#!/usr/bin/env python3
"""Threat intelligence enrichment pipeline for Splunk.

Manages threat intel lookups, KV store collections, and modular inputs
for enriching Splunk events with IOC context from MISP, OTX, and CSV feeds.
"""

import json
import csv
import datetime
import io

try:
    import requests
    HAS_REQUESTS = True
except ImportError:
    HAS_REQUESTS = False


SPLUNK_TI_COLLECTIONS = {
    "ip_intel": {
        "fields": ["ip", "threat_key", "description", "source", "weight", "time"],
        "lookup_name": "ip_intel_lookup",
    },
    "domain_intel": {
        "fields": ["domain", "threat_key", "description", "source", "weight", "time"],
        "lookup_name": "domain_intel_lookup",
    },
    "file_intel": {
        "fields": ["file_hash", "file_name", "threat_key", "description", "source", "weight", "time"],
        "lookup_name": "file_intel_lookup",
    },
    "email_intel": {
        "fields": ["src_user", "threat_key", "description", "source", "weight", "time"],
        "lookup_name": "email_intel_lookup",
    },
}


def fetch_otx_pulse_iocs(pulse_id):
    """Fetch IOCs from AlienVault OTX pulse."""
    if not HAS_REQUESTS:
        return {"error": "requests not installed"}
    url = "https://otx.alienvault.com/api/v1/pulses/{}/indicators".format(pulse_id)
    try:
        resp = requests.get(url, timeout=15)
        if resp.status_code == 200:
            data = resp.json()
            iocs = []
            for ind in data.get("results", []):
                iocs.append({
                    "type": ind.get("type", ""),
                    "indicator": ind.get("indicator", ""),
                    "title": ind.get("title", ""),
                    "created": ind.get("created", ""),
                })
            return {"pulse_id": pulse_id, "count": len(iocs), "indicators": iocs}
        return {"error": "HTTP {}".format(resp.status_code)}
    except Exception as e:
        return {"error": str(e)}


def convert_iocs_to_splunk_lookup(iocs, collection_type="ip_intel"):
    """Convert IOC list to Splunk KV store format."""
    collection = SPLUNK_TI_COLLECTIONS.get(collection_type, SPLUNK_TI_COLLECTIONS["ip_intel"])
    rows = []
    now = datetime.datetime.utcnow().isoformat() + "Z"
    for ioc in iocs:
        if collection_type == "ip_intel" and ioc.get("type") in ("IPv4", "IPv6"):
            rows.append({
                "ip": ioc["indicator"],
                "threat_key": ioc.get("title", "malicious_ip"),
                "description": "OTX: " + ioc.get("title", ""),
                "source": "otx",
                "weight": "3",
                "time": now,
            })
        elif collection_type == "domain_intel" and ioc.get("type") in ("domain", "hostname"):
            rows.append({
                "domain": ioc["indicator"],
                "threat_key": ioc.get("title", "malicious_domain"),
                "description": "OTX: " + ioc.get("title", ""),
                "source": "otx",
                "weight": "3",
                "time": now,
            })
        elif collection_type == "file_intel" and ioc.get("type") in ("FileHash-SHA256", "FileHash-MD5"):
            rows.append({
                "file_hash": ioc["indicator"],
                "file_name": "",
                "threat_key": ioc.get("title", "malicious_file"),
                "description": "OTX: " + ioc.get("title", ""),
                "source": "otx",
                "weight": "3",
                "time": now,
            })
    return {"collection": collection_type, "lookup_name": collection["lookup_name"], "row_count": len(rows), "rows": rows}


def generate_splunk_lookup_csv(rows, output_path=None):
    """Generate CSV file for Splunk lookup table."""
    if not rows:
        return ""
    output = io.StringIO()
    writer = csv.DictWriter(output, fieldnames=rows[0].keys())
    writer.writeheader()
    writer.writerows(rows)
    csv_content = output.getvalue()
    if output_path:
        with open(output_path, "w", encoding="utf-8") as f:
            f.write(csv_content)
    return csv_content


