#!/usr/bin/env python3
"""Breach and Attack Simulation (BAS) agent for continuous security validation using MITRE ATT&CK."""

import argparse
import json
import logging
import os
import sys
from datetime import datetime
from typing import List

try:
    import requests
except ImportError:
    sys.exit("requests required: pip install requests")

logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")
logger = logging.getLogger(__name__)

ATTACK_TECHNIQUES = [
    {"id": "T1566.001", "name": "Spearphishing Attachment", "tactic": "Initial Access",
     "test_type": "email", "payload": "eicar_test_attachment"},
    {"id": "T1059.001", "name": "PowerShell", "tactic": "Execution",
     "test_type": "endpoint", "payload": "benign_ps_download_cradle"},
    {"id": "T1003.001", "name": "LSASS Memory", "tactic": "Credential Access",
     "test_type": "endpoint", "payload": "procdump_lsass_simulation"},
    {"id": "T1021.002", "name": "SMB/Windows Admin Shares", "tactic": "Lateral Movement",
     "test_type": "network", "payload": "smb_admin_share_access"},
    {"id": "T1486", "name": "Data Encrypted for Impact", "tactic": "Impact",
     "test_type": "endpoint", "payload": "benign_file_encryption"},
    {"id": "T1071.001", "name": "Web Protocols", "tactic": "Command and Control",
     "test_type": "network", "payload": "http_c2_beacon_simulation"},
    {"id": "T1048.003", "name": "Exfiltration Over Unencrypted Protocol", "tactic": "Exfiltration",
     "test_type": "network", "payload": "dns_exfil_simulation"},
]


def simulate_technique(technique: dict, target: str) -> dict:
    """Simulate a single ATT&CK technique and record detection status."""
    start_time = datetime.utcnow().isoformat()
    detected = False
    blocked = False
    alert_id = ""
    try:
        if technique["test_type"] == "network":
            resp = requests.get(f"http://{target}/health", timeout=5)
            detected = resp.status_code != 200
        elif technique["test_type"] == "email":
            detected = False
        elif technique["test_type"] == "endpoint":
            detected = False
    except requests.RequestException:
        blocked = True
        detected = True
    return {
        "technique_id": technique["id"],
        "technique_name": technique["name"],
        "tactic": technique["tactic"],
        "test_type": technique["test_type"],
        "start_time": start_time,
        "detected": detected,
        "blocked": blocked,
        "alert_generated": alert_id,
    }


def check_siem_detection(siem_url: str, api_key: str, technique_id: str,
                          time_window_minutes: int = 15) -> dict:
    """Check if SIEM generated an alert for the simulated technique."""
    try:
        resp = requests.get(
            f"{siem_url}/api/alerts",
            headers={"Authorization": f"Bearer {api_key}"},
            params={"technique": technique_id, "minutes": time_window_minutes},
            timeout=15)
        if resp.status_code == 200:
            alerts = resp.json().get("alerts", [])
            return {"detected": len(alerts) > 0, "alert_count": len(alerts)}
    except requests.RequestException:
        pass
    return {"detected": False, "alert_count": 0}


def compute_detection_coverage(results: List[dict]) -> dict:
    """Compute detection coverage across tested techniques."""
    total = len(results)
    detected = sum(1 for r in results if r["detected"])
    blocked = sum(1 for r in results if r["blocked"])
    by_tactic = {}
    for r in results:
        tactic = r["tactic"]
        if tactic not in by_tactic:
            by_tactic[tactic] = {"total": 0, "detected": 0}
        by_tactic[tactic]["total"] += 1
        if r["detected"]:
            by_tactic[tactic]["detected"] += 1
    return {
        "total_tests": total,
        "detected": detected,
        "blocked": blocked,
        "missed": total - detected,
        "detection_rate_pct": round(detected / total * 100, 1) if total else 0,
        "by_tactic": by_tactic,
    }


def generate_report(target: str, siem_url: str = "", siem_key: str = "") -> dict:
    """Run BAS simulation campaign and generate detection gap report."""
    report = {"analysis_date": datetime.utcnow().isoformat(), "target": target, "results": []}
    for technique in ATTACK_TECHNIQUES:
        result = simulate_technique(technique, target)
        if siem_url and siem_key:
            siem_check = check_siem_detection(siem_url, siem_key, technique["id"])
            result["siem_detection"] = siem_check
            if siem_check["detected"]:
                result["detected"] = True
        report["results"].append(result)
    report["coverage"] = compute_detection_coverage(report["results"])
    report["gaps"] = [r for r in report["results"] if not r["detected"]]
    report["recommendations"] = []
    for gap in report["gaps"]:
        report["recommendations"].append(
            f"Create detection rule for {gap['technique_id']} ({gap['technique_name']})")
    return report


def main():
    parser = argparse.ArgumentParser(description="Breach and Attack Simulation Agent")
    parser.add_argument("--target", required=True, help="Target host for simulation")
    parser.add_argument("--siem-url", default="", help="SIEM API URL for detection validation")
    parser.add_argument("--siem-key", default="", help="SIEM API key")
    parser.add_argument("--output-dir", default=".")
    parser.add_argument("--output", default="bas_report.json")
    args = parser.parse_args()

    os.makedirs(args.output_dir, exist_ok=True)
    report = generate_report(args.target, args.siem_url, args.siem_key)
    out_path = os.path.join(args.output_dir, args.output)
    with open(out_path, "w") as f:
        json.dump(report, f, indent=2)
    logger.info("Report saved to %s", out_path)
    print(json.dumps(report["coverage"], indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
BAS Results Analyzer and Control Effectiveness Calculator

Processes Breach and Attack Simulation results to calculate
security control effectiveness scores and identify gaps.

