#!/usr/bin/env python3
"""Vulnerability aging and SLA tracking agent.

Tracks vulnerability remediation timelines, calculates SLA compliance,
generates aging reports, and identifies overdue items by severity.
"""

import json
import datetime
import collections


SLA_DEFINITIONS = {
    "critical": {"remediation_days": 7, "patch_days": 15, "exception_max_days": 30},
    "high": {"remediation_days": 30, "patch_days": 45, "exception_max_days": 90},
    "medium": {"remediation_days": 90, "patch_days": 120, "exception_max_days": 180},
    "low": {"remediation_days": 180, "patch_days": 365, "exception_max_days": 365},
}

AGING_BUCKETS = [
    (0, 7, "0-7 days"),
    (8, 30, "8-30 days"),
    (31, 60, "31-60 days"),
    (61, 90, "61-90 days"),
    (91, 180, "91-180 days"),
    (181, 365, "181-365 days"),
    (366, 99999, "365+ days"),
]


def calculate_age(discovery_date_str):
    """Calculate vulnerability age in days from discovery date."""
    try:
        disc = datetime.datetime.fromisoformat(discovery_date_str.replace("Z", "+00:00"))
        now = datetime.datetime.now(datetime.timezone.utc)
        return (now - disc).days
    except (ValueError, AttributeError):
        return 0


def check_sla_compliance(vuln):
    """Check if a vulnerability is within SLA."""
    severity = vuln.get("severity", "medium").lower()
    sla = SLA_DEFINITIONS.get(severity, SLA_DEFINITIONS["medium"])
    age = calculate_age(vuln.get("discovery_date", ""))
    status = vuln.get("status", "open")

    result = {
        "vuln_id": vuln.get("id", ""),
        "severity": severity,
        "age_days": age,
        "sla_days": sla["remediation_days"],
        "days_remaining": sla["remediation_days"] - age,
        "sla_status": "within_sla",
    }

    if status in ("remediated", "closed"):
        result["sla_status"] = "resolved"
    elif status == "exception":
        if age > sla["exception_max_days"]:
            result["sla_status"] = "exception_expired"
        else:
            result["sla_status"] = "exception_active"
    elif age > sla["remediation_days"]:
        result["sla_status"] = "overdue"
    elif age > sla["remediation_days"] * 0.8:
        result["sla_status"] = "at_risk"

    return result


def build_aging_report(vulns):
    """Build vulnerability aging distribution report."""
    buckets = {label: {"total": 0, "critical": 0, "high": 0, "medium": 0, "low": 0}
               for _, _, label in AGING_BUCKETS}

    for vuln in vulns:
        if vuln.get("status") in ("remediated", "closed"):
            continue
        age = calculate_age(vuln.get("discovery_date", ""))
        severity = vuln.get("severity", "medium").lower()
        for low, high, label in AGING_BUCKETS:
            if low <= age <= high:
                buckets[label]["total"] += 1
                if severity in buckets[label]:
                    buckets[label][severity] += 1
                break

    return {"aging_distribution": buckets, "generated_at": datetime.datetime.utcnow().isoformat() + "Z"}


def calculate_mttr(vulns):
    """Calculate Mean Time to Remediate by severity."""
    remediation_times = collections.defaultdict(list)
    for vuln in vulns:
        if vuln.get("status") in ("remediated", "closed") and vuln.get("remediation_date"):
            try:
                disc = datetime.datetime.fromisoformat(vuln["discovery_date"].replace("Z", "+00:00"))
                rem = datetime.datetime.fromisoformat(vuln["remediation_date"].replace("Z", "+00:00"))
                days = (rem - disc).days
                severity = vuln.get("severity", "medium").lower()
                remediation_times[severity].append(days)
            except (ValueError, KeyError):
                pass

    mttr = {}
    for sev, times in remediation_times.items():
        mttr[sev] = {
            "mean_days": round(sum(times) / len(times), 1),
            "median_days": sorted(times)[len(times) // 2],
            "count": len(times),
        }
    return mttr


def generate_sla_dashboard(vulns):
    """Generate SLA compliance dashboard data."""
    total = 0
    compliant = 0
    overdue = 0
    at_risk = 0
    by_severity = collections.defaultdict(lambda: {"total": 0, "compliant": 0, "overdue": 0})

    for vuln in vulns:
        sla_result = check_sla_compliance(vuln)
        if sla_result["sla_status"] == "resolved":
            continue
        total += 1
        severity = sla_result["severity"]
        by_severity[severity]["total"] += 1
        if sla_result["sla_status"] == "within_sla":
            compliant += 1
            by_severity[severity]["compliant"] += 1
        elif sla_result["sla_status"] == "overdue":
            overdue += 1
            by_severity[severity]["overdue"] += 1
        elif sla_result["sla_status"] == "at_risk":
            at_risk += 1

    return {
        "total_open": total,
        "compliant": compliant,
        "overdue": overdue,
        "at_risk": at_risk,
        "compliance_rate": round(compliant / max(total, 1) * 100, 1),
        "by_severity": dict(by_severity),
    }


if __name__ == "__main__":
    print("=" * 60)
    print("Vulnerability Aging & SLA Tracking")
    print("SLA compliance, aging distribution, MTTR calculation")
    print("=" * 60)

    now = datetime.datetime.utcnow()
    demo_vulns = [
        {"id": "CVE-2024-1234", "severity": "critical", "status": "open",
         "discovery_date": (now - datetime.timedelta(days=10)).isoformat() + "Z"},
        {"id": "CVE-2024-2345", "severity": "high", "status": "open",
         "discovery_date": (now - datetime.timedelta(days=45)).isoformat() + "Z"},
        {"id": "CVE-2024-3456", "severity": "medium", "status": "open",
         "discovery_date": (now - datetime.timedelta(days=120)).isoformat() + "Z"},
        {"id": "CVE-2024-4567", "severity": "critical", "status": "remediated",
         "discovery_date": (now - datetime.timedelta(days=5)).isoformat() + "Z",
         "remediation_date": (now - datetime.timedelta(days=2)).isoformat() + "Z"},
        {"id": "CVE-2024-5678", "severity": "low", "status": "exception",
         "discovery_date": (now - datetime.timedelta(days=200)).isoformat() + "Z"},
    ]

    print("\n--- SLA Compliance ---")
    for vuln in demo_vulns:
        result = check_sla_compliance(vuln)
        print("  {} [{}] age={}d sla={}d -> {}".format(
            result["vuln_id"], result["severity"], result["age_days"],
            result["sla_days"], result["sla_status"]))

    dashboard = generate_sla_dashboard(demo_vulns)
    print("\n--- Dashboard ---")
    print("  Compliance rate: {}%".format(dashboard["compliance_rate"]))
    print("  Open: {} | Compliant: {} | Overdue: {} | At-risk: {}".format(
        dashboard["total_open"], dashboard["compliant"], dashboard["overdue"], dashboard["at_risk"]))

    mttr = calculate_mttr(demo_vulns)
    if mttr:
        print("\n--- MTTR ---")
        for sev, data in mttr.items():
            print("  {}: mean={}d median={}d (n={})".format(sev, data["mean_days"], data["median_days"], data["count"]))

    print("\n" + json.dumps({"vulns_tracked": len(demo_vulns)}, indent=2))

#!/usr/bin/env python3
"""
Vulnerability Aging and SLA Tracking Engine

Calculates vulnerability aging, SLA compliance, and generates
escalation reports and KPI dashboards.

Requirements:
    pip install pandas

Usage:
    python process.py analyze --csv vulns.csv --output aging_report.csv
    python process.py kpis --csv vulns.csv
    python process.py escalations --csv vulns.csv --output escalations.csv
"""

import argparse
import sys
from datetime import datetime, timedelta

import pandas as pd


SLA_DAYS = {
    "Critical": 14,
    "High": 30,
    "Medium": 60,
    "Low": 90,
}


def calculate_aging(df, sla_config=None):
    """Add aging and SLA columns to vulnerability dataframe."""
    sla = sla_config or SLA_DAYS
    today = pd.Timestamp.now()

    df["discovery_date"] = pd.to_datetime(df["discovery_date"])
    df["remediation_date"] = pd.to_datetime(df["remediation_date"], errors="coerce")

    df["age_days"] = df.apply(
        lambda r: (r["remediation_date"] - r["discovery_date"]).days
        if pd.notna(r["remediation_date"])
        else (today - r["discovery_date"]).days,
        axis=1
    )

    df["sla_days"] = df["severity"].map(sla).fillna(90).astype(int)
    df["sla_deadline"] = df["discovery_date"] + pd.to_timedelta(df["sla_days"], unit="D")
    df["is_open"] = df["remediation_date"].isna()
    df["is_overdue"] = df["is_open"] & (df["age_days"] > df["sla_days"])
    df["days_overdue"] = df.apply(
        lambda r: max(0, r["age_days"] - r["sla_days"]) if r["is_overdue"] else 0,
        axis=1
    )
    df["sla_pct_elapsed"] = (df["age_days"] / df["sla_days"] * 100).round(1)
    df["within_sla"] = df.apply(
        lambda r: r["age_days"] <= r["sla_days"]
        if pd.notna(r["remediation_date"]) else None,
        axis=1
    )

    return df


def generate_kpis(df):
    """Generate KPI summary."""
    open_df = df[df["is_open"]]
    closed_df = df[~df["is_open"]]

    print(f"\n{'=' * 60}")
    print("VULNERABILITY AGING KPI REPORT")
    print(f"{'=' * 60}")
    print(f"Report Date:           {datetime.now().strftime('%Y-%m-%d')}")
    print(f"Total Vulnerabilities: {len(df)}")
    print(f"Open:                  {len(open_df)}")
    print(f"Closed:                {len(closed_df)}")
    print(f"Overdue:               {open_df['is_overdue'].sum()}")

    if len(closed_df) > 0:
        mttr = closed_df["age_days"].mean()
        sla_rate = closed_df["within_sla"].mean() * 100
        print(f"\nMTTR (all):            {mttr:.1f} days")
        print(f"SLA Compliance Rate:   {sla_rate:.1f}%")

        for sev in ["Critical", "High", "Medium", "Low"]:
            sev_df = closed_df[closed_df["severity"] == sev]
            if len(sev_df) > 0:
                print(f"  {sev} MTTR: {sev_df['age_days'].mean():.1f}d "
                      f"| SLA: {sev_df['within_sla'].mean() * 100:.1f}%")

    print(f"\nOpen Vulnerabilities by Age:")
    bins = [0, 7, 14, 30, 60, 90, float("inf")]
    labels = ["0-7d", "8-14d", "15-30d", "31-60d", "61-90d", "90+d"]
    if len(open_df) > 0:
        open_df = open_df.copy()
        open_df["age_bucket"] = pd.cut(open_df["age_days"], bins=bins, labels=labels)
        print(open_df["age_bucket"].value_counts().sort_index().to_string())

    print(f"\nOverdue by Severity:")
    overdue = open_df[open_df["is_overdue"]]
    if len(overdue) > 0:
        print(overdue.groupby("severity")["days_overdue"].agg(["count", "mean", "max"]).to_string())


def generate_escalations(df):
    """Generate escalation list."""
    open_df = df[df["is_open"]].copy()
    escalations = []

    for _, row in open_df.iterrows():
        pct = row["sla_pct_elapsed"]
        if pct >= 120:
            level = "VP/CTO Escalation"
        elif pct >= 100:
            level = "CISO Notification"
        elif pct >= 75:
            level = "Manager Escalation"
        elif pct >= 50:
            level = "Owner Reminder"
        else:
            continue

        escalations.append({
            "cve_id": row.get("cve_id", ""),
            "severity": row["severity"],
            "asset": row.get("asset", ""),
            "owner": row.get("owner", ""),
            "age_days": row["age_days"],
            "sla_days": row["sla_days"],
            "days_overdue": row["days_overdue"],
            "sla_pct": pct,
            "escalation_level": level,
        })

    return pd.DataFrame(escalations).sort_values("sla_pct", ascending=False)


def main():
    parser = argparse.ArgumentParser(description="Vulnerability Aging and SLA Tracker")
    subparsers = parser.add_subparsers(dest="command")

    analyze_p = subparsers.add_parser("analyze", help="Calculate aging metrics")
    analyze_p.add_argument("--csv", required=True)
    analyze_p.add_argument("--output", default="aging_report.csv")

    subparsers.add_parser("kpis", help="Generate KPI summary").add_argument("--csv", required=True)

    esc_p = subparsers.add_parser("escalations", help="Generate escalation list")
    esc_p.add_argument("--csv", required=True)
    esc_p.add_argument("--output", default="escalations.csv")

    args = parser.parse_args()

    if not args.command:
        parser.print_help()
        sys.exit(1)

    df = pd.read_csv(args.csv)
    df = calculate_aging(df)

    if args.command == "analyze":
        df.to_csv(args.output, index=False)
        print(f"[+] Aging report saved to {args.output}")
        generate_kpis(df)
    elif args.command == "kpis":
        generate_kpis(df)
    elif args.command == "escalations":
        esc_df = generate_escalations(df)
        esc_df.to_csv(args.output, index=False)
        print(f"[+] {len(esc_df)} escalations saved to {args.output}")
        if len(esc_df) > 0:
            print(esc_df["escalation_level"].value_counts().to_string())


if __name__ == "__main__":
    main()