// ============================================================================
// Imara - Suspicious behaviour: three statistical checks on the recorded
// connections and name lookups.
// ============================================================================

// The behavioral detectors are statistical checks the control plane runs every
// 5 minutes over the flow and DNS telemetry in ClickHouse
// (control-plane/internal/behavior). Each card states the formula, the window
// and the exact threshold for the selected sensitivity; findings are the real
// alerts of that kind from /api/alerts. desc is the one sentence on the card;
// more opens with the rest under "How it works".
const BEHAVIORAL = [
  {
    key: "beaconing", name: "Beaconing", icon: "RadioTower",
    desc: "Connections to one external address and port at regular, timer-like intervals, typical of command-and-control (C2) malware.",
    more: "Private addresses and your own servers are ignored.",
    method: "coefficient of variation of the gaps between connections",
    window: "last 6 h · average gap 10 s to 1 h",
    flags: {
      low: "at least 30 connections with gap CV below 0.10",
      medium: "at least 20 connections with gap CV below 0.20",
      high: "at least 12 connections with gap CV below 0.35",
    },
  },
  {
    key: "lateral_movement", name: "Lateral movement", icon: "Spline",
    desc: "A server contacts far more internal hosts than in its busiest hour of the past week, including new ones.",
    more: "Internal hosts: your servers and private addresses. Servers enrolled less than a day ago are skipped (no baseline yet).",
    method: "distinct internal peers in the last hour vs the 7-day hourly maximum",
    window: "last 1 h vs each hour of the previous 7 days",
    flags: {
      low: "max(3, 3 x baseline) peers and at least 5 new",
      medium: "max(3, 2 x baseline) peers and at least 3 new",
      high: "max(3, 1.5 x baseline) peers and at least 2 new · raised as critical",
    },
  },
  {
    key: "dns_tunneling", name: "DNS tunnelling", icon: "Globe",
    desc: "Many DNS queries under one domain with long, random-looking names, typical of data tunnelled out over DNS.",
    method: "Shannon entropy and length of the leftmost DNS label",
    window: "last 1 h · per host and registered domain",
    flags: {
      low: "at least 200 queries, entropy 4.0 bits/char, labels 30 chars",
      medium: "at least 100 queries, entropy 3.6 bits/char, labels 24 chars",
      high: "at least 50 queries, entropy 3.2 bits/char, labels 18 chars",
    },
  },
];
// The key numbers each detector records in alert.details, shown as chips.
const EVIDENCE = {
  beaconing: [["peer", (v) => `to ${v}`], ["port", (v) => `port ${v}`], ["processes", (v) => `process ${Array.isArray(v) ? v.join(", ") : v}`], ["period_seconds", (v) => `every ${v} s`], ["connections", (v) => `${v} connections`], ["cv", (v) => `gap CV ${v}`]],
  lateral_movement: [["internal_peers_last_hour", (v) => `${v} internal hosts in the last hour`], ["new_peers", (v) => `${v} new`], ["new_peer_sample", (v) => `new: ${Array.isArray(v) ? v.slice(0, 5).join(", ") + (v.length > 5 ? " and " + (v.length - 5) + " more" : "") : v}`], ["processes", (v) => `process ${Array.isArray(v) ? v.join(", ") : v}`], ["baseline_max_per_hour", (v) => `7-day hourly peak ${v}`]],
  dns_tunneling: [["domain", (v) => v], ["queries", (v) => `${v} queries`], ["sample_names", (v) => `e.g. ${Array.isArray(v) ? v.slice(0, 3).join(", ") : v}`], ["avg_label_length", (v) => `avg label ${v} chars`], ["avg_label_entropy", (v) => `entropy ${v} bits/char`]],
};
const SENS_LABEL = { low: "Fewer alerts", medium: "Balanced", high: "More alerts" };
// The alert panel shows the same evidence.
window.ALERT_EVIDENCE = EVIDENCE;
function DetectionsPage({ openAlert, alerts: alertsProp, onStatus }) {
  const D = window.MS_DATA;
  const ALERTS = alertsProp || D.ALERTS || [];
  const [cfg, setCfg] = useState(() => {
    const o = {};
    BEHAVIORAL.forEach((b) => { o[b.key] = { on: true, sens: "medium" }; });
    return o;
  });
  // Settings are shown only once the Imara server answered (no saved row
  // means on and balanced, which is also what the server uses). Until then,
  // or if reading fails, they read "unknown" and cannot be changed. Each
  // check saves one change at a time; the screen follows the server.
  const [saveErr, setSaveErr] = useState("");
  const [loaded, setLoaded] = useState("loading"); // loading | ok | failed
  const [saving, setSaving] = useState({});
  useEffect(() => {
    if (!window.ImaraAPI || !window.ImaraAPI.listDetectors) { setLoaded("failed"); return; }
    window.ImaraAPI.listDetectors().then((list) => {
      setCfg((c) => {
        const n = { ...c };
        (list || []).forEach((d) => { if (n[d.key]) n[d.key] = { on: d.enabled, sens: d.sensitivity }; });
        return n;
      });
      setLoaded("ok");
    }).catch(() => setLoaded("failed"));
  }, []);
  const setOne = (k, patch) => {
    if (loaded !== "ok" || saving[k]) return;
    if (patch && patch.on === false && cfg[k] && cfg[k].on && !window.confirm("Turn this check off for all servers? It raises no alerts until turned back on. Recorded in the audit log.")) return;
    const prev = cfg[k];
    const next = { ...prev, ...patch };
    setCfg((c) => ({ ...c, [k]: next }));
    if (!window.ImaraAPI || !window.ImaraAPI.saveDetector) return;
    setSaving((m) => ({ ...m, [k]: true }));
    window.ImaraAPI.saveDetector(k, next.on, next.sens)
      .then((saved) => {
        setSaveErr("");
        if (saved && typeof saved === "object" && saved.key === k) setCfg((c) => ({ ...c, [k]: { on: saved.enabled, sens: saved.sensitivity } }));
      })
      .catch((e) => { setCfg((c) => ({ ...c, [k]: prev })); setSaveErr((e && e.message) || "save failed"); })
      .finally(() => setSaving((m) => ({ ...m, [k]: false })));
  };

