#!/usr/bin/env python3
"""Malware Incident Communication Template Agent - Generates structured incident communications."""

import json
import logging
import argparse
from datetime import datetime, timedelta

logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")
logger = logging.getLogger(__name__)

SEVERITY_LEVELS = {
    "critical": {"response_time": "15 minutes", "escalation": "CISO + Legal + CEO", "update_freq": "1 hour"},
    "high": {"response_time": "1 hour", "escalation": "CISO + SOC Manager", "update_freq": "2 hours"},
    "medium": {"response_time": "4 hours", "escalation": "SOC Manager", "update_freq": "4 hours"},
    "low": {"response_time": "24 hours", "escalation": "SOC Analyst", "update_freq": "daily"},
}

MALWARE_CATEGORIES = {
    "ransomware": {"impact": "Data encryption, operational disruption", "containment": "Isolate affected hosts, disable network shares",
                    "recovery": "Restore from backups, rebuild affected systems"},
    "trojan": {"impact": "Unauthorized access, data exfiltration", "containment": "Block C2 IPs, isolate hosts",
               "recovery": "Full malware removal, credential reset"},
    "wiper": {"impact": "Data destruction, system damage", "containment": "Isolate immediately, preserve evidence",
              "recovery": "Rebuild from known-good images"},
    "infostealer": {"impact": "Credential theft, PII exposure", "containment": "Block exfiltration channels, isolate hosts",
                    "recovery": "Force password resets, monitor for abuse"},
    "worm": {"impact": "Lateral spread, network disruption", "containment": "Segment network, block propagation vectors",
             "recovery": "Patch vulnerability, clean all hosts"},
}


def generate_initial_notification(incident_id, severity, malware_type, affected_systems, detected_by):
    """Generate initial incident notification."""
    sev_info = SEVERITY_LEVELS.get(severity, SEVERITY_LEVELS["medium"])
    mal_info = MALWARE_CATEGORIES.get(malware_type, {"impact": "Under investigation", "containment": "Isolate affected systems"})
    notification = {
        "type": "initial_notification",
        "incident_id": incident_id,
        "timestamp": datetime.utcnow().isoformat(),
        "subject": f"[{severity.upper()}] Malware Incident {incident_id} - {malware_type.title()} Detected",
        "severity": severity,
        "escalation_to": sev_info["escalation"],
        "response_deadline": sev_info["response_time"],
        "body": {
            "summary": f"A {malware_type} infection has been detected on {len(affected_systems)} system(s).",
            "detection_source": detected_by,
            "affected_systems": affected_systems,
            "potential_impact": mal_info["impact"],
            "immediate_actions": mal_info["containment"],
            "next_update": sev_info["update_freq"],
        },
    }
    return notification


def generate_status_update(incident_id, severity, phase, containment_status, iocs_found, actions_taken):
    """Generate incident status update communication."""
    update = {
        "type": "status_update",
        "incident_id": incident_id,
        "timestamp": datetime.utcnow().isoformat(),
        "subject": f"[UPDATE] Incident {incident_id} - {phase.replace('_', ' ').title()}",
        "phase": phase,
        "body": {
            "current_status": containment_status,
            "actions_completed": actions_taken,
            "indicators_discovered": iocs_found,
            "next_steps": [],
        },
    }
    if phase == "containment":
        update["body"]["next_steps"] = ["Complete host isolation", "Collect forensic evidence", "Begin malware analysis"]
    elif phase == "eradication":
        update["body"]["next_steps"] = ["Remove all malware artifacts", "Patch exploited vulnerabilities", "Verify clean state"]
    elif phase == "recovery":
        update["body"]["next_steps"] = ["Restore services from backups", "Monitor for reinfection", "Validate system integrity"]
    return update


def generate_executive_summary(incident_id, severity, malware_type, affected_count, timeline_events, business_impact):
    """Generate executive-level incident summary."""
    summary = {
        "type": "executive_summary",
        "incident_id": incident_id,
        "timestamp": datetime.utcnow().isoformat(),
        "subject": f"Executive Briefing: Malware Incident {incident_id}",
        "body": {
            "overview": f"On {datetime.utcnow().strftime('%B %d, %Y')}, a {malware_type} incident affecting "
                        f"{affected_count} systems was detected and classified as {severity} severity.",
            "business_impact": business_impact,
            "timeline": timeline_events,
            "response_effectiveness": {
                "detection_to_containment": "Under assessment",
                "systems_recovered": 0,
                "data_loss": "Under investigation",
            },
            "recommendations": [
                "Conduct post-incident review within 5 business days",
                "Update incident response playbook based on lessons learned",
                "Review and enhance detection capabilities for similar threats",
                "Schedule tabletop exercise for similar scenarios",
            ],
        },
    }
    return summary


