#!/usr/bin/env python3
"""Cortex XSOAR playbook management agent.

Interfaces with the Cortex XSOAR (Demisto) API to manage and audit
security playbooks, automation scripts, incidents, and integrations.
Supports listing playbooks, checking incident statistics, and
verifying integration health.
"""
import argparse
import json
import os
import sys
from datetime import datetime, timezone

try:
    import requests
except ImportError:
    print("[!] 'requests' required: pip install requests", file=sys.stderr)
    sys.exit(1)


def get_xsoar_config():
    """Return XSOAR server URL and API key."""
    server = os.environ.get("XSOAR_URL", "").rstrip("/")
    api_key = os.environ.get("XSOAR_API_KEY", "")
    if not server or not api_key:
        print("[!] Set XSOAR_URL and XSOAR_API_KEY env vars", file=sys.stderr)
        sys.exit(1)
    return server, api_key


def xsoar_api(server, api_key, endpoint, method="POST", data=None):
    """Make authenticated XSOAR API call."""
    url = f"{server}{endpoint}"
    headers = {"Authorization": api_key, "Content-Type": "application/json",
               "Accept": "application/json"}
    if method == "GET":
        resp = requests.get(url, headers=headers,
                            verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true", timeout=30)  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments
    else:
        resp = requests.post(url, headers=headers, json=data or {},
                             verify=not os.environ.get("SKIP_TLS_VERIFY", "").lower() == "true", timeout=30)  # Set SKIP_TLS_VERIFY=true for self-signed certs in lab environments
    resp.raise_for_status()
    return resp.json()


def list_playbooks(server, api_key, query=""):
    """List all playbooks."""
    print("[*] Fetching playbooks...")
    data = {"query": query, "page": 0, "size": 500}
    result = xsoar_api(server, api_key, "/playbook/search", data=data)
    playbooks = result.get("playbooks", [])
    print(f"[+] Found {len(playbooks)} playbooks")
    return [{
        "id": pb.get("id", ""),
        "name": pb.get("name", ""),
        "version": pb.get("version", 0),
        "deprecated": pb.get("deprecated", False),
        "hidden": pb.get("hidden", False),
        "system": pb.get("system", False),
        "modified": pb.get("modified", ""),
    } for pb in playbooks]


def get_incident_stats(server, api_key, days=30):
    """Get incident statistics."""
    print(f"[*] Fetching incident statistics (last {days}d)...")
    data = {"size": 0, "filter": {"period": {"by": "day", "fromValue": days}}}
    result = xsoar_api(server, api_key, "/incidents/search", data=data)
    total = result.get("total", 0)
    print(f"[+] {total} incidents in last {days} days")

    # Get status breakdown
    statuses = {}
    data_with_agg = {"size": 0, "filter": {"period": {"by": "day", "fromValue": days}},
                     "aggregations": [{"field": "status", "type": "terms"}]}
    try:
        agg_result = xsoar_api(server, api_key, "/incidents/search", data=data_with_agg)
        for bucket in agg_result.get("aggregations", {}).get("status", {}).get("buckets", []):
            statuses[bucket.get("key", "unknown")] = bucket.get("doc_count", 0)
    except (requests.RequestException, KeyError):
        pass

    return {"total": total, "period_days": days, "by_status": statuses}


def list_integrations(server, api_key):
    """List configured integrations and their health."""
    print("[*] Fetching integrations...")
    result = xsoar_api(server, api_key, "/settings/integration/search",
                       data={"size": 500})
    instances = result.get("instances", [])
    integrations = []
    for inst in instances:
        integrations.append({
            "name": inst.get("name", ""),
            "brand": inst.get("brand", ""),
            "enabled": inst.get("enabled", ""),
            "is_long_running": inst.get("isLongRunning", False),
            "configured": inst.get("configurationStatus", ""),
        })
    print(f"[+] Found {len(integrations)} integration instances")
    return integrations


def audit_playbook_health(playbooks, integrations):
    """Audit playbooks for common issues."""
    findings = []
    deprecated = [pb for pb in playbooks if pb.get("deprecated")]
    if deprecated:
        findings.append({
            "check": "Deprecated playbooks in use",
            "severity": "MEDIUM",
            "count": len(deprecated),
            "detail": ", ".join(pb["name"] for pb in deprecated[:5]),
        })