  // Alerts marked false positive from this page are hidden at once; the app's
  // alert list catches up on its next refresh.
  const [closedHere, setClosedHere] = useState({});
  const markFalsePositive = (a) => {
    const scope = a.kind === "lateral_movement"
      ? "Lateral movement alerts for this server are muted for 7 days, whatever it connects to."
      : a.kind === "beaconing" ? "Beaconing alerts for this server and this external address and port are muted for 7 days."
      : a.kind === "dns_tunneling" ? "DNS tunnelling alerts for this server and this domain are muted for 7 days."
      : "Alerts from this check for this server and this destination are muted for 7 days.";
    const also = a.details && Array.isArray(a.details.also_flagged) ? a.details.also_flagged : [];
    const alsoText = also.length ? ` Also muted: ${also.length} other finding${also.length === 1 ? "" : "s"} in this alert (${also.slice(0, 2).join("; ")}${also.length > 2 ? "; ..." : ""}).` : "";
    if (!window.confirm(`Mark this alert as a false positive? It closes. ${scope}${alsoText}`)) return;
    // Through the shared alert update, so counts, lists and the audit log follow
    // (it says so itself when the update fails).
    Promise.resolve(onStatus(a, "false_positive")).then((ok) => { if (ok !== false) setClosedHere((m) => ({ ...m, [a.id]: true })); });
  };

  // Only unresolved alerts count as "open" findings on the detector cards.
  const isOpen = (a) => a.status !== "resolved" && a.status !== "false_positive" && !closedHere[a.id];
  const findingFor = (k) => ALERTS.filter((a) => a.kind === k && isOpen(a));
  const behavioralOpen = ALERTS.filter((a) => isOpen(a) && BEHAVIORAL.some((b) => b.key === a.kind));
  const enabledCount = loaded === "ok" ? Object.values(cfg).filter((c) => c.on).length : null;
  const hostOf = (a) => (D.byId && D.byId[a.server_id] && D.byId[a.server_id].hostname) || (a.details && a.details.hostname) || a.server_id || "all servers";
  const T = window.ImaraTerms;
  const [how, setHow] = useState({});

