diff --git a/src/shared/components/icons/icons.tsx b/src/shared/components/icons/icons.tsx index 1c877c7..27783e8 100644 --- a/src/shared/components/icons/icons.tsx +++ b/src/shared/components/icons/icons.tsx @@ -77,3 +77,76 @@ export const CloseIcon = ({ size = 12 }: { size?: number }) => ( ); + +export const EntityIcon = { + host: ( + + ), + user: ( + + ), + process: ( + + ), + executable: ( + + ), +}; + +export const FactIcon = { + status: ( + + ), + severity: ( + + ), + alerts: ( + + ), + comments: ( + + ), + createdBy: ( + + ), + created: ( + + ), + updated: ( + + ), +}; diff --git a/src/views/alert-triage/components/AlertCard.tsx b/src/views/alert-triage/components/AlertCard.tsx index 748b257..7317907 100644 --- a/src/views/alert-triage/components/AlertCard.tsx +++ b/src/views/alert-triage/components/AlertCard.tsx @@ -8,34 +8,7 @@ import React from "react"; import { timeAgo } from "../../../shared/theme"; import type { SecurityAlert } from "../../../shared/types"; - -export const EntityIcon = { - host: ( - - ), - user: ( - - ), - process: ( - - ), - executable: ( - - ), -}; +import { EntityIcon } from "../../../shared/components/icons/icons"; interface AlertCardProps { alert: SecurityAlert; diff --git a/src/views/alert-triage/components/DetailView.tsx b/src/views/alert-triage/components/DetailView.tsx index fdd3909..1472a3d 100644 --- a/src/views/alert-triage/components/DetailView.tsx +++ b/src/views/alert-triage/components/DetailView.tsx @@ -9,7 +9,8 @@ import React, { useRef, useState } from "react"; import { ChevronDownIcon, LoadingState } from "../../../shared/components"; import { useClickOutside } from "../../../shared/hooks/useClickOutside"; import type { AlertContext, SecurityAlert } from "../../../shared/types"; -import { AlertScoreRing, EntityIcon } from "./AlertCard"; +import { AlertScoreRing } from "./AlertCard"; +import { EntityIcon } from "../../../shared/components/icons/icons"; import { ExpandSection } from "./ExpandSection"; import { FactCol } from "./FactCol"; import { NetworkTable } from "./NetworkTable"; diff --git a/src/views/case-management/App.tsx b/src/views/case-management/App.tsx index 0d7fa55..e9a8775 100644 --- a/src/views/case-management/App.tsx +++ b/src/views/case-management/App.tsx @@ -40,6 +40,7 @@ import { import type { Severity } from "../../shared/components"; import { useFullscreen } from "../../shared/hooks/useFullscreen"; import { useMcpApp } from "../../shared/hooks/useMcpApp"; +import { FactIcon } from "../../shared/components/icons/icons"; import "./styles.css"; type SeverityKey = Severity; @@ -937,52 +938,6 @@ function FactCol({ label, value, icon, onFilter }: { label: string; value?: stri ); } -// ─── Fact icons ────────────────────────────────────────────────────────────── - -const FactIcon = { - status: ( - - ), - severity: ( - - ), - alerts: ( - - ), - comments: ( - - ), - createdBy: ( - - ), - created: ( - - ), - updated: ( - - ), -}; function ExpandSection({ title, count, expanded, onToggle, previewCount, children }: { title: string; count: number; expanded: boolean; onToggle: () => void; previewCount: number; children: React.ReactNode; diff --git a/src/views/sample-data/App.tsx b/src/views/sample-data/App.tsx index b54bd61..f782137 100644 --- a/src/views/sample-data/App.tsx +++ b/src/views/sample-data/App.tsx @@ -9,6 +9,7 @@ import React, { useState, useCallback, useMemo } from "react"; import { App as McpApp } from "@modelcontextprotocol/ext-apps"; import { extractCallResult } from "../../shared/extract-tool-text"; import { SeverityChip } from "../../shared/components"; +import { AppGlyph, SearchIcon } from "../../shared/components/icons/icons"; import { useMcpApp } from "../../shared/hooks/useMcpApp"; import "./styles.css"; @@ -489,12 +490,6 @@ const SEVERITY_FILTERS: { key: SeverityFilter; label: string }[] = [ { key: "medium", label: "Medium" }, ]; -const AppGlyph = () => ( - -); - export function App() { const [selected, setSelected] = useState>(new Set()); const [expanded, setExpanded] = useState(null); @@ -715,7 +710,7 @@ export function App() { })}
- + ( - -); - -const FullscreenIcon = () => ( - -); - -const ExitFullscreenIcon = () => ( - -); - -/** - * Default state seeds a realistic ES|QL scenario on first load (results table). - * The investigation graph stays hidden until the user runs a query that returns - * rows and clicks entities, or uses "Example graph". - */ -const DEFAULT_QUERY = `FROM logs-* -| WHERE host.name == "win-dc-01" -| STATS count = COUNT(*) BY user.name, process.name -| SORT count DESC -| LIMIT 10`; - -const DEFAULT_RESULTS: EsqlResult = { - columns: [ - { name: "user.name", type: "keyword" }, - { name: "process.name", type: "keyword" }, - { name: "host.name", type: "keyword" }, - { name: "count", type: "long" }, - ], - values: [ - ["svc_backup", "powershell.exe", "win-dc-01", 147], - ["svc_backup", "procdump.exe", "win-dc-01", 42], - ["admin.backup", "powershell.exe", "win-dc-01", 38], - ["svc_backup", "cmd.exe", "win-dc-01", 29], - ["admin.backup", "rundll32.exe", "win-dc-01", 21], - ["svc_backup", "net.exe", "win-dc-01", 17], - ["admin.backup", "wmic.exe", "win-dc-01", 14], - ["svc_backup", "reg.exe", "win-dc-01", 11], - ], -}; - export function App() { - const [query, setQuery] = useState(DEFAULT_QUERY); - const [results, setResults] = useState(DEFAULT_RESULTS); + const [query, setQuery] = useState(""); + const [results, setResults] = useState(null); const [queryError, setQueryError] = useState(null); const [executing, setExecuting] = useState(false); - const [hasExecuted, setHasExecuted] = useState(true); + const [hasExecuted, setHasExecuted] = useState(false); const [graphNodes, setGraphNodes] = useState([]); const [graphEdges, setGraphEdges] = useState([]);