Initial commit: Bot Detector Dashboard for SOC Incident Response

🛡️ Dashboard complet pour l'analyse et la classification des menaces

Fonctionnalités principales:
- Visualisation des détections en temps réel (24h)
- Investigation multi-entités (IP, JA4, ASN, Host, User-Agent)
- Analyse de corrélation pour classification SOC
- Clustering automatique par subnet/JA4/UA
- Export des classifications pour ML

Composants:
- Backend: FastAPI (Python) + ClickHouse
- Frontend: React + TypeScript + TailwindCSS
- 6 routes API: metrics, detections, variability, attributes, analysis, entities
- 7 types d'entités investigables

Documentation ajoutée:
- NAVIGATION_GRAPH.md: Graph complet de navigation
- SOC_OPTIMIZATION_PROPOSAL.md: Proposition d'optimisation pour SOC
  • Réduction de 7 à 2 clics pour classification
  • Nouvelle vue /incidents clusterisée
  • Panel latéral d'investigation
  • Quick Search (Cmd+K)
  • Timeline interactive
  • Graph de corrélations

Sécurité:
- .gitignore configuré (exclut .env, secrets, node_modules)
- Credentials dans .env (à ne pas committer)

⚠️ Audit sécurité réalisé - Voir recommandations dans SOC_OPTIMIZATION_PROPOSAL.md

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

frontend/src/api/client.ts

@@ -0,0 +1,151 @@
+import axios from 'axios';
+
+const API_BASE_URL = '/api';
+
+export const api = axios.create({
+  baseURL: API_BASE_URL,
+  headers: {
+    'Content-Type': 'application/json',
+  },
+});
+
+// Types
+export interface MetricsSummary {
+  total_detections: number;
+  critical_count: number;
+  high_count: number;
+  medium_count: number;
+  low_count: number;
+  known_bots_count: number;
+  anomalies_count: number;
+  unique_ips: number;
+}
+
+export interface TimeSeriesPoint {
+  hour: string;
+  total: number;
+  critical: number;
+  high: number;
+  medium: number;
+  low: number;
+}
+
+export interface MetricsResponse {
+  summary: MetricsSummary;
+  timeseries: TimeSeriesPoint[];
+  threat_distribution: Record<string, number>;
+}
+
+export interface Detection {
+  detected_at: string;
+  src_ip: string;
+  ja4: string;
+  host: string;
+  bot_name: string;
+  anomaly_score: number;
+  threat_level: string;
+  model_name: string;
+  recurrence: number;
+  asn_number: string;
+  asn_org: string;
+  asn_detail: string;
+  asn_domain: string;
+  country_code: string;
+  asn_label: string;
+  hits: number;
+  hit_velocity: number;
+  fuzzing_index: number;
+  post_ratio: number;
+  reason: string;
+  client_headers: string;
+}
+
+export interface DetectionsListResponse {
+  items: Detection[];
+  total: number;
+  page: number;
+  page_size: number;
+  total_pages: number;
+}
+
+export interface AttributeValue {
+  value: string;
+  count: number;
+  percentage: number;
+  first_seen?: string;
+  last_seen?: string;
+  threat_levels?: Record<string, number>;
+  unique_ips?: number;
+  primary_threat?: string;
+}
+
+export interface VariabilityAttributes {
+  user_agents: AttributeValue[];
+  ja4: AttributeValue[];
+  countries: AttributeValue[];
+  asns: AttributeValue[];
+  hosts: AttributeValue[];
+  threat_levels: AttributeValue[];
+  model_names: AttributeValue[];
+}
+
+export interface Insight {
+  type: 'warning' | 'info' | 'success';
+  message: string;
+}
+
+export interface VariabilityResponse {
+  type: string;
+  value: string;
+  total_detections: number;
+  unique_ips: number;
+  date_range: {
+    first_seen: string;
+    last_seen: string;
+  };
+  attributes: VariabilityAttributes;
+  insights: Insight[];
+}
+
+export interface AttributeListItem {
+  value: string;
+  count: number;
+}
+
+export interface AttributeListResponse {
+  type: string;
+  items: AttributeListItem[];
+  total: number;
+}
+
+// API Functions
+export const metricsApi = {
+  getMetrics: () => api.get<MetricsResponse>('/metrics'),
+  getThreatDistribution: () => api.get('/metrics/threats'),
+};
+
+export const detectionsApi = {
+  getDetections: (params?: {
+    page?: number;
+    page_size?: number;
+    threat_level?: string;
+    model_name?: string;
+    country_code?: string;
+    asn_number?: string;
+    search?: string;
+    sort_by?: string;
+    sort_order?: string;
+  }) => api.get<DetectionsListResponse>('/detections', { params }),
+  
+  getDetails: (id: string) => api.get(`/detections/${encodeURIComponent(id)}`),
+};
+
+export const variabilityApi = {
+  getVariability: (type: string, value: string) => 
+    api.get<VariabilityResponse>(`/variability/${type}/${encodeURIComponent(value)}`),
+};
+
+export const attributesApi = {
+  getAttributes: (type: string, limit?: number) =>
+    api.get<AttributeListResponse>(`/attributes/${type}`, { params: { limit } }),
+};