#!/usr/bin/env python3
"""Rapid7 InsightVM vulnerability scanning agent.

Interfaces with the InsightVM (Nexpose) REST API to manage scan
configurations, launch scans, retrieve vulnerability results, and
generate remediation reports. Supports site management, asset
discovery, and vulnerability prioritization.
"""
import argparse
import json
import os
import sys
import time
from datetime import datetime, timezone

try:
    import requests
    from requests.auth import HTTPBasicAuth
except ImportError:
    print("[!] 'requests' required: pip install requests", file=sys.stderr)
    sys.exit(1)


def get_insightvm_config():
    """Return InsightVM API connection config."""
    host = os.environ.get("INSIGHTVM_HOST", "localhost")
    port = os.environ.get("INSIGHTVM_PORT", "3780")
    user = os.environ.get("INSIGHTVM_USER", "")
    password = os.environ.get("INSIGHTVM_PASSWORD", "")
    return f"https://{host}:{port}", user, password


def api_call(base_url, endpoint, user, password, method="GET",
             data=None, params=None):
    """Make authenticated API call to InsightVM."""
    url = f"{base_url}/api/3{endpoint}"
    auth = HTTPBasicAuth(user, password)
    headers = {"Content-Type": "application/json", "Accept": "application/json"}
    if method == "POST":
        resp = requests.post(url, auth=auth, headers=headers, json=data,
                             params=params,
                             verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true", timeout=60)  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments
    elif method == "PUT":
        resp = requests.put(url, auth=auth, headers=headers, json=data,
                            verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true", timeout=60)  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments
    else:
        resp = requests.get(url, auth=auth, headers=headers, params=params,
                            verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true", timeout=60)  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments
    resp.raise_for_status()
    return resp.json()


def list_sites(base_url, user, password):
    """List all scan sites."""
    print("[*] Listing sites...")
    data = api_call(base_url, "/sites", user, password, params={"size": 500})
    sites = []
    for site in data.get("resources", []):
        sites.append({
            "id": site.get("id"),
            "name": site.get("name", ""),
            "description": site.get("description", ""),
            "type": site.get("type", ""),
            "assets": site.get("assets", 0),
            "last_scan_time": site.get("lastScanTime", ""),
            "risk_score": site.get("riskScore", 0),
        })
    print(f"[+] Found {len(sites)} sites")
    return sites


def get_site_vulnerabilities(base_url, user, password, site_id):
    """Get vulnerabilities for a specific site."""
    print(f"[*] Fetching vulnerabilities for site {site_id}...")
    vulns = []
    page = 0
    while True:
        data = api_call(base_url, f"/sites/{site_id}/vulnerabilities",
                        user, password, params={"page": page, "size": 100})
        resources = data.get("resources", [])
        if not resources:
            break
        for v in resources:
            vulns.append({
                "id": v.get("id", ""),
                "title": v.get("title", ""),
                "severity": v.get("severity", ""),
                "cvss_v3_score": v.get("cvss", {}).get("v3", {}).get("score", 0),
                "risk_score": v.get("riskScore", 0),
                "instances": v.get("instances", 0),
                "status": v.get("status", ""),
            })
        page += 1
        total_pages = data.get("page", {}).get("totalPages", 1)
        if page >= total_pages:
            break

    print(f"[+] Retrieved {len(vulns)} vulnerabilities")
    return vulns


def launch_scan(base_url, user, password, site_id, scan_name=None):
    """Launch a scan on a site."""
    if not scan_name:
        scan_name = f"agent-scan-{datetime.now(timezone.utc).strftime('%Y%m%d-%H%M%S')}"
    print(f"[*] Launching scan '{scan_name}' on site {site_id}...")
    data = api_call(base_url, f"/sites/{site_id}/scans", user, password,
                    method="POST", data={"name": scan_name})
    scan_id = data.get("id")
    print(f"[+] Scan started, ID: {scan_id}")
    return scan_id


def poll_scan_status(base_url, user, password, scan_id, max_wait=1800):
    """Poll scan status until completion."""
    print(f"[*] Waiting for scan {scan_id} to complete...")
    elapsed = 0
    interval = 30
    while elapsed < max_wait:
        data = api_call(base_url, f"/scans/{scan_id}", user, password)
        status = data.get("status", "unknown")
        if status in ("finished", "stopped", "error"):
            print(f"[+] Scan {status}")
            return status, data
        print(f"    Status: {status} ({elapsed}s)")
        time.sleep(interval)
        elapsed += interval
    print("[!] Scan timed out")
    return "timeout", {}


def get_scan_report(base_url, user, password, scan_id):
    """Get scan results summary."""
    data = api_call(base_url, f"/scans/{scan_id}", user, password)
    return {
        "scan_id": scan_id,
        "status": data.get("status", ""),
        "start_time": data.get("startTime", ""),
        "end_time": data.get("endTime", ""),
        "duration": data.get("duration", ""),
        "assets_discovered": data.get("assets", 0),
        "vulnerabilities": data.get("vulnerabilities", {}),
    }


def format_summary(sites, vulns=None, scan_report=None):
    """Print summary."""
    print(f"\n{'='*60}")
    print(f"  Rapid7 InsightVM Report")
    print(f"{'='*60}")

    if sites:
        print(f"\n  Sites ({len(sites)}):")
        for s in sites:
            print(f"    {s['name']:30s} | Assets: {s['assets']:5d} | "
                  f"Risk: {s['risk_score']:8.1f}")

    if vulns:
        severity_counts = {}
        for v in vulns:
            sev = v.get("severity", "unknown")
            severity_counts[sev] = severity_counts.get(sev, 0) + 1
        print(f"\n  Vulnerabilities ({len(vulns)}):")
        for sev in sorted(severity_counts.keys()):
            print(f"    {sev:15s}: {severity_counts[sev]}")

    if scan_report:
        print(f"\n  Scan Report:")
        print(f"    Status    : {scan_report.get('status', 'N/A')}")
        print(f"    Assets    : {scan_report.get('assets_discovered', 0)}")


def main():
    parser = argparse.ArgumentParser(description="Rapid7 InsightVM scanning agent")
    sub = parser.add_subparsers(dest="command")

    sub.add_parser("list-sites", help="List scan sites")

    p_vulns = sub.add_parser("get-vulns", help="Get site vulnerabilities")
    p_vulns.add_argument("--site-id", required=True, type=int)

    p_scan = sub.add_parser("scan", help="Launch a scan")
    p_scan.add_argument("--site-id", required=True, type=int)
    p_scan.add_argument("--wait", action="store_true", help="Wait for completion")
    p_scan.add_argument("--max-wait", type=int, default=1800)

    parser.add_argument("--host", help="InsightVM host (or INSIGHTVM_HOST env)")
    parser.add_argument("--user", help="Username (or INSIGHTVM_USER env)")
    parser.add_argument("--password", help="Password (or INSIGHTVM_PASSWORD env)")
    parser.add_argument("--output", "-o", help="Output JSON report")
    parser.add_argument("--verbose", "-v", action="store_true")
    args = parser.parse_args()

    if not args.command:
        parser.print_help()
        sys.exit(1)

    if args.host:
        os.environ["INSIGHTVM_HOST"] = args.host
    if args.user:
        os.environ["INSIGHTVM_USER"] = args.user
    if args.password:
        os.environ["INSIGHTVM_PASSWORD"] = args.password

    base_url, user, password = get_insightvm_config()
    if not user or not password:
        print("[!] Set INSIGHTVM_USER and INSIGHTVM_PASSWORD", file=sys.stderr)
        sys.exit(1)

