#!/usr/bin/env python3
"""Vulnerability SLA breach alerting agent.

Monitors vulnerability remediation timelines and generates alerts when
SLA breaches occur or are imminent. Supports webhook notifications
(Slack, Teams, PagerDuty), email alerts, and escalation workflows.
"""
import argparse
import json
import os
import sys
from datetime import datetime, timezone, timedelta

try:
    import requests
except ImportError:
    requests = None


DEFAULT_SLA_DAYS = {"CRITICAL": 7, "HIGH": 30, "MEDIUM": 90, "LOW": 180}


def load_vulnerabilities(source_path):
    """Load vulnerability data from JSON file."""
    with open(source_path, "r") as f:
        data = json.load(f)
    if isinstance(data, list):
        return data
    return data.get("vulnerabilities", data.get("findings", []))


def check_sla_breaches(vulns, sla_days=None, warn_days_before=7):
    """Check for SLA breaches and upcoming deadlines."""
    if sla_days is None:
        sla_days = DEFAULT_SLA_DAYS

    now = datetime.now(timezone.utc)
    breaches = []
    warnings = []

    for vuln in vulns:
        status = (vuln.get("status") or vuln.get("state") or "open").lower()
        if status not in ("open", "new", "active", "unresolved"):
            continue

        severity = (vuln.get("severity") or "MEDIUM").upper()
        target_days = sla_days.get(severity, 90)

        disc_str = (vuln.get("discovered_date") or vuln.get("first_found") or
                    vuln.get("discovered") or "")
        try:
            if "T" in disc_str:
                discovered = datetime.fromisoformat(disc_str.replace("Z", "+00:00"))
            elif disc_str:
                discovered = datetime.strptime(disc_str[:10], "%Y-%m-%d").replace(tzinfo=timezone.utc)
            else:
                continue
        except (ValueError, TypeError):
            continue

        deadline = discovered + timedelta(days=target_days)
        days_remaining = (deadline - now).days

        vuln_id = vuln.get("id") or vuln.get("cve_id") or vuln.get("vulnerability_id") or "unknown"
        asset = vuln.get("asset") or vuln.get("host") or vuln.get("ip") or "unknown"
        title = vuln.get("title") or vuln.get("name") or "Unknown"

        alert_entry = {
            "id": vuln_id,
            "severity": severity,
            "asset": asset,
            "title": title[:80],
            "discovered": disc_str[:10],
            "deadline": deadline.isoformat()[:10],
            "days_remaining": days_remaining,
            "sla_target_days": target_days,
        }

        if days_remaining < 0:
            alert_entry["alert_type"] = "BREACH"
            alert_entry["overdue_days"] = abs(days_remaining)
            breaches.append(alert_entry)
        elif days_remaining <= warn_days_before:
            alert_entry["alert_type"] = "WARNING"
            warnings.append(alert_entry)

    breaches.sort(key=lambda x: -x.get("overdue_days", 0))
    warnings.sort(key=lambda x: x.get("days_remaining", 999))
    return breaches, warnings


def send_slack_alert(webhook_url, breaches, warnings):
    """Send SLA breach alert to Slack via webhook."""
    if not requests:
        print("[!] requests library required for Slack alerts", file=sys.stderr)
        return False

    blocks = [
        {"type": "header", "text": {"type": "plain_text",
         "text": f"Vulnerability SLA Alert - {len(breaches)} Breaches, {len(warnings)} Warnings"}},
    ]

    if breaches:
        breach_text = "*SLA BREACHES (Immediate Action Required):*\n"
        for b in breaches[:10]:
            breach_text += (f"- [{b['severity']}] `{b['id']}` on {b['asset']} - "
                           f"*{b['overdue_days']}d overdue*\n")
        blocks.append({"type": "section", "text": {"type": "mrkdwn", "text": breach_text}})

    if warnings:
        warn_text = "*Approaching SLA Deadline:*\n"
        for w in warnings[:10]:
            warn_text += (f"- [{w['severity']}] `{w['id']}` on {w['asset']} - "
                         f"{w['days_remaining']}d remaining\n")
        blocks.append({"type": "section", "text": {"type": "mrkdwn", "text": warn_text}})