def generate_regulatory_notification(incident_id, data_types_affected, record_count, jurisdiction):
    """Generate regulatory breach notification template."""
    notification = {
        "type": "regulatory_notification",
        "incident_id": incident_id,
        "timestamp": datetime.utcnow().isoformat(),
        "subject": f"Data Breach Notification - Incident {incident_id}",
        "jurisdiction": jurisdiction,
        "body": {
            "nature_of_breach": "Malware-related unauthorized access to personal data",
            "data_categories": data_types_affected,
            "approximate_records": record_count,
            "date_of_awareness": datetime.utcnow().isoformat(),
            "notification_deadline": (datetime.utcnow() + timedelta(hours=72)).isoformat() if jurisdiction == "GDPR"
                                     else (datetime.utcnow() + timedelta(days=30)).isoformat(),
            "measures_taken": ["Contained the incident", "Engaged forensic investigators",
                               "Notified law enforcement", "Implementing additional safeguards"],
            "contact_dpo": "dpo@organization.com",
        },
    }
    return notification


def generate_full_template_set(incident_id, severity, malware_type, affected_systems, detected_by):
    """Generate complete set of communication templates."""
    templates = {
        "initial_notification": generate_initial_notification(incident_id, severity, malware_type, affected_systems, detected_by),
        "containment_update": generate_status_update(incident_id, severity, "containment", "In progress", [], ["Hosts isolated"]),
        "eradication_update": generate_status_update(incident_id, severity, "eradication", "Pending", [], []),
        "recovery_update": generate_status_update(incident_id, severity, "recovery", "Pending", [], []),
        "executive_summary": generate_executive_summary(incident_id, severity, malware_type, len(affected_systems), [], "Under assessment"),
    }
    return templates


def generate_report(templates):
    """Generate communication template report."""
    report = {
        "timestamp": datetime.utcnow().isoformat(),
        "template_count": len(templates),
        "template_types": list(templates.keys()),
        "templates": templates,
    }
    print(f"COMMUNICATION REPORT: {len(templates)} templates generated")
    return report


def main():
    parser = argparse.ArgumentParser(description="Malware Incident Communication Template Generator")
    parser.add_argument("--incident-id", required=True, help="Incident identifier")
    parser.add_argument("--severity", choices=["critical", "high", "medium", "low"], required=True)
    parser.add_argument("--malware-type", choices=list(MALWARE_CATEGORIES.keys()), required=True)
    parser.add_argument("--affected-systems", nargs="+", required=True)
    parser.add_argument("--detected-by", default="EDR Alert")
    parser.add_argument("--output", default="incident_comms_report.json")
    args = parser.parse_args()

    templates = generate_full_template_set(args.incident_id, args.severity, args.malware_type,
                                           args.affected_systems, args.detected_by)
    report = generate_report(templates)
    with open(args.output, "w") as f:
        json.dump(report, f, indent=2)
    logger.info("Report saved to %s", args.output)


if __name__ == "__main__":
    main()

"""
Malware Incident Communication Template Generator
Generates severity-appropriate communication templates for malware incidents.
"""

import json
from datetime import datetime, timezone
from pathlib import Path


class IncidentCommunicationGenerator:
    """Generates incident communication templates based on severity and type."""

    SEVERITY_LEVELS = {
        "P1": {"name": "Critical", "notify_minutes": 15, "update_hours": 2},
        "P2": {"name": "High", "notify_minutes": 60, "update_hours": 4},
        "P3": {"name": "Medium", "notify_minutes": 240, "update_hours": 8},
        "P4": {"name": "Low", "notify_minutes": 1440, "update_hours": 24},
    }

