{% extends "base.html" %}
{% block title %}Security · {{ agent.hostname }}{% endblock %}
{% block content %}

<style>
  .sec-head { display:flex; justify-content:space-between; align-items:flex-end; gap:18px; margin-bottom:14px; flex-wrap:wrap; }
  .sec-grid { display:grid; grid-template-columns:1fr; gap:14px; }
  .card { background:var(--surface); border:1px solid var(--line); border-radius:var(--r-lg); padding:16px; box-shadow:var(--shadow-1); }
  .card h2 { font-size:14px; font-weight:700; margin:0 0 10px; }
  table.sec { width:100%; border-collapse:collapse; font-size:12px; }
  table.sec th { text-align:left; color:var(--muted); font-weight:600; font-size:10.5px; text-transform:uppercase; letter-spacing:.4px; padding:5px 8px; border-bottom:1px solid var(--line); }
  table.sec td { padding:5px 8px; border-bottom:1px solid var(--line-soft); vertical-align:top; }
  table.sec td.mono, table.sec th.mono { font-family:var(--font-mono); font-variant-numeric:tabular-nums; }
  .sev { display:inline-block; padding:1px 7px; border-radius:999px; font:700 10.5px/1.5 var(--font-sans); }
  .sev-info { background:var(--surface-3); color:var(--muted); }
  .sev-low  { background:rgba(96,165,250,.15); color:#93c5fd; }
  .sev-warn { background:rgba(251,191,36,.16); color:#fbbf24; }
  .sev-crit { background:rgba(249,115,115,.16); color:#fca5a5; }
  .truncate { max-width:420px; overflow:hidden; text-overflow:ellipsis; white-space:nowrap; }
  .actions-row { display:flex; gap:10px; flex-wrap:wrap; align-items:center; }
  .actions-row form { display:inline-flex; gap:6px; align-items:center; margin:0; }
  .iso-banner { padding:8px 12px; border-radius:var(--r-md); font-size:12.5px; font-weight:600; margin-bottom:10px;
                color:#fca5a5; background:rgba(249,115,115,.12); border:1px solid rgba(249,115,115,.4); }
  .approve-note { color:var(--muted-2); font-size:11.5px; margin-top:8px; }
  input.pidbox { width:90px; background:var(--surface-2); border:1px solid var(--line); border-radius:6px; color:var(--ink); padding:5px 8px; font-family:var(--font-mono); }
</style>

<div class="sec-head">
  <div>
    <p class="crumb"><a href="/dashboard">Dashboard</a> &rsaquo; <a href="/orgs/{{ org.id }}">{{ org.name }}</a> &rsaquo;
       <a href="/orgs/{{ org.id }}/agents/{{ agent.id }}">{{ agent.hostname }}</a> &rsaquo;</p>
    <h1 class="page-title">Security &middot; {{ agent.hostname }}</h1>
    <p class="muted">EDR telemetry, detections &amp; response &middot; {{ agent.os }} &middot; agent v{{ agent.agent_version or '?' }}</p>
  </div>
  <a class="btn btn-ghost" href="/orgs/{{ org.id }}/agents/{{ agent.id }}">&lsaquo; Overview</a>
</div>

{% if agent.isolated %}
<div class="iso-banner">&#9940; This host is network-isolated (firewall locked to RMM/Mesh only){% if agent.isolated_at %} since {{ agent.isolated_at| pt('%Y-%m-%d %H:%M') }}{% endif %}. Release it below to restore connectivity.</div>
{% endif %}
{% if not agent.edr_enabled %}
<div class="iso-banner" style="color:#fbbf24; background:rgba(251,191,36,.1); border-color:rgba(251,191,36,.35);">EDR detection is <b>disabled</b> for this device — telemetry is still collected but no detections are raised. Re-enable in <a href="/security/controls">EDR Controls</a>.</div>
{% endif %}

<div class="sec-grid">

  <!-- ===== Response actions ===== -->
  <div class="card">
    <h2>Response</h2>
    <div class="actions-row">
      {% if agent.isolated %}
        <form method="post" action="/orgs/{{ org.id }}/agents/{{ agent.id }}/edr/release_host">
          <button class="btn" type="submit">Release isolation</button>
        </form>
      {% else %}
        <form method="post" action="/orgs/{{ org.id }}/agents/{{ agent.id }}/edr/isolate_host"
              onsubmit="return confirm('Isolate {{ agent.hostname }}? It will only reach the RMM/Mesh server until released.');">
          <button class="btn" type="submit">Isolate host</button>
        </form>
      {% endif %}
      <form method="post" action="/orgs/{{ org.id }}/agents/{{ agent.id }}/edr/kill_process">
        <input class="pidbox" type="text" name="pid" placeholder="PID" inputmode="numeric" pattern="[0-9]+" required>
        <button class="btn" type="submit">Kill process</button>
      </form>
      <form method="post" action="/orgs/{{ org.id }}/agents/{{ agent.id }}/edr/collect_triage">
        <button class="btn btn-ghost" type="submit">Collect triage</button>
      </form>
    </div>
    <p class="approve-note">Isolate / release / kill are <b>approval-gated</b>: a super-admin must approve before the agent receives them. Triage collection (read-only) runs immediately. Every action is audited below and tied to a command-channel job.</p>
  </div>

