https://bluelanternsecurity.io/DeviceReport-DueFCVgY.js

1import{x as ie,y as M,j as e,f as h,z as re,i as oe,r as b,o as ae,s as le,L as F,az as de,a6 as ce,a5 as me,C as pe}from"./index-C86sjUM7.js";import{u as he}from"./reportNavigation-B2CPzqI6.js";import{h as ue,t as A}from"./monitoringHub-BRSFAgjF.js";import{f as P,c as $}from"./runPresentation-DoqGxX4m.js";import{S as U}from"./shield-alert-cz1iZj9B.js";import{S as V,a as fe}from"./shield-x-CWkSTwZs.js";import{M as ge}from"./monitor-smartphone-ukvAVDvk.js";import{D as xe}from"./download-BjVXJSVp.js";import{L as be}from"./list-checks-DN2yWwV4.js";import{I as ve}from"./info-D5zhcT7u.js";const ye=[["circle",{cx:"12",cy:"12",r:"10",key:"1mglay"}],["path",{d:"M9.09 9a3 3 0 0 1 5.83 1c0 2-3 3-3 3",key:"1u773s"}],["path",{d:"M12 17h.01",key:"p32p05"}]],we=ie("circle-question-mark",ye),D={disk_encryption_enabled:{description:"FileVault full-disk encryption is turned on. A lost or stolen Mac without disk encryption exposes every file on it; this is the first control cyber-insurance applications and compliance audits ask about.",remediation:"System Settings → Privacy & Security → FileVault → Turn On."},sip_enabled:{description:"System Integrity Protection is active. SIP stops even root processes from modifying the OS itself; it only gets disabled through deliberate recovery-mode steps, usually a leftover developer workaround that leaves the whole system open to tampering.",remediation:"Reboot into macOS Recovery and run `csrutil enable`."},gatekeeper_enabled:{description:"Gatekeeper app assessment is active, so macOS verifies downloaded apps are signed and notarized before they run. Disabling it removes the OS's main defense against known-malicious and tampered software.",remediation:"Re-enable app verification: `sudo spctl --master-enable`."},sharing_services_disabled:{description:"No remote-access or sharing services are listening: Screen Sharing, File Sharing, Remote Login (SSH), Remote Management, Remote Apple Events, Internet Sharing, Bluetooth/disc/printer sharing. Each enabled service is a network-reachable door most users never intended to leave open. Note: an MSP's own remote-support tooling can legitimately enable Screen Sharing or Remote Management.",remediation:"System Settings → General → Sharing → turn off any service not deliberately in use."},auto_login_disabled:{description:"No account signs in automatically at boot. Auto-login hands anyone with physical access a live session, and it weakens FileVault since the disk unlocks without a password.",remediation:"System Settings → Users & Groups → Automatic login → Off."},edr_agent_running:{description:"A known endpoint-protection (EDR/AV) agent is running: Defender, CrowdStrike, SentinelOne, Huntress, Jamf Protect, Sophos, Bitdefender, Cylance, Elastic, Malwarebytes, ESET, or Trend Micro. Compliance and monitoring agents do not count: this checks for software that can detect and block threats, the coverage proof insurers ask for. A product missing from the known list reports as not found.",remediation:"Deploy the organization's EDR to this device, or report the product name so it can be added to the detection list."},firewall_enabled:{description:"The macOS firewall is on, filtering unsolicited inbound connections per application.",remediation:"System Settings → Network → Firewall → On."},automatic_updates_not_disabled:{description:"Automatic checking for macOS updates has not been explicitly turned off. An unset preference means the macOS default, which is on.",remediation:"System Settings → General → Software Update → enable automatic update checks."},screen_lock_required:{description:"A password is required within 5 seconds of sleep or the screen saver starting. Without it, an unattended machine is open to anyone walking past.",remediation:"System Settings → Lock Screen → require password immediately after sleep or screen saver."},third_party_root_certificates:{description:"Lists self-signed certificate authorities added to the system trust store. A trusted root CA can silently intercept any HTTPS traffic on the machine; corporate TLS-inspection firewalls install these legitimately, adware installs them maliciously; either way, every entry should be recognized.",remediation:"Open Keychain Access → System keychain and remove any root certificate that cannot be attributed."},persistence_unsigned:{description:"Every third-party launch daemon and agent binary carries a valid code signature. Unsigned or ad-hoc-signed persistence is the classic footprint of Mac malware; legitimate vendors sign their software.",remediation:"Investigate each listed entry; remove the launchd plist and its binary if not recognized."},guest_user_disabled:{description:"Guest login is off, so there is no passwordless account on the machine.",remediation:"System Settings → Users & Groups → Guest User → Off."},screensaver_idle_timeout:{description:"The screen saver (and with it the screen lock) starts within 20 minutes of inactivity. An unset preference means the macOS default, treated as compliant.",remediation:"System Settings → Lock Screen â

1†’ start Screen Saver at 20 minutes or less."},firewall_stealth_enabled:{description:"Firewall stealth mode is on: the Mac ignores pings and network probes instead of confirming its presence to scans. Off by default on macOS; most valuable on laptops that join untrusted networks.",remediation:"Run `sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on`."},legacy_kernel_extensions:{description:"No third-party kernel extensions are loaded. Kexts are deprecated by Apple; any still present are usually leftovers from old security or VPN products and are both a stability and a security smell.",remediation:"Uninstall the product that owns the listed extension, then reboot."},local_backup_configured:{description:"Reports whether a Time Machine backup destination is configured. The agent cannot see cloud backup services, so 'not configured' is a fact to interpret against the client's actual backup strategy, not automatically a gap."},local_backup_recent:{description:"Reports whether a Time Machine backup completed within the last 7 days. Only meaningful on machines that use Time Machine; cloud backups are invisible to this check."},os_updates_pending:{description:"Lists software updates offered by macOS and when they were checked, with results reused for up to 12 hours. Offerings can be alternative upgrade paths, not a count of required patches. Older reports containing LastUpdatesAvailable are cached signals, not update inventories."},mdm_enrolled:{description:"Reports whether the device is under MDM management, based on the presence of MDM-delivered policies. Unenrolled devices sit outside the management control plane entirely: no remote lock, wipe, or configuration enforcement. An enrolled device whose MDM pushes zero policies can read as unenrolled."},admin_users_inventory:{description:"Lists local administrator accounts. Most single-user Macs run as admin; the list provides the facts to judge whether that is acceptable for this client."},persistence_inventory:{description:"Lists every third-party launch daemon and agent with its binary path: the machine's complete auto-start surface. Unexpected entries are the lead worth pulling."},remote_access_tools_inventory:{description:"Lists installed remote-access and tunneling tools: TeamViewer, AnyDesk, RustDesk, Splashtop, Chrome Remote Desktop, ngrok, ScreenConnect/ConnectWise Control. Each is a potential unattended door into the machine; an MSP's own support tooling is expected, anything unrecognized deserves a look."},bitlocker_enabled:{description:"BitLocker encryption is protecting the system drive. A lost or stolen machine without disk encryption exposes everything on it; the first question on cyber-insurance applications.",remediation:"Enable BitLocker on the system drive (Control Panel → BitLocker Drive Encryption, or `manage-bde -on C:`)."},secure_boot_enabled:{description:"UEFI Secure Boot is on, blocking unsigned bootloaders and boot-level rootkits before Windows starts.",remediation:"Enable Secure Boot in the machine's UEFI firmware settings."},antivirus_healthy:{description:"Windows Security Center reports antivirus present, enabled, and with current signatures. Not available on Server editions, which lack the Security Center service.",remediation:"Enable Microsoft Defender or the deployed AV product and allow signatures to update."},uac_enabled:{description:"User Account Control is on, so software cannot silently elevate itself to administrator rights.",remediation:"Re-enable UAC (Control Panel → User Account Control settings) and reboot."},rdp_disabled:{description:"Remote Desktop is off. Exposed RDP is the most common ransomware entry vector; where a client genuinely needs it, it should be deliberate, network-restricted, and documented.",remediation:"Settings → System → Remote Desktop → Off, or restrict RDP to VPN-only reachability."},smbv1_disabled:{description:"The legacy SMBv1 protocol is not installed. SMBv1 is the file-sharing protocol exploited by WannaCry-class worms and has no place on a modern network.",remediation:"Remove it: `Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol`."},windows_auto_login_disabled:{description:"No account signs in automatically at boot (no AutoAdminLogon or stored password). Auto-login hands physical access a live session; common on shop-floor and kiosk machines, where it deserves an explicit, documented exception.",remediation:"Require sign-in via `netplwiz`, and clear AutoAdm

