#!/usr/bin/env python3
"""Vulnerability remediation SLA tracking agent.

Tracks vulnerability remediation against defined SLA targets based on
severity. Ingests vulnerability data from scanners (JSON/CSV format),
calculates SLA compliance, identifies overdue items, and generates
remediation priority reports.
"""
import argparse
import csv
import json
import os
import sys
from datetime import datetime, timezone, timedelta


DEFAULT_SLA_DAYS = {
    "CRITICAL": 7,
    "HIGH": 30,
    "MEDIUM": 90,
    "LOW": 180,
}


def load_vulnerabilities(source_path):
    """Load vulnerabilities from a JSON or CSV file."""
    ext = os.path.splitext(source_path)[1].lower()
    if ext == ".json":
        with open(source_path, "r") as f:
            data = json.load(f)
        if isinstance(data, list):
            return data
        return data.get("vulnerabilities", data.get("findings", data.get("results", [])))
    elif ext == ".csv":
        vulns = []
        with open(source_path, "r", newline="") as f:
            reader = csv.DictReader(f)
            for row in reader:
                vulns.append(row)
        return vulns
    else:
        print(f"[!] Unsupported file format: {ext}", file=sys.stderr)
        return []


def normalize_vulnerability(vuln):
    """Normalize vulnerability fields from various scanner formats."""
    return {
        "id": (vuln.get("id") or vuln.get("vulnerability_id") or
               vuln.get("cve_id") or vuln.get("CVE") or vuln.get("plugin_id") or "unknown"),
        "severity": (vuln.get("severity") or vuln.get("risk") or
                     vuln.get("Severity") or "MEDIUM").upper(),
        "title": (vuln.get("title") or vuln.get("name") or
                  vuln.get("vulnerability_name") or vuln.get("Title") or "Unknown"),
        "asset": (vuln.get("asset") or vuln.get("host") or
                  vuln.get("ip") or vuln.get("hostname") or "unknown"),
        "discovered_date": (vuln.get("discovered_date") or vuln.get("first_found") or
                           vuln.get("discovered") or vuln.get("date_found") or
                           datetime.now(timezone.utc).isoformat()),
        "status": (vuln.get("status") or vuln.get("state") or "open").lower(),
        "remediation": (vuln.get("remediation") or vuln.get("fix") or
                       vuln.get("solution") or ""),
    }


def calculate_sla_status(vulns, sla_days=None):
    """Calculate SLA compliance for each vulnerability."""
    if sla_days is None:
        sla_days = DEFAULT_SLA_DAYS

    now = datetime.now(timezone.utc)
    results = []

    for vuln in vulns:
        norm = normalize_vulnerability(vuln)
        if norm["status"] not in ("open", "new", "active", "unresolved"):
            norm["sla_status"] = "RESOLVED"
            norm["sla_days_remaining"] = None
            results.append(norm)
            continue

        severity = norm["severity"]
        target_days = sla_days.get(severity, sla_days.get("MEDIUM", 90))

        try:
            disc_str = norm["discovered_date"]
            if "T" in disc_str:
                discovered = datetime.fromisoformat(disc_str.replace("Z", "+00:00"))
            else:
                discovered = datetime.strptime(disc_str[:10], "%Y-%m-%d").replace(tzinfo=timezone.utc)
        except (ValueError, TypeError):
            discovered = now
            norm["parse_warning"] = "Could not parse discovered_date"

        age_days = (now - discovered).days
        sla_deadline = discovered + timedelta(days=target_days)
        days_remaining = (sla_deadline - now).days

        norm["age_days"] = age_days
        norm["sla_target_days"] = target_days
        norm["sla_deadline"] = sla_deadline.isoformat()
        norm["sla_days_remaining"] = days_remaining

        if days_remaining < 0:
            norm["sla_status"] = "BREACHED"
            norm["sla_overdue_days"] = abs(days_remaining)
        elif days_remaining <= 7:
            norm["sla_status"] = "AT_RISK"
        else:
            norm["sla_status"] = "ON_TRACK"

        results.append(norm)