  <!-- ===== Antivirus (ClamAV) ===== -->
  <div class="card">
    <h2>Antivirus (ClamAV)</h2>
    <div class="actions-row">
      <form method="post" action="/orgs/{{ org.id }}/agents/{{ agent.id }}/edr/av_scan_quick">
        <button class="btn" type="submit">Quick scan</button>
      </form>
      <form method="post" action="/orgs/{{ org.id }}/agents/{{ agent.id }}/edr/av_scan_full"
            onsubmit="return confirm('Run a FULL system scan on {{ agent.hostname }}? This can take a long time.');">
        <button class="btn btn-ghost" type="submit">Full scan</button>
      </form>
      <form method="post" action="/orgs/{{ org.id }}/agents/{{ agent.id }}/edr/av_status">
        <button class="btn btn-ghost" type="submit">AV status</button>
      </form>
      <form method="post" action="/orgs/{{ org.id }}/agents/{{ agent.id }}/edr/av_install"
            onsubmit="return confirm('Install ClamAV antivirus on {{ agent.hostname }}?');">
        <button class="btn btn-ghost" type="submit">Install AV</button>
      </form>
    </div>
    <p class="approve-note">Open-source <b>ClamAV</b> — quick scan (Downloads / Temp / home), full scan, status, or install. Detected malware is quarantined and raised as a critical detection below; the agent also auto-scans downloads every 15&nbsp;min once installed. Results appear in the Response audit.</p>
  </div>

  <!-- ===== Local console (STS EDR Agent) ===== -->
  <div class="card">
    <h2>Local console <span class="muted">(STS EDR Agent)</span></h2>
    <div class="actions-row">
      <form method="post" action="/orgs/{{ org.id }}/agents/{{ agent.id }}/edr/console_pause"
            onsubmit="return confirm('Pause EDR protection on {{ agent.hostname }}? This is approval-gated and reported as a tamper detection.');">
        <input class="pidbox" type="text" name="mins" placeholder="min" value="60" inputmode="numeric" pattern="[0-9]+">
        <button class="btn" type="submit">Pause protection</button>
      </form>
      <form method="post" action="/orgs/{{ org.id }}/agents/{{ agent.id }}/edr/console_resume">
        <button class="btn btn-ghost" type="submit">Resume protection</button>
      </form>
      <form method="post" action="/orgs/{{ org.id }}/agents/{{ agent.id }}/edr/console_set_admin"
            onsubmit="return confirm('Set/reset the LOCAL admin code on {{ agent.hostname }}? Approval-gated.');">
        <input class="pidbox" type="password" name="code" placeholder="new code (4+)" minlength="4" required>
        <button class="btn btn-ghost" type="submit">Set local admin code</button>
      </form>
    </div>
    <p class="approve-note">Controls the on-device <b>STS EDR Agent</b> console (loopback&nbsp;127.0.0.1 only). <b>Pause</b> and <b>Set&nbsp;admin&nbsp;code</b> are <b>approval-gated</b> (super-admin) — this is the portal "admin bypass"; <b>Resume</b> ships immediately. The agent auto-resumes when the pause window expires, and every pause/resume is reported back as a tamper detection below. Requires the agent to be on a build with the local console (staged; deploys with the endpoint test).</p>
  </div>

  <!-- ===== Power ===== -->
  <div class="card">
    <h2>Power</h2>
    <div class="actions-row">
      <form method="post" action="/orgs/{{ org.id }}/agents/{{ agent.id }}/edr/reboot"
            onsubmit="return confirm('Reboot {{ agent.hostname }}? Approval-gated \u2014 a super-admin must approve before the agent reboots.');">
        <button class="btn" type="submit">Reboot host</button>
      </form>
      <form method="post" action="/orgs/{{ org.id }}/agents/{{ agent.id }}/edr/poweroff"
            onsubmit="return confirm('Shut DOWN {{ agent.hostname }}? It will stay offline until powered on manually. Approval-gated.');">
        <button class="btn btn-ghost" type="submit">Shut down</button>
      </form>
    </div>
    <p class="approve-note">Remote <b>reboot</b> / <b>shutdown</b> over the agent command channel \u2014 both <b>approval-gated</b> (super-admin). Clears a hung host before it fully wedges (e.g. process-table exhaustion \u2014 watch the <b>process pressure</b> alert). Needs the agent online to receive the command; a fully-offline host still needs a physical power-cycle.</p>
  </div>