    result = {}
    if args.command == "list-sites":
        sites = list_sites(base_url, user, password)
        format_summary(sites)
        result = {"sites": sites}
    elif args.command == "get-vulns":
        vulns = get_site_vulnerabilities(base_url, user, password, args.site_id)
        format_summary([], vulns)
        result = {"site_id": args.site_id, "vulnerabilities": vulns}
    elif args.command == "scan":
        scan_id = launch_scan(base_url, user, password, args.site_id)
        if args.wait:
            status, data = poll_scan_status(base_url, user, password, scan_id, args.max_wait)
            scan_report = get_scan_report(base_url, user, password, scan_id)
            format_summary([], scan_report=scan_report)
            result = {"scan_id": scan_id, "report": scan_report}
        else:
            result = {"scan_id": scan_id, "status": "launched"}

    report = {
        "timestamp": datetime.now(timezone.utc).isoformat(),
        "tool": "Rapid7 InsightVM",
        "command": args.command,
        "result": result,
    }

    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2)
        print(f"\n[+] Report saved to {args.output}")
    elif args.verbose:
        print(json.dumps(report, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Rapid7 InsightVM Scan Automation and Reporting Tool

Automates scan operations, asset queries, and vulnerability reporting
via the InsightVM API v3.

Requirements:
    pip install requests pandas tabulate

Usage:
    python process.py sites                          # List all sites
    python process.py scan --site-id 1               # Start scan for site
    python process.py status --scan-id 12345         # Check scan status
    python process.py vulns --asset-id 42            # Get asset vulnerabilities
    python process.py report --site-id 1 --output report.csv  # Export report
"""

import argparse
import json
import os
import sys
import time
import urllib3
from datetime import datetime

import pandas as pd
import requests

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


class InsightVMAPI:
    """Rapid7 InsightVM API v3 client."""

    def __init__(self, console_url, username=None, password=None, api_key=None):
        self.base_url = f"{console_url.rstrip('/')}/api/3"
        self.session = requests.Session()
        self.session.verify = not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true"  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments

        if api_key:
            self.session.headers.update({
                "Authorization": f"Bearer {api_key}",
                "Content-Type": "application/json"
            })
        elif username and password:
            self.session.auth = (username, password)
            self.session.headers.update({"Content-Type": "application/json"})
        else:
            raise ValueError("Provide either api_key or username/password")

    def _get_paginated(self, endpoint, params=None):
        """Fetch all pages from a paginated endpoint."""
        all_resources = []
        page = 0
        while True:
            p = params.copy() if params else {}
            p["page"] = page
            p["size"] = 100
            response = self.session.get(
                f"{self.base_url}/{endpoint}", params=p, timeout=60
            )
            response.raise_for_status()
            data = response.json()
            resources = data.get("resources", [])
            all_resources.extend(resources)
            total_pages = data.get("page", {}).get("totalPages", 1)
            page += 1
            if page >= total_pages:
                break
        return all_resources

    def list_sites(self):
        """List all scan sites."""
        return self._get_paginated("sites")

    def get_site(self, site_id):
        """Get details for a specific site."""
        response = self.session.get(
            f"{self.base_url}/sites/{site_id}", timeout=30
        )
        response.raise_for_status()
        return response.json()

    def start_scan(self, site_id, engine_id=None, template_id=None, hosts=None):
        """Start a scan for a site."""
        payload = {}
        if engine_id:
            payload["engineId"] = engine_id
        if template_id:
            payload["templateId"] = template_id
        if hosts:
            payload["hosts"] = hosts

        response = self.session.post(
            f"{self.base_url}/sites/{site_id}/scans",
            json=payload, timeout=30
        )
        response.raise_for_status()
        return response.json()

    def get_scan_status(self, scan_id):
        """Get the status of a scan."""
        response = self.session.get(
            f"{self.base_url}/scans/{scan_id}", timeout=30
        )
        response.raise_for_status()
        return response.json()

    def wait_for_scan(self, scan_id, poll_interval=30, timeout=3600):
        """Wait for a scan to complete."""
        start_time = time.time()
        while time.time() - start_time < timeout:
            status = self.get_scan_status(scan_id)
            state = status.get("status", "unknown")
            print(f"  Scan {scan_id}: {state} "
                  f"({status.get('assets', 0)} assets, "
                  f"{status.get('vulnerabilities', {}).get('total', 0)} vulns)")
            if state in ("finished", "stopped", "error", "aborted"):
                return status
            time.sleep(poll_interval)
        print(f"  [!] Scan timeout after {timeout}s")
        return None