    return results


def generate_metrics(results):
    """Generate SLA compliance metrics."""
    open_vulns = [r for r in results if r.get("sla_status") != "RESOLVED"]
    breached = [r for r in open_vulns if r.get("sla_status") == "BREACHED"]
    at_risk = [r for r in open_vulns if r.get("sla_status") == "AT_RISK"]
    on_track = [r for r in open_vulns if r.get("sla_status") == "ON_TRACK"]

    compliance_rate = ((len(on_track) + len(at_risk)) / len(open_vulns) * 100) if open_vulns else 100.0

    by_severity = {}
    for r in open_vulns:
        sev = r.get("severity", "MEDIUM")
        by_severity.setdefault(sev, {"total": 0, "breached": 0, "at_risk": 0})
        by_severity[sev]["total"] += 1
        if r.get("sla_status") == "BREACHED":
            by_severity[sev]["breached"] += 1
        elif r.get("sla_status") == "AT_RISK":
            by_severity[sev]["at_risk"] += 1

    oldest_breach = None
    if breached:
        oldest = max(breached, key=lambda r: r.get("sla_overdue_days", 0))
        oldest_breach = {
            "id": oldest["id"],
            "severity": oldest["severity"],
            "overdue_days": oldest.get("sla_overdue_days", 0),
            "asset": oldest["asset"],
        }

    return {
        "total_open": len(open_vulns),
        "breached": len(breached),
        "at_risk": len(at_risk),
        "on_track": len(on_track),
        "resolved": len(results) - len(open_vulns),
        "compliance_rate": round(compliance_rate, 1),
        "by_severity": by_severity,
        "oldest_breach": oldest_breach,
    }


def format_summary(metrics, results):
    """Print SLA tracking summary."""
    print(f"\n{'='*60}")
    print(f"  Vulnerability Remediation SLA Report")
    print(f"{'='*60}")
    print(f"  Open Vulnerabilities : {metrics['total_open']}")
    print(f"  SLA Breached         : {metrics['breached']}")
    print(f"  At Risk (<7 days)    : {metrics['at_risk']}")
    print(f"  On Track             : {metrics['on_track']}")
    print(f"  Resolved             : {metrics['resolved']}")
    print(f"  Compliance Rate      : {metrics['compliance_rate']}%")

    print(f"\n  By Severity:")
    for sev in ["CRITICAL", "HIGH", "MEDIUM", "LOW"]:
        data = metrics["by_severity"].get(sev, {})
        if data.get("total", 0) > 0:
            print(f"    {sev:10s}: {data['total']} open, {data['breached']} breached, {data['at_risk']} at-risk")

    breached = [r for r in results if r.get("sla_status") == "BREACHED"]
    if breached:
        print(f"\n  SLA Breached ({len(breached)}):")
        for r in sorted(breached, key=lambda x: -x.get("sla_overdue_days", 0))[:15]:
            print(f"    [{r['severity']:8s}] {r['id']:20s} | {r['asset']:20s} | "
                  f"{r.get('sla_overdue_days', 0)}d overdue | {r['title'][:30]}")

    if metrics.get("oldest_breach"):
        ob = metrics["oldest_breach"]
        print(f"\n  Worst Breach: {ob['id']} ({ob['severity']}) on {ob['asset']} - "
              f"{ob['overdue_days']} days overdue")


def main():
    parser = argparse.ArgumentParser(description="Vulnerability remediation SLA tracking agent")
    parser.add_argument("--source", required=True, help="Vulnerability data file (JSON or CSV)")
    parser.add_argument("--sla-critical", type=int, default=7, help="SLA days for CRITICAL (default: 7)")
    parser.add_argument("--sla-high", type=int, default=30, help="SLA days for HIGH (default: 30)")
    parser.add_argument("--sla-medium", type=int, default=90, help="SLA days for MEDIUM (default: 90)")
    parser.add_argument("--sla-low", type=int, default=180, help="SLA days for LOW (default: 180)")
    parser.add_argument("--output", "-o", help="Output JSON report")
    parser.add_argument("--verbose", "-v", action="store_true")
    args = parser.parse_args()

    sla_days = {
        "CRITICAL": args.sla_critical,
        "HIGH": args.sla_high,
        "MEDIUM": args.sla_medium,
        "LOW": args.sla_low,
    }

    vulns = load_vulnerabilities(args.source)
    print(f"[*] Loaded {len(vulns)} vulnerabilities from {args.source}")

    results = calculate_sla_status(vulns, sla_days)
    metrics = generate_metrics(results)
    format_summary(metrics, results)

    report = {
        "timestamp": datetime.now(timezone.utc).isoformat(),
        "tool": "Vulnerability SLA Tracker",
        "source": args.source,
        "sla_targets": sla_days,
        "metrics": metrics,
        "vulnerabilities": results,
    }

    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2)
        print(f"\n[+] Report saved to {args.output}")
    elif args.verbose:
        print(json.dumps(report, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Vulnerability Remediation SLA Tracking Engine

Calculates SLA deadlines, monitors compliance, generates breach
notifications, and produces executive reporting dashboards.

Requirements:
    pip install pandas jinja2

Usage:
    python process.py calculate --vulns vulns.csv --assets assets.csv --output sla_assignments.csv
    python process.py monitor --sla-csv sla_assignments.csv --report sla_report.html
"""

import argparse
import json
import sys
from datetime import datetime, timedelta

import pandas as pd


class SLACalculator:
    """Calculate remediation SLA deadlines based on severity and asset tier."""

    DEFAULT_SLA_MATRIX = {
        ("Critical", "Tier1"): 2,
        ("Critical", "Tier2"): 3,
        ("Critical", "Tier3"): 7,
        ("High", "Tier1"): 7,
        ("High", "Tier2"): 14,
        ("High", "Tier3"): 30,
        ("Medium", "Tier1"): 30,
        ("Medium", "Tier2"): 45,
        ("Medium", "Tier3"): 60,
        ("Low", "Tier1"): 90,
        ("Low", "Tier2"): 90,
        ("Low", "Tier3"): 90,
    }

    SLA_ACCELERATORS = {
        "in_cisa_kev": 0.5,
        "exploit_available": 0.5,
        "internet_facing": 0.5,
        "epss_high": 0.5,
    }

    def __init__(self, sla_matrix: dict = None):
        self.sla_matrix = sla_matrix or self.DEFAULT_SLA_MATRIX

    def get_severity_label(self, cvss_score: float) -> str:
        """Map CVSS score to severity label."""
        if cvss_score >= 9.0:
            return "Critical"
        elif cvss_score >= 7.0:
            return "High"
        elif cvss_score >= 4.0:
            return "Medium"
        elif cvss_score > 0:
            return "Low"
        return "Info"

    def calculate_sla(self, severity: str, tier: str, accelerators: dict = None) -> int:
        """Calculate SLA days based on severity, tier, and accelerators."""
        base_sla = self.sla_matrix.get((severity, tier), 90)

        if accelerators:
            for accel, factor in self.SLA_ACCELERATORS.items():
                if accelerators.get(accel, False):
                    base_sla = int(base_sla * factor)

        return max(base_sla, 1)

    def assign_slas(self, vulns_df: pd.DataFrame, assets_df: pd.DataFrame) -> pd.DataFrame:
        """Assign SLA deadlines to all vulnerabilities."""
        merged = vulns_df.merge(
            assets_df[["hostname", "tier", "internet_facing"]],
            on="hostname", how="left"
        )

        results = []
        for _, row in merged.iterrows():
            severity = row.get("severity", self.get_severity_label(float(row.get("cvss_score", 0))))
            tier = row.get("tier", "Tier3")

            accelerators = {
                "in_cisa_kev": row.get("in_cisa_kev", False),
                "exploit_available": row.get("exploit_available", False),
                "internet_facing": row.get("internet_facing", False),
                "epss_high": float(row.get("epss_score", 0)) > 0.5,
            }

            sla_days = self.calculate_sla(severity, tier, accelerators)
            discovery_date = pd.to_datetime(row.get("discovery_date", datetime.now()))
            deadline = discovery_date + timedelta(days=sla_days)

            results.append({
                **row.to_dict(),
                "severity": severity,
                "sla_days": sla_days,
                "discovery_date": discovery_date.isoformat(),
                "sla_deadline": deadline.isoformat(),
                "days_remaining": (deadline - datetime.now()).days,
                "sla_status": self._get_sla_status(deadline, row.get("remediated_date")),
            })

        return pd.DataFrame(results)

    def _get_sla_status(self, deadline: datetime, remediated_date=None) -> str:
        """Determine SLA status."""
        now = datetime.now()
        if remediated_date and pd.notna(remediated_date):
            rem_date = pd.to_datetime(remediated_date)
            if isinstance(deadline, str):
                deadline = pd.to_datetime(deadline)
            return "compliant" if rem_date <= deadline else "breached_remediated"

        if isinstance(deadline, str):
            deadline = pd.to_datetime(deadline)

        days_remaining = (deadline - now).days
        if days_remaining < 0:
            return "breached"
        elif days_remaining <= 3:
            return "critical"
        elif days_remaining <= 7:
            return "warning"
        return "on_track"


class SLAMonitor:
    """Monitor SLA compliance and generate reports."""

    def __init__(self, sla_df: pd.DataFrame):
        self.sla_df = sla_df

    def get_compliance_summary(self) -> dict:
        """Calculate overall SLA compliance metrics."""
        total = len(self.sla_df)
        status_counts = self.sla_df["sla_status"].value_counts().to_dict()

        compliant = status_counts.get("compliant", 0) + status_counts.get("on_track", 0)
        breached = status_counts.get("breached", 0) + status_counts.get("breached_remediated", 0)
        warning = status_counts.get("warning", 0) + status_counts.get("critical", 0)

        remediated = self.sla_df[self.sla_df["sla_status"].isin(["compliant", "breached_remediated"])]
        if not remediated.empty:
            mttr_data = remediated.copy()
            mttr_data["disc"] = pd.to_datetime(mttr_data["discovery_date"])
            mttr_data["rem"] = pd.to_datetime(mttr_data.get("remediated_date", datetime.now()))
            avg_mttr = (mttr_data["rem"] - mttr_data["disc"]).dt.days.mean()
        else:
            avg_mttr = 0

        return {
            "total_vulns": total,
            "compliant": compliant,
            "compliance_rate": f"{compliant / max(total, 1) * 100:.1f}%",
            "breached": breached,
            "breach_rate": f"{breached / max(total, 1) * 100:.1f}%",
            "at_risk": warning,
            "avg_mttr_days": round(avg_mttr, 1),
            "by_severity": self.sla_df.groupby("severity")["sla_status"].value_counts().to_dict(),
        }

    def get_breach_list(self) -> pd.DataFrame:
        """Get list of SLA-breached vulnerabilities."""
        return self.sla_df[self.sla_df["sla_status"] == "breached"].sort_values("days_remaining")

    def generate_report(self, output_path: str):
        """Generate SLA compliance HTML report."""
        summary = self.get_compliance_summary()
        breaches = self.get_breach_list().head(30)

        by_sev = self.sla_df.groupby("severity").agg(
            total=("sla_status", "count"),
            compliant=("sla_status", lambda x: (x.isin(["compliant", "on_track"])).sum()),
            breached=("sla_status", lambda x: (x.isin(["breached", "breached_remediated"])).sum()),
        ).reset_index()
        by_sev["rate"] = (by_sev["compliant"] / by_sev["total"] * 100).round(1)

        html = f"""<!DOCTYPE html>
<html>
<head>
    <title>SLA Compliance Dashboard - {datetime.now().strftime('%Y-%m-%d')}</title>
    <style>
        body {{ font-family: Arial, sans-serif; margin: 20px; background: #f5f5f5; }}
        .header {{ background: #0f3460; color: white; padding: 20px; border-radius: 8px; }}
        .metrics {{ display: flex; gap: 15px; margin: 20px 0; flex-wrap: wrap; }}
        .card {{ background: white; padding: 20px; border-radius: 8px; flex: 1; min-width: 180px;
                 box-shadow: 0 2px 4px rgba(0,0,0,0.1); text-align: center; }}
        .card h3 {{ margin: 0; font-size: 2em; }}
        .green {{ border-top: 4px solid #27ae60; }}
        .red {{ border-top: 4px solid #e74c3c; }}
        .yellow {{ border-top: 4px solid #f39c12; }}
        table {{ width: 100%; border-collapse: collapse; background: white; margin: 15px 0;
                 box-shadow: 0 2px 4px rgba(0,0,0,0.1); }}
        th {{ background: #2c3e50; color: white; padding: 10px; text-align: left; }}
        td {{ padding: 8px 10px; border-bottom: 1px solid #eee; }}
    </style>
</head>
<body>
    <div class="header">
        <h1>Vulnerability Remediation SLA Dashboard</h1>
        <p>Report Date: {datetime.now().strftime('%Y-%m-%d %H:%M')}</p>
    </div>
    <div class="metrics">
        <div class="card green"><h3>{summary['compliance_rate']}</h3><p>SLA Compliance</p></div>
        <div class="card red"><h3>{summary['breached']}</h3><p>SLA Breaches</p></div>
        <div class="card yellow"><h3>{summary['at_risk']}</h3><p>At Risk</p></div>
        <div class="card"><h3>{summary['avg_mttr_days']}d</h3><p>Avg MTTR</p></div>
    </div>

    <h2>Compliance by Severity</h2>
    <table>
        <tr><th>Severity</th><th>Total</th><th>Compliant</th><th>Breached</th><th>Rate</th></tr>
        {''.join(f"<tr><td>{r.severity}</td><td>{r.total}</td><td>{r.compliant}</td><td>{r.breached}</td><td>{r.rate}%</td></tr>" for r in by_sev.itertuples())}
    </table>

    <h2>Active SLA Breaches (Top 30)</h2>
    <table>
        <tr><th>Host</th><th>CVE</th><th>Severity</th><th>SLA Days</th><th>Days Overdue</th></tr>
        {''.join(f"<tr><td>{r.hostname if hasattr(r,'hostname') else ''}</td><td>{r.cve if hasattr(r,'cve') else ''}</td><td>{r.severity}</td><td>{r.sla_days}</td><td>{abs(r.days_remaining)}</td></tr>" for r in breaches.itertuples())}
    </table>
</body>
</html>"""

        with open(output_path, "w", encoding="utf-8") as f:
            f.write(html)
        print(f"[+] SLA report saved to: {output_path}")


def main():
    parser = argparse.ArgumentParser(description="Vulnerability Remediation SLA Engine")
    subparsers = parser.add_subparsers(dest="command")

    calc_p = subparsers.add_parser("calculate", help="Assign SLA deadlines")
    calc_p.add_argument("--vulns", required=True, help="Vulnerabilities CSV")
    calc_p.add_argument("--assets", required=True, help="Assets CSV")
    calc_p.add_argument("--output", required=True, help="Output SLA CSV")

    mon_p = subparsers.add_parser("monitor", help="Monitor SLA compliance")
    mon_p.add_argument("--sla-csv", required=True, help="SLA assignments CSV")
    mon_p.add_argument("--report", default="sla_report.html", help="HTML report output")

    args = parser.parse_args()

    if args.command == "calculate":
        calc = SLACalculator()
        vulns = pd.read_csv(args.vulns)
        assets = pd.read_csv(args.assets)
        result = calc.assign_slas(vulns, assets)
        result.to_csv(args.output, index=False)
        print(f"[+] SLA assignments saved to: {args.output}")
        print(f"    Total: {len(result)}, Breached: {len(result[result['sla_status']=='breached'])}")

    elif args.command == "monitor":
        sla_df = pd.read_csv(args.sla_csv)
        monitor = SLAMonitor(sla_df)
        summary = monitor.get_compliance_summary()
        print(f"\n=== SLA Compliance Summary ===")
        print(f"Compliance Rate: {summary['compliance_rate']}")
        print(f"Breaches: {summary['breached']}")
        print(f"Avg MTTR: {summary['avg_mttr_days']} days")
        monitor.generate_report(args.report)

    else:
        parser.print_help()


if __name__ == "__main__":
    main()