{% extends "base.html" %}
{% block title %}Detection rules · SD RMM{% endblock %}
{% block content %}
{% include "_security_nav.html" %}

<style>
  .rules-head { display:flex; justify-content:space-between; align-items:baseline; flex-wrap:wrap; gap:10px; margin-bottom:6px; }
  .card { background:var(--surface); border:1px solid var(--line); border-radius:var(--r-lg); padding:16px; box-shadow:var(--shadow-1); margin-bottom:14px; }
  .card h2 { font-size:13px; font-weight:700; margin:0 0 12px; text-transform:uppercase; letter-spacing:.4px; color:var(--muted); }
  .searchbar { display:flex; gap:8px; margin-bottom:14px; }
  .searchbar input[type=text] { flex:1; background:var(--surface-2); border:1px solid var(--line); border-radius:8px; color:var(--ink); padding:9px 12px; font-size:13px; }
  table.r { width:100%; border-collapse:collapse; font-size:12px; }
  table.r th { text-align:left; color:var(--muted); font-weight:600; font-size:10.5px; text-transform:uppercase; letter-spacing:.4px; padding:6px 8px; border-bottom:1px solid var(--line); }
  table.r td { padding:7px 8px; border-bottom:1px solid var(--line-soft); vertical-align:middle; }
  table.r .mono { font-family:var(--font-mono); }
  .src { display:inline-block; padding:1px 6px; border-radius:999px; font:600 10px/1.5 var(--font-sans); background:var(--surface-3); color:var(--muted); }
  .sev { display:inline-block; padding:1px 7px; border-radius:999px; font:700 10.5px/1.5 var(--font-sans); }
  .sev-crit { background:rgba(249,115,115,.16); color:#fca5a5; } .sev-warn { background:rgba(251,191,36,.16); color:#fbbf24; }
  .sev-low { background:rgba(96,165,250,.15); color:#93c5fd; } .sev-info { background:var(--surface-3); color:var(--muted); }
  .rowform { display:flex; gap:7px; align-items:center; }
  .rowform select { background:var(--surface-2); border:1px solid var(--line); border-radius:6px; color:var(--ink); padding:4px 6px; font-size:11.5px; }
  .muted-pill { background:rgba(249,115,115,.12); color:#fca5a5; padding:1px 7px; border-radius:999px; font:700 10px/1.5 var(--font-sans); }
  .saved { color:var(--ok); font-size:12px; }
  .truncate { max-width:360px; overflow:hidden; text-overflow:ellipsis; white-space:nowrap; }
</style>

<div class="rules-head">
  <div>
    <h1 class="page-title" style="margin-bottom:2px;">Detection rules</h1>
    <p class="muted" style="margin:0;">{{ total_rules }} rules loaded (built-in + Sigma). Mute or re-grade any rule. {% if saved %}<span class="saved">saved &check;</span>{% endif %}</p>
  </div>
  <a class="btn btn-ghost" href="/security">&lsaquo; Security</a>
</div>

<div class="card">
  <h2>Find a rule</h2>
  <form method="get" action="/security/rules" class="searchbar">
    <input type="text" name="q" value="{{ q }}" placeholder="Search by rule id, title, or MITRE technique (e.g. mimikatz, T1059, regsvr32)" autofocus>
    <button class="btn btn-primary" type="submit">Search</button>
  </form>
  {% if q %}
    {% if results %}
    <table class="r">
      <thead><tr><th>Rule</th><th>Src</th><th>Default</th><th>State / severity</th><th></th></tr></thead>
      <tbody>
      {% for r in results %}
        {% set ov = ov_map.get(r.rule_id) %}
        <tr>
          <td><div class="truncate" title="{{ r.title }}">{{ r.title }}</div><span class="mono muted" style="font-size:10.5px;">{{ r.rule_id }}{% if r.mitre %} &middot; {{ r.mitre }}{% endif %}</span></td>
          <td><span class="src">{{ r.source }}</span></td>
          <td><span class="sev sev-{{ r.severity }}">{{ r.severity }}</span></td>
          <td>
            <form method="post" action="/security/rules/{{ r.rule_id }}" class="rowform">
              <input type="hidden" name="q" value="{{ q }}">
              <label style="font-size:11.5px;"><input type="checkbox" name="enabled" {% if not ov or ov.enabled %}checked{% endif %}> enabled</label>
              <select name="severity">
                <option value="">default</option>
                {% for s in ['info','low','warn','crit'] %}<option value="{{ s }}" {% if ov and ov.severity==s %}selected{% endif %}>{{ s }}</option>{% endfor %}
              </select>
              <button class="btn btn-ghost" type="submit">Save</button>
            </form>
          </td>
          <td>{% if ov %}<span class="muted-pill">tuned</span>{% endif %}</td>
        </tr>
      {% endfor %}
      </tbody>
    </table>
    <p class="muted" style="font-size:11px;margin-top:8px;">Showing up to 60 matches. Refine the search to narrow.</p>
    {% else %}<p class="muted">No rules match &ldquo;{{ q }}&rdquo;.</p>{% endif %}
  {% endif %}
</div>

