{{ _('Generated:') }} {{ generated_at }} | {{ _('Profile ID:') }} {{ profile.profile_id }}

{{ _('Detection Event Timeline — based on WAF alerts and file system monitoring.') }} {{ _('Full attack chain reconstruction requires SIEM/NDR integration.') }}

{{ _('Tool Fingerprint') }}	`{{ profile.ua_fingerprint or _('Unknown') }}`
{{ _('First Seen') }}	{{ profile.created_at.strftime('%Y-%m-%d %H:%M') }}
{{ _('Last Seen') }}	{{ profile.last_seen.strftime('%Y-%m-%d %H:%M') if profile.last_seen else _('N/A') }}
{{ _('Status') }}	{{ profile.status.upper() }}
{{ _('Total Events') }}	{{ events\|length }}

{% for tag in mitre_tags %} {{ tag.id }} {{ tag.name }} [{{ tag.tactic }}] {% endfor %}

{% if events %}

{% for evt in (events|reverse|list)[:50] %}

{{ evt.timestamp.strftime('%Y-%m-%d %H:%M:%S') if evt.timestamp else _('N/A') }}

{{ evt.event_type.upper() }} — {{ evt.waf_rule_id or evt.file_path or _('Detection') }}

{{ _('IP:') }} {{ evt.src_ip }} {% if evt.url %} {{ _('URL:') }} {{ evt.url[:80] }}{% endif %} {% if evt.waf_score > 0 %} {{ _('Score:') }} {{ "%.2f"|format(evt.waf_score) }}{% endif %}

{% endfor %}

{% else %}

{% endif %}

{{ _('Associated IPs') }} ({{ profile.ip_pool|length }})

{% for ip in (profile.ip_pool|list)[:50] %} {% endfor %}

{{ _('IP Address') }}	{{ _('Events') }}	{{ _('Cluster Level') }}
`{{ ip }}`	—	—

{% for rec in recs %}

{{ rec.action }}

{% endfor %}

{{ _('Attacker Profile Report') }}

{{ _('MITRE ATT&CK Mapping') }}

{{ _('Detection Event Timeline') }}

{{ _('Associated IPs') }} ({{ profile.ip_pool|length }})

{{ _('Disposal Recommendations') }}