Function fetchPwnLogs

web/scripts/ragnar_modern.js:6598–6658

(options = {})

        }
        const [cls, label] = _IPINTEL_CLASS_STYLE[d.classification] || _IPINTEL_CLASS_STYLE.unknown;
        const row = (k, v) => v ? `<div class="flex gap-2"><span class="text-gray-500 w-28 shrink-0">${k}</span><span class="text-gray-200 break-all">${escapeHtml(String(v))}</span></div>` : '';
        const country = d.country ? d.country + (d.country_routing ? ' (routing: ' + escapeHtml(d.country_routing) + ')' : '') : '';
        out.innerHTML = `
            <div class="rounded-lg border ${cls} px-3 py-2 mb-3">
                <span class="text-sm font-semibold">${escapeHtml(d.ip)}</span>
                <span class="text-xs ml-2">${escapeHtml(label)}</span>
                <span class="text-xs opacity-70 ml-2">${d.confidence != null ? d.confidence + '% ownership resolved' : ''}${d.cached ? ' · cached' : ''}</span>
            </div>
            <div class="space-y-1 text-xs">
                ${row('Network', (d.prefix || '') + (d.network_name ? '  ' + d.network_name : ''))}
                ${row('Allocated', d.allocated)}
                ${row('ASN', d.asn ? 'AS' + d.asn + (d.as_org ? '  ' + d.as_org : '') : '')}
                ${row('Country', country)}
                ${row('Registry', d.registry)}
                ${row('Reverse DNS', d.ptr)}
                ${row('Abuse contact', d.abuse_email || 'not published')}
                ${row('Org address', d.org_address)}
                ${row('Resolved from', d.resolved_from)}
            </div>
            ${d.country_note ? `<p class="text-xs text-amber-300/80 mt-2">${escapeHtml(d.country_note)}</p>` : ''}
            ${d.attribution_note ? `<p class="text-xs text-amber-300/90 mt-2">${escapeHtml(d.attribution_note)}</p>` : ''}
            <p class="text-xs text-gray-500 mt-2">${escapeHtml(d.location_note || '')}</p>`;
    } catch (e) {
        out.innerHTML = '<p class="text-sm text-red-400">Failed: ' + escapeHtml(e.message) + '</p>';
    } finally {
        _ndBusy(btn, false);
    }
}

// ---- Watchtower: unified pane for the standalone watchers ------------------
const _WT_SEV_STYLE = {
    critical: ['bg-red-950/60 border-red-800 text-red-300', '🛑'],
    high:     ['bg-orange-950/50 border-orange-800 text-orange-300', '⚠'],
    medium:   ['bg-amber-950/50 border-amber-800 text-amber-300', '⚠'],
    low:      ['bg-slate-800 border-slate-700 text-slate-300', 'ℹ'],
    info:     ['bg-slate-800 border-slate-700 text-slate-400', 'ℹ'],
};
function _wtSevChip(sev, n) {
    const [cls, icon] = _WT_SEV_STYLE[sev] || _WT_SEV_STYLE.info;
    return `<span class="px-2.5 py-1 rounded border ${cls}">${icon} ${escapeHtml(sev)}: ${n}</span>`;
}
// Correlated attack-chain incidents — the fused view. Rendered above the raw
// alert list because an incident is the "so what" behind a cluster of alerts.
function renderIncidents(incidents, elId, max) {
    const el = document.getElementById(elId);
    if (!el) return;
    const list = (incidents || []).slice(0, max || 4);
    if (!list.length) { el.innerHTML = ''; return; }
    el.innerHTML = list.map(inc => {
        const [cls] = _WT_SEV_STYLE[inc.severity] || _WT_SEV_STYLE.info;
        const ents = Object.entries(inc.entities || {})
            .map(([k, v]) => escapeHtml(v.slice(0, 3).join(', '))).filter(Boolean).join(' · ');
        const conf = inc.confidence != null ? inc.confidence + '%' : '';
        return `<div class="rounded-lg border ${cls} px-3 py-2">
            <div class="flex items-start justify-between gap-3">
                <div class="min-w-0">
                    <span class="text-[10px] uppercase tracking-wide opacity-70">Incident</span>
                    <span class="text-sm font-semibold ml-1">${escapeHtml(inc.label || 'Correlated activity')}</span>