From 368265dea423afab55be87a767527e5302702b82 Mon Sep 17 00:00:00 2001
From: Lorenzo Venerandi <lollo.venerandi@gmail.com>
Date: Sat, 28 Feb 2026 18:12:40 +0100
Subject: [PATCH] feat: update suspicious activity display to show last 10
 requests and improve database filtering

---
 src/database.py                           | 6 +++++-
 src/routes/dashboard.py                   | 2 +-
 src/templates/jinja2/dashboard/index.html | 6 +++---
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/src/database.py b/src/database.py
index ffd2592..2d56712 100644
--- a/src/database.py
+++ b/src/database.py
@@ -1767,7 +1767,11 @@ class DatabaseManager:
 
             # Filter out local/private IPs and server IP, then sort
             filtered = [
-                {"ip": row.ip, "count": row.count, "category": row.category or "unknown"}
+                {
+                    "ip": row.ip,
+                    "count": row.count,
+                    "category": row.category or "unknown",
+                }
                 for row in results
                 if is_valid_public_ip(row.ip, server_ip)
             ]
diff --git a/src/routes/dashboard.py b/src/routes/dashboard.py
index 0e93873..081336c 100644
--- a/src/routes/dashboard.py
+++ b/src/routes/dashboard.py
@@ -23,7 +23,7 @@ async def dashboard_page(request: Request):
 
     # Get initial data for server-rendered sections
     stats = db.get_dashboard_counts()
-    suspicious = db.get_recent_suspicious(limit=20)
+    suspicious = db.get_recent_suspicious(limit=10)
 
     # Get credential count for the stats card
     cred_result = db.get_credentials_paginated(page=1, page_size=1)
diff --git a/src/templates/jinja2/dashboard/index.html b/src/templates/jinja2/dashboard/index.html
index d4cb7d3..647a00c 100644
--- a/src/templates/jinja2/dashboard/index.html
+++ b/src/templates/jinja2/dashboard/index.html
@@ -46,6 +46,9 @@
         {# Map section #}
         {% include "dashboard/partials/map_section.html" %}
 
+        {# Suspicious Activity - server-rendered (last 10 requests) #}
+        {% include "dashboard/partials/suspicious_table.html" %}
+
         {# Top IPs + Top User-Agents side by side #}
         <div style="display: flex; gap: 20px; flex-wrap: wrap;">
             <div class="table-container" style="flex: 1; min-width: 300px;">
@@ -78,9 +81,6 @@
                 <div class="htmx-indicator">Loading...</div>
             </div>
         </div>
-
-        {# Suspicious Activity - server-rendered #}
-        {% include "dashboard/partials/suspicious_table.html" %}
     </div>
 
     {# ==================== ATTACKS TAB ==================== #}