    def get_site_assets(self, site_id):
        """Get all assets for a site."""
        return self._get_paginated(f"sites/{site_id}/assets")

    def get_asset_vulnerabilities(self, asset_id):
        """Get vulnerabilities for a specific asset."""
        return self._get_paginated(f"assets/{asset_id}/vulnerabilities")

    def get_vulnerability_details(self, vuln_id):
        """Get details for a specific vulnerability."""
        response = self.session.get(
            f"{self.base_url}/vulnerabilities/{vuln_id}", timeout=30
        )
        response.raise_for_status()
        return response.json()

    def list_scan_engines(self):
        """List all scan engines."""
        return self._get_paginated("scan_engines")

    def list_scan_templates(self):
        """List available scan templates."""
        return self._get_paginated("scan_templates")


def cmd_list_sites(api):
    """List all configured sites."""
    sites = api.list_sites()
    if not sites:
        print("No sites configured.")
        return

    print(f"\n{'ID':<6} {'Name':<35} {'Assets':<10} {'Last Scan':<20}")
    print("-" * 75)
    for site in sites:
        last_scan = site.get("lastScanTime", "Never")
        if last_scan != "Never":
            last_scan = last_scan[:19]
        print(f"{site['id']:<6} {site['name'][:34]:<35} "
              f"{site.get('assets', 0):<10} {last_scan:<20}")


def cmd_start_scan(api, site_id, engine_id=None, template_id=None, wait=False):
    """Start a scan for a site."""
    print(f"[*] Starting scan for site {site_id}...")
    result = api.start_scan(site_id, engine_id, template_id)
    scan_id = result.get("id")
    print(f"[+] Scan started: ID={scan_id}")

    if wait and scan_id:
        print("[*] Waiting for scan to complete...")
        final_status = api.wait_for_scan(scan_id)
        if final_status:
            print(f"\n[+] Scan completed: {final_status.get('status')}")
            vulns = final_status.get("vulnerabilities", {})
            print(f"    Total vulnerabilities: {vulns.get('total', 0)}")
            print(f"    Critical: {vulns.get('critical', 0)}")
            print(f"    Severe: {vulns.get('severe', 0)}")
            print(f"    Moderate: {vulns.get('moderate', 0)}")


def cmd_scan_status(api, scan_id):
    """Check scan status."""
    status = api.get_scan_status(scan_id)
    print(f"\nScan ID:     {status.get('id')}")
    print(f"Status:      {status.get('status')}")
    print(f"Start Time:  {status.get('startTime', 'N/A')}")
    print(f"End Time:    {status.get('endTime', 'N/A')}")
    print(f"Assets:      {status.get('assets', 0)}")
    vulns = status.get("vulnerabilities", {})
    print(f"Vulns Total: {vulns.get('total', 0)}")
    print(f"  Critical:  {vulns.get('critical', 0)}")
    print(f"  Severe:    {vulns.get('severe', 0)}")
    print(f"  Moderate:  {vulns.get('moderate', 0)}")


def cmd_asset_vulns(api, asset_id):
    """List vulnerabilities for an asset."""
    vulns = api.get_asset_vulnerabilities(asset_id)
    if not vulns:
        print(f"No vulnerabilities found for asset {asset_id}.")
        return

    print(f"\nVulnerabilities for asset {asset_id}: {len(vulns)} total\n")
    print(f"{'Vuln ID':<40} {'Severity':<10} {'CVSS':<8} {'Status':<12}")
    print("-" * 72)
    for v in sorted(vulns, key=lambda x: x.get("severity", ""), reverse=True):
        print(f"{v.get('id', 'N/A')[:39]:<40} "
              f"{v.get('severity', 'N/A'):<10} "
              f"{v.get('cvssV3Score', 'N/A'):<8} "
              f"{v.get('status', 'N/A'):<12}")