    STAKEHOLDER_MATRIX = {
        "P1": ["incident_commander", "ciso", "ceo", "legal", "board", "external_ir", "law_enforcement"],
        "P2": ["incident_commander", "ciso", "it_director", "legal"],
        "P3": ["security_manager", "it_director"],
        "P4": ["security_team_lead"],
    }

    def __init__(self, org_name="Organization", output_dir="communication_output"):
        self.org_name = org_name
        self.output_dir = Path(output_dir)
        self.output_dir.mkdir(parents=True, exist_ok=True)

    def generate_initial_notification(self, case_id, severity, malware_type,
                                       affected_systems, impact_description):
        """Generate initial incident notification."""
        now = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
        sev_info = self.SEVERITY_LEVELS.get(severity, self.SEVERITY_LEVELS["P2"])

        notification = f"""SUBJECT: [{severity} - {sev_info['name']}] Malware Incident - Initial Notification - {now}

CLASSIFICATION: CONFIDENTIAL - IR TEAM ONLY

INCIDENT ID: {case_id}
DETECTION TIME: {now}
NOTIFICATION TIME: {now}
SEVERITY: {severity} - {sev_info['name']}

SUMMARY:
A malware incident has been detected affecting {len(affected_systems)} system(s).
The malware has been identified as {malware_type}.

CURRENT IMPACT:
- Systems affected: {', '.join(affected_systems)}
- Business impact: {impact_description}
- Current spread status: Under investigation

IMMEDIATE ACTIONS TAKEN:
1. Affected endpoints have been isolated from the network
2. EDR containment policies have been activated
3. Security operations team has been mobilized
4. Forensic evidence preservation has been initiated

NEXT STEPS:
1. Complete scope assessment within the next 2 hours
2. Deploy IOC-based hunting across enterprise
3. Engage external IR support if needed

INCIDENT COMMANDER: [Assigned IC Name]
CONTACT: [Secure Communication Channel]

NEXT UPDATE: {sev_info['update_hours']} hours or sooner if situation changes

---
Do not forward this notification outside the IR team.
"""
        output_file = self.output_dir / f"{case_id}_initial_notification.txt"
        with open(output_file, "w") as f:
            f.write(notification)

        print(f"[+] Initial notification generated: {output_file}")
        return notification

    def generate_executive_briefing(self, case_id, severity, incident_summary,
                                     business_impact, status, decisions_needed):
        """Generate executive briefing document."""
        now = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")

        briefing = f"""SUBJECT: Executive Briefing - Malware Incident {case_id}

FOR: CISO / CEO / CIO
FROM: Incident Commander
DATE: {now}

SITUATION SUMMARY:
{incident_summary}

BUSINESS IMPACT:
{business_impact}

CURRENT STATUS: {status}

KEY DECISIONS NEEDED:
"""
        for i, decision in enumerate(decisions_needed, 1):
            briefing += f"{i}. {decision}\n"

        briefing += f"""
EXTERNAL COMMUNICATION STATUS:
- Regulatory notification: Under assessment by Legal
- Customer notification: Under assessment
- Law enforcement: Under assessment

NEXT UPDATE: As determined by severity level
"""
        output_file = self.output_dir / f"{case_id}_executive_briefing.txt"
        with open(output_file, "w") as f:
            f.write(briefing)

        print(f"[+] Executive briefing generated: {output_file}")
        return briefing

    def generate_technical_advisory(self, case_id, malware_name, description,
                                     iocs, affected_systems, required_actions):
        """Generate technical advisory for IT teams."""
        now = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")

        advisory = f"""SUBJECT: TECHNICAL ADVISORY - {malware_name} - Immediate Action Required

SEVERITY: CRITICAL
DATE: {now}
ADVISORY ID: TA-{case_id}

THREAT DESCRIPTION:
{description}

AFFECTED SYSTEMS:
"""
        for system in affected_systems:
            advisory += f"- {system}\n"

        advisory += "\nINDICATORS OF COMPROMISE (IOCs):\n"

        if "hashes" in iocs:
            advisory += "\nFile Hashes:\n"
            for h in iocs["hashes"]:
                advisory += f"  {h['type']}: {h['value']}\n"

        if "domains" in iocs:
            advisory += "\nC2 Domains:\n"
            for d in iocs["domains"]:
                advisory += f"  {d}\n"

        if "ips" in iocs:
            advisory += "\nC2 IP Addresses:\n"
            for ip in iocs["ips"]:
                advisory += f"  {ip}\n"

        if "filenames" in iocs:
            advisory += "\nFile Names:\n"
            for fn in iocs["filenames"]:
                advisory += f"  {fn}\n"

        advisory += "\nREQUIRED ACTIONS:\n"
        for i, action in enumerate(required_actions, 1):
            advisory += f"{i}. [{action.get('priority', 'MEDIUM')}] {action['description']}\n"

        output_file = self.output_dir / f"{case_id}_technical_advisory.txt"
        with open(output_file, "w") as f:
            f.write(advisory)

        print(f"[+] Technical advisory generated: {output_file}")
        return advisory

    def generate_regulatory_notification(self, case_id, regulation, data_types,
                                          affected_count, timeline_events):
        """Generate regulatory breach notification."""
        now = datetime.now(timezone.utc).strftime("%Y-%m-%d")

        notification = f"""[ORGANIZATION LETTERHEAD]

Date: {now}
RE: Data Security Incident Notification - {case_id}

Pursuant to {regulation}, {self.org_name} is providing notification
of a data security incident.

