{% extends "base.html" %}
{% block title %}EDR Controls · SD RMM{% endblock %}
{% block content %}
{% include "_security_nav.html" %}

<style>
  .c-head { display:flex; justify-content:space-between; align-items:baseline; flex-wrap:wrap; gap:10px; margin-bottom:6px; }
  .card { background:var(--surface); border:1px solid var(--line); border-radius:var(--r-lg); padding:16px; box-shadow:var(--shadow-1); margin-bottom:14px; }
  .card h2 { font-size:13px; font-weight:700; margin:0 0 12px; text-transform:uppercase; letter-spacing:.4px; color:var(--muted); }
  .toggles { display:grid; grid-template-columns:1fr 1fr; gap:14px; }
  @media (max-width:680px){ .toggles { grid-template-columns:1fr; } }
  .toggle { display:flex; justify-content:space-between; align-items:center; gap:14px; background:var(--surface-2); border:1px solid var(--line); border-radius:var(--r-md); padding:14px 16px; }
  .toggle .lbl b { font-size:14px; } .toggle .lbl p { color:var(--muted); font-size:12px; margin:4px 0 0; max-width:340px; }
  .state { display:inline-block; padding:2px 10px; border-radius:999px; font:700 11px/1.6 var(--font-sans); }
  .state.on { background:rgba(74,222,128,.14); color:var(--ok); } .state.off { background:rgba(249,115,115,.14); color:#fca5a5; }
  .kpis { display:grid; grid-template-columns:repeat(4,1fr); gap:12px; }
  @media (max-width:760px){ .kpis { grid-template-columns:repeat(2,1fr); } }
  .kpi { background:var(--surface-2); border:1px solid var(--line); border-radius:var(--r-md); padding:12px 14px; }
  .kpi .v { font:700 22px/1 var(--font-sans); font-variant-numeric:tabular-nums; }
  .kpi .k { font-size:10px; text-transform:uppercase; letter-spacing:.5px; color:var(--muted); font-weight:700; margin-top:6px; }
  table.ag { width:100%; border-collapse:collapse; font-size:12.5px; }
  table.ag th { text-align:left; color:var(--muted); font-weight:600; font-size:10.5px; text-transform:uppercase; letter-spacing:.4px; padding:7px 8px; border-bottom:1px solid var(--line); }
  table.ag td { padding:8px; border-bottom:1px solid var(--line-soft); }
  .saved { color:var(--ok); font-size:12px; }
  .links a { margin-right:14px; }
</style>

<div class="c-head">
  <div>
    <h1 class="page-title" style="margin-bottom:2px;">EDR Controls</h1>
    <p class="muted" style="margin:0;">Enable/disable detection, manage the engine &amp; feeds. {% if saved %}<span class="saved">saved &check;</span>{% endif %}</p>
  </div>
  <a class="btn btn-ghost" href="/security">&lsaquo; Security</a>
</div>

<div class="card">
  <h2>Master switches</h2>
  <div class="toggles">
    <div class="toggle">
      <div class="lbl"><b>EDR detection</b> <span class="state {{ 'on' if edr_on else 'off' }}">{{ 'ON' if edr_on else 'OFF' }}</span>
        <p>Fleet-wide. When OFF, telemetry is still collected but no detections/alerts are raised.</p></div>
      <form method="post" action="/security/controls/toggle/edr_enabled"><button class="btn" type="submit">{{ 'Disable' if edr_on else 'Enable' }}</button></form>
    </div>
    <div class="toggle">
      <div class="lbl"><b>Threat-intel (IOC) matching</b> <span class="state {{ 'on' if ioc_on else 'off' }}">{{ 'ON' if ioc_on else 'OFF' }}</span>
        <p>Match telemetry against the {{ "{:,}".format(stats.iocs) }} known-bad IOCs (hashes / URLs / IPs).</p></div>
      <form method="post" action="/security/controls/toggle/ioc_enabled"><button class="btn" type="submit">{{ 'Disable' if ioc_on else 'Enable' }}</button></form>
    </div>
    <div class="toggle">
      <div class="lbl"><b>Web / URL filtering</b> <span class="state {{ 'on' if webfilter_on else 'off' }}">{{ 'ON' if webfilter_on else 'OFF' }}</span>
        <p>Sinkhole known-malicious domains in each endpoint's hosts file &mdash; blocks browsers/apps from reaching them. Requires the agent to run as admin / SYSTEM.</p></div>
      <form method="post" action="/security/controls/toggle/webfilter_enabled"><button class="btn" type="submit">{{ 'Disable' if webfilter_on else 'Enable' }}</button></form>
    </div>
  </div>
</div>

<div class="card">
  <h2>Escalation thresholds</h2>
  <p class="muted" style="margin:-4px 0 12px; font-size:12px;">When a host crosses this many <b>critical</b> detections within the window, one urgent escalation is raised (ntfy + the Security console) instead of per-rule spam. Leave Scope on "Global default", or pick an org to override it just for that org.</p>
  <form method="post" action="/security/controls/escalation" style="display:flex; flex-wrap:wrap; gap:14px; align-items:flex-end;">
    <label style="font-size:12px;">Scope
      <select name="org_id" style="display:block; margin-top:4px;">
        <option value="">Global default</option>
        {% for o in orgs %}<option value="{{ o.id }}">{{ o.name }}</option>{% endfor %}
      </select>
    </label>
    <label style="font-size:12px;">Critical threshold
      <input type="number" name="threshold" min="1" value="{{ esc.threshold }}" style="display:block; width:90px; margin-top:4px;">
    </label>
    <label style="font-size:12px;">Window (min)
      <input type="number" name="window_min" min="1" value="{{ esc.window_min }}" style="display:block; width:90px; margin-top:4px;">
    </label>
    <label style="font-size:12px;">Re-alert throttle (min)
      <input type="number" name="throttle_min" min="1" value="{{ esc.throttle_min }}" style="display:block; width:110px; margin-top:4px;">
    </label>
    <button class="btn" type="submit">Save</button>
  </form>
  <p class="muted" style="margin:10px 0 0; font-size:11px;">Current global: {{ esc.threshold }} crit / {{ esc.window_min }} min, re-alert every {{ esc.throttle_min }} min. Saving with an org selected creates a per-org override.</p>
</div>

<div class="card">
  <h2>Engine</h2>
  <div class="kpis">
    <div class="kpi"><div class="v">{{ stats.builtin + stats.sigma }}</div><div class="k">Detection rules</div></div>
    <div class="kpi"><div class="v">{{ "{:,}".format(stats.iocs) }}</div><div class="k">Threat-intel IOCs</div></div>
    <div class="kpi"><div class="v">{{ stats.feeds_on }}<span class="muted" style="font-size:14px;">/{{ stats.feeds_total }}</span></div><div class="k">Feeds enabled</div></div>
    <div class="kpi"><div class="v">{{ stats.agents_edr_on }}<span class="muted" style="font-size:14px;">/{{ stats.agents_total }}</span></div><div class="k">Agents with EDR on</div></div>
  </div>
  <p class="muted links" style="font-size:12px; margin-top:12px;">
    <a href="/security/rules">Tune detection rules &rsaquo;</a>
    <a href="/security/threatintel">Manage threat-intel feeds &rsaquo;</a>
    <a href="/security">Fleet dashboard &rsaquo;</a>
  </p>
</div>

<div class="card">
  <h2>Per-device EDR</h2>
  {% if agents %}
  <table class="ag">
    <thead><tr><th>Host</th><th>Organization</th><th>EDR</th><th></th></tr></thead>
    <tbody>
    {% for r in agents %}
      <tr>
        <td><a href="/orgs/{{ r.agent.org_id }}/agents/{{ r.agent.id }}"><strong>{{ r.agent.hostname }}</strong></a>{% if r.agent.isolated %} <span class="state off">isolated</span>{% endif %}</td>
        <td class="muted">{{ r.org_name }}</td>
        <td><span class="state {{ 'on' if r.agent.edr_enabled else 'off' }}">{{ 'ON' if r.agent.edr_enabled else 'OFF' }}</span></td>
        <td>
          <form method="post" action="/orgs/{{ r.agent.org_id }}/agents/{{ r.agent.id }}/edr-toggle">
            <input type="hidden" name="back" value="/security/controls">
            <button class="btn btn-ghost" type="submit">{{ 'Disable' if r.agent.edr_enabled else 'Enable' }}</button>
          </form>
        </td>
      </tr>
    {% endfor %}
    </tbody>
  </table>
  {% else %}<p class="muted">No agents enrolled yet.</p>{% endif %}
</div>
{% endblock %}