{% from "partials/_macros.html" import card_header %} {% set sev_styles = { 'critical': 'bg-red-900/50 text-red-200 border-red-800', 'high': 'bg-red-900/40 text-red-300 border-red-900/60', 'medium': 'bg-amber-900/40 text-amber-300 border-amber-900/60', 'low': 'bg-sky-900/40 text-sky-300 border-sky-900/60', 'informational': 'bg-slate-700/40 text-slate-300 border-slate-600', } %} {# ATT&CK tactic → accent colour for timeline dots / category chips #} {% set cat_color = { 'reconnaissance': '#64748b', 'initial_access': '#f97316', 'execution': '#f59e0b', 'persistence': '#a855f7', 'privilege_escalation':'#ec4899', 'defense_evasion': '#8b5cf6', 'credential_access': '#ef4444', 'discovery': '#0ea5e9', 'lateral_movement': '#14b8a6', 'collection': '#eab308', 'command_and_control': '#dc2626', 'exfiltration': '#e11d48', 'impact': '#b91c1c', } %} {% set prio_styles = { 'immediate': 'bg-red-900/50 text-red-200 border-red-800', 'high': 'bg-amber-900/40 text-amber-300 border-amber-900/60', 'medium': 'bg-sky-900/40 text-sky-300 border-sky-900/60', 'low': 'bg-slate-700/40 text-slate-300 border-slate-600', } %}
{{ card_header("incident digest") }} {% if narrative %} {{ narrative.severity }} {% endif %}
{% if narrative %}

{{ narrative.headline }}

{{ narrative.finding_count }} active finding{{ '' if narrative.finding_count == 1 else 's' }} · {{ narrative.created_at | datetime_fmt }} · {{ narrative.model }}
{% if narrative.summary %}

{{ narrative.summary }}

{% endif %} {% if timeline %}

attack timeline

    {% for ev in timeline %} {% set color = cat_color.get(ev.category, '#475569') %}
  1. {% if ev.time %}{{ ev.time | datetime_fmt }}{% endif %} {% if ev.category %} {{ ev.category.replace('_', ' ') }} {% endif %}
    {{ ev.title }}
    {% if ev.detail %}
    {{ ev.detail }}
    {% endif %}
  2. {% endfor %}
{% endif %} {% if actions %}

recommended actions

{% for a in actions %}
{{ a.priority }} {{ a.title }}
{% if a.command %}
{{ a.command }}
{% endif %} {% if a.detail %}
{{ a.detail }}
{% endif %}
{% endfor %}
{% endif %} {# Back-compat: a digest written before the structured format. #} {% if not timeline and not actions and narrative.narrative %}
{{ narrative.narrative | markdown }}
{% if narrative.recommended_actions %}
{{ narrative.recommended_actions | markdown }}
{% endif %} {% endif %} {% else %}
no incident digest yet — generated once active suspicious/malicious findings exist and the LLM judge is enabled.
{% endif %}