    payload = {"blocks": blocks}
    resp = requests.post(webhook_url, json=payload, timeout=15)
    if resp.status_code == 200:
        print(f"[+] Slack alert sent successfully")
        return True
    else:
        print(f"[!] Slack alert failed: {resp.status_code}", file=sys.stderr)
        return False


def send_teams_alert(webhook_url, breaches, warnings):
    """Send SLA breach alert to Microsoft Teams via webhook."""
    if not requests:
        return False

    facts = []
    for b in breaches[:5]:
        facts.append({"name": f"[BREACH] {b['id']}", "value": f"{b['severity']} - {b['overdue_days']}d overdue on {b['asset']}"})
    for w in warnings[:5]:
        facts.append({"name": f"[WARNING] {w['id']}", "value": f"{w['severity']} - {w['days_remaining']}d left on {w['asset']}"})

    payload = {
        "@type": "MessageCard",
        "themeColor": "FF0000" if breaches else "FFA500",
        "summary": f"SLA Alert: {len(breaches)} breaches, {len(warnings)} warnings",
        "sections": [{
            "activityTitle": "Vulnerability SLA Alert",
            "facts": facts,
        }],
    }
    resp = requests.post(webhook_url, json=payload, timeout=15)
    return resp.status_code == 200


def send_pagerduty_alert(routing_key, breaches):
    """Send PagerDuty incident for critical SLA breaches."""
    if not requests or not breaches:
        return False

    critical_breaches = [b for b in breaches if b["severity"] == "CRITICAL"]
    if not critical_breaches:
        return False

    payload = {
        "routing_key": routing_key,
        "event_action": "trigger",
        "payload": {
            "summary": f"{len(critical_breaches)} CRITICAL vulnerability SLA breaches",
            "severity": "critical",
            "source": "vulnerability-sla-agent",
            "custom_details": {
                "breaches": critical_breaches[:5],
                "total_critical_breaches": len(critical_breaches),
            },
        },
    }
    resp = requests.post(
        "https://events.pagerduty.com/v2/enqueue",
        json=payload, timeout=15,
    )
    if resp.status_code == 202:
        print(f"[+] PagerDuty incident created")
        return True
    return False


def format_summary(breaches, warnings):
    """Print alert summary."""
    print(f"\n{'='*60}")
    print(f"  Vulnerability SLA Breach Alert Report")
    print(f"{'='*60}")
    print(f"  SLA Breaches  : {len(breaches)}")
    print(f"  SLA Warnings  : {len(warnings)}")

    if breaches:
        critical = sum(1 for b in breaches if b["severity"] == "CRITICAL")
        high = sum(1 for b in breaches if b["severity"] == "HIGH")
        print(f"    Critical breaches: {critical}")
        print(f"    High breaches    : {high}")

        print(f"\n  Breached Vulnerabilities:")
        for b in breaches[:15]:
            print(f"    [{b['severity']:8s}] {b['id']:20s} | {b['asset']:20s} | "
                  f"{b['overdue_days']}d overdue (deadline: {b['deadline']})")

    if warnings:
        print(f"\n  Approaching Deadline:")
        for w in warnings[:10]:
            print(f"    [{w['severity']:8s}] {w['id']:20s} | {w['asset']:20s} | "
                  f"{w['days_remaining']}d remaining")


def main():
    parser = argparse.ArgumentParser(description="Vulnerability SLA breach alerting agent")
    parser.add_argument("--source", required=True, help="Vulnerability data JSON file")
    parser.add_argument("--sla-critical", type=int, default=7)
    parser.add_argument("--sla-high", type=int, default=30)
    parser.add_argument("--sla-medium", type=int, default=90)
    parser.add_argument("--sla-low", type=int, default=180)
    parser.add_argument("--warn-days", type=int, default=7, help="Warn N days before deadline")
    parser.add_argument("--slack-webhook", help="Slack webhook URL for alerts")
    parser.add_argument("--teams-webhook", help="Teams webhook URL for alerts")
    parser.add_argument("--pagerduty-key", help="PagerDuty routing key for critical breaches")
    parser.add_argument("--output", "-o", help="Output JSON report")
    parser.add_argument("--verbose", "-v", action="store_true")
    args = parser.parse_args()