    disabled_integrations = [i for i in integrations if i.get("enabled") == "false"]
    if disabled_integrations:
        findings.append({
            "check": "Disabled integrations",
            "severity": "HIGH",
            "count": len(disabled_integrations),
            "detail": ", ".join(i["name"] for i in disabled_integrations[:5]),
        })

    return findings


def format_summary(playbooks, incident_stats, integrations, findings):
    """Print XSOAR audit summary."""
    print(f"\n{'='*60}")
    print(f"  Cortex XSOAR Playbook Audit Report")
    print(f"{'='*60}")
    print(f"  Playbooks    : {len(playbooks)}")
    print(f"  Integrations : {len(integrations)}")
    print(f"  Incidents    : {incident_stats.get('total', 0)} (last {incident_stats.get('period_days', 30)}d)")
    print(f"  Findings     : {len(findings)}")

    if incident_stats.get("by_status"):
        print(f"\n  Incidents by Status:")
        for status, count in incident_stats["by_status"].items():
            print(f"    {status:15s}: {count}")

    enabled_count = sum(1 for i in integrations if i.get("enabled") != "false")
    print(f"\n  Integrations: {enabled_count} enabled, {len(integrations) - enabled_count} disabled")

    severity_counts = {}
    for f in findings:
        sev = f.get("severity", "INFO")
        severity_counts[sev] = severity_counts.get(sev, 0) + 1
    return severity_counts


def main():
    parser = argparse.ArgumentParser(description="Cortex XSOAR playbook audit agent")
    parser.add_argument("--url", help="XSOAR URL (or XSOAR_URL env)")
    parser.add_argument("--api-key", help="API key (or XSOAR_API_KEY env)")
    parser.add_argument("--days", type=int, default=30, help="Incident stats period")
    parser.add_argument("--output", "-o", help="Output JSON report")
    parser.add_argument("--verbose", "-v", action="store_true")
    args = parser.parse_args()

    if args.url:
        os.environ["XSOAR_URL"] = args.url
    if args.api_key:
        os.environ["XSOAR_API_KEY"] = args.api_key

    server, api_key = get_xsoar_config()

    playbooks = list_playbooks(server, api_key)
    incident_stats = get_incident_stats(server, api_key, args.days)
    integrations = list_integrations(server, api_key)
    findings = audit_playbook_health(playbooks, integrations)

    severity_counts = format_summary(playbooks, incident_stats, integrations, findings)

    report = {
        "timestamp": datetime.now(timezone.utc).isoformat(),
        "tool": "Cortex XSOAR Audit",
        "playbooks": playbooks,
        "incident_stats": incident_stats,
        "integrations": integrations,
        "findings": findings,
        "severity_counts": severity_counts,
    }

    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2)
        print(f"\n[+] Report saved to {args.output}")
    elif args.verbose:
        print(json.dumps(report, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
XSOAR Playbook Builder and Validator

Generates XSOAR-compatible playbook YAML structures,
validates playbook logic, and tracks automation metrics.
"""

import json
import yaml
from datetime import datetime
from typing import Optional


class PlaybookTask:
    """Represents a single task in an XSOAR playbook."""

    def __init__(
        self,
        task_id: str,
        name: str,
        task_type: str = "regular",
        script: Optional[str] = None,
        playbook_name: Optional[str] = None,
        conditions: Optional[list] = None,
        next_tasks: Optional[dict] = None,
        script_arguments: Optional[dict] = None,
    ):
        self.task_id = task_id
        self.name = name
        self.task_type = task_type  # start, regular, condition, playbook, manual, title
        self.script = script
        self.playbook_name = playbook_name
        self.conditions = conditions or []
        self.next_tasks = next_tasks or {}
        self.script_arguments = script_arguments or {}

    def to_dict(self) -> dict:
        task = {
            "id": self.task_id,
            "taskid": self.task_id,
            "type": self.task_type,
            "task": {"name": self.name},
            "nexttasks": self.next_tasks,
        }
        if self.script:
            task["task"]["script"] = self.script
        if self.playbook_name:
            task["task"]["playbookName"] = self.playbook_name
        if self.conditions:
            task["conditions"] = self.conditions
        if self.script_arguments:
            task["scriptarguments"] = self.script_arguments
        return task


class XSOARPlaybook:
    """Represents a complete XSOAR playbook."""

    def __init__(self, name: str, description: str, incident_type: str):
        self.name = name
        self.description = description
        self.incident_type = incident_type
        self.tasks = {}
        self.start_task_id = "0"
        self.version = -1

    def add_task(self, task: PlaybookTask):
        self.tasks[task.task_id] = task

    def validate(self) -> dict:
        """Validate playbook structure and logic."""
        issues = []

        # Check start task exists
        if self.start_task_id not in self.tasks:
            issues.append("ERROR: Start task not found")

        # Check all referenced next tasks exist
        for task_id, task in self.tasks.items():
            for label, next_ids in task.next_tasks.items():
                for next_id in next_ids:
                    if next_id not in self.tasks:
                        issues.append(f"ERROR: Task {task_id} references non-existent task {next_id}")

        # Check for orphaned tasks (not reachable from start)
        reachable = set()
        queue = [self.start_task_id]
        while queue:
            current = queue.pop(0)
            if current in reachable:
                continue
            reachable.add(current)
            if current in self.tasks:
                for next_ids in self.tasks[current].next_tasks.values():
                    queue.extend(next_ids)

        orphaned = set(self.tasks.keys()) - reachable
        for orphan in orphaned:
            issues.append(f"WARNING: Task {orphan} ({self.tasks[orphan].name}) is not reachable")

        # Check conditional tasks have conditions
        for task_id, task in self.tasks.items():
            if task.task_type == "condition" and not task.conditions:
                issues.append(f"WARNING: Conditional task {task_id} has no conditions defined")

        # Check for manual review gates before destructive actions
        destructive_keywords = ["isolate", "block", "delete", "disable", "purge", "quarantine"]
        for task_id, task in self.tasks.items():
            if task.script and any(kw in task.script.lower() for kw in destructive_keywords):
                # Check if preceding task is manual
                has_manual_gate = False
                for other_id, other_task in self.tasks.items():
                    for next_ids in other_task.next_tasks.values():
                        if task_id in next_ids and other_task.task_type == "manual":
                            has_manual_gate = True
                if not has_manual_gate:
                    issues.append(
                        f"INFO: Destructive task {task_id} ({task.name}) "
                        f"has no manual approval gate"
                    )

        return {
            "playbook_name": self.name,
            "valid": not any(i.startswith("ERROR") for i in issues),
            "total_tasks": len(self.tasks),
            "reachable_tasks": len(reachable),
            "orphaned_tasks": len(orphaned),
            "issues": issues,
        }

    def to_yaml(self) -> str:
        playbook_dict = {
            "id": self.name.lower().replace(" ", "-"),
            "version": self.version,
            "name": self.name,
            "description": self.description,
            "starttaskid": self.start_task_id,
            "tasks": {tid: t.to_dict() for tid, t in self.tasks.items()},
        }
        return yaml.dump(playbook_dict, default_flow_style=False, sort_keys=False)


class SOARMetrics:
    """Track SOAR playbook performance metrics."""

    def __init__(self):
        self.executions = []

    def add_execution(
        self,
        playbook_name: str,
        incident_type: str,
        duration_seconds: int,
        manual_duration_seconds: int,
        tasks_automated: int,
        tasks_manual: int,
        success: bool,
    ):
        self.executions.append({
            "playbook_name": playbook_name,
            "incident_type": incident_type,
            "duration_seconds": duration_seconds,
            "manual_duration_seconds": manual_duration_seconds,
            "tasks_automated": tasks_automated,
            "tasks_manual": tasks_manual,
            "success": success,
            "timestamp": datetime.utcnow().isoformat(),
        })

    def calculate_roi(self, analyst_hourly_rate: float = 75.0) -> dict:
        total_manual_time = sum(e["manual_duration_seconds"] for e in self.executions)
        total_automated_time = sum(e["duration_seconds"] for e in self.executions)
        saved_seconds = total_manual_time - total_automated_time
        saved_hours = saved_seconds / 3600

        return {
            "total_executions": len(self.executions),
            "total_manual_time_hours": round(total_manual_time / 3600, 1),
            "total_automated_time_hours": round(total_automated_time / 3600, 1),
            "time_saved_hours": round(saved_hours, 1),
            "cost_savings": round(saved_hours * analyst_hourly_rate, 2),
            "automation_rate": round(
                sum(e["tasks_automated"] for e in self.executions)
                / max(1, sum(e["tasks_automated"] + e["tasks_manual"] for e in self.executions))
                * 100, 1
            ),
            "success_rate": round(
                sum(1 for e in self.executions if e["success"]) / max(1, len(self.executions)) * 100, 1
            ),
        }


def build_phishing_playbook() -> XSOARPlaybook:
    """Build a sample phishing investigation playbook."""
    pb = XSOARPlaybook(
        "Phishing Investigation",
        "Automated phishing email investigation with enrichment and response",
        "Phishing",
    )

    pb.add_task(PlaybookTask("0", "Start", "start", next_tasks={"#none#": ["1"]}))
    pb.add_task(PlaybookTask("1", "Extract Indicators from Email", "regular",
                             script="ParseEmailFiles", next_tasks={"#none#": ["2", "3", "4"]}))
    pb.add_task(PlaybookTask("2", "URL Enrichment", "playbook",
                             playbook_name="URL Enrichment - Generic v2", next_tasks={"#none#": ["5"]}))
    pb.add_task(PlaybookTask("3", "File Enrichment", "playbook",
                             playbook_name="File Enrichment - Generic v2", next_tasks={"#none#": ["5"]}))
    pb.add_task(PlaybookTask("4", "IP Enrichment", "playbook",
                             playbook_name="IP Enrichment - Generic v2", next_tasks={"#none#": ["5"]}))
    pb.add_task(PlaybookTask("5", "Is Email Malicious?", "condition",
                             conditions=[{"label": "yes", "operator": "isEqualString", "left": "DBotScore.Score", "right": "3"}],
                             next_tasks={"yes": ["6"], "no": ["9"]}))
    pb.add_task(PlaybookTask("6", "Approve Containment", "manual", next_tasks={"#none#": ["7"]}))
    pb.add_task(PlaybookTask("7", "Block Sender and Purge Emails", "regular",
                             script="o365-mail-block-sender", next_tasks={"#none#": ["8"]}))
    pb.add_task(PlaybookTask("8", "Notify User", "regular",
                             script="send-mail", next_tasks={"#none#": ["9"]}))
    pb.add_task(PlaybookTask("9", "Close Incident", "regular", script="closeInvestigation"))

    return pb


if __name__ == "__main__":
    playbook = build_phishing_playbook()

    print("=" * 70)
    print("XSOAR PLAYBOOK VALIDATOR")
    print("=" * 70)

    validation = playbook.validate()
    print(f"\nPlaybook: {validation['playbook_name']}")
    print(f"Valid: {validation['valid']}")
    print(f"Total Tasks: {validation['total_tasks']}")
    print(f"Reachable Tasks: {validation['reachable_tasks']}")
    for issue in validation["issues"]:
        print(f"  {issue}")

    print(f"\n{'=' * 70}")
    print("GENERATED PLAYBOOK YAML")
    print("=" * 70)
    print(playbook.to_yaml())

    # Simulate metrics
    metrics = SOARMetrics()
    metrics.add_execution("Phishing Investigation", "Phishing", 300, 2700, 8, 1, True)
    metrics.add_execution("Phishing Investigation", "Phishing", 240, 2700, 8, 1, True)
    metrics.add_execution("Phishing Investigation", "Phishing", 360, 2700, 7, 2, True)
    metrics.add_execution("Phishing Investigation", "Phishing", 280, 2700, 8, 1, False)

    print(f"\n{'=' * 70}")
    print("SOAR ROI METRICS")
    print("=" * 70)
    roi = metrics.calculate_roi()
    for key, value in roi.items():
        print(f"  {key}: {value}")