#!/usr/bin/env python3
"""Agent for triaging vulnerabilities with the SSVC framework.

Implements CISA's Stakeholder-Specific Vulnerability Categorization
decision tree to produce actionable priorities: Track, Track*,
Attend, or Act based on exploitation status, technical impact,
automatability, and mission prevalence.
"""

import json
import sys
from pathlib import Path
from datetime import datetime

try:
    import requests
except ImportError:
    requests = None


class ExploitationStatus:
    NONE = "none"
    POC = "poc"
    ACTIVE = "active"


class TechnicalImpact:
    PARTIAL = "partial"
    TOTAL = "total"


class Automatability:
    NO = "no"
    YES = "yes"


class MissionPrevalence:
    MINIMAL = "minimal"
    SUPPORT = "support"
    ESSENTIAL = "essential"


class SSVCDecision:
    TRACK = "Track"
    TRACK_STAR = "Track*"
    ATTEND = "Attend"
    ACT = "Act"


SSVC_DECISION_TREE = {
    (ExploitationStatus.ACTIVE, TechnicalImpact.TOTAL): SSVCDecision.ACT,
    (ExploitationStatus.ACTIVE, TechnicalImpact.PARTIAL, Automatability.YES): SSVCDecision.ACT,
    (ExploitationStatus.ACTIVE, TechnicalImpact.PARTIAL, Automatability.NO, MissionPrevalence.ESSENTIAL): SSVCDecision.ACT,
    (ExploitationStatus.ACTIVE, TechnicalImpact.PARTIAL, Automatability.NO, MissionPrevalence.SUPPORT): SSVCDecision.ATTEND,
    (ExploitationStatus.ACTIVE, TechnicalImpact.PARTIAL, Automatability.NO, MissionPrevalence.MINIMAL): SSVCDecision.ATTEND,
    (ExploitationStatus.POC, TechnicalImpact.TOTAL, Automatability.YES): SSVCDecision.ATTEND,
    (ExploitationStatus.POC, TechnicalImpact.TOTAL, Automatability.NO): SSVCDecision.TRACK_STAR,
    (ExploitationStatus.POC, TechnicalImpact.PARTIAL): SSVCDecision.TRACK_STAR,
    (ExploitationStatus.NONE, TechnicalImpact.TOTAL): SSVCDecision.TRACK_STAR,
    (ExploitationStatus.NONE, TechnicalImpact.PARTIAL): SSVCDecision.TRACK,
}


class SSVCTriageAgent:
    """Triages vulnerabilities using the SSVC decision tree."""

    def __init__(self, output_dir="./ssvc_triage"):
        self.output_dir = Path(output_dir)
        self.output_dir.mkdir(parents=True, exist_ok=True)
        self.results = []

    def check_cisa_kev(self, cve_id):
        """Check if CVE is in CISA Known Exploited Vulnerabilities catalog."""
        if not requests:
            return None
        resp = None
        try:
            resp = requests.get(
                "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
                timeout=15,
            )
        except Exception:
            return None
        if resp and resp.status_code == 200:
            data = resp.json()
            for vuln in data.get("vulnerabilities", []):
                if vuln.get("cveID") == cve_id:
                    return {
                        "in_kev": True,
                        "vendor": vuln.get("vendorProject"),
                        "product": vuln.get("product"),
                        "date_added": vuln.get("dateAdded"),
                        "due_date": vuln.get("dueDate"),
                    }
        return {"in_kev": False}

    def get_epss_score(self, cve_id):
        """Get EPSS probability score from FIRST API."""
        if not requests:
            return None
        try:
            resp = requests.get(f"https://api.first.org/data/v1/epss?cve={cve_id}", timeout=10)
            if resp and resp.status_code == 200:
                data = resp.json().get("data", [])
                if data:
                    return {
                        "cve": cve_id,
                        "epss": float(data[0].get("epss", 0)),
                        "percentile": float(data[0].get("percentile", 0)),
                    }
        except Exception:
            pass
        return None

    def determine_exploitation(self, cve_id):
        """Determine exploitation status using KEV and EPSS."""
        kev = self.check_cisa_kev(cve_id)
        if kev and kev.get("in_kev"):
            return ExploitationStatus.ACTIVE, kev
        epss = self.get_epss_score(cve_id)
        if epss and epss.get("epss", 0) > 0.5:
            return ExploitationStatus.POC, epss
        if epss and epss.get("epss", 0) > 0.1:
            return ExploitationStatus.POC, epss
        return ExploitationStatus.NONE, epss