    sla_days = {
        "CRITICAL": args.sla_critical, "HIGH": args.sla_high,
        "MEDIUM": args.sla_medium, "LOW": args.sla_low,
    }

    vulns = load_vulnerabilities(args.source)
    print(f"[*] Loaded {len(vulns)} vulnerabilities")

    breaches, warnings = check_sla_breaches(vulns, sla_days, args.warn_days)
    format_summary(breaches, warnings)

    alerts_sent = []
    if args.slack_webhook and (breaches or warnings):
        if send_slack_alert(args.slack_webhook, breaches, warnings):
            alerts_sent.append("slack")
    if args.teams_webhook and (breaches or warnings):
        if send_teams_alert(args.teams_webhook, breaches, warnings):
            alerts_sent.append("teams")
    if args.pagerduty_key and breaches:
        if send_pagerduty_alert(args.pagerduty_key, breaches):
            alerts_sent.append("pagerduty")

    report = {
        "timestamp": datetime.now(timezone.utc).isoformat(),
        "tool": "SLA Breach Alerting",
        "sla_targets": sla_days,
        "breaches": breaches,
        "warnings": warnings,
        "alerts_sent": alerts_sent,
    }

    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2)
        print(f"\n[+] Report saved to {args.output}")
    elif args.verbose:
        print(json.dumps(report, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""Vulnerability SLA Breach Alerting System.

Tracks vulnerability remediation timelines, detects SLA breaches,
and dispatches notifications through multiple channels.
"""

import argparse
import csv
import json
import os
import smtplib
import sqlite3
from datetime import datetime, timedelta, timezone
from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
from pathlib import Path

import requests
import yaml

DB_PATH = os.environ.get("SLA_DB_PATH", "vulnerability_sla.db")

SLA_TIERS = {
    "critical": {"cvss_min": 9.0, "cvss_max": 10.0, "days": 2},
    "high": {"cvss_min": 7.0, "cvss_max": 8.9, "days": 15},
    "medium": {"cvss_min": 4.0, "cvss_max": 6.9, "days": 60},
    "low": {"cvss_min": 0.1, "cvss_max": 3.9, "days": 90},
}


def init_db(db_path=DB_PATH):
    """Initialize SQLite database for SLA tracking."""
    conn = sqlite3.connect(db_path)
    conn.execute("""
        CREATE TABLE IF NOT EXISTS vulnerability_sla (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            cve_id TEXT NOT NULL,
            finding_id TEXT NOT NULL,
            asset_hostname TEXT,
            severity TEXT NOT NULL,
            cvss_score REAL,
            discovered_at TEXT NOT NULL,
            sla_deadline TEXT NOT NULL,
            remediated_at TEXT,
            status TEXT DEFAULT 'open',
            owner_email TEXT,
            escalation_level INTEGER DEFAULT 0,
            last_alert_sent TEXT,
            created_at TEXT DEFAULT CURRENT_TIMESTAMP
        )
    """)
    conn.commit()
    return conn


def get_severity_tier(cvss_score):
    """Map CVSS score to severity tier."""
    for tier_name, tier in SLA_TIERS.items():
        if tier["cvss_min"] <= cvss_score <= tier["cvss_max"]:
            return tier_name, tier["days"]
    return "low", 90


def import_findings(conn, csv_path):
    """Import vulnerability findings from CSV and assign SLA deadlines."""
    imported = 0
    with open(csv_path, "r", encoding="utf-8") as f:
        reader = csv.DictReader(f)
        for row in reader:
            cve_id = row.get("cve_id", "").strip()
            cvss = float(row.get("cvss_score", 0))
            if not cve_id or cvss == 0:
                continue
            discovered = row.get("discovered_at", datetime.now(timezone.utc).isoformat())
            discovered_dt = datetime.fromisoformat(discovered.replace("Z", "+00:00"))
            severity, sla_days = get_severity_tier(cvss)
            deadline = discovered_dt + timedelta(days=sla_days)

            conn.execute(
                """INSERT INTO vulnerability_sla
                   (cve_id, finding_id, asset_hostname, severity, cvss_score,
                    discovered_at, sla_deadline, owner_email, status)
                   VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'open')""",
                (
                    cve_id,
                    row.get("finding_id", f"{cve_id}_{row.get('host', 'unknown')}"),
                    row.get("host", "unknown"),
                    severity,
                    cvss,
                    discovered_dt.isoformat(),
                    deadline.isoformat(),
                    row.get("owner_email", ""),
                ),
            )
            imported += 1
    conn.commit()
    print(f"[+] Imported {imported} findings with SLA deadlines")
    return imported


def check_sla_breaches(conn):
    """Check all open findings for SLA status and return categorized results."""
    now = datetime.now(timezone.utc)
    cursor = conn.execute(
        "SELECT * FROM vulnerability_sla WHERE status = 'open'"
    )
    columns = [d[0] for d in cursor.description]
    breached = []
    approaching = []
    within_sla = []

    for row in cursor.fetchall():
        record = dict(zip(columns, row))
        deadline = datetime.fromisoformat(record["sla_deadline"])
        discovered = datetime.fromisoformat(record["discovered_at"])
        if deadline.tzinfo is None:
            deadline = deadline.replace(tzinfo=timezone.utc)
        if discovered.tzinfo is None:
            discovered = discovered.replace(tzinfo=timezone.utc)

        if now > deadline:
            overdue_days = (now - deadline).days
            record["sla_status"] = f"breached_{overdue_days}d_overdue"
            record["overdue_days"] = overdue_days
            breached.append(record)
        else:
            total_window = (deadline - discovered).total_seconds()
            elapsed = (now - discovered).total_seconds()
            pct = (elapsed / total_window * 100) if total_window > 0 else 0
            if pct >= 80:
                record["sla_status"] = "approaching_breach"
                record["pct_elapsed"] = round(pct, 1)
                approaching.append(record)
            else:
                record["sla_status"] = "within_sla"
                record["pct_elapsed"] = round(pct, 1)
                within_sla.append(record)

    return {"breached": breached, "approaching": approaching, "within_sla": within_sla}


def send_slack_notification(webhook_url, findings, alert_type):
    """Send SLA alert to Slack channel."""
    if not webhook_url or not findings:
        return
    color_map = {"breached": "#FF0000", "approaching": "#FFA500", "within_sla": "#36A64F"}
    for finding in findings[:10]:
        payload = {
            "attachments": [
                {
                    "color": color_map.get(alert_type, "#808080"),
                    "title": f"SLA {alert_type.upper()}: {finding['cve_id']}",
                    "fields": [
                        {"title": "Severity", "value": finding["severity"], "short": True},
                        {"title": "CVSS", "value": str(finding["cvss_score"]), "short": True},
                        {"title": "Asset", "value": finding["asset_hostname"], "short": True},
                        {"title": "Deadline", "value": finding["sla_deadline"][:16], "short": True},
                        {"title": "Owner", "value": finding.get("owner_email", "Unassigned"), "short": True},
                        {"title": "Status", "value": finding["sla_status"], "short": True},
                    ],
                }
            ]
        }
        try:
            requests.post(webhook_url, json=payload, timeout=10)
        except requests.RequestException as e:
            print(f"[-] Slack notification failed: {e}")


def send_email_notification(smtp_config, findings, alert_type):
    """Send SLA alert via email."""
    if not smtp_config or not findings:
        return
    recipients = set()
    for f in findings:
        if f.get("owner_email"):
            recipients.add(f["owner_email"])
    if not recipients:
        return

    body_lines = [f"Vulnerability SLA {alert_type.upper()} Report", "=" * 50, ""]
    for f in findings:
        body_lines.extend([
            f"CVE: {f['cve_id']}",
            f"Severity: {f['severity']} (CVSS {f['cvss_score']})",
            f"Asset: {f['asset_hostname']}",
            f"Deadline: {f['sla_deadline'][:16]}",
            f"Status: {f['sla_status']}",
            "-" * 40,
        ])

    msg = MIMEMultipart()
    msg["Subject"] = f"[VULN SLA {alert_type.upper()}] {len(findings)} findings require attention"
    msg["From"] = smtp_config.get("from_address", "vuln-alerts@company.com")
    msg["To"] = ", ".join(recipients)
    msg.attach(MIMEText("\n".join(body_lines), "plain"))

    try:
        with smtplib.SMTP(smtp_config["host"], smtp_config.get("port", 587)) as server:
            server.starttls()
            if smtp_config.get("username"):
                server.login(smtp_config["username"], smtp_config["password"])
            server.send_message(msg)
        print(f"[+] Email sent to {len(recipients)} recipients")
    except Exception as e:
        print(f"[-] Email notification failed: {e}")


def generate_compliance_report(conn, output_path, period_days=30):
    """Generate SLA compliance report."""
    cutoff = (datetime.now(timezone.utc) - timedelta(days=period_days)).isoformat()
    cursor = conn.execute(
        """SELECT severity,
                  COUNT(*) as total,
                  SUM(CASE WHEN remediated_at IS NOT NULL
                       AND remediated_at <= sla_deadline THEN 1 ELSE 0 END) as within_sla,
                  SUM(CASE WHEN remediated_at IS NOT NULL
                       AND remediated_at > sla_deadline THEN 1 ELSE 0 END) as breached_remediated,
                  SUM(CASE WHEN status = 'open'
                       AND datetime('now') > sla_deadline THEN 1 ELSE 0 END) as currently_overdue
           FROM vulnerability_sla
           WHERE discovered_at >= ?
           GROUP BY severity
           ORDER BY CASE severity
                WHEN 'critical' THEN 1
                WHEN 'high' THEN 2
                WHEN 'medium' THEN 3
                WHEN 'low' THEN 4 END""",
        (cutoff,),
    )

    report = {
        "generated_at": datetime.now(timezone.utc).isoformat(),
        "period_days": period_days,
        "tiers": [],
    }
    total_findings = 0
    total_compliant = 0
    for row in cursor.fetchall():
        severity, total, within_sla, breached_remediated, currently_overdue = row
        compliance_rate = (within_sla / total * 100) if total > 0 else 0
        report["tiers"].append({
            "severity": severity,
            "total": total,
            "within_sla": within_sla,
            "breached_remediated": breached_remediated,
            "currently_overdue": currently_overdue,
            "compliance_rate": round(compliance_rate, 1),
        })
        total_findings += total
        total_compliant += within_sla

    report["overall_compliance"] = round(
        (total_compliant / total_findings * 100) if total_findings > 0 else 0, 1
    )
    report["total_findings"] = total_findings

    with open(output_path, "w", encoding="utf-8") as f:
        json.dump(report, f, indent=2)
    print(f"[+] Compliance report written to {output_path}")
    print(f"    Overall SLA Compliance: {report['overall_compliance']}%")
    return report


def main():
    parser = argparse.ArgumentParser(description="Vulnerability SLA Breach Alerting System")
    parser.add_argument("--import-findings", help="Import findings from CSV")
    parser.add_argument("--check-sla", action="store_true", help="Check for SLA breaches")
    parser.add_argument("--report", action="store_true", help="Generate compliance report")
    parser.add_argument("--output", default="sla_compliance_report.json", help="Report output path")
    parser.add_argument("--period", type=int, default=30, help="Report period in days")
    parser.add_argument("--slack-webhook", help="Slack webhook URL for notifications")
    parser.add_argument("--db", default=DB_PATH, help="Database path")
    args = parser.parse_args()

    conn = init_db(args.db)

    if args.import_findings:
        import_findings(conn, args.import_findings)

    if args.check_sla:
        results = check_sla_breaches(conn)
        print(f"\n[*] SLA Check Results:")
        print(f"    Breached: {len(results['breached'])}")
        print(f"    Approaching: {len(results['approaching'])}")
        print(f"    Within SLA: {len(results['within_sla'])}")

        if args.slack_webhook:
            if results["breached"]:
                send_slack_notification(args.slack_webhook, results["breached"], "breached")
            if results["approaching"]:
                send_slack_notification(args.slack_webhook, results["approaching"], "approaching")

    if args.report:
        generate_compliance_report(conn, args.output, args.period)

    conn.close()


if __name__ == "__main__":
    main()