE-003</small><h2>Détection comportementale UEBA</h2><p>Profils locaux pseudonymisés et détection explicable des écarts de comportement.</p></div><div><div class="ueba-value"><?= (int)$r['risk_score'] ?>/100</div><strong><?= $e($r['status']) ?></strong></div></section>
<div class="ueba-grid"><article class="ueba-card"><small>Événements analysés</small><div class="ueba-value"><?= (int)$r['events'] ?></div></article><article class="ueba-card"><small>Acteurs pseudonymisés</small><div class="ueba-value"><?= (int)$r['actors'] ?></div></article><article class="ueba-card"><small>Anomalies</small><div class="ueba-value"><?= (int)$r['finding_count'] ?></div></article><article class="ueba-card"><small>Risque élevé</small><div class="ueba-value"><?= (int)$r['high_count'] ?></div></article></div>
<section class="ueba-card"><h3>Fenêtre d’analyse</h3><div class="ueba-actions"><?php foreach([1,6,24,72,168] as $h): ?><a class="ueba-btn" href="?hours=<?= $h ?>"><?= $h<24?$h.' h':($h/24).' j' ?></a><?php endforeach; ?></div></section>
<section class="ueba-card"><h3>Recommandations</h3><ul class="ueba-list"><?php foreach($r['recommendations'] as $x): ?><li><?= $e($x) ?></li><?php endforeach; ?></ul></section>
<section class="ueba-card ueba-scroll"><h3>Anomalies explicables</h3><table class="ueba-table"><thead><tr><th>Niveau</th><th>Acteur</th><th>Score</th><th>Motifs</th><th>Signaux</th><th>Dernière activité</th></tr></thead><tbody><?php if(!$r['findings']): ?><tr><td colspan="6">Aucune anomalie significative dans la fenêtre choisie.</td></tr><?php endif; ?><?php foreach($r['findings'] as $f): ?><tr><td><span class="ueba-pill ueba-<?= $e($f['level']) ?>"><?= $e(strtoupper($f['level'])) ?></span></td><td><?= $e($f['actor']) ?></td><td><strong><?= (int)$f['score'] ?>/100</strong><br><small><?= (int)$f['events'] ?> événements</small></td><td><ul class="ueba-list"><?php foreach($f['reasons'] as $x): ?><li><?= $e($x) ?></li><?php endforeach; ?></ul></td><td><?= $e(implode(', ',$f['signals'])) ?></td><td><?= $e($f['last_at']) ?></td></tr><?php endforeach; ?></tbody></table></section>
<p><small>Les profils sont conservés dans le stockage privé, bornés et pseudonymisés. Aucun cookie, jeton, adresse IP brute ni secret n’est affiché ou persisté par ce module.</small></p>
</div>