def cmd_export_report(api, site_id, output_file):
    """Export vulnerability report for a site to CSV."""
    print(f"[*] Fetching assets for site {site_id}...")
    assets = api.get_site_assets(site_id)
    print(f"[+] Found {len(assets)} assets")

    all_findings = []
    for asset in assets:
        asset_id = asset.get("id")
        hostname = asset.get("hostName", asset.get("ip", "unknown"))
        ip = asset.get("ip", "N/A")
        os_name = asset.get("os", {}).get("description", "Unknown")

        vulns = api.get_asset_vulnerabilities(asset_id)
        for v in vulns:
            all_findings.append({
                "asset_id": asset_id,
                "hostname": hostname,
                "ip_address": ip,
                "os": os_name,
                "vulnerability_id": v.get("id", ""),
                "severity": v.get("severity", ""),
                "cvss_v3_score": v.get("cvssV3Score", ""),
                "status": v.get("status", ""),
                "first_found": v.get("since", ""),
            })

        print(f"  Processed {hostname}: {len(vulns)} vulnerabilities")

    if all_findings:
        df = pd.DataFrame(all_findings)
        df = df.sort_values(["cvss_v3_score", "severity"], ascending=[False, False])
        df.to_csv(output_file, index=False)
        print(f"\n[+] Report exported to {output_file}")
        print(f"    Total findings: {len(all_findings)}")
        print(f"\n    Severity Distribution:")
        print(df["severity"].value_counts().to_string())
    else:
        print("[!] No findings to export.")


def main():
    parser = argparse.ArgumentParser(
        description="Rapid7 InsightVM Scan Automation Tool"
    )
    parser.add_argument("--console", default="https://localhost:3780",
                        help="InsightVM console URL")
    parser.add_argument("--username", help="Console username")
    parser.add_argument("--password", help="Console password")
    parser.add_argument("--api-key", help="API key (alternative to user/pass)")

    subparsers = parser.add_subparsers(dest="command")

    subparsers.add_parser("sites", help="List all scan sites")

    scan_p = subparsers.add_parser("scan", help="Start a scan")
    scan_p.add_argument("--site-id", type=int, required=True)
    scan_p.add_argument("--engine-id", type=int)
    scan_p.add_argument("--template-id", type=str)
    scan_p.add_argument("--wait", action="store_true")

    status_p = subparsers.add_parser("status", help="Check scan status")
    status_p.add_argument("--scan-id", type=int, required=True)

    vuln_p = subparsers.add_parser("vulns", help="List asset vulnerabilities")
    vuln_p.add_argument("--asset-id", type=int, required=True)

    report_p = subparsers.add_parser("report", help="Export vulnerability report")
    report_p.add_argument("--site-id", type=int, required=True)
    report_p.add_argument("--output", default="insightvm_report.csv")

    subparsers.add_parser("engines", help="List scan engines")
    subparsers.add_parser("templates", help="List scan templates")

    args = parser.parse_args()

    if not args.command:
        parser.print_help()
        sys.exit(1)

    api = InsightVMAPI(
        args.console,
        username=args.username,
        password=args.password,
        api_key=args.api_key
    )

    if args.command == "sites":
        cmd_list_sites(api)
    elif args.command == "scan":
        cmd_start_scan(api, args.site_id, args.engine_id,
                       args.template_id, args.wait)
    elif args.command == "status":
        cmd_scan_status(api, args.scan_id)
    elif args.command == "vulns":
        cmd_asset_vulns(api, args.asset_id)
    elif args.command == "report":
        cmd_export_report(api, args.site_id, args.output)
    elif args.command == "engines":
        engines = api.list_scan_engines()
        for e in engines:
            print(f"  Engine {e['id']}: {e['name']} - {e.get('address', 'N/A')}")
    elif args.command == "templates":
        templates = api.list_scan_templates()
        for t in templates:
            print(f"  {t['id']}: {t['name']}")


if __name__ == "__main__":
    main()