1inLogon/DefaultPassword under the Winlogon registry key."},windows_edr_agent_running:{description:"A known endpoint-protection (EDR/AV) agent process is running. Compliance and monitoring agents do not count: this checks for software that can detect and block threats, proof the coverage the client pays for is actually deployed. A product missing from the known list reports as not found.",remediation:"Deploy the organization's EDR to this device, or report the product name so it can be added to the detection list."},bitlocker_fixed_drives_encrypted:{description:"Every BitLocker-capable fixed data drive is encrypted, not just the system drive. Data on a second disk is just as exposed to theft.",remediation:"Enable BitLocker on each listed fixed drive."},windows_firewall_enabled:{description:"Windows Security Center reports the firewall enabled and healthy.",remediation:"Turn on Windows Defender Firewall for all network profiles."},windows_automatic_updates_enabled:{description:"Windows Security Center reports automatic updates enabled and healthy.",remediation:"Enable automatic updates in Settings, or via update policy (GPO/Intune)."},non_default_smb_shares:{description:"Lists file shares beyond the administrative defaults (C$, ADMIN$, IPC$). A small-office 'server PC' sharing a folder is normal; the point is that every share should be intentional and known.",remediation:"Remove shares nobody claims ownership of; deliberately permission the rest."},unsigned_startup_items:{description:"Everything that auto-starts at boot or login carries a valid Authenticode signature. Unsigned startup entries are where commodity Windows malware persists.",remediation:"Investigate each listed entry; remove unrecognized startup items."},windows_guest_account_disabled:{description:"The built-in Guest account is disabled (the Windows default), so there is no passwordless login.",remediation:"Run `net user guest /active:no`."},windows_password_policy:{description:"The local security policy requires passwords of at least 8 characters with complexity. Local policy governs local accounts only (domain/Entra accounts and Windows Hello PINs are governed elsewhere), so treat this as a configuration signal, not proof of credential strength; unmanaged machines fail it by default.",remediation:"Set password policy via GPO/Intune, or locally in secpol.msc → Account Policies → Password Policy."},windows_backup_solution_present:{description:"A recognized backup mechanism is present: a known backup agent (Veeam, Acronis, Macrium, Carbonite, Backblaze, CrashPlan/Code42, Datto, Druva, IDrive, Arcserve, Cove) or OneDrive folder backup (Known Folder Move). Backups are what make ransomware a bad day instead of a company-ending event, and proof of them is a standing cyber-insurance question. A product missing from the known list reports as not found.",remediation:"Deploy the organization's backup agent, enable OneDrive folder backup, or report the product name so it can be added to the detection list."},vss_not_disabled:{description:"The Volume Shadow Copy service has not been disabled. Killing VSS is classic ransomware preparation — it removes Windows' ability to keep the shadow copies files are rolled back from — and there is almost never a legitimate reason for it.",remediation:"Restore the service (`Set-Service VSS -StartupType Manual` from elevated PowerShell), then investigate what disabled it."},removable_storage_writes_blocked:{description:"Reports whether writing to removable USB storage is blocked (by policy, BitLocker To Go enforcement, or USB storage being disabled). Almost no SMB blocks USB writes; this is a DLP posture fact, not an expected control."},startup_items_inventory:{description:"Lists everything configured to start automatically at boot or login: the machine's complete auto-start surface, for triage and drift-spotting."