    def evaluate_decision(self, exploitation, technical_impact, automatability=None,
                          mission_prevalence=None):
        """Walk the SSVC decision tree to produce a prioritization."""
        if (exploitation, technical_impact) in SSVC_DECISION_TREE:
            return SSVC_DECISION_TREE[(exploitation, technical_impact)]
        if automatability:
            key = (exploitation, technical_impact, automatability)
            if key in SSVC_DECISION_TREE:
                return SSVC_DECISION_TREE[key]
            if mission_prevalence:
                key = (exploitation, technical_impact, automatability, mission_prevalence)
                if key in SSVC_DECISION_TREE:
                    return SSVC_DECISION_TREE[key]
        return SSVCDecision.TRACK

    def triage_cve(self, cve_id, technical_impact=TechnicalImpact.PARTIAL,
                   automatability=Automatability.NO,
                   mission_prevalence=MissionPrevalence.SUPPORT):
        """Full SSVC triage for a single CVE."""
        exploitation, enrichment = self.determine_exploitation(cve_id)
        decision = self.evaluate_decision(exploitation, technical_impact,
                                          automatability, mission_prevalence)
        result = {
            "cve_id": cve_id,
            "exploitation_status": exploitation,
            "technical_impact": technical_impact,
            "automatability": automatability,
            "mission_prevalence": mission_prevalence,
            "decision": decision,
            "enrichment": enrichment,
            "remediation_timeline": self._get_timeline(decision),
        }
        self.results.append(result)
        return result

    def _get_timeline(self, decision):
        timelines = {
            SSVCDecision.ACT: "Immediate - remediate within 24-48 hours",
            SSVCDecision.ATTEND: "Urgent - remediate within 1-2 weeks",
            SSVCDecision.TRACK_STAR: "Scheduled - remediate in next patch cycle",
            SSVCDecision.TRACK: "Monitor - include in regular vulnerability management",
        }
        return timelines.get(decision, "Unknown")

    def triage_batch(self, cves, defaults=None):
        """Triage a list of CVEs with optional default parameters."""
        defaults = defaults or {}
        for cve in cves:
            self.triage_cve(
                cve,
                technical_impact=defaults.get("technical_impact", TechnicalImpact.PARTIAL),
                automatability=defaults.get("automatability", Automatability.NO),
                mission_prevalence=defaults.get("mission_prevalence", MissionPrevalence.SUPPORT),
            )
        return self.results

    def generate_report(self, cves=None):
        if cves:
            self.triage_batch(cves)
        by_decision = {}
        for r in self.results:
            d = r["decision"]
            by_decision[d] = by_decision.get(d, 0) + 1

        report = {
            "report_date": datetime.utcnow().isoformat(),
            "framework": "SSVC (CISA Stakeholder-Specific Vulnerability Categorization)",
            "total_triaged": len(self.results),
            "by_decision": by_decision,
            "triage_results": self.results,
        }
        out = self.output_dir / "ssvc_triage_report.json"
        with open(out, "w") as f:
            json.dump(report, f, indent=2)
        print(json.dumps(report, indent=2))
        return report


def main():
    if len(sys.argv) < 2:
        print("Usage: agent.py <CVE-ID> [CVE-ID2 ...] [--impact total|partial]")
        sys.exit(1)
    cves = [a for a in sys.argv[1:] if a.startswith("CVE-")]
    impact = TechnicalImpact.PARTIAL
    if "--impact" in sys.argv:
        val = sys.argv[sys.argv.index("--impact") + 1]
        impact = TechnicalImpact.TOTAL if val == "total" else TechnicalImpact.PARTIAL
    agent = SSVCTriageAgent()
    agent.generate_report(cves)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""SSVC Vulnerability Triage Processor.

