import React, { useState } from 'react'; import { X, PlusCircle } from 'lucide-react'; import { InvestigationCase, ThreatCategory, ThreatLevel } from '../../types/forensics'; interface NewCaseModalProps { isOpen: boolean; onClose: () => void; onAddCase: (newCase: InvestigationCase) => void; } export const NewCaseModal: React.FC = ({ isOpen, onClose, onAddCase, }) => { const [title, setTitle] = useState(''); const [category, setCategory] = useState('COUNTER_TERRORISM'); const [threatLevel, setThreatLevel] = useState('CRITICAL'); const [alias, setAlias] = useState(''); const [ip, setIp] = useState(''); const [wallet, setWallet] = useState(''); const [summary, setSummary] = useState(''); if (!isOpen) return null; const handleSubmit = (e: React.FormEvent) => { e.preventDefault(); if (!title.trim() || !alias.trim()) return; const newId = `CASE-${new Date().getFullYear()}-OP-${Math.floor(1000 + Math.random() * 9000)}`; const newCase: InvestigationCase = { id: newId, title, category, threatLevel, status: 'UNDER_REVIEW', compositeTrustScore: threatLevel === 'CRITICAL' ? 12 : threatLevel === 'HIGH' ? 28 : 55, assignedAnalyst: 'Agent Sentinel-7', createdDate: new Date().toISOString().slice(0, 10), updatedDate: new Date().toISOString().slice(0, 10), entityTarget: { primaryAlias: alias, legalName: 'Subject under active warrant review', entityType: category === 'COUNTER_TERRORISM' ? 'CELL_NETWORK' : 'SHELL_CORP', associatedEmails: [`${alias.toLowerCase().replace(/[^a-z0-9]/g, '')}@proton.me`], associatedPhoneNumbers: ['+1 (555) 019-2834'], walletAddress: wallet || '0x71C...CustomIngest', }, executiveSummary: summary || `Newly ingested target profile ${alias} identified via automated network honeypot and financial cross-border monitoring.`, networkTelemetry: { claimedGeo: { ip: ip || '185.220.101.5', country: 'Germany', region: 'Hesse', city: 'Frankfurt', lat: 50.1109, lng: 8.6821, asn: 'AS200052', isp: 'HostEurope Proxy Overlay', asnType: 'COMMERCIAL_PROXY', }, bgpAnycast: { egressNode: 'fra-core-01.transit.net', speedOfLightViolation: true, propagationDeltaMs: 142.5, physicalOriginInference: 'Eastern Europe / Regional Node Triangulated', formulaExplanation: 'Measured latency of 8.2ms to Warsaw edge PoP violates claimed Frankfurt distance (750km), confirming direct physical location in Eastern Europe.', popLatencies: [ { pop: 'FRA-1', city: 'Frankfurt', country: 'Germany', lat: 50.1109, lng: 8.6821, measuredRttMs: 88.4, expectedPhysicalMinRttMs: 1.0, physicalDistanceKm: 10, anomalous: true }, { pop: 'WAW-1', city: 'Warsaw', country: 'Poland', lat: 52.2297, lng: 21.0122, measuredRttMs: 8.2, expectedPhysicalMinRttMs: 15.0, physicalDistanceKm: 750, anomalous: false }, ], }, tlsFingerprint: { ja3: '771,4865-4866-4867,0-23-65281-10-11,29-23-24,0', ja3s: 'e3568b73ad6d', ja4: 't13d1516h2_8daaf6152771_custom_ingest', detectedClientEngine: 'Automated Tor / Shadowsocks Hybrid Pipeline', cipherSuites: ['TLS_AES_128_GCM_SHA256', 'TLS_CHACHA20_POLY1305_SHA256'], supportedCurves: ['x25519', 'secp256r1'], extensions: ['server_name', 'supported_groups', 'key_share'], isKnownEvasionStack: true, anomalyReason: 'Discrepancy between cipher suite and browser user-agent header.', }, tcpStack: { initialTtl: 64, claimedOsTtl: 128, windowSize: 65535, mss: 1460, osMismatchDetected: true, osMismatchDetails: 'Client reports Windows 11 in HTTP headers, but TCP options structure matches Linux 6.x kernel.', }, clientProbes: { webrtcCandidateLeak: { leakDetected: true, localPrivateIp: '192.168.1.104', unmaskedPublicIp: '94.140.8.22', stunServerUsed: 'stun.l.google.com:19302', leakDetails: 'WebRTC STUN interface bypassed system proxy