INCIDENT SUMMARY:
On {timeline_events.get('detected', now)}, {self.org_name} detected a malware incident
affecting systems containing {', '.join(data_types)}.

DATA POTENTIALLY AFFECTED:
- Types of data: {', '.join(data_types)}
- Number of individuals: {affected_count}

TIMELINE:
- Incident occurred (estimated): {timeline_events.get('occurred', 'Under investigation')}
- Incident detected: {timeline_events.get('detected', now)}
- Containment achieved: {timeline_events.get('contained', 'In progress')}
- This notification: {now}

MEASURES TAKEN:
1. Immediate containment of affected systems
2. Engagement of external forensic investigators
3. Enhanced monitoring and security controls
4. Comprehensive review of security posture

CONTACT INFORMATION:
[Data Protection Officer / Privacy Officer]
{self.org_name}
[Contact Details]
"""
        output_file = self.output_dir / f"{case_id}_regulatory_notification.txt"
        with open(output_file, "w") as f:
            f.write(notification)

        print(f"[+] Regulatory notification generated: {output_file}")
        return notification

    def generate_full_communication_pack(self, case_id, severity, malware_type,
                                          malware_name, affected_systems, impact,
                                          iocs=None):
        """Generate complete communication pack for an incident."""
        print(f"[*] Generating full communication pack for {case_id}")

        self.generate_initial_notification(
            case_id, severity, malware_type, affected_systems, impact
        )

        self.generate_executive_briefing(
            case_id, severity,
            f"A {malware_type} incident has been detected affecting {len(affected_systems)} systems.",
            impact, "CONTAINMENT IN PROGRESS",
            ["Approve engagement of external IR firm",
             "Approve customer notification if data exposure confirmed"]
        )

        self.generate_technical_advisory(
            case_id, malware_name or malware_type,
            f"{malware_type} detected on enterprise systems",
            iocs or {},
            affected_systems,
            [
                {"priority": "CRITICAL", "description": "Block all IOCs at perimeter"},
                {"priority": "HIGH", "description": "Scan all endpoints for indicators"},
                {"priority": "MEDIUM", "description": "Verify backup integrity"},
            ]
        )

        manifest = {
            "case_id": case_id,
            "severity": severity,
            "generated": datetime.now(timezone.utc).isoformat(),
            "documents": [
                f"{case_id}_initial_notification.txt",
                f"{case_id}_executive_briefing.txt",
                f"{case_id}_technical_advisory.txt",
            ],
            "stakeholders": self.STAKEHOLDER_MATRIX.get(severity, []),
        }

        manifest_file = self.output_dir / f"{case_id}_communication_manifest.json"
        with open(manifest_file, "w") as f:
            json.dump(manifest, f, indent=2)

        print(f"[+] Full communication pack generated in {self.output_dir}/")
        return manifest


def main():
    import argparse

    parser = argparse.ArgumentParser(description="Malware Incident Communication Generator")
    parser.add_argument("--case-id", default="IR-2025-001")
    parser.add_argument("--severity", choices=["P1", "P2", "P3", "P4"], default="P1")
    parser.add_argument("--malware-type", default="ransomware")
    parser.add_argument("--malware-name", default="Unknown")
    parser.add_argument("--affected", nargs="+", default=["SRV-01", "WKS-042"])
    parser.add_argument("--impact", default="Business operations partially disrupted")
    parser.add_argument("--org", default="Organization")
    parser.add_argument("-o", "--output", default="communication_output")

    args = parser.parse_args()

    generator = IncidentCommunicationGenerator(org_name=args.org, output_dir=args.output)
    generator.generate_full_communication_pack(
        args.case_id, args.severity, args.malware_type,
        args.malware_name, args.affected, args.impact
    )


if __name__ == "__main__":
    main()