Evaluates vulnerabilities against CISA's Stakeholder-Specific Vulnerability
Categorization (SSVC) decision tree and produces prioritized triage reports.
"""

import argparse
import csv
import json
import sys
import time
import xml.etree.ElementTree as ET
from datetime import datetime, timezone
from pathlib import Path

import requests

KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"
EPSS_API = "https://api.first.org/data/v1/epss"
NVD_API = "https://services.nvd.nist.gov/rest/json/cves/2.0"

SSVC_SLA = {
    "Act": 2,
    "Attend": 14,
    "Track*": 60,
    "Track": 90,
}


def fetch_kev_catalog():
    """Download the CISA Known Exploited Vulnerabilities catalog."""
    resp = requests.get(KEV_URL, timeout=30)
    resp.raise_for_status()
    data = resp.json()
    return {v["cveID"] for v in data.get("vulnerabilities", [])}


def fetch_epss_scores(cve_ids):
    """Fetch EPSS scores for a list of CVE IDs from FIRST API."""
    scores = {}
    batch_size = 100
    for i in range(0, len(cve_ids), batch_size):
        batch = cve_ids[i : i + batch_size]
        params = {"cve": ",".join(batch)}
        resp = requests.get(EPSS_API, params=params, timeout=30)
        if resp.status_code == 200:
            for entry in resp.json().get("data", []):
                scores[entry["cve"]] = {
                    "epss": float(entry.get("epss", 0)),
                    "percentile": float(entry.get("percentile", 0)),
                }
        time.sleep(1)
    return scores


def fetch_nvd_cve(cve_id, api_key=None):
    """Fetch CVE details from NVD API v2."""
    params = {"cveId": cve_id}
    headers = {}
    if api_key:
        headers["apiKey"] = api_key
    resp = requests.get(NVD_API, params=params, headers=headers, timeout=30)
    if resp.status_code == 200:
        vulns = resp.json().get("vulnerabilities", [])
        if vulns:
            return vulns[0].get("cve", {})
    return None


def evaluate_exploitation(cve_id, kev_set, epss_scores):
    """Determine exploitation status: active, poc, or none."""
    if cve_id in kev_set:
        return "active"
    epss_data = epss_scores.get(cve_id, {})
    if epss_data.get("epss", 0) > 0.5:
        return "poc"
    if epss_data.get("epss", 0) > 0.1:
        return "poc"
    return "none"


def evaluate_technical_impact(cvss_vector):
    """Assess technical impact from CVSS vector string."""
    if not cvss_vector:
        return "partial"
    vector_upper = cvss_vector.upper()
    if "S:C" in vector_upper:
        return "total"
    if "C:H" in vector_upper and "I:H" in vector_upper and "A:H" in vector_upper:
        return "total"
    if "C:H" in vector_upper and "I:H" in vector_upper:
        return "total"
    return "partial"


def evaluate_automatability(cvss_vector):
    """Determine if exploitation can be automated."""
    if not cvss_vector:
        return "no"
    vector_upper = cvss_vector.upper()
    network = "AV:N" in vector_upper
    low_complexity = "AC:L" in vector_upper
    no_user_interaction = "UI:N" in vector_upper
    if network and low_complexity and no_user_interaction:
        return "yes"
    return "no"


def ssvc_decision(exploitation, tech_impact, automatability, mission_prevalence, public_wellbeing):
    """Apply CISA SSVC decision tree to produce triage outcome.

    Returns one of: Act, Attend, Track*, Track
    """
    if exploitation == "active":
        if automatability == "yes":
            return "Act"
        if tech_impact == "total":
            if mission_prevalence in ("essential", "support"):
                return "Act"
            return "Attend"
        if mission_prevalence == "essential":
            return "Attend"
        if public_wellbeing in ("irreversible", "material"):
            return "Attend"
        return "Attend"

    if exploitation == "poc":
        if automatability == "yes" and tech_impact == "total":
            if mission_prevalence in ("essential", "support"):
                return "Attend"
            return "Track*"
        if tech_impact == "total" and mission_prevalence == "essential":
            return "Attend"
        if public_wellbeing == "irreversible":
            return "Attend"
        return "Track*"

    # exploitation == "none"
    if tech_impact == "total" and mission_prevalence == "essential":
        return "Track*"
    if automatability == "yes" and mission_prevalence == "essential":
        return "Track*"
    return "Track"


def parse_nessus_csv(filepath):
    """Parse Nessus CSV export into vulnerability records."""
    vulns = []
    with open(filepath, "r", encoding="utf-8") as f:
        reader = csv.DictReader(f)
        for row in reader:
            cve = row.get("CVE", "").strip()
            if not cve or not cve.startswith("CVE-"):
                continue
            vulns.append(
                {
                    "cve_id": cve,
                    "host": row.get("Host", "unknown"),
                    "port": row.get("Port", ""),
                    "plugin_name": row.get("Name", ""),
                    "severity": row.get("Severity", ""),
                    "cvss_vector": row.get("CVSS V3 Vector", ""),
                    "description": row.get("Synopsis", ""),
                }
            )
    return vulns