  // The console holds the newest open alerts (up to 500) and the newest 100
  // of any state: counts here are of those, said so when there are more.
  const D0 = window.MS_DATA, oc0 = D0.ALERT_OPEN_COUNTS;
  const partialOpen = !!(oc0 && D0.ALERT_OPEN_LOADED != null && (oc0.critical || 0) + (oc0.warn || 0) + (oc0.info || 0) > D0.ALERT_OPEN_LOADED) || !!D0.ALERT_ACK_PARTIAL;
  // Real SIEM fan-out status: the configured connectors reported by the control
  // plane. Null while loading; [] when none configured.
  const [siem, setSiem] = useState(null);
  useEffect(() => {
    if (window.ImaraAPI?.siemStatus) window.ImaraAPI.siemStatus().then(setSiem).catch(() => setSiem("failed"));
    else setSiem([]);
  }, []);
  const siemLabel = siem == null ? "…" : siem === "failed" ? "unknown" : (siem.length ? (siem.length === 1 ? siem[0] : `${siem.length} connected`) : "none");

  return (
    <div className="scroll"><section className="section">
      <div className="grid" style={{ gridTemplateColumns: "repeat(3,1fr)", marginBottom: 16 }}>
        <Stat label="Checks on" value={enabledCount == null ? "unknown" : `${enabledCount} of ${BEHAVIORAL.length}`} icon="ScanEye" foot={loaded === "failed" ? "settings could not be read" : "each runs every 5 minutes"} />
        <Stat label="Unresolved alerts" value={`${behavioralOpen.length}${partialOpen ? "+" : ""}`} icon="Waypoints" foot={partialOpen ? "open or acknowledged; older ones may be missing" : "open or acknowledged"} />
        <Stat label="SIEM forwarding" value={siemLabel} icon="Send" foot={siem === "failed" ? "SIEM status could not be read" : siem == null ? "checking…" : siem.length ? "critical alerts, audit log and firewall drift" : "no SIEM connected"} />
      </div>

      {/* behavioral */}
      <div className="row gap8 wrap" style={{ marginBottom: 10 }}>
        <Icon name="Activity" size={16} style={{ color: "var(--accent)" }} />
        <b style={{ fontSize: 13.5, whiteSpace: "nowrap" }}>Suspicious behaviour checks<Help width={360}>
          <p>Fixed statistical thresholds over recorded connections and DNS queries, not a trained model.</p>
          <p>Changes to a check (on, off, sensitivity) are saved, recorded in the audit log, and apply from the next run.</p>
          <p>An open finding stays one alert. Once it is resolved, the same server and destination are not raised again until the check's time window has passed. False positives are muted for 7 days.</p>
        </Help></b>
        {saveErr && <Badge tone="bad" sq>not saved: {saveErr}</Badge>}
        {loaded === "failed" && <Badge tone="warn" sq>settings could not be read: shown as unknown</Badge>}
        {partialOpen && <span className="faint" style={{ fontSize: 11.5 }}>older open alerts may be missing (see Alerts for counts)</span>}
      </div>
      <div className="col gap10">
        {BEHAVIORAL.map((b) => {
          const f = findingFor(b.key);
          const known = loaded === "ok";
          const on = known && cfg[b.key].on;
          const sens = cfg[b.key].sens;
          const busyK = !!saving[b.key];
          return (
            <div key={b.key} className="card" style={{ padding: 16 }}>
              <div className="row gap12" style={{ alignItems: "flex-start", opacity: on ? 1 : 0.6, transition: "opacity .15s" }}>
                <div style={{ width: 38, height: 38, borderRadius: "var(--r-md)", background: "var(--bg-raised)", border: "1px solid var(--border)", display: "grid", placeItems: "center", flexShrink: 0 }}>
                  <Icon name={b.icon} size={18} style={{ color: on ? "var(--accent)" : "var(--text-faint)" }} />
                </div>
                <div style={{ flex: 1, minWidth: 0 }}>
                  <div className="row gap8">
                    <b style={{ fontSize: 13.5, whiteSpace: "nowrap" }}>{b.name}</b>
                    {f.length > 0 && <Badge tone="warn" sq>{f.length} open alert{f.length === 1 ? "" : "s"}</Badge>}
                    {!known && <Badge tone="warn" sq>{loaded === "loading" ? "loading" : "setting unknown"}</Badge>}
                    {known && !on && <Badge tone="neutral" sq>off</Badge>}
                  </div>
                  <div className="muted" style={{ fontSize: 12.5, marginTop: 4, lineHeight: 1.5, maxWidth: 640 }}>{b.desc}</div>
                  <div className="row gap6 wrap" style={{ marginTop: 10, alignItems: "center" }}>
                    <div className="seg">
                      {["low", "medium", "high"].map((sv) => <button key={sv} className={cx(known && sens === sv && "on")} onClick={() => setOne(b.key, { sens: sv })} disabled={!on || busyK}>{SENS_LABEL[sv]}</button>)}
                    </div>
                    <button className="btn ghost sm" onClick={() => setHow((h) => ({ ...h, [b.key]: !h[b.key] }))}><Icon name={how[b.key] ? "ChevronUp" : "ChevronDown"} size={12} /> How it works</button>
                  </div>
                  {how[b.key] && (
                    <div className="col gap4 faint" style={{ fontSize: 11.5, marginTop: 8, lineHeight: 1.5 }}>
                      {b.more && <span>{b.more}</span>}
                      <span>Method: {b.method}.</span>
                      <span>Window: {b.window}.</span>
                      {["low", "medium", "high"].map((sv) => <span key={sv}>{SENS_LABEL[sv]}: alerts at {b.flags[sv]}.</span>)}
                    </div>
                  )}
                </div>
                <div style={{ opacity: known && !busyK ? 1 : 0.5, pointerEvents: known && !busyK ? "auto" : "none" }} title={known ? "" : "The setting could not be read"}><Toggle on={on} onChange={(v) => setOne(b.key, { on: v })} /></div>
              </div>
              {/* Open alerts only: a check without any shows nothing here
                  (that older ones may be missing is said once, above). */}
              {f.length > 0 && (
                <div className="col gap6" style={{ marginTop: 12, paddingTop: 12, borderTop: "1px solid var(--border)" }}>
                  {f.slice(0, 5).map((a) => {
                    const d = a.details || {};
                    const chips = (EVIDENCE[b.key] || []).filter(([k]) => d[k] !== undefined && d[k] !== null && d[k] !== "").map(([k, fmtFn]) => fmtFn(d[k]));
                    return (
                      <div key={a.id} className="row gap10" style={{ alignItems: "flex-start", padding: "6px 0" }}>
                        <button className="col" onClick={() => openAlert(a)} title="Open the alert"
                          style={{ flex: 1, minWidth: 0, textAlign: "left", background: "transparent", border: "none", padding: 0, cursor: "pointer", gap: 4, alignItems: "stretch" }}>
                          <span className="row gap10" style={{ width: "100%" }}>
                            <Badge tone={SEV[a.severity]} dot>{a.severity === "warn" ? "warning" : a.severity}</Badge>
                            <span style={{ fontSize: 12.5, flex: 1, overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }}>{T.alertName(a.kind)}</span>
                            <span className="mono faint" style={{ fontSize: 11, whiteSpace: "nowrap" }}>{hostOf(a)}</span>
                            <span className="faint" style={{ fontSize: 11, whiteSpace: "nowrap" }}>{agoLong(a.created_at)}</span>
                            <Icon name="ChevronRight" size={14} className="faint" />
                          </span>
                          {chips.length > 0 && (
                            <span className="row gap6 wrap">{chips.map((c, i) => <span key={i} className="chip mono" style={{ fontSize: 11 }}>{c}</span>)}</span>
                          )}
                        </button>
                        <button className="btn" onClick={() => markFalsePositive(a)} title={a.kind === "lateral_movement" ? "Close it and mute this check for this server for 7 days" : "Close it and mute this server and destination for 7 days"}
                          style={{ fontSize: 11, padding: "3px 8px", whiteSpace: "nowrap", flexShrink: 0 }}>False positive</button>
                      </div>
                    );
                  })}
                  {f.length > 5 && <span className="faint" style={{ fontSize: 11.5 }}>and {(f.length - 5).toLocaleString("en-US")} more on the Alerts page.</span>}
                </div>
              )}
            </div>
          );
        })}
      </div>

    </section></div>
  );
}

window.DetectionsPage = DetectionsPage;