Requirements:
    pip install pandas

Usage:
    python process.py analyze --csv bas_results.csv --output control_scores.csv
    python process.py gaps --csv bas_results.csv --output gaps.csv
    python process.py trend --dir results/ --output trend.csv
"""

import argparse
import sys
from collections import defaultdict
from datetime import datetime
from pathlib import Path

import pandas as pd


CONTROL_TECHNIQUE_MAP = {
    "email_gateway": ["T1566.001", "T1566.002", "T1566.003"],
    "edr": ["T1059.001", "T1059.003", "T1003.001", "T1055", "T1547.001",
            "T1053.005", "T1027", "T1140"],
    "ngfw_proxy": ["T1071.001", "T1071.004", "T1048.001", "T1048.003",
                   "T1572", "T1090"],
    "siem": ["T1087", "T1018", "T1069", "T1021.002", "T1021.001"],
    "dlp": ["T1048", "T1567", "T1041", "T1560"],
    "ndr": ["T1071", "T1021", "T1040", "T1046"],
    "waf": ["T1190", "T1210"],
    "pam": ["T1078", "T1134", "T1098"],
}


def analyze_control_effectiveness(df):
    """Calculate control effectiveness from BAS results."""
    scores = []

    for control, techniques in CONTROL_TECHNIQUE_MAP.items():
        relevant = df[df["technique_id"].isin(techniques)]
        if len(relevant) == 0:
            continue

        total = len(relevant)
        prevented = len(relevant[relevant["result"] == "prevented"])
        detected = len(relevant[relevant["result"] == "detected"])
        missed = len(relevant[relevant["result"] == "missed"])

        scores.append({
            "control": control,
            "total_tests": total,
            "prevented": prevented,
            "detected": detected,
            "missed": missed,
            "prevention_rate": round(prevented / total * 100, 1),
            "detection_rate": round(detected / total * 100, 1),
            "effectiveness": round((prevented + detected) / total * 100, 1),
            "gap_rate": round(missed / total * 100, 1),
        })

    return pd.DataFrame(scores).sort_values("effectiveness", ascending=True)


def identify_gaps(df):
    """Identify attack techniques that bypass all controls."""
    missed = df[df["result"] == "missed"].copy()
    if len(missed) == 0:
        print("[+] No gaps found - all attacks were prevented or detected!")
        return pd.DataFrame()

    gaps = missed.groupby(["technique_id", "technique_name"]).agg(
        miss_count=("result", "count"),
        targets=("target", lambda x: ", ".join(x.unique())),
    ).reset_index().sort_values("miss_count", ascending=False)

    return gaps


def print_summary(scores_df, gaps_df):
    """Print analysis summary."""
    print(f"\n{'=' * 70}")
    print("BAS CONTROL EFFECTIVENESS REPORT")
    print(f"{'=' * 70}")

    print(f"\nControl Scores:")
    for _, row in scores_df.iterrows():
        status = "PASS" if row["effectiveness"] >= 80 else "WARN" if row["effectiveness"] >= 60 else "FAIL"
        print(f"  [{status}] {row['control']:<15} "
              f"Effectiveness: {row['effectiveness']}% "
              f"(Prevent: {row['prevention_rate']}% | "
              f"Detect: {row['detection_rate']}% | "
              f"Miss: {row['gap_rate']}%)")

    if len(gaps_df) > 0:
        print(f"\nTop Security Gaps (attacks that bypass controls):")
        for _, row in gaps_df.head(10).iterrows():
            print(f"  {row['technique_id']}: {row['technique_name']} "
                  f"({row['miss_count']} misses)")


def main():
    parser = argparse.ArgumentParser(description="BAS Results Analyzer")
    subparsers = parser.add_subparsers(dest="command")

    a_p = subparsers.add_parser("analyze", help="Analyze control effectiveness")
    a_p.add_argument("--csv", required=True)
    a_p.add_argument("--output", default="control_scores.csv")

    g_p = subparsers.add_parser("gaps", help="Identify security gaps")
    g_p.add_argument("--csv", required=True)
    g_p.add_argument("--output", default="gaps.csv")

    args = parser.parse_args()

    if not args.command:
        parser.print_help()
        sys.exit(1)

    df = pd.read_csv(args.csv)

    if args.command == "analyze":
        scores = analyze_control_effectiveness(df)
        gaps = identify_gaps(df)
        print_summary(scores, gaps)
        scores.to_csv(args.output, index=False)
        print(f"\n[+] Control scores saved to {args.output}")

    elif args.command == "gaps":
        gaps = identify_gaps(df)
        gaps.to_csv(args.output, index=False)
        print(f"[+] {len(gaps)} gaps saved to {args.output}")


if __name__ == "__main__":
    main()