},windows_admin_users_inventory:{description:"Lists members of the local Administrators group: the facts needed to judge least-privilege for this client."},windows_mdm_enrolled:{description:"Reports whether the device is enrolled in MDM (Intune or similar). Unenrolled devices sit outside the management control plane: no remote lock, wipe, or configuration enforcement."},cloud_sync_apps_inventory:{description:"Lists consumer file-sync clients present (personal OneDrive, Dropbox, Google Drive, and similar). Personal sync accounts on business machines are a common, quiet path for data to leave the organization."},windows_remote_access_tools_inventory:{description:"Lists installed remote-access and tunneling tools: TeamViewer, AnyDesk, RustDesk, Splashtop, Chrome Remote Desktop, ngrok, Remote Utilities, ScreenConnect/ConnectWise Control. Each is a potential unattended door into the machine; an MSP's own support tooling is expected, anything unrecognized deserves a look."},edr_sensor_online:{description:"The Falcon sensor has checked in recently (unseen for more than 7 days fail

1s; the threshold is tunable server-side). A sensor that stops reporting means the device is running without EDR protection or visibility. Devices unseen for over 30 days age out and stop producing runs entirely.",remediation:"Confirm the device is powered on and can reach CrowdStrike, and that the Falcon sensor service is running. Decommissioned devices can simply be hidden in the Falcon console."},edr_sensor_healthy:{description:"The Falcon sensor is not in reduced-functionality mode (RFM). In RFM the sensor runs with degraded detection and prevention — most often because the OS or kernel was updated past what the installed sensor version supports.",remediation:"Update the Falcon sensor to a build that supports the current OS version, or enable sensor auto-update in the Falcon console."},edr_prevention_policy_assigned:{description:"A prevention policy is applied to the host, so the sensor is configured to actually block threats rather than only observe them.",remediation:"Assign the host to a prevention policy in the Falcon console (Host setup and management → Prevention policies)."},edr_no_active_alerts:{description:"No alerts for this device are still waiting on an admin in the EDR console (statuses like new or in progress). The read is presence-only — alert ids are counted, contents are never read or stored. An open alert is a detection nobody has triaged yet. Omitted when the credential lacks the alert-read permission.",remediation:"Triage and resolve the open alerts in your EDR console — the CrowdStrike Falcon console, or security.microsoft.com for Microsoft Defender."},edr_av_protection_healthy:{description:"Microsoft Defender antivirus on the device reports healthy, current protection. Fails when AV is disabled, not reporting, or running stale signatures; devices that do not report an AV status omit the check. Defender-specific — Falcon devices carry the prevention-policy check instead.",remediation:"Enable Defender antivirus on the device and let its signatures update, then review the device page at security.microsoft.com."}},je={malicious:{Icon:V,accent:"bg-red-500",iconClass:"text-red-400",ring:"bg-red-500/10"},suspicious:{Icon:U,accent:"bg-amber-500",iconClass:"text-amber-400",ring:"bg-amber-500/10"},clean:{Icon:M,accent:"bg-emerald-500",iconClass:"text-emerald-400",ring:"bg-emerald-500/10"},critical:{Icon:V,accent:"bg-red-500",iconClass:"text-red-400",ring:"bg-red-500/10"},at_risk:{Icon:U,accent:"bg-amber-500",iconClass:"text-amber-400",ring:"bg-amber-500/10"},healthy:{Icon:M,accent:"bg-emerald-500",iconClass:"text-emerald-400",ring:"bg-emerald-500/10"}},_e={Icon:fe,accent:"bg-slate-600",iconClass:"text-slate-400",ring:"bg-slate-500/10"};function q({determination:s,totalChecks:n,numberFailedChecks:r,unavailableLabel:i="Not scored",explanation:u}){const m=ue(s),o=je[String(s||"").toLowerCase()]||_e,{Icon:p}=o,j=Number.isFinite(n),_=Number.isFinite(r),k=_?r>0?"text-red-400":"text-emerald-400":"text-slate-500";return e.jsxs("div",{className:"relative mb-8 overflow-hidden rounded-[14px] border border-slate-800/80 bg-slate-900/60",children:[e.jsx("div",{className:`absolute left-0 right-0 top-0 h-1 ${o.accent}`}),e.jsxs("div",{className:"grid grid-cols-1 gap-6 p-6 sm:grid-cols-3 sm:p-8",children:[e.jsxs("div",{className:"flex items-center gap-4",children:[e.jsx("div",{className:`rounded-xl p-3 ${o.ring}`,children:e.jsx(p,{className:`h-6 w-6 ${o.iconClass}`})}),e.jsxs("div",{children:[e.jsx("p",{className:"mb-1 