#!/usr/bin/env python3
"""Attack path analysis agent using XM Cyber REST API for exposure management."""

import argparse
import json
import logging
import os
import sys
from datetime import datetime
from typing import List

try:
    import requests
except ImportError:
    sys.exit("requests required: pip install requests")

logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")
logger = logging.getLogger(__name__)


class XMCyberClient:
    """Client for XM Cyber Continuous Exposure Management API."""

    def __init__(self, base_url: str, api_key: str):
        self.base_url = base_url.rstrip("/")
        self.session = requests.Session()
        self.session.headers.update({
            "Authorization": f"Bearer {api_key}",
            "Content-Type": "application/json",
        })

    def get_scenarios(self) -> List[dict]:
        """List all attack scenarios."""
        resp = self.session.get(f"{self.base_url}/api/v1/scenarios", timeout=30)
        resp.raise_for_status()
        return resp.json().get("data", [])

    def get_attack_paths(self, scenario_id: str) -> List[dict]:
        """Get attack paths for a specific scenario."""
        resp = self.session.get(
            f"{self.base_url}/api/v1/scenarios/{scenario_id}/attack-paths", timeout=30)
        resp.raise_for_status()
        return resp.json().get("data", [])

    def get_choke_points(self, scenario_id: str) -> List[dict]:
        """Get choke points where multiple attack paths converge."""
        resp = self.session.get(
            f"{self.base_url}/api/v1/scenarios/{scenario_id}/choke-points", timeout=30)
        resp.raise_for_status()
        return resp.json().get("data", [])

    def get_critical_assets(self) -> List[dict]:
        """List critical assets defined in the platform."""
        resp = self.session.get(f"{self.base_url}/api/v1/critical-assets", timeout=30)
        resp.raise_for_status()
        return resp.json().get("data", [])

    def get_entities_at_risk(self, scenario_id: str) -> List[dict]:
        """Get entities at risk of compromise in a scenario."""
        resp = self.session.get(
            f"{self.base_url}/api/v1/scenarios/{scenario_id}/entities-at-risk", timeout=30)
        resp.raise_for_status()
        return resp.json().get("data", [])

    def get_remediation_actions(self, scenario_id: str) -> List[dict]:
        """Get recommended remediation actions prioritized by impact."""
        resp = self.session.get(
            f"{self.base_url}/api/v1/scenarios/{scenario_id}/remediations", timeout=30)
        resp.raise_for_status()
        return resp.json().get("data", [])


def analyze_choke_points(choke_points: List[dict]) -> dict:
    """Analyze choke points to identify highest-impact remediation targets."""
    sorted_cp = sorted(choke_points, key=lambda c: c.get("paths_through", 0), reverse=True)
    return {
        "total_choke_points": len(choke_points),
        "top_choke_points": [
            {"entity": cp.get("entity_name", ""), "type": cp.get("entity_type", ""),
             "paths_through": cp.get("paths_through", 0),
             "techniques": cp.get("techniques", [])}
            for cp in sorted_cp[:10]
        ],
    }


def compute_risk_score(attack_paths: List[dict], critical_assets: List[dict]) -> dict:
    """Compute risk score based on attack path complexity and critical asset exposure."""
    reachable = set()
    for path in attack_paths:
        target = path.get("target_asset", "")
        if target:
            reachable.add(target)
    critical_names = {a.get("name", "") for a in critical_assets}
    compromised = reachable & critical_names
    pct = (len(compromised) / len(critical_names) * 100) if critical_names else 0
    return {
        "total_paths": len(attack_paths),
        "unique_targets": len(reachable),
        "critical_assets_reachable": len(compromised),
        "critical_asset_exposure_pct": round(pct, 1),
    }


def generate_report(client: XMCyberClient) -> dict:
    """Generate comprehensive attack path analysis report."""
    report = {"analysis_date": datetime.utcnow().isoformat(), "scenarios": []}
    scenarios = client.get_scenarios()
    critical_assets = client.get_critical_assets()
    report["critical_assets_count"] = len(critical_assets)

    for scenario in scenarios[:5]:
        sid = scenario.get("id", "")
        paths = client.get_attack_paths(sid)
        choke = client.get_choke_points(sid)
        remediations = client.get_remediation_actions(sid)
        report["scenarios"].append({
            "id": sid, "name": scenario.get("name", ""),
            "attack_paths": len(paths),
            "choke_point_analysis": analyze_choke_points(choke),
            "risk_score": compute_risk_score(paths, critical_assets),
            "top_remediations": remediations[:5],
        })
    return report