and exposed physical ISP host.', }, ambientRfTriangulation: { bssidMac: 'd4:6e:0e:aa:12:90', ssid: 'TP-Link_5G_Home', rssiDb: -58, cellTowerCgi: '260-02-14022-8819', triangulatedLocation: 'Warsaw Metropolitan Sector, Poland', accuracyMeters: 45, }, ntpClockSkew: { deviceClockIso: '2026-09-01T15:00:00Z', serverNtpTimestampIso: '2026-09-01T15:00:00Z', clientReportedTz: 'Europe/Berlin', skewDeltaSeconds: 1.2, verdict: 'Nominal clock synchronization with regional NTP pool.', }, linguisticTelemetry: { activeKeyboardLayout: 'QWERTZ (German/Central Europe)', typingCadenceMs: 95, acceptLanguage: 'de-DE,de;q=0.9,en;q=0.8', anomalyFlag: false, anomalyNote: 'Typing cadence and language headers align with Central European profile.', }, }, }, financialLedger: { totalVolumeUsd: 850000, detectedStructuring: true, structuringSummary: 'Repeated batches of $9,400 to $9,900 USD structured across 14 virtual IBANs.', sanctionsHits: [], hops: [ { id: 'HOP-ING-01', from: 'P2P Exchange Rail', to: 'Intermediate Transit Node', amountUsd: 9800, asset: 'USDT', timestamp: '2026-09-01 12:00:00', hopType: 'SMURFING_DEPOSIT', riskTag: 'BSA Under $10k Structuring', flaggedSanction: false }, { id: 'HOP-ING-02', from: 'Intermediate Transit Node', to: wallet || '0xMixerPool', amountUsd: 840200, asset: 'ETH', timestamp: '2026-09-01 13:30:00', hopType: 'CRYPTO_MIXER', riskTag: 'Anonymizing Pool Intercept', flaggedSanction: true }, ], }, statutoryMatrix: { statute18USC2331_International: true, statute18USC2331_Domestic: false, materialSupport18USC2339B: true, fbiOperational28CFR085: true, euDsaArticle34_35: true, euTcoReg2021_784: true, firstAmendmentBoundary: 'Material assistance in facilitating structured financing to designated endpoints operates outside First Amendment protected advocacy under Holder v. Humanitarian Law Project.', platformEditorialProtection: 'Protected under Section 230(c)(2)(A) and First Amendment editorial discretion per Moody v. NetChoice (2024).', gifctTier: 'TIER_2', recommendedAction: 'Execute emergency freeze on transit wallet and transmit FinCEN SAR filing.', }, evidenceFiles: [ { id: 'EVID-NEW-1', name: 'target_pcap_trace.pcap', sha256Hash: 'a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8', fileType: 'PCAP / Wireshark', fileSize: '14.2 MB', summary: 'Network capture confirming BGP Anycast latency anomaly.', gifctMatch: false }, ], timeline: [ { timestamp: '2026-09-01 15:00:00', event: 'Target ingested into Sentinel review engine.', actor: 'Agent Sentinel-7', severity: 'INFO' }, ], analystNotes: 'Initial intake complete. Ready for deep-dive synthesis and statutory review.', dispositionLog: [ { timestamp: '2026-09-01 15:00:00', action: 'INGESTION', officer: 'Agent Sentinel-7', referenceCode: `${newId}-INIT` }, ], }; onAddCase(newCase); onClose(); }; return (
{/* Header */}

INGEST NEW TARGET PROFILE / THREAT DOCKET

{/* Form */}
setTitle(e.target.value)} placeholder="e.g. Operation Shadow-Tunnel // Evasion Cell" className="w-full bg-slate-950 border border-slate-800 rounded p-2 text-slate-200 focus:outline-none focus:border-cyan-500" />
setAlias(e.target.value)} placeholder="e.g. @dark_node_09" className="w-full bg-slate-950 border border-slate-800 rounded p-2 text-slate-200 focus:outline-none focus:border-cyan-500" />
setIp(e.target.value)} placeholder="e.g. 185.220.101.5" className="w-full bg-slate-950 border border-slate-800 rounded p-2 text-slate-200 focus:outline-none focus:border-cyan-500" />
setWallet(e.target.value)} placeholder="e.g. 0x8a72b94... or bc1q..." className="w-full bg-slate-950 border border-slate-800 rounded p-2 text-slate-200 focus:outline-none focus:border-cyan-500" />