text-sm text-slate-400",children:"Determination"}),m?e.jsx("span",{className:`inline-flex items-center rounded-full border px-2.5 py-1 text-sm font-semibold ${m.chipClass}`,children:m.label}):e.jsx("span",{className:"text-lg font-semibold text-slate-300",children:i})]})]}),e.jsxs("div",{className:"sm:border-l sm:border-slate-800/80 sm:pl-6",children:[e.jsx("p",{className:"mb-1 text-sm text-slate-400",children:"Failed Checks"}),e.jsx("p",{className:`text-3xl font-bold ${k}`,children:_?r:"—"})]}),e.jsxs("div",{className:"sm:border-l sm:border-slate-800/80 sm:pl-6",children:[e.jsx("p",{className:"mb-1 text-sm text-slate-400",children:"Total Checks"}),e.jsx("p",{className:"text-3xl font-bold text-white",children:j?n:"—"})]})]}),u&&e.jsx("p",{className:"border-t border-slate-800 px-6 py-3 text-xs leading-relaxed text-slate-400",children:u})]})}q.propTypes={determination:h.string,unavailableLabel:h.string,explanation:h.string,totalChecks:h.number,numberFailedChecks:h.number};function W({inventory:s}){const{offerings:n,count:r,observedAt:i,mode:u,truncated:m}=s;

1return e.jsxs("div",{className:"max-w-md space-y-2 text-xs text-slate-400",children:[e.jsx("p",{className:"font-medium text-slate-200",children:r===0?"No offerings reported":r===null?"Available offerings":`${r} available ${r===1?"offering":"offerings"}`}),e.jsxs("p",{children:["Checked ",i?e.jsx("time",{dateTime:i,children:new Date(i).toLocaleString()}):"at an unknown time",u==="cached"?" · Cached observation":u==="live"?" · Collected live":""]}),e.jsx("p",{children:"Source: macOS Software Update. Offerings can include alternative upgrade paths."}),m&&e.jsxs("p",{className:"text-amber-300",children:["Showing ",n.length,r!==null?` of ${r}`:""," offerings. Some inventory or details were omitted by report limits."]}),n.length>0&&e.jsxs("details",{children:[e.jsxs("summary",{className:"cursor-pointer text-cyan-300",children:["Show offering details (",n.length,")"]}),e.jsx("ul",{className:"mt-2 max-h-72 space-y-2 overflow-y-auto pr-1",children:n.map((o,p)=>e.jsxs("li",{className:"rounded-lg border border-slate-800 bg-slate-950/70 p-3",children:[e.jsx("p",{className:"font-medium text-slate-200",children:o.title||"Title not reported"}),e.jsxs("dl",{className:"mt-1 space-y-1",children:[e.jsxs("div",{children:[e.jsx("dt",{className:"inline",children:"Version: "}),e.jsx("dd",{className:"inline",children:o.version||"Not reported"})]}),e.jsxs("div",{children:[e.jsx("dt",{className:"inline",children:"Recommended by macOS: "}),e.jsx("dd",{className:"inline",children:["yes","no"].includes(o.recommended)?o.recommended:"Not reported"})]}),e.jsxs("div",{children:[e.jsx("dt",{className:"inline",children:"Required action: "}),e.jsx("dd",{className:"inline",children:o.action&&o.action!=="not_reported"?o.action:"Not reported"})]}),e.jsxs("div",{className:"break-all",children:[e.jsx("dt",{className:"inline",children:"Label: "}),e.jsx("dd",{className:"inline",children:o.label||"Not reported"})]})]})]},`${o.label||"offering"}-${p}`))})]})]})}W.propTypes={inventory:h.shape({offerings:h.arrayOf(h.object).isRequired,count:h.number,observedAt:h.string,mode:h.string.isRequired,truncated:h.bool.isRequired}).isRequired};function Se(s){if(s?.id!=="os_updates_pending"||s.status!=="fail"||!Array.isArray(s.failed_rows))return null;const n=s.failed_rows.filter(p=>p&&typeof p=="object"&&!Array.isArray(p)),r=n.find(p=>p.kind==="collection");if(!r)return null;const i=n.filter(p=>p.kind==="offering"),u=String(r.offering_count??"");let m=/^\d+$/.test(u)&&Number.isSafeInteger(Number(u))?Number(u):null;m!==null&&m<i.length&&(m=null);const o=r.observed_at;return{offerings:i,count:m,observedAt:typeof o=="string"&&Number.isFinite(Date.parse(o))?o:null,mode:["live","cached"].includes(r.collection_mode)?r.collection_mode:"unknown",truncated:s.truncated===!0||m!