def main():
    parser = argparse.ArgumentParser(description="XM Cyber Attack Path Analysis Agent")
    parser.add_argument("--url", required=True, help="XM Cyber platform URL")
    parser.add_argument("--api-key", required=True, help="API key")
    parser.add_argument("--output-dir", default=".", help="Output directory")
    parser.add_argument("--output", default="attack_path_report.json")
    args = parser.parse_args()

    os.makedirs(args.output_dir, exist_ok=True)
    client = XMCyberClient(args.url, args.api_key)
    report = generate_report(client)
    out_path = os.path.join(args.output_dir, args.output)
    with open(out_path, "w") as f:
        json.dump(report, f, indent=2)
    logger.info("Report saved to %s", out_path)
    print(json.dumps(report, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Attack Path Analysis and Choke Point Prioritization Tool

Processes attack path data from exposure management platforms
to identify and prioritize choke points for remediation.

Requirements:
    pip install pandas networkx matplotlib

Usage:
    python process.py analyze --input attack_paths.json --output choke_points.csv
    python process.py visualize --input attack_paths.json --output graph.png
    python process.py report --input attack_paths.json
"""

import argparse
import json
import sys
from collections import defaultdict

import networkx as nx
import pandas as pd


class AttackPathAnalyzer:
    """Analyze attack paths and identify choke points."""

    def __init__(self):
        self.graph = nx.DiGraph()
        self.critical_assets = set()
        self.choke_points = []

    def load_attack_paths(self, data):
        """Load attack path data into a directed graph."""
        for path in data.get("attack_paths", []):
            nodes = path.get("nodes", [])
            for i in range(len(nodes) - 1):
                src = nodes[i]
                dst = nodes[i + 1]
                self.graph.add_node(src["id"], **src)
                self.graph.add_node(dst["id"], **dst)
                self.graph.add_edge(
                    src["id"], dst["id"],
                    technique=path.get("technique", "unknown"),
                    path_id=path.get("path_id", "")
                )

        for asset in data.get("critical_assets", []):
            self.critical_assets.add(asset["id"])
            if asset["id"] in self.graph:
                self.graph.nodes[asset["id"]]["is_critical"] = True
                self.graph.nodes[asset["id"]]["tier"] = asset.get("tier", 3)

        print(f"[+] Loaded {self.graph.number_of_nodes()} nodes, "
              f"{self.graph.number_of_edges()} edges")
        print(f"    Critical assets: {len(self.critical_assets)}")

    def find_choke_points(self):
        """Identify choke points using betweenness centrality
        weighted by paths to critical assets."""
        betweenness = nx.betweenness_centrality(self.graph)

        node_path_counts = defaultdict(lambda: {"paths": 0, "assets": set()})

        for critical_asset in self.critical_assets:
            if critical_asset not in self.graph:
                continue
            for source in self.graph.nodes():
                if source == critical_asset:
                    continue
                if source in self.critical_assets:
                    continue
                try:
                    for path in nx.all_simple_paths(
                        self.graph, source, critical_asset, cutoff=8
                    ):
                        for node in path[1:-1]:
                            node_path_counts[node]["paths"] += 1
                            node_path_counts[node]["assets"].add(critical_asset)
                except nx.NetworkXNoPath:
                    continue

        self.choke_points = []
        for node_id, counts in node_path_counts.items():
            if counts["paths"] < 2:
                continue

            node_data = self.graph.nodes.get(node_id, {})
            self.choke_points.append({
                "entity_id": node_id,
                "entity_name": node_data.get("name", node_id),
                "entity_type": node_data.get("type", "unknown"),
                "exposure_category": node_data.get("exposure_category", "unknown"),
                "paths_through": counts["paths"],
                "critical_assets_at_risk": len(counts["assets"]),
                "assets_list": list(counts["assets"]),
                "betweenness_centrality": round(betweenness.get(node_id, 0), 4),
                "risk_score": round(
                    counts["paths"] * len(counts["assets"]) *
                    (1 + betweenness.get(node_id, 0)),
                    2
                ),
                "remediation": node_data.get("remediation", "Review and fix"),
                "fix_complexity": node_data.get("fix_complexity", "medium"),
            })

        self.choke_points.sort(key=lambda x: x["risk_score"], reverse=True)
        print(f"[+] Identified {len(self.choke_points)} choke points")
        return self.choke_points

    def generate_remediation_plan(self):
        """Generate prioritized remediation plan from choke points."""
        if not self.choke_points:
            self.find_choke_points()

        plan = []
        for i, cp in enumerate(self.choke_points, 1):
            if cp["risk_score"] >= 100 or cp["critical_assets_at_risk"] >= 3:
                priority = "P1-Emergency"
                sla = "48 hours"
            elif cp["risk_score"] >= 50 or cp["critical_assets_at_risk"] >= 2:
                priority = "P2-Critical"
                sla = "7 days"
            elif cp["risk_score"] >= 20:
                priority = "P3-High"
                sla = "14 days"
            else:
                priority = "P4-Medium"
                sla = "30 days"

            plan.append({
                "rank": i,
                "entity": cp["entity_name"],
                "type": cp["entity_type"],
                "category": cp["exposure_category"],
                "paths_eliminated": cp["paths_through"],
                "assets_protected": cp["critical_assets_at_risk"],
                "risk_score": cp["risk_score"],
                "priority": priority,
                "sla": sla,
                "complexity": cp["fix_complexity"],
                "remediation": cp["remediation"],
            })

        return pd.DataFrame(plan)

    def print_summary(self):
        """Print analysis summary."""
        if not self.choke_points:
            self.find_choke_points()

        total_nodes = self.graph.number_of_nodes()
        total_edges = self.graph.number_of_edges()
        total_choke = len(self.choke_points)

        print(f"\n{'=' * 70}")
        print("ATTACK PATH ANALYSIS SUMMARY")
        print(f"{'=' * 70}")
        print(f"Total entities:       {total_nodes}")
        print(f"Total attack edges:   {total_edges}")
        print(f"Critical assets:      {len(self.critical_assets)}")
        print(f"Choke points found:   {total_choke}")
        print(f"Choke point ratio:    {total_choke / max(total_nodes, 1) * 100:.1f}%")

        if self.choke_points:
            print(f"\nTop 10 Choke Points:")
            for i, cp in enumerate(self.choke_points[:10], 1):
                print(f"  {i}. {cp['entity_name']}")
                print(f"     Type: {cp['entity_type']} | "
                      f"Category: {cp['exposure_category']}")
                print(f"     Paths: {cp['paths_through']} | "
                      f"Assets at risk: {cp['critical_assets_at_risk']} | "
                      f"Risk: {cp['risk_score']}")

            categories = defaultdict(int)
            for cp in self.choke_points:
                categories[cp["exposure_category"]] += 1
            print(f"\nChoke Points by Category:")
            for cat, count in sorted(categories.items(),
                                     key=lambda x: x[1], reverse=True):
                print(f"  {cat}: {count}")


def main():
    parser = argparse.ArgumentParser(
        description="Attack Path Analysis and Choke Point Prioritization"
    )
    subparsers = parser.add_subparsers(dest="command")

    analyze_p = subparsers.add_parser("analyze", help="Analyze attack paths")
    analyze_p.add_argument("--input", required=True, help="Attack paths JSON file")
    analyze_p.add_argument("--output", default="choke_points.csv")

    report_p = subparsers.add_parser("report", help="Generate summary report")
    report_p.add_argument("--input", required=True, help="Attack paths JSON file")

    plan_p = subparsers.add_parser("plan", help="Generate remediation plan")
    plan_p.add_argument("--input", required=True, help="Attack paths JSON file")
    plan_p.add_argument("--output", default="remediation_plan.csv")

    args = parser.parse_args()
    analyzer = AttackPathAnalyzer()

    if not args.command:
        parser.print_help()
        sys.exit(1)

    with open(args.input) as f:
        data = json.load(f)
    analyzer.load_attack_paths(data)

    if args.command == "analyze":
        choke_points = analyzer.find_choke_points()
        df = pd.DataFrame(choke_points)
        df.to_csv(args.output, index=False)
        print(f"[+] Choke points saved to {args.output}")
        analyzer.print_summary()
    elif args.command == "report":
        analyzer.print_summary()
    elif args.command == "plan":
        plan_df = analyzer.generate_remediation_plan()
        plan_df.to_csv(args.output, index=False)
        print(plan_df.to_string(index=False))
        print(f"\n[+] Remediation plan saved to {args.output}")


if __name__ == "__main__":
    main()