def build_spl_correlation_search(collection_type="ip_intel"):
    """Build SPL query for threat intelligence correlation."""
    queries = {
        "ip_intel": (
            '| tstats summariesonly=t count from datamodel=Network_Traffic '
            'by All_Traffic.dest_ip '
            '| rename All_Traffic.dest_ip as ip '
            '| lookup ip_intel_lookup ip OUTPUT threat_key description source '
            '| where isnotnull(threat_key) '
            '| table ip threat_key description source count'
        ),
        "domain_intel": (
            '| tstats summariesonly=t count from datamodel=Network_Resolution '
            'by DNS.query '
            '| rename DNS.query as domain '
            '| lookup domain_intel_lookup domain OUTPUT threat_key description source '
            '| where isnotnull(threat_key) '
            '| table domain threat_key description source count'
        ),
        "file_intel": (
            'index=endpoint sourcetype=sysmon EventCode=1 '
            '| lookup file_intel_lookup file_hash as Hashes OUTPUT threat_key description '
            '| where isnotnull(threat_key) '
            '| table _time Computer Image Hashes threat_key description'
        ),
    }
    return queries.get(collection_type, "| makeresults | eval error=\"Unknown collection\"")


if __name__ == "__main__":
    print("=" * 60)
    print("Threat Intelligence Enrichment in Splunk")
    print("KV store collections, lookup tables, SPL correlation")
    print("=" * 60)
    print("  requests available: {}".format(HAS_REQUESTS))

    print("\n--- Splunk TI Collections ---")
    for name, info in SPLUNK_TI_COLLECTIONS.items():
        print("  {}: lookup={}, fields={}".format(name, info["lookup_name"], len(info["fields"])))

    print("\n--- SPL Correlation Queries ---")
    for ctype in ["ip_intel", "domain_intel", "file_intel"]:
        spl = build_spl_correlation_search(ctype)
        print("  [{}] {}...".format(ctype, spl[:80]))

    demo_iocs = [
        {"type": "IPv4", "indicator": "198.51.100.42", "title": "C2 Server"},
        {"type": "domain", "indicator": "evil.example.com", "title": "Phishing Domain"},
        {"type": "FileHash-SHA256", "indicator": "a" * 64, "title": "Malware Sample"},
    ]
    for ctype in ["ip_intel", "domain_intel", "file_intel"]:
        result = convert_iocs_to_splunk_lookup(demo_iocs, ctype)
        if result["row_count"] > 0:
            print("\n  Converted {} IOCs to {} format".format(result["row_count"], ctype))

    print("\n" + json.dumps({"collections_configured": len(SPLUNK_TI_COLLECTIONS)}, indent=2))

#!/usr/bin/env python3
"""
Splunk Threat Intelligence Enrichment Pipeline

Manages threat intelligence feed ingestion, normalization,
and enrichment workflows for Splunk Enterprise Security.
"""

import json
import hashlib
from datetime import datetime, timedelta
from typing import Optional


class ThreatIndicator:
    """Represents a single threat intelligence indicator."""

    def __init__(self, value: str, indicator_type: str, source: str,
                 threat_type: str, confidence: int, description: str = "",
                 severity: str = "medium", first_seen: Optional[str] = None,
                 last_seen: Optional[str] = None, tags: Optional[list] = None):
        self.value = value
        self.indicator_type = indicator_type
        self.source = source
        self.threat_type = threat_type
        self.confidence = min(100, max(0, confidence))
        self.description = description
        self.severity = severity
        self.first_seen = first_seen or datetime.utcnow().isoformat()
        self.last_seen = last_seen or datetime.utcnow().isoformat()
        self.tags = tags or []
        self.indicator_id = self._generate_id()

    def _generate_id(self) -> str:
        hash_input = f"{self.indicator_type}:{self.value}:{self.source}"
        return hashlib.sha256(hash_input.encode()).hexdigest()[:16]

    def is_expired(self, max_age_days: int = 90) -> bool:
        last = datetime.fromisoformat(self.last_seen.replace("Z", "+00:00").replace("+00:00", ""))
        return (datetime.utcnow() - last).days > max_age_days

    def to_kv_store_record(self) -> dict:
        type_field_map = {
            "ip": "ip",
            "domain": "domain",
            "file_hash": "file_hash",
            "url": "url",
            "email": "email",
        }
        key_field = type_field_map.get(self.indicator_type, "value")
        return {
            "_key": self.indicator_id,
            key_field: self.value,
            "threat_type": self.threat_type,
            "confidence": self.confidence,
            "source": self.source,
            "description": self.description,
            "severity": self.severity,
            "first_seen": self.first_seen,
            "last_seen": self.last_seen,
            "tags": ",".join(self.tags),
        }


class ThreatFeed:
    """Represents a threat intelligence feed source."""

