#!/usr/bin/env python3
"""AWS GuardDuty findings automation and detection agent."""

import json
import sys
import argparse
from datetime import datetime

try:
    import boto3
except ImportError:
    print("Install: pip install boto3")
    sys.exit(1)


def get_guardduty_detector(session):
    """Get the active GuardDuty detector ID."""
    gd = session.client("guardduty")
    detectors = gd.list_detectors()["DetectorIds"]
    if not detectors:
        return None
    return detectors[0]


def list_findings(session, detector_id, severity_min=4.0, max_results=50):
    """List GuardDuty findings filtered by severity."""
    gd = session.client("guardduty")
    criteria = {
        "Criterion": {
            "severity": {"Gte": severity_min},
            "service.archived": {"Eq": ["false"]},
        }
    }
    finding_ids = gd.list_findings(
        DetectorId=detector_id,
        FindingCriteria=criteria,
        SortCriteria={"AttributeName": "severity", "OrderBy": "DESC"},
        MaxResults=max_results,
    )["FindingIds"]

    if not finding_ids:
        return []

    details = gd.get_findings(
        DetectorId=detector_id, FindingIds=finding_ids
    )["Findings"]

    results = []
    for f in details:
        results.append({
            "id": f.get("Id", ""),
            "type": f.get("Type", ""),
            "severity": f.get("Severity", 0),
            "title": f.get("Title", ""),
            "description": f.get("Description", "")[:200],
            "resource_type": f.get("Resource", {}).get("ResourceType", ""),
            "region": f.get("Region", ""),
            "first_seen": f.get("Service", {}).get("EventFirstSeen", ""),
            "last_seen": f.get("Service", {}).get("EventLastSeen", ""),
            "count": f.get("Service", {}).get("Count", 0),
            "action_type": f.get("Service", {}).get("Action", {}).get("ActionType", ""),
        })
    return results


def get_finding_statistics(session, detector_id):
    """Get finding count grouped by type and severity."""
    gd = session.client("guardduty")
    stats = gd.get_findings_statistics(
        DetectorId=detector_id,
        FindingStatisticTypes=["COUNT_BY_SEVERITY"],
    )
    return stats.get("FindingStatistics", {})


def check_detector_configuration(session, detector_id):
    """Audit GuardDuty detector configuration for coverage gaps."""
    gd = session.client("guardduty")
    findings = []

    detector = gd.get_detector(DetectorId=detector_id)
    status = detector.get("Status", "")
    if status != "ENABLED":
        findings.append({
            "check": "Detector status",
            "status": status,
            "severity": "CRITICAL",
            "issue": "GuardDuty detector is not enabled",
        })

    features = detector.get("Features", [])
    expected_features = {
        "S3_DATA_EVENTS", "EKS_AUDIT_LOGS", "EBS_MALWARE_PROTECTION",
        "RDS_LOGIN_EVENTS", "LAMBDA_NETWORK_LOGS", "RUNTIME_MONITORING",
    }
    enabled_features = set()
    for feat in features:
        if feat.get("Status") == "ENABLED":
            enabled_features.add(feat.get("Name", ""))

    missing = expected_features - enabled_features
    for m in missing:
        findings.append({
            "check": f"Feature: {m}",
            "status": "DISABLED",
            "severity": "HIGH",
            "issue": f"GuardDuty feature {m} not enabled — reduced detection coverage",
        })

    return findings


def check_member_accounts(session, detector_id):
    """Check GuardDuty member account enrollment in multi-account setup."""
    gd = session.client("guardduty")
    members = gd.list_members(
        DetectorId=detector_id, OnlyAssociated="true"
    ).get("Members", [])

    results = []
    for m in members:
        status = m.get("RelationshipStatus", "")
        results.append({
            "account_id": m.get("AccountId", ""),
            "email": m.get("Email", ""),
            "status": status,
            "detector_id": m.get("DetectorId", ""),
        })
        if status != "Enabled":
            results[-1]["finding"] = f"Member account not fully enabled: {status}"
            results[-1]["severity"] = "HIGH"
    return results


def auto_archive_low_severity(session, detector_id, threshold=2.0):
    """Auto-archive findings below severity threshold."""
    gd = session.client("guardduty")
    criteria = {
        "Criterion": {
            "severity": {"Lt": threshold},
            "service.archived": {"Eq": ["false"]},
        }
    }
    finding_ids = gd.list_findings(
        DetectorId=detector_id,
        FindingCriteria=criteria,
        MaxResults=100,
    )["FindingIds"]

    if finding_ids:
        gd.archive_findings(DetectorId=detector_id, FindingIds=finding_ids)
    return {"archived_count": len(finding_ids)}


def run_audit(args):
    """Execute GuardDuty findings automation audit."""
    print(f"\n{'='*60}")
    print(f"  AWS GUARDDUTY FINDINGS AUTOMATION")
    print(f"  Generated: {datetime.utcnow().isoformat()} UTC")
    print(f"{'='*60}\n")

    session = boto3.Session(profile_name=args.profile, region_name=args.region)
    report = {}

    detector_id = get_guardduty_detector(session)
    if not detector_id:
        print("ERROR: No GuardDuty detector found")
        return {"error": "No detector found"}

    report["detector_id"] = detector_id
    print(f"Detector ID: {detector_id}\n")

    config_findings = check_detector_configuration(session, detector_id)
    report["configuration_findings"] = config_findings
    print(f"--- CONFIGURATION AUDIT ({len(config_findings)} findings) ---")
    for f in config_findings:
        print(f"  [{f['severity']}] {f['check']}: {f['issue']}")

    findings = list_findings(session, detector_id, args.min_severity)
    report["active_findings"] = len(findings)
    print(f"\n--- ACTIVE FINDINGS ({len(findings)}, severity >= {args.min_severity}) ---")
    for f in findings[:15]:
        print(f"  [{f['severity']:.1f}] {f['type']}")
        print(f"         {f['title'][:80]}")

    members = check_member_accounts(session, detector_id)
    report["member_accounts"] = members
    print(f"\n--- MEMBER ACCOUNTS ({len(members)}) ---")
    for m in members:
        status_icon = "OK" if m["status"] == "Enabled" else "WARN"
        print(f"  [{status_icon}] {m['account_id']}: {m['status']}")

    return report


def main():
    parser = argparse.ArgumentParser(description="GuardDuty Findings Automation Agent")
    parser.add_argument("--profile", default=None, help="AWS profile name")
    parser.add_argument("--region", default="us-east-1", help="AWS region")
    parser.add_argument("--min-severity", type=float, default=4.0,
                        help="Minimum severity threshold (default: 4.0)")
    parser.add_argument("--output", help="Save report to JSON file")
    args = parser.parse_args()

    report = run_audit(args)
    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2, default=str)
        print(f"\n[+] Report saved to {args.output}")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
AWS GuardDuty Findings Management Script

Lists, analyzes, and exports GuardDuty findings for security operations.
"""

import boto3
import json
import sys
from datetime import datetime
from collections import Counter


def get_detector_id(session):
    """Get the GuardDuty detector ID for the current region."""
    client = session.client('guardduty')
    response = client.list_detectors()
    detectors = response.get('DetectorIds', [])
    if not detectors:
        print("[!] No GuardDuty detector found. Enable GuardDuty first.")
        return None
    return detectors[0]


def list_findings(session, severity_min=0, max_results=50):
    """List GuardDuty findings filtered by severity."""
    client = session.client('guardduty')
    detector_id = get_detector_id(session)
    if not detector_id:
        return []

    criteria = {}
    if severity_min > 0:
        criteria['severity'] = {'Gte': severity_min}

    response = client.list_findings(
        DetectorId=detector_id,
        FindingCriteria={'Criterion': criteria} if criteria else {},
        SortCriteria={'AttributeName': 'severity', 'OrderBy': 'DESC'},
        MaxResults=max_results
    )

    finding_ids = response.get('FindingIds', [])
    if not finding_ids:
        print("[+] No findings found")
        return []

    details = client.get_findings(
        DetectorId=detector_id,
        FindingIds=finding_ids
    )

    findings = details.get('Findings', [])
    print(f"[+] Retrieved {len(findings)} findings\n")

    for f in findings:
        sev = f['Severity']
        sev_label = 'HIGH' if sev >= 7 else 'MEDIUM' if sev >= 4 else 'LOW'
        print(f"  [{sev_label} {sev}] {f['Type']}")
        print(f"    Account: {f['AccountId']} | Region: {f['Region']}")
        print(f"    Description: {f.get('Description', 'N/A')[:100]}")
        print()

    return findings


def get_findings_statistics(session):
    """Get statistical summary of GuardDuty findings."""
    client = session.client('guardduty')
    detector_id = get_detector_id(session)
    if not detector_id:
        return

    response = client.get_findings_statistics(
        DetectorId=detector_id,
        FindingStatisticTypes=['COUNT_BY_SEVERITY']
    )

    stats = response.get('FindingStatistics', {})
    severity_counts = stats.get('CountBySeverity', {})

    print("[+] GuardDuty Findings Statistics:")
    for severity, count in sorted(severity_counts.items(), reverse=True):
        print(f"  Severity {severity}: {count} findings")


def analyze_findings(findings):
    """Analyze findings for patterns and top threats."""
    if not findings:
        return

    type_counter = Counter(f['Type'] for f in findings)
    severity_counter = Counter(
        'HIGH' if f['Severity'] >= 7 else 'MEDIUM' if f['Severity'] >= 4 else 'LOW'
        for f in findings
    )

    print("\n[+] Finding Type Distribution:")
    for finding_type, count in type_counter.most_common(10):
        print(f"  {count:3d} - {finding_type}")

    print("\n[+] Severity Distribution:")
    for level in ['HIGH', 'MEDIUM', 'LOW']:
        print(f"  {level}: {severity_counter.get(level, 0)}")


if __name__ == "__main__":
    import argparse
    parser = argparse.ArgumentParser(description="GuardDuty Findings Manager")
    parser.add_argument("--list", action="store_true", help="List findings")
    parser.add_argument("--stats", action="store_true", help="Show statistics")
    parser.add_argument("--severity", type=float, default=0, help="Minimum severity filter")
    parser.add_argument("--max-results", type=int, default=50)
    parser.add_argument("--region", default="us-east-1")
    parser.add_argument("--profile", type=str)
    args = parser.parse_args()

    kwargs = {"region_name": args.region}
    if args.profile:
        kwargs["profile_name"] = args.profile
    session = boto3.Session(**kwargs)

    if args.list:
        findings = list_findings(session, args.severity, args.max_results)
        analyze_findings(findings)
    if args.stats:
        get_findings_statistics(session)