==null&&m>i.length}}const B="inline-flex w-fit items-center gap-2 rounded-md border border-slate-700/60 bg-slate-800/50 px-4 py-2 text-sm font-medium text-slate-300 transition-colors hover:border-slate-600 hover:bg-slate-800 hover:text-white";function Ne(s){if(s?.body&&typeof s.body=="string")try{return JSON.parse(s.body)}catch{return s}return s}const ke={darwin:"macOS",windows:"Windows",linux:"Linux"},N={critical:"border-red-400/20 bg-red-400/10 text-red-400",high:"border-orange-400/20 bg-orange-400/10 text-orange-400",medium:"border-amber-400/20 bg-amber-400/10 text-amber-400",low:"border-slate-400/20 bg-slate-400/10 text-slate-400",info:"border-slate-400/20 bg-slate-400/10 text-slate-400"},z={pass:{label:"Pass",Icon:me,chip:"border-emerald-400/20 bg-emerald-400/10 text-emerald-400"},fail:{label:"Fail",Icon:ce,chip:"border-red-400/20 bg-red-400/10 text-red-400"},error:{label:"Error",Icon:we,chip:"border-slate-400/20 bg-slate-400/10 text-slate-400"}},Ce={label:"Reported",Icon:ve,chip:"border-cyan-400/20 bg-cyan-400/10 text-cyan-400"};function G({rows:s}){const[n,r]=b.useState(!1);return e.jsxs("div",{className:"max-w-md",children:[e.jsxs("button",{onClick:()=>r(i=>!i),className:"inline-flex items-center gap-1.5 rounded-md border border-slate-700/60 bg-slate-800/50 px-2.5 py-1.5 text-xs font-medium text-slate-300 transition-colors hover:border-slate-600 hover:bg-slate-800 hover:text-white",children:[e.jsx(pe,{className:`h-3.5 w-3.5 transition-transform ${n?"rotate-90":""}`}),n?"Hide":"Show"," details (",s.length," ",s.length===1?"item":"items",")"]}),n&&e.jsx("ul",{className:"mt-2 max-h-72 space-y-2 overflow-y-auto pr-1",children:s.map((i,u)=>e.jsx("li",{className:"rounded-lg border border-slate-800 bg-slate-950/70 p-3",children:i&&t

1ypeof i=="object"?e.jsx("dl",{className:"space-y-1.5",children:Object.entries(i).map(([m,o])=>e.jsxs("div",{className:"flex flex-col gap-0.5 sm:flex-row sm:gap-3",children:[e.jsx("dt",{className:"shrink-0 text-xs font-medium text-slate-500 sm:w-28 sm:text-right",children:m}),e.jsx("dd",{className:"min-w-0 break-all font-mono text-xs text-slate-300",children:String(o)})]},m))}):e.jsx("span",{className:"break-all font-mono text-xs text-slate-300",children:String(i)})},u))})]})}G.propTypes={rows:h.array.isRequired};function L({check:s}){const n=Se(s);return n?e.jsx(W,{inventory:n}):e.jsx(G,{rows:s.failed_rows||[]})}L.propTypes={check:h.object.isRequired};function Re(s){if(!s)return null;const n=new Date(String(s).replace(" ","T"));return Number.isNaN(n.getTime())?String(s):n.toLocaleString()}function Ae(s){return s.map(n=>n.map(r=>`"${String(r??"").replace(/"/g,'""')}"`).join(",")).join(`
2`)}function Ue(){const{jobId:s}=re(),n=he(),{getValidToken:r}=oe(),[i,u]=b.useState(null),[m,o]=b.useState(!0),[p,j]=b.useState(null),{runs:_,runsLoading:k}=ae(),[H,K]=b.useState(null),[J,Q]=b.useState(!0),C=P(H,s),Y=P(_,s),v=C?.determination?C:Y||C;b.useEffect(()=>{let t=!1;return(async()=>{const c=r();if(!c){j("Authentication required"),o(!1);return}try{const l=await fetch("https://api.bluelanternsecurity.io/results",{method:"POST",headers:{Authorization:`${c}`,"Content-Type":"application/json"},body:JSON.stringify({jobId:s})}),d=await l.json().catch(()=>null);if(!l.ok)throw new Error(`HTTP error! status: ${l.status}`);const f=Ne(d),x=f?.result??f;if(!x||typeof x!="object"||!Array.isArray(x.checks))throw new Error("Report data unavailable");t||(u(x),o(!1))}catch(l){console.error("Error fetching device report:",l),t||(j(l.message||"Failed to load report"),o(!1))}})(),()=>{t=!0}},[s,r]),b.useEffect(()=>{let t=!1;const a=r();if(a)return fetch(`https://api.bluelanternsecurity.io/runs/${s}`,{method:"GET",headers:{Authorization:`${a}`,"Content-Type":"application/json"}}).then(c=>c.ok?c.json():null).then(c=>{t||!c||K(c)}).catch(()=>{}).finally(()=>{t||Q(!1)}),()=>{t=!0}},[s,r]);const X=()=>{if(!i)return;const t=[["Section","Field","Value","Description","Remediation"]];Object.entries(i.device||{}).forEach(([d,f])=>t.push(["Device",d,f,"",""])),Object.entries(i.scan||{}).forEach(([d,f])=>t.push(["Scan",d,f,"",""])),(i.checks||[]).forEach(d=>{const f=D[d.id]||{};t.push(["Check",d.title||(d.id?A(d.id):""),`${d.status}${d.severity?` (${d.severity})`:""}${d.error?` — ${d.error}`:""}`,f.description||"",f.remediation||""])});const a=new Blob([Ae(t)],{type:"text/csv"}),c=window.URL.createObjectURL(a),l=document.createElement("a");l.href=c,l.download=`device_report_${s}.csv`,document.body.appendChild(l),l.click(),document.body.removeChild(l),window.URL.revokeObjectURL(c)};if(m)return e.jsx("div",{className:"min-h-screen bg-slate-950 text-white flex items-center justify-center",children:e.jsxs("div",{className:"text-center",children:[e.jsx("div",{className:"w-16 h-16 mx-auto mb-4 border-4 border-cyan-500/30 border-t-cyan-500 rounded-full animate-spin"}),e.jsx("p",{className:"text-lg text-slate-300",children:"Loading device report..."