def parse_openvas_xml(filepath):
    """Parse OpenVAS XML report into vulnerability records."""
    vulns = []
    tree = ET.parse(filepath)
    root = tree.getroot()
    for result in root.iter("result"):
        nvt = result.find("nvt")
        if nvt is None:
            continue
        cve_elem = nvt.find("cve")
        if cve_elem is None or not cve_elem.text or cve_elem.text == "NOCVE":
            continue
        host_elem = result.find("host")
        port_elem = result.find("port")
        vulns.append(
            {
                "cve_id": cve_elem.text.strip(),
                "host": host_elem.text.strip() if host_elem is not None else "unknown",
                "port": port_elem.text.strip() if port_elem is not None else "",
                "plugin_name": nvt.findtext("name", ""),
                "severity": result.findtext("severity", ""),
                "cvss_vector": nvt.findtext("tags", ""),
                "description": result.findtext("description", ""),
            }
        )
    return vulns


def parse_generic_csv(filepath):
    """Parse generic CSV with cve_id, host, cvss_vector columns."""
    vulns = []
    with open(filepath, "r", encoding="utf-8") as f:
        reader = csv.DictReader(f)
        for row in reader:
            cve = row.get("cve_id", "").strip()
            if not cve:
                continue
            vulns.append(
                {
                    "cve_id": cve,
                    "host": row.get("host", "unknown"),
                    "port": row.get("port", ""),
                    "plugin_name": row.get("plugin_name", ""),
                    "severity": row.get("severity", ""),
                    "cvss_vector": row.get("cvss_vector", ""),
                    "description": row.get("description", ""),
                    "mission_prevalence": row.get("mission_prevalence", "support"),
                    "public_wellbeing": row.get("public_wellbeing", "minimal"),
                }
            )
    return vulns


def run_triage(vulns, kev_set, epss_scores, default_mission="support", default_wellbeing="minimal"):
    """Run SSVC triage on a list of vulnerability records."""
    results = []
    for vuln in vulns:
        cve_id = vuln["cve_id"]
        exploitation = evaluate_exploitation(cve_id, kev_set, epss_scores)
        tech_impact = evaluate_technical_impact(vuln.get("cvss_vector", ""))
        automatability = evaluate_automatability(vuln.get("cvss_vector", ""))
        mission = vuln.get("mission_prevalence", default_mission)
        wellbeing = vuln.get("public_wellbeing", default_wellbeing)

        outcome = ssvc_decision(exploitation, tech_impact, automatability, mission, wellbeing)
        epss_data = epss_scores.get(cve_id, {})

        results.append(
            {
                "cve_id": cve_id,
                "host": vuln.get("host", "unknown"),
                "port": vuln.get("port", ""),
                "plugin_name": vuln.get("plugin_name", ""),
                "ssvc_outcome": outcome,
                "sla_days": SSVC_SLA[outcome],
                "exploitation_status": exploitation,
                "technical_impact": tech_impact,
                "automatability": automatability,
                "mission_prevalence": mission,
                "public_wellbeing": wellbeing,
                "epss_score": epss_data.get("epss", 0),
                "epss_percentile": epss_data.get("percentile", 0),
                "in_kev": cve_id in kev_set,
            }
        )

    outcome_order = {"Act": 0, "Attend": 1, "Track*": 2, "Track": 3}
    results.sort(key=lambda r: (outcome_order.get(r["ssvc_outcome"], 4), -r["epss_score"]))
    return results


def generate_report(results, output_path, report_format="json"):
    """Generate triage report in JSON or CSV format."""
    summary = {
        "generated_at": datetime.now(timezone.utc).isoformat(),
        "total_vulnerabilities": len(results),
        "outcome_counts": {},
        "results": results,
    }
    for r in results:
        outcome = r["ssvc_outcome"]
        summary["outcome_counts"][outcome] = summary["outcome_counts"].get(outcome, 0) + 1

    if report_format == "csv":
        if results:
            with open(output_path, "w", newline="", encoding="utf-8") as f:
                writer = csv.DictWriter(f, fieldnames=results[0].keