#!/usr/bin/env python3
"""Host-based intrusion detection agent using OSSEC/Wazuh API and osquery."""

import json
import os
import sys
import argparse
import subprocess
from datetime import datetime

try:
    import requests
    requests.packages.urllib3.disable_warnings()
except ImportError:
    print("Install: pip install requests")
    sys.exit(1)


class WazuhClient:
    """Wazuh API client for HIDS management."""

    def __init__(self, base_url, username, password):
        self.url = base_url.rstrip("/")
        self.token = self._authenticate(username, password)

    def _authenticate(self, username, password):
        resp = requests.post(f"{self.url}/security/user/authenticate",
                             auth=(username, password),
                             verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true", timeout=30)  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments
        resp.raise_for_status()
        return resp.json()["data"]["token"]

    def _get(self, endpoint, params=None):
        resp = requests.get(f"{self.url}/{endpoint}",
                            headers={"Authorization": f"Bearer {self.token}"},
                            params=params,
                            verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true", timeout=30)  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments
        resp.raise_for_status()
        return resp.json()

    def list_agents(self, status=None):
        params = {}
        if status:
            params["status"] = status
        return self._get("agents", params)

    def get_agent_alerts(self, agent_id, limit=20):
        return self._get(f"alerts", {"agent.id": agent_id, "limit": limit})

    def get_sca_results(self, agent_id):
        return self._get(f"sca/{agent_id}")

    def get_rootcheck(self, agent_id):
        return self._get(f"rootcheck/{agent_id}")


def run_osquery_check(query):
    """Execute osquery for host inspection."""
    cmd = ["osqueryi", "--json", query]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        return json.loads(result.stdout) if result.stdout.strip() else []
    except (FileNotFoundError, json.JSONDecodeError):
        return [{"error": "osquery not available"}]


def check_file_integrity(paths):
    """Check file integrity for key system files."""
    checks = []
    import hashlib, os
    for path in paths:
        if os.path.exists(path):
            with open(path, "rb") as f:
                sha256 = hashlib.sha256(f.read()).hexdigest()
            stat = os.stat(path)
            checks.append({
                "path": path,
                "sha256": sha256,
                "size": stat.st_size,
                "modified": datetime.fromtimestamp(stat.st_mtime).isoformat(),
                "status": "present",
            })
        else:
            checks.append({"path": path, "status": "missing", "severity": "HIGH"})
    return checks


def run_audit(wazuh_url=None, username=None, password=None, agent_id=None):
    """Execute HIDS audit."""
    print(f"\n{'='*60}")
    print(f"  HOST-BASED INTRUSION DETECTION AUDIT")
    print(f"  Generated: {datetime.utcnow().isoformat()} UTC")
    print(f"{'='*60}\n")

    if wazuh_url and username and password:
        client = WazuhClient(wazuh_url, username, password)
        agents = client.list_agents()
        data = agents.get("data", {})
        items = data.get("affected_items", [])
        print(f"--- WAZUH AGENTS ({data.get('total_affected_items', 0)}) ---")
        for a in items[:10]:
            print(f"  {a.get('name', 'N/A')} ({a.get('id', '')}): {a.get('status', '')}")

        if agent_id:
            sca = client.get_sca_results(agent_id)
            sca_data = sca.get("data", {}).get("affected_items", [])
            print(f"\n--- SCA RESULTS (agent {agent_id}) ---")
            for s in sca_data[:5]:
                print(f"  {s.get('name', '')}: pass={s.get('pass', 0)} fail={s.get('fail', 0)}")

    system_files = ["/etc/passwd", "/etc/shadow", "/etc/sudoers", "/etc/ssh/sshd_config"]
    integrity = check_file_integrity(system_files)
    print(f"\n--- FILE INTEGRITY CHECK ---")
    for f in integrity:
        print(f"  {f['path']}: {f['status']}")

    processes = run_osquery_check("SELECT name, pid, uid FROM processes WHERE uid = 0")
    print(f"\n--- ROOT PROCESSES ({len(processes)}) ---")
    for p in processes[:10]:
        if "error" not in p:
            print(f"  PID {p.get('pid', '')}: {p.get('name', '')}")

    return {"integrity": integrity, "processes": processes}


def main():
    parser = argparse.ArgumentParser(description="HIDS Audit Agent")
    parser.add_argument("--wazuh-url", help="Wazuh API URL (https://host:55000)")
    parser.add_argument("--username", help="Wazuh API username")
    parser.add_argument("--password", help="Wazuh API password")
    parser.add_argument("--agent-id", help="Specific agent ID to audit")
    parser.add_argument("--output", help="Save report to JSON file")
    args = parser.parse_args()

    report = run_audit(args.wazuh_url, args.username, args.password, args.agent_id)
    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2, default=str)
        print(f"\n[+] Report saved to {args.output}")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
HIDS Alert Analyzer

Parses Wazuh/OSSEC alerts JSON and generates summary reports for
file integrity monitoring and intrusion detection events.
"""

import json
import sys
import os
from collections import defaultdict, Counter
from datetime import datetime


def parse_wazuh_alerts(json_path: str) -> list:
    """Parse Wazuh alerts JSON file (one JSON object per line)."""
    alerts = []

    with open(json_path, "r", encoding="utf-8") as f:
        for line in f:
            line = line.strip()
            if not line:
                continue
            try:
                alert = json.loads(line)
                alerts.append({
                    "timestamp": alert.get("timestamp", ""),
                    "rule_id": alert.get("rule", {}).get("id", ""),
                    "rule_description": alert.get("rule", {}).get("description", ""),
                    "rule_level": alert.get("rule", {}).get("level", 0),
                    "rule_groups": alert.get("rule", {}).get("groups", []),
                    "agent_name": alert.get("agent", {}).get("name", ""),
                    "agent_ip": alert.get("agent", {}).get("ip", ""),
                    "syscheck_path": alert.get("syscheck", {}).get("path", ""),
                    "syscheck_event": alert.get("syscheck", {}).get("event", ""),
                    "syscheck_md5_after": alert.get("syscheck", {}).get("md5_after", ""),
                    "src_ip": alert.get("data", {}).get("srcip", ""),
                    "full_log": alert.get("full_log", "")[:300],
                })
            except json.JSONDecodeError:
                continue

    return alerts


def analyze_alerts(alerts: list) -> dict:
    """Analyze parsed alerts for patterns and summary statistics."""
    analysis = {
        "total_alerts": len(alerts),
        "by_level": Counter(),
        "by_rule": Counter(),
        "by_agent": Counter(),
        "by_group": Counter(),
        "fim_events": {
            "modified": 0,
            "added": 0,
            "deleted": 0,
            "top_modified_files": Counter(),
        },
        "high_severity": [],
        "attack_sources": Counter(),
    }

    for alert in alerts:
        level = alert["rule_level"]
        analysis["by_level"][level] += 1
        analysis["by_rule"][f"{alert['rule_id']}: {alert['rule_description']}"] += 1
        analysis["by_agent"][alert["agent_name"]] += 1

        for group in alert["rule_groups"]:
            analysis["by_group"][group] += 1

        if "syscheck" in alert["rule_groups"] or alert["syscheck_path"]:
            event = alert["syscheck_event"]
            if event == "modified":
                analysis["fim_events"]["modified"] += 1
                analysis["fim_events"]["top_modified_files"][alert["syscheck_path"]] += 1
            elif event == "added":
                analysis["fim_events"]["added"] += 1
            elif event == "deleted":
                analysis["fim_events"]["deleted"] += 1

        if level >= 10:
            analysis["high_severity"].append({
                "timestamp": alert["timestamp"],
                "agent": alert["agent_name"],
                "rule": alert["rule_description"],
                "level": level,
                "detail": alert["full_log"],
            })

        if alert["src_ip"]:
            analysis["attack_sources"][alert["src_ip"]] += 1

    return analysis


def generate_report(analysis: dict, output_path: str) -> None:
    """Generate HIDS alert analysis report."""
    report = {
        "report_generated": datetime.utcnow().isoformat() + "Z",
        "total_alerts": analysis["total_alerts"],
        "severity_distribution": dict(analysis["by_level"]),
        "top_rules": dict(analysis["by_rule"].most_common(20)),
        "top_agents": dict(analysis["by_agent"].most_common(20)),
        "alert_groups": dict(analysis["by_group"].most_common(15)),
        "file_integrity": {
            "files_modified": analysis["fim_events"]["modified"],
            "files_added": analysis["fim_events"]["added"],
            "files_deleted": analysis["fim_events"]["deleted"],
            "top_modified": dict(analysis["fim_events"]["top_modified_files"].most_common(20)),
        },
        "high_severity_alerts": analysis["high_severity"][:50],
        "top_attack_sources": dict(analysis["attack_sources"].most_common(20)),
    }

    with open(output_path, "w", encoding="utf-8") as f:
        json.dump(report, f, indent=2)


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python process.py <wazuh_alerts.json>")
        print()
        print("Analyzes Wazuh/OSSEC alerts JSON for HIDS event patterns.")
        sys.exit(1)

    json_path = sys.argv[1]
    if not os.path.exists(json_path):
        print(f"Error: File not found: {json_path}")
        sys.exit(1)

    print("Parsing Wazuh alerts...")
    alerts = parse_wazuh_alerts(json_path)
    print(f"Parsed {len(alerts)} alerts")

    print("Analyzing alert patterns...")
    analysis = analyze_alerts(alerts)

    base = os.path.splitext(os.path.basename(json_path))[0]
    out_dir = os.path.dirname(json_path) or "."
    report_path = os.path.join(out_dir, f"{base}_analysis.json")
    generate_report(analysis, report_path)
    print(f"Analysis report: {report_path}")

    print(f"\n--- HIDS Alert Summary ---")
    print(f"Total alerts: {analysis['total_alerts']}")
    print(f"High severity (level >= 10): {len(analysis['high_severity'])}")
    print(f"FIM: {analysis['fim_events']['modified']} modified, "
          f"{analysis['fim_events']['added']} added, "
          f"{analysis['fim_events']['deleted']} deleted")