    def __init__(self, name: str, feed_type: str, url: str,
                 polling_interval: int = 3600, api_key: str = ""):
        self.name = name
        self.feed_type = feed_type
        self.url = url
        self.polling_interval = polling_interval
        self.api_key = api_key
        self.indicators = []
        self.last_poll = None
        self.stats = {"total_ingested": 0, "duplicates_skipped": 0, "expired_removed": 0}

    def add_indicator(self, indicator: ThreatIndicator):
        self.indicators.append(indicator)
        self.stats["total_ingested"] += 1

    def get_active_indicators(self, max_age_days: int = 90) -> list:
        active = [i for i in self.indicators if not i.is_expired(max_age_days)]
        self.stats["expired_removed"] = len(self.indicators) - len(active)
        return active

    def generate_splunk_input_conf(self) -> str:
        return f"""[threatlist://{self.name}]
description = {self.name} threat feed
type = {self.feed_type}
url = {self.url}
polling_interval = {self.polling_interval}
disabled = false
"""


class EnrichmentPipeline:
    """Manages the complete TI enrichment pipeline for Splunk."""

    def __init__(self):
        self.feeds = []
        self.kv_store = {"ip_intel": [], "domain_intel": [], "file_intel": [], "url_intel": []}
        self.correlation_hits = []

    def add_feed(self, feed: ThreatFeed):
        self.feeds.append(feed)

    def ingest_all_feeds(self):
        for feed in self.feeds:
            active = feed.get_active_indicators()
            for indicator in active:
                collection = self._get_collection(indicator.indicator_type)
                if collection is not None:
                    self.kv_store[collection].append(indicator.to_kv_store_record())

    def _get_collection(self, indicator_type: str) -> Optional[str]:
        mapping = {
            "ip": "ip_intel",
            "domain": "domain_intel",
            "file_hash": "file_intel",
            "url": "url_intel",
        }
        return mapping.get(indicator_type)

    def simulate_correlation(self, events: list) -> list:
        """Simulate correlating events against TI indicators."""
        hits = []
        ip_iocs = {r["ip"]: r for r in self.kv_store.get("ip_intel", []) if "ip" in r}
        domain_iocs = {r["domain"]: r for r in self.kv_store.get("domain_intel", []) if "domain" in r}

        for event in events:
            dest_ip = event.get("dest_ip", "")
            domain = event.get("domain", "")

            if dest_ip in ip_iocs:
                ioc = ip_iocs[dest_ip]
                hits.append({
                    "event": event,
                    "match_type": "ip",
                    "matched_value": dest_ip,
                    "threat_type": ioc["threat_type"],
                    "confidence": ioc["confidence"],
                    "source": ioc["source"],
                    "severity": ioc["severity"],
                })

            if domain in domain_iocs:
                ioc = domain_iocs[domain]
                hits.append({
                    "event": event,
                    "match_type": "domain",
                    "matched_value": domain,
                    "threat_type": ioc["threat_type"],
                    "confidence": ioc["confidence"],
                    "source": ioc["source"],
                    "severity": ioc["severity"],
                })

        self.correlation_hits = hits
        return hits

    def get_pipeline_stats(self) -> dict:
        return {
            "total_feeds": len(self.feeds),
            "kv_store_sizes": {k: len(v) for k, v in self.kv_store.items()},
            "total_indicators": sum(len(v) for v in self.kv_store.values()),
            "correlation_hits": len(self.correlation_hits),
            "feed_stats": [
                {"name": f.name, "indicators": len(f.indicators), "stats": f.stats}
                for f in self.feeds
            ],
        }

    def generate_spl_correlation(self, indicator_type: str) -> str:
        templates = {
            "ip": (
                '| tstats summariesonly=true count from datamodel=Network_Traffic '
                'where All_Traffic.action=allowed by All_Traffic.dest_ip, All_Traffic.src_ip, _time span=5m\n'
                '| rename "All_Traffic.*" as *\n'
                '| lookup ip_threat_intel_lookup ip as dest_ip '
                'OUTPUT threat_type, confidence, source as ti_source, severity as ti_severity\n'
                '| where isnotnull(threat_type) AND confidence > 70\n'
                '| eval description="TI Hit: ".dest_ip." (".threat_type.") from ".ti_source'
            ),
            "domain": (
                'index=dns sourcetype=stream:dns\n'
                '| lookup domain_threat_intel_lookup domain as query '
                'OUTPUT threat_type, confidence, source as ti_source\n'
                '| where isnotnull(threat_type) AND confidence > 70\n'
                '| stats count dc(src_ip) as unique_sources by query, threat_type, ti_source\n'
                '| eval description="DNS to malicious domain ".query." from ".unique_sources." sources"'
            ),
            "file_hash": (
                'index=endpoint sourcetype=sysmon EventCode=1\n'
                '| lookup file_hash_intel_lookup file_hash as Hashes '
                'OUTPUT malware_family, confidence, source as ti_source\n'
                '| where isnotnull(malware_family)\n'
                '| eval description="Known malware ".malware_family." on ".Computer'
            ),
        }
        return templates.get(indicator_type, "# No template for this indicator type")


if __name__ == "__main__":
    pipeline = EnrichmentPipeline()

    # Create sample feeds
    otx_feed = ThreatFeed("AlienVault_OTX", "api", "https://otx.alienvault.com/api/v1/pulses/subscribed")
    otx_feed.add_indicator(ThreatIndicator("203.0.113.50", "ip", "OTX", "C2", 85, "Known C2 server", "high"))
    otx_feed.add_indicator(ThreatIndicator("198.51.100.25", "ip", "OTX", "Scanner", 60, "Port scanner", "medium"))
    otx_feed.add_indicator(ThreatIndicator("evil-domain.com", "domain", "OTX", "Phishing", 92, "Phishing domain", "critical"))

    abuse_feed = ThreatFeed("AbuseIPDB", "csv", "https://api.abuseipdb.com/api/v2/blacklist")
    abuse_feed.add_indicator(ThreatIndicator("203.0.113.50", "ip", "AbuseIPDB", "C2", 90, "Reported C2", "high"))
    abuse_feed.add_indicator(ThreatIndicator("192.0.2.100", "ip", "AbuseIPDB", "Brute Force", 75, "SSH brute forcer", "medium"))

    pipeline.add_feed(otx_feed)
    pipeline.add_feed(abuse_feed)
    pipeline.ingest_all_feeds()

    # Simulate events
    events = [
        {"src_ip": "10.0.0.50", "dest_ip": "203.0.113.50", "dest_port": 443, "domain": ""},
        {"src_ip": "10.0.1.100", "dest_ip": "8.8.8.8", "dest_port": 53, "domain": "google.com"},
        {"src_ip": "10.0.2.75", "dest_ip": "93.184.216.34", "dest_port": 80, "domain": "evil-domain.com"},
        {"src_ip": "10.0.0.10", "dest_ip": "192.0.2.100", "dest_port": 22, "domain": ""},
    ]

    hits = pipeline.simulate_correlation(events)

    print("=" * 70)
    print("THREAT INTELLIGENCE ENRICHMENT PIPELINE")
    print("=" * 70)

    stats = pipeline.get_pipeline_stats()
    print(f"\nFeeds: {stats['total_feeds']}")
    print(f"Total Indicators: {stats['total_indicators']}")
    print(f"KV Store: {stats['kv_store_sizes']}")

    print(f"\nCorrelation Hits: {len(hits)}")
    for hit in hits:
        print(f"  [{hit['severity'].upper()}] {hit['match_type']}: {hit['matched_value']} "
              f"({hit['threat_type']}) - Confidence: {hit['confidence']}% - Source: {hit['source']}")

    print(f"\n{'=' * 70}")
    print("GENERATED SPL CORRELATION SEARCHES")
    print("=" * 70)
    for ioc_type in ["ip", "domain", "file_hash"]:
        print(f"\n--- {ioc_type.upper()} Correlation ---")
        print(pipeline.generate_spl_correlation(ioc_type))