  <!-- ===== Pending approvals ===== -->
  {% if pending %}
  <div class="card" id="approvals">
    <h2>Awaiting approval ({{ pending|length }})</h2>
    <table class="sec">
      <thead><tr><th>Action</th><th>Param</th><th class="mono">Queued</th><th>Risk</th><th></th></tr></thead>
      <tbody>
      {% for c in pending %}
        <tr>
          <td><b>{{ c.ctype }}</b></td>
          <td class="mono">{{ c.payload or '' }}</td>
          <td class="mono muted">{{ c.created_at| pt('%m-%d %H:%M:%S') }}</td>
          <td><span class="sev sev-crit">{{ c.risk }}</span></td>
          <td>
            {% if user.is_super_admin %}
              <form method="post" action="/orgs/{{ org.id }}/agents/{{ agent.id }}/commands/{{ c.id }}/approve"
                    onsubmit="return confirm('Approve {{ c.ctype }} on {{ agent.hostname }}?');">
                <button class="btn" type="submit">Approve</button>
              </form>
            {% else %}<span class="muted">needs super-admin</span>{% endif %}
          </td>
        </tr>
      {% endfor %}
      </tbody>
    </table>
  </div>
  {% endif %}

  <!-- ===== Detections ===== -->
  <div class="card">
    <h2>Detections</h2>
    {% if detections %}
    <table class="sec" id="dets-tbl">
      <thead><tr><th class="mono">Time (PT)</th><th>Sev</th><th>Rule</th><th>ATT&amp;CK</th><th>Summary</th><th>State</th></tr></thead>
      <tbody>
      {% for d in detections %}
        <tr>
          <td class="mono muted">{{ d.ts| pt('%m-%d %H:%M:%S') }}</td>
          <td><span class="sev sev-{{ d.severity }}">{{ d.severity }}</span></td>
          <td class="mono">{{ d.rule_id }}</td>
          <td class="mono">{{ d.mitre or '' }}</td>
          <td class="truncate" title="{{ d.summary }}">{{ d.summary }}</td>
          <td>
            <form method="post" action="/security/detections/{{ d.id }}/state" style="display:inline; gap:4px;">
              <input type="hidden" name="back" value="/orgs/{{ org.id }}/agents/{{ agent.id }}/security">
              {% if d.state == 'closed' %}
                <span class="muted">closed</span>
                <button class="btn btn-ghost" name="state" value="open" type="submit" style="padding:2px 8px; font-size:11px;">Reopen</button>
              {% else %}
                <span class="muted">{{ d.state }}</span>
                {% if d.state == 'open' %}<button class="btn btn-ghost" name="state" value="ack" type="submit" style="padding:2px 8px; font-size:11px;">Ack</button>{% endif %}
                <button class="btn btn-ghost" name="state" value="closed" type="submit" style="padding:2px 8px; font-size:11px;">Close</button>
              {% endif %}
            </form>
          </td>
        </tr>
      {% endfor %}
      </tbody>
    </table>
    {% else %}<p class="muted">No detections. The engine evaluates Sigma-style rules over incoming telemetry.</p>{% endif %}
  </div>

  <!-- ===== Response audit ===== -->
  {% if responses %}
  <div class="card" id="responses">
    <h2>Response audit</h2>
    <table class="sec">
      <thead><tr><th class="mono">Time (PT)</th><th>Action</th><th>Param</th><th>Result</th></tr></thead>
      <tbody>
      {% for r in responses %}
        <tr>
          <td class="mono muted">{{ r.ts| pt('%m-%d %H:%M:%S') }}</td>
          <td><b>{{ r.action }}</b></td>
          <td class="mono">{{ r.params or '' }}</td>
          <td>{% if r.result %}<details><summary>view</summary><pre class="cc-out">{{ r.result }}</pre></details>{% else %}<span class="muted">pending&hellip;</span>{% endif %}</td>
        </tr>
      {% endfor %}
      </tbody>
    </table>
  </div>
  {% endif %}

  <!-- ===== Event timeline ===== -->
  <div class="card">
    <h2>Event timeline <span class="muted" style="font-weight:400; font-size:12px">(most recent {{ events|length }})</span></h2>
    {% if events %}
    <table class="sec" id="events-tbl">
      <thead><tr><th class="mono">Time (PT)</th><th>Category</th><th>Action</th><th>Actor</th><th>Target</th><th>Src</th></tr></thead>
      <tbody>
      {% for e in events %}
        <tr>
          <td class="mono muted">{{ e.ts| pt('%m-%d %H:%M:%S') }}</td>
          <td>{{ e.category }}</td>
          <td class="mono">{{ e.action }}</td>
          <td class="mono truncate" title="{{ e.actor or '' }}">{{ e.actor or '' }}</td>
          <td class="mono truncate" title="{{ e.target or '' }}">{{ e.target or '' }}</td>
          <td class="muted">{{ e.source or '' }}</td>
        </tr>
      {% endfor %}
      </tbody>
    </table>
    {% else %}
    <p class="muted">No events yet. The Windows agent collector streams process &amp; network telemetry (Sysmon if present, else Security-log 4688) to <code>/v1/events</code>.</p>
    {% endif %}
  </div>

</div>
{% endblock %}