})]})});if(p||!i)return e.jsx("div",{className:"min-h-screen bg-slate-950 text-white flex flex-col items-center justify-center p-8",children:e.jsxs("div",{className:"text-center max-w-2xl w-full",children:[e.jsx(le,{className:"w-16 h-16 text-yellow-400 mx-auto mb-4"}),e.jsx("h1",{className:"text-2xl font-bold mb-2",children:p||"Report Not Found"}),e.jsxs(F,{to:n.to,className:`${B} mb-8`,children:["← ",n.label]})]})});const g=i.device||{},w=i.scan||{},y=Array.isArray(i.checks)?i.checks:[],Z={critical:0,high:1,medium:2,low:3,info:4},E=[...y].sort((t,a)=>{const c=d=>Z[String(d.severity||"").toLowerCase()]??3;if(c(t)!==c(a))return c(t)-c(a);const l=d=>String(d.status||"").toLowerCase()==="fail"?0:1;return l(t)!==l(a)?l(t)-l(a):String(t.title||t.id||"").localeCompare(String(a.title||a.id||""))}),R=y.filter(t=>String(t.status).toLowerCase()==="fail"&&String(t.severity).toLowerCase()!=="info").length,ee=v?.determination??null,te=$(v?.total_checks,y.length),se=$(v?.number_failed_checks,R),T=Re(w.finished_at||w.started_at||v?.run_end||v?.run_start),O=ke[String(g.platform||"").toLowerCase()]||g.platform||"Unknown",S=y.filter(t=>String(t.status).toLowerCase()==="error").length,ne=[{label:"Hostname",value:g.hostname},{label:"Platform",value:O},{label:"Source",value:String(i.source||"").toLowerCase()==="falcon"?"CrowdStrike Falcon (EDR)":null},{label:"Device Owner",value:g.owner_email},{label:"Last Login User",value:g.owner_email?null:g.last_login_user?`${g.last_login_user} (unverified)`:null},{label:"OS Version",value:g.os_version},{label:"Agent Version",value:g.agent_version},{label:"osquery Version",value:g.osquery_version},{label:"Host Identifier",value:g.host_identifier,mono:!0},{label:"Policy Pack",value:w.pack_id?`${w.pack_id}${w.pack_version?` (${w.pack_version})`:""}`:null}].filter(t=>t.value);return e.jsx("div",{className:"min-h-screen bg-slate-950 text-white",children:e.jsxs("div",{className:"relative max-w-6xl mx-auto px-4 pb-12 pt-24 sm:px-6 sm:pb-16 sm:pt-28",children:[e.jsxs("div",{className:"mb-8",children:[e.jsxs(F,{to:n.to,className:`${B} mb-4`,children:["← ",n.label]}),e.jsxs("div",{className:"flex items-start justify-between flex-wrap gap-4",children:[e.jsxs("div",{children:[e.jsxs("h1",{className:"mb-2 flex items-center gap-3 text-3xl font-semibold tracking-tight text-white sm:text-4xl",children:[e.jsx("span",{className:"flex h-11 w-11 shrink-0 items-center justify-center rounded-lg bg-cyan-500/10 border border-cyan-400/20",children:e.jsx(ge,{className:"h-6 w-6 text-cyan-200"})}),"Device Posture Report"]}),e.jsx("p",{className:"text-sm text-slate-400",children:T?`Scanned on ${T}`:`Job ID: ${s}`})]}),e.jsxs("button",{onClick:X,className:"rounded-md border border-slate-700 bg-slate-800/60 px-4 py-2 text-sm font-medium text-slate-200 transition-colors hover:border-slate-600 hover:bg-slate-800 hover:text-white flex items-center gap-2",children:[e.jsx(xe,{className:"w-4 h-4"}),"Download CSV"]})]})]}),e.jsx(q,{unavailableLabel:J||k?"Loading verdict…":v&&Object.hasOwn(v,"determination")?"Not scored":"Verdict unavailable",explanation:"The verdict is the server’s overall assessment. Individual check counts are shown separately and may not determine the verdict.",determination:ee,totalChecks:te,numberFailedChecks:se}),e.jsxs("section",{className:"report-findings","aria-labelledby":"findings-heading",children:[e.jsxs("div",{className:"section-heading",children:[e.jsxs("div",{children:[e.jsx("p",{className:"eyebrow",children:"Recommended next steps"}),e.jsx("h2",{id:"findings-heading",children:"Findings to address"})]}),e.jsxs("span",{children:[R," flagged · ",S," incomplete"]})]}),E.filter(t=>String(t.status).toLowerCase()==="fail"&&String(t.severity).toLowerCase()!=="info"||String(t.status).toLowerCase()==="error").map(t=>{const a=D[t.id]||{};return e.jsxs("article",{className:"finding-card",children:[e.jsxs("div",{children:[e.jsx("span",{className:`inline-flex rounded-full border px-2.5 py-1 text-xs capitalize ${N[t.severity]||N.low}`,children:t.status==="error"?"Incomplete":t.severity||"Finding"}),e.jsx("h3",{children:t.title||A(t.id)})]}),a.description&&e.jsx("p",{children:a.description}),e.jsxs("p",{className:"finding-remediation",children:[e.jsx("strong",{children:t.status==="error"?"Next step: ":"How to fix: "}),t.status==="error"?"Review the collection error below and rerun the device agent after resolving it.":a.remediation||"Review the evidence and your device policy to resolve this finding."]}),t.error&&e.jsx("p",{className:"font-mono text-xs",children:t.error}),Array.isArray(t.failed_rows)&&t.failed_rows.length>0&&e.jsx(L,{check:t})]},t.id||t.title)}),R===0&&S===0&&e.jsx("p",{className:"text-slate-400",children:"No actionable failures in this report’s checks. Review the overall verdict above for the server’s assessment."})]}),e.jsxs("details",{className:"report-disclosure rounded-[14px] bg-slate-900/60 border border-slate-800/80 overflow-hidden relative mb-6",children:[e.jsxs("summary",{children:["Device details · ",g.hostname||O]}),e.jsxs("div",{className:"p-6",children:[e.jsxs("div",{className:"mb-6 flex items-start gap-4",children:[e.jsx("div",{className:"w-12 h-12 rounded-[10px] bg-cyan-500/15 ring-1 ring-cyan-400/40 flex items-center justify-center flex-shrink-0",children:e.jsx(de,{className:"h-6 w-6 text-cyan-300"})}),e.jsxs("div",{children:[e.jsx("h2",{className:"text-2xl font-semibold text-white",children:"Device"}),e.jsx("p",{className:"text-sm text-slate-400",children:"The endpoint this posture scan 

2was reported from."})]})]}),e.jsx("dl",{className:"grid grid-cols-1 gap-x-8 gap-y-4 sm:grid-cols-2 lg:grid-cols-3",children:ne.map(t=>e.jsxs("div",{className:"min-w-0",children:[e.jsx("dt",{className:"text-sm text-slate-400",children:t.label}),e.jsx("dd",{className:`mt-0.5 truncate text-sm font-medium text-white ${t.mono?"font-mono text-xs":""}`,title:String(t.value),children:t.value})]},t.label))})]})]}),e.jsxs("details",{className:"report-disclosure rounded-[14px] bg-slate-900/60 border border-slate-800/80 overflow-hidden relative mb-6",children:[e.jsxs("summary",{children:["All checks & inventory · ",y.length," checks"]}),e.jsxs("div",{className:"p-6",children:[e.jsxs("div",{className:"mb-6 flex items-start gap-4",children:[e.jsx("div",{className:"w-12 h-12 rounded-[10px] bg-cyan-500/15 ring-1 ring-cyan-400/40 flex items-center justify-center flex-shrink-0",children:e.jsx(be,{className:"h-6 w-6 text-cyan-300"})}),e.jsxs("div",{children:[e.jsx("h2",{className:"text-2xl font-semibold text-white",children:"Posture Checks"}),e.jsxs("p",{className:"text-sm text-slate-400",children:[y.length," checks evaluated on the device",S>0?` (${S} could not be evaluated)`:"","."]})]})]}),e.jsx("div",{className:"overflow-x-auto",children:e.jsxs("table",{className:"w-full text-left",children:[e.jsx("thead",{className:"border-b border-slate-800 text-xs font-semibold uppercase tracking-wider text-slate-400",children:e.jsxs("tr",{children:[e.jsx("th",{className:"px-3 py-3 font-medium",children:"Check"}),e.jsx("th",{className:"px-3 py-3 font-medium",children:"Severity"}),e.jsx("th",{className:"px-3 py-3 text-center font-medium",children:"Result"}),e.jsx("th",{className:"px-3 py-3 font-medium",children:"Details"})]})}),e.jsxs("tbody",{className:"divide-y divide-slate-800/50",children:[E.map(t=>{const a=String(t.status||"").toLowerCase(),c=String(t.severity||"").toLowerCase(),l=c==="info"&&a==="fail"?Ce:z[a]||z.error,d=Array.isArray(t.failed_rows)?t.failed_rows:[],f=D[t.id]||{},x=a==="fail"?f.remediation:null,I=t.title||(t.id?A(t.id):"");return e.jsxs("tr",{className:"align-top",children:[e.jsxs("td",{className:"px-3 py-3",children:[e.jsx("div",{className:"text-sm font-medium text-white",children:I||t.id}),t.id&&I!==t.id&&e.jsx("div",{className:"mt-0.5 font-mono text-xs text-slate-500",children:t.id}),f.description&&e.jsx("p",{className:"mt-1.5 max-w-sm text-xs leading-relaxed text-slate-500",children:f.description})]}),e.jsx("td",{className:"whitespace-nowrap px-3 py-3",children:e.jsx("span",{className:`inline-flex items-center rounded-full border px-2.5 py-1 text-xs font-medium capitalize ${N[c]||N.low}`,children:c||"unknown"})}),e.jsx("td",{className:"whitespace-nowrap px-3 py-3 text-center",children:e.jsxs("span",{className:`inline-flex items-center gap-1.5 rounded-full border px-2.5 py-1 text-xs font-medium ${l.chip}`,children:[e.jsx(l.Icon,{className:"h-3.5 w-3.5"}),l.label]})}),e.jsxs("td",{className:"px-3 py-3 text-sm text-slate-400",children:[a==="error"&&t.error?e.jsx("span",{className:"block max-w-md break-words font-mono text-xs text-slate-500",title:t.error,children:t.error}):a==="fail"&&d.length>0?e.jsx(L,{check:t}):a==="fail"&&Number(t.row_count)>0?`${t.row_count} matching row${Number(t.row_count)===1?"":"s"}`:x?null:e.jsx("span",{className:"text-slate-600",children:"—"}),x&&e.jsxs("p",{className:"mt-2 max-w-md text-xs leading-relaxed text-slate-300",children:[e.jsx("span",{className:"font-semibold text-amber-300",children:"How to fix: "}),x]})]})]},t.id||t.title)}),y.length===0&&e.jsx("tr",{children:e.jsx("td",{colSpan:"4",className:"p-8 text-center text-slate-500",children:"No checks were reported for this scan."})})]})]})})]})]})]})})}export{Ue as default};