Show summarized security events above raw export

infra/debug-dashboard/app.py

@@ -171,22 +171,32 @@ def device(machine_name):
         abort(404)
 
     payload = report[12]
-    ninja = payload.get("NinjaOne") or payload.get("ninjaOne") or {}
-    runtime = payload.get("Runtime") or payload.get("runtime") or {}
-    raw_export = {
-        "organization_name": ninja.get("OrganizationName") or ninja.get("organizationName") or "Nicht zugeordnet",
-        "organization_id": ninja.get("OrganizationId") or ninja.get("organizationId") or "-",
-        "generated_at": payload.get("GeneratedAtUtc") or payload.get("generatedAtUtc") or report[4],
-        "client_version": payload.get("ClientVersion") or payload.get("clientVersion") or report[3] or "-",
-        "upload_status": runtime.get("UploadStatus") or runtime.get("uploadStatus") or "unbekannt",
-        "error_count": len(payload.get("Errors") or payload.get("errors") or []),
-    }
+    event_groups = {}
+    for entry in payload.get("Events") or payload.get("events") or []:
+        event_type = entry.get("Target") or entry.get("target") or "Sicherheitsereignis"
+        account = entry.get("Username") or entry.get("username") or "-"
+        source_ip = entry.get("SourceIp") or entry.get("sourceIp") or "-"
+        key = (event_type, account, source_ip)
+        group = event_groups.setdefault(
+            key,
+            {"type": event_type, "account": account, "source_ip": source_ip, "count": 0, "latest": "-"},
+        )
+        group["count"] += 1
+        timestamp = entry.get("Timestamp") or entry.get("timestamp") or "-"
+        if timestamp > group["latest"]:
+            group["latest"] = timestamp
+
+    security_events = sorted(
+        event_groups.values(),
+        key=lambda entry: (entry["latest"], entry["count"]),
+        reverse=True,
+    )[:25]
     return render_template(
         "device.html",
         report=report,
         event=event_metadata(payload),
         payload=payload,
-        raw_export=raw_export,
+        security_events=security_events,
         payload_pretty=json.dumps(payload, indent=2, ensure_ascii=False),
     )