<?php use App\Core\Csrf;$h=static fn($v):string=>htmlspecialchars((string)$v,ENT_QUOTES,'UTF-8');$report=is_array($report??null)?$report:[];$stats=is_array($report['stats']??null)?$report['stats']:[];$indicators=is_array($report['indicators']??null)?$report['indicators']:[];$detections=is_array($report['detections']??null)?$report['detections']:[];$rules=is_array($report['rules']??null)?$report['rules']:[]; ?>
<style>.ti{display:grid;gap:16px}.ti-card{background:#fff;border:1px solid #dce4ef;border-radius:16px;padding:18px}.ti-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:12px}.ti-kpi strong{font-size:28px;display:block}.ti-table{width:100%;border-collapse:collapse}.ti-table th,.ti-table td{padding:9px;border-bottom:1px solid #e8edf4;text-align:left}.ti-scroll{overflow:auto}.ti-btn{border:0;border-radius:9px;padding:9px 12px;background:#eaf1f9;color:#15385d;font-weight:750;cursor:pointer;text-decoration:none}.ti-btn.primary{background:#1d5f9f;color:#fff}.ti label{display:grid;gap:5px}.ti input,.ti select{padding:9px;border:1px solid #cfd9e6;border-radius:8px;width:100%;box-sizing:border-box}.ti-pill{padding:4px 8px;border-radius:999px;background:#edf2f7;font-size:12px;font-weight:800}</style>
<div class="ti"><div><a class="ti-btn" href="/public/administration/securite/soc">← SOC</a></div><section class="ti-card"><small>ENTERPRISE-008.6 · AXIOM 9.9.2</small><h1>Threat Intelligence & Detection Engine</h1><p>Indicateurs internes, détection comportementale et enrichissement du risque sans appel externe ni transmission de données.</p></section>
<section class="ti-grid"><article class="ti-card ti-kpi"><span>Indicateurs</span><strong><?= (int)($stats['total']??0) ?></strong></article><article class="ti-card ti-kpi"><span>Actifs</span><strong><?= (int)($stats['active']??0) ?></strong></article><article class="ti-card ti-kpi"><span>Critiques</span><strong><?= (int)($stats['critical']??0) ?></strong></article><article class="ti-card ti-kpi"><span>Correspondances</span><strong><?= (int)($stats['matches']??0) ?></strong></article></section>
<section class="ti-card"><h2>Ajouter un indicateur</h2><form method="post" action="/public/administration/securite/soc/threat-intelligence/ajouter"><?= Csrf::field() ?><div class="ti-grid"><label>Type<select name="indicator_type" required><option value="ip">Adresse IP</option><option value="domain">Domaine</option><option value="url">URL</option><option value="hash">Hash</option><option value="email">E-mail</option></select></label><label>Valeur<input name="indicator_value" maxlength="500" required></label><label>Gravité<select name="severity"><option value="medium">Moyenne</option><option value="high">Haute</option><option value="critical">Critique</option><option value="low">Faible</option></select></label><label>Confiance<input type="number" name="confidence" min="0" max="100" value="70"></label><label>Source<input name="source_name" value="Interne" maxlength="160"></label></div><button class="ti-btn primary">Enregistrer</button></form></section>
<section class="ti-card"><h2>Moteur de détection</h2><form method="post" action="/public/administration/securite/soc/threat-intelligence/detecter"><?= Csrf::field() ?><button class="ti-btn primary">Lancer l’analyse maintenant</button></form><div class="ti-grid" style="margin-top:12px"><?php foreach($rules as $r):?><article><strong><?= $h($r['name']) ?></strong><p><?= $h($r['description']) ?></p><small>Dernier passage : <?= $h($r['last_run_at']??'jamais') ?> · <?= (int)($r['last_match_count']??0) ?> résultat(s)</small></article><?php endforeach?></div></section>
<section class="ti-card ti-scroll"><h2>Indicateurs</h2><table class="ti-table"><thead><tr><th>Type</th><th>Valeur</th><th>Gravité</th><th>Confiance</th><th>Source</th><th>Statut</th></tr></thead><tbody><?php foreach($indicators as $i):?><tr><td><?= $h($i['indicator_type']) ?></td><td><?= $h($i['indicator_value']) ?></td><td><span class="ti-pill"><?= $h($i['severity']) ?></span></td><td><?= (int)$i['confidence'] ?>%</td><td><?= $h($i['source_name']) ?></td><td><?= $h($i['status']) ?></td></tr><?php endforeach?><?php if(!$indicators):?><tr><td colspan="6">Aucun indicateur.</td></tr><?php endif?></tbody></table></section>
<section class="ti-card ti-scroll"><h2>Détections récentes</h2><table class="ti-table"><thead><tr><th>Règle</th><th>Entité</th><th>Score</th><th>Gravité</th><th>Statut</th><th>Date</th></tr></thead><tbody><?php foreach($detections as $d):?><tr><td><?= $h($d['rule_name']) ?></td><td><?= $h($d['entity_type'].' '.$d['entity_id']) ?></td><td><?= (int)$d['score'] ?>/100</td><td><?= $h($d['severity']) ?></td><td><?= $h($d['status']) ?></td><td><?= $h($d['detected_at']) ?></td></tr><?php endforeach?><?php if(!$detections):?><tr><td colspan="6">Aucune détection.</td></tr><?php endif?></tbody></table></section></div>