<div class="card">
  <h2>Active overrides ({{ tuned|length }})</h2>
  {% if tuned %}
  <table class="r">
    <thead><tr><th>Rule</th><th>State</th><th>Severity</th><th>By</th><th></th></tr></thead>
    <tbody>
    {% for t in tuned %}
      <tr>
        <td><div class="truncate" title="{{ t.meta.get('title','?') }}">{{ t.meta.get('title', t.o.rule_id) }}</div><span class="mono muted" style="font-size:10.5px;">{{ t.o.rule_id }}</span></td>
        <td>{% if t.o.enabled %}<span class="muted">enabled</span>{% else %}<span class="muted-pill">MUTED</span>{% endif %}</td>
        <td>{% if t.o.severity %}<span class="sev sev-{{ t.o.severity }}">{{ t.o.severity }}</span>{% else %}<span class="muted">default</span>{% endif %}</td>
        <td class="muted" style="font-size:11px;">{{ t.o.updated_at| pt('%m-%d %H:%M') }}</td>
        <td>
          <form method="post" action="/security/rules/{{ t.o.rule_id }}">
            <input type="hidden" name="action" value="reset">
            <button class="btn btn-ghost" type="submit">Reset</button>
          </form>
        </td>
      </tr>
    {% endfor %}
    </tbody>
  </table>
  {% else %}<p class="muted">No rule overrides &mdash; all {{ total_rules }} rules run at their default severity. Search above to mute or re-grade one.</p>{% endif %}
</div>
<div class="card">
  <h2>Tuning exclusions ({{ exclusions|length }})</h2>
  <p class="muted" style="font-size:12px;margin:0 0 10px;">Suppress detections when an event field matches a regex &mdash; for known-good tooling that trips behavioral rules (dev agents, SSH client cmdlines). Checked before <em>any</em> rule set raises a detection. Rule <span class="mono">*</span> = all rules; empty host = fleet-wide. Changes apply within a minute.</p>
  {% if exclusions %}
  <table class="r">
    <thead><tr><th>Rule</th><th>Host</th><th>Field</th><th>Pattern</th><th>Note</th><th></th></tr></thead>
    <tbody>
    {% for x in exclusions %}
      <tr>
        <td class="mono">{{ x.rule_id }}</td>
        <td class="mono">{{ x.hostname or 'fleet' }}</td>
        <td class="mono">{{ x.field }}</td>
        <td class="mono truncate" style="max-width:260px;" title="{{ x.pattern }}">{{ x.pattern }}</td>
        <td class="muted truncate" style="max-width:240px;font-size:11px;" title="{{ x.note or '' }}">{{ x.note or '' }}</td>
        <td>
          <form method="post" action="/security/rules/exclusions/{{ x.id }}/delete"
                onsubmit="return confirm('Delete this exclusion? Matching events will raise detections again.');">
            <button class="btn btn-ghost" type="submit">Delete</button>
          </form>
        </td>
      </tr>
    {% endfor %}
    </tbody>
  </table>
  {% endif %}
  <form method="post" action="/security/rules/exclusions" class="rowform" style="flex-wrap:wrap;margin-top:12px;">
    <input type="text" name="rule_id" placeholder="rule id or *" value="*" style="width:130px;background:var(--surface-2);border:1px solid var(--line);border-radius:6px;color:var(--ink);padding:6px 8px;font-size:12px;">
    <input type="text" name="hostname" placeholder="host (blank = fleet)" style="width:150px;background:var(--surface-2);border:1px solid var(--line);border-radius:6px;color:var(--ink);padding:6px 8px;font-size:12px;">
    <select name="field">
      <option value="cmdline">cmdline</option>
      <option value="image">image</option>
      <option value="parent_image">parent_image</option>
      <option value="user">user</option>
    </select>
    <input type="text" name="pattern" placeholder="regex, e.g. ^/usr/bin/ssh$" required style="flex:1;min-width:220px;background:var(--surface-2);border:1px solid var(--line);border-radius:6px;color:var(--ink);padding:6px 8px;font-size:12px;font-family:var(--font-mono);">
    <input type="text" name="note" placeholder="why (shows here)" style="width:220px;background:var(--surface-2);border:1px solid var(--line);border-radius:6px;color:var(--ink);padding:6px 8px;font-size:12px;">
    <button class="btn btn-primary" type="submit">Add exclusion</button>
  </form>
</div>
{% endblock %}