From d889d327146af0932e61f1f0286c320e473c8102 Mon Sep 17 00:00:00 2001
From: CyberMind-FR <gandalf@Gk2.net>
Date: Tue, 16 Jun 2026 07:55:11 +0200
Subject: [PATCH] ui(threat-analyst): country flags in Top source countries
 (closes #613)

flagEmoji() maps ISO alpha-2 -> regional-indicator emoji; renderTop gains a
withFlag arg used for the countries list.
---
 .../secubox-threat-analyst/debian/changelog   |  7 +++++++
 .../www/threat-analyst/index.html             | 19 ++++++++++++++-----
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/packages/secubox-threat-analyst/debian/changelog b/packages/secubox-threat-analyst/debian/changelog
index 68b90095..91ad661b 100644
--- a/packages/secubox-threat-analyst/debian/changelog
+++ b/packages/secubox-threat-analyst/debian/changelog
@@ -1,3 +1,10 @@
+secubox-threat-analyst (1.4.6-1~bookworm1) bookworm; urgency=medium
+
+  * ui: add country flag emoji to the Top source countries list (#613) —
+    ISO 3166-1 alpha-2 → regional-indicator emoji before each code.
+
+ -- Gerald KERMA <devel@cybermind.fr>  Tue, 16 Jun 2026 09:30:00 +0200
+
 secubox-threat-analyst (1.4.5-1~bookworm1) bookworm; urgency=medium
 
   * ui: limit the Recent attacks table to 5 rows (#611), matching the Top-N
diff --git a/packages/secubox-threat-analyst/www/threat-analyst/index.html b/packages/secubox-threat-analyst/www/threat-analyst/index.html
index 25107cd5..08463b9d 100644
--- a/packages/secubox-threat-analyst/www/threat-analyst/index.html
+++ b/packages/secubox-threat-analyst/www/threat-analyst/index.html
@@ -421,12 +421,21 @@
             for (const v of items) { if (!v) continue; counts[v] = (counts[v] || 0) + 1; }
             return Object.entries(counts).sort((a, b) => b[1] - a[1]).slice(0, n);
         }
-        function renderTop(elId, pairs) {
+        // ISO 3166-1 alpha-2 → flag emoji (regional indicator symbols). #613
+        function flagEmoji(cc) {
+            if (!cc || !/^[A-Za-z]{2}$/.test(cc)) return '';
+            const A = 0x1F1E6;
+            return String.fromCodePoint(A + cc.toUpperCase().charCodeAt(0) - 65,
+                                        A + cc.toUpperCase().charCodeAt(1) - 65);
+        }
+        function renderTop(elId, pairs, withFlag = false) {
             const el = document.getElementById(elId);
             if (!pairs.length) { el.innerHTML = '<li class="empty">no data</li>'; return; }
-            el.innerHTML = pairs.map(([k, v]) =>
-                `<li><span class="k">${esc(k)}</span><span class="v">${v}</span></li>`
-            ).join('');
+            el.innerHTML = pairs.map(([k, v]) => {
+                const fl = withFlag ? flagEmoji(k) : '';
+                const label = fl ? `<span class="flag-emoji">${fl}</span> ${esc(k)}` : esc(k);
+                return `<li><span class="k">${label}</span><span class="v">${v}</span></li>`;
+            }).join('');
         }
 
         // Loaders
@@ -496,7 +505,7 @@
             document.getElementById('s-unique-ips').textContent = ipSet.size;
             document.getElementById('s-countries').textContent  = countrySet.size;
             renderTop('top-ips',       topN(ips, 5));
-            renderTop('top-countries', topN(countries, 5));
+            renderTop('top-countries', topN(countries, 5), true);
             renderTop('top-types',     topN(types, 5));
             renderTop('top-targets',   topN(targets, 5));
         }