AlertWindowRealtime (Core UI: Real-time Ransomware Alert)

1. Overview

AlertWindowRealtime is a core GTK4 (gtkmm) modal dialog window used to notify the user when BastionGuard detects a ransomware-related event in real time. It presents the detected family name, the affected file path, an icon indicating severity, and a set of response actions.

The dialog is designed for fast, user-driven incident response and integrates directly with the quarantine subsystem. It also supports batch workflows by optionally showing how many additional detections are pending.

2. Primary Responsibilities

  • Render a consistent, theme-aligned alert dialog using the same CSS as the main UI
  • Show ransomware detection context: family and file path
  • Provide immediate response actions:
    • Quarantine – isolate the file via Quarantine::move()
    • Ignore – dismiss only the current alert
    • Ignore All – dismiss and notify the caller to skip remaining queued detections
  • Optionally display a “pending count” indicator for additional detections waiting in the queue

3. Construction and Inputs

Constructor signature:

AlertWindowRealtime::AlertWindowRealtime(
    const std::string& file,
    const std::string& family,
    size_t pending)

Parameters

  • file – full path of the detected file
  • family – malware/ransomware family identifier or status token
  • pending – number of additional detections awaiting user decision

The constructor stores file into filePath and builds the full UI structure immediately.

4. Window Configuration and Theming

4.1 Window Policy

  • Title is intentionally empty (set_title("")) to rely on custom headerbar branding
  • Default size: 620 × 240
  • Non-resizable
  • Modal: blocks interaction with the parent context while awaiting user action

4.2 CSS Class Hooks

The dialog attaches theme-critical CSS classes to the window style context:

  • app-dialog
  • main-window
  • app-window

These class hooks ensure the alert inherits the same visual language as the main BastionGuard UI.

4.3 CSS Loading Strategy

To ensure consistent styling even when created independently of the main window, the dialog loads the stylesheet directly from the application resources:

resource("BastionGuard.css")

and installs it on the default display at GTK_STYLE_PROVIDER_PRIORITY_APPLICATION. Failures are non-fatal; errors are logged to stderr.

5. Header Bar and Window Controls

The dialog uses a custom GTK HeaderBar consistent with the core UI:

  • Default title buttons disabled
  • Decoration layout cleared
  • CSS class: custom-headerbar

A custom close button is created using icon-close.png from resources. Clicking it calls hide(), closing the dialog without performing any remediation action.

Because GTK4 expects a widget wrapper in some headerbar compositions, the headerbar is placed into a vertical box wrapper and assigned through set_titlebar().

6. Content Layout

6.1 Core Widgets

The dialog content is assembled inside a vertical box (vbox) with consistent margins and spacing:

  • Title label – localized “real-time ransomware detected” message, styled with title CSS class
  • Icon – a centered Gtk::Picture rendered from a status image
  • Message label – formatted content including family and file path
  • Pending label (optional) – displayed when pending > 0
  • Action buttons – quarantine / ignore / ignore all

6.2 Message Formatting

The main message uses Glib::ustring::compose for safe localization-aware formatting:

  • Family: %1
  • File: %2

Text alignment is centered and wrapping is enabled to support long file paths.

6.3 Severity Icon Selection

The icon path is selected based on the family string:

  • If family is OK, Clean, or None → use true.png
  • Otherwise → use false.png

Icons are loaded from:

/usr/share/BastionGuard/data/icons/

When present, the image is scaled to 68×68 and applied as a texture to the Gtk::Picture. Loading failures are logged but do not stop the dialog.

6.4 Pending Queue Indicator

If pending > 0, the dialog displays a secondary label:

  • Localized text “%1 others pending…”
  • Centered alignment

This supports workflows where multiple detections are raised and handled sequentially.

6.5 Action Buttons and Styling

The action buttons are styled via CSS classes to communicate intent:

  • quarantineButton → btn-danger
  • ignoreButton → btn-success
  • ignoreAllButton → btn-warning

Buttons are arranged in a centered horizontal box with spacing to reduce misclick risk.

7. Signals and Interaction Flow

  • Quarantine:
    • Invokes move_to_quarantine()
    • Hides the dialog
  • Ignore:
    • Simply hides the dialog
  • Ignore All:
    • Emits signal_ignore_all to notify upstream logic to dismiss remaining pending alerts
    • Hides the dialog

The dialog uses hide() rather than destroying the window immediately, which can simplify lifecycle management for callers that reuse the instance or manage it as a transient window.

8. Quarantine Integration

8.1 move_to_quarantine()

void AlertWindowRealtime::move_to_quarantine()

This method delegates remediation to the quarantine subsystem:

Quarantine::move(filePath)

On success or failure, it logs a localized message to stdout/stderr respectively. The user-facing UI decision (quarantine vs ignore) is therefore recorded in logs for operational traceability.

9. Security and Operational Considerations

  • Modal enforcement: forcing a user decision can be appropriate for high-severity events, but it can also block workflows if detections are frequent; the “Ignore All” pathway mitigates alert storms.
  • Visual risk communication: explicit button styling reduces the chance of user error under stress.
  • File-path exposure: the dialog displays full file paths; this is operationally useful but should be considered when screenshots/logs are shared.
  • Resource and path assumptions: icon assets are loaded from a fixed system directory; packaging must ensure these files exist to avoid degraded UI.
  • Quarantine side effects: quarantine success depends on filesystem permissions and the implementation details of Quarantine::move().

In summary, AlertWindowRealtime is a core incident-response dialog that provides immediate user control over real-time ransomware detections, integrates with quarantine operations, and remains visually consistent with the BastionGuard theme through explicit CSS loading and style class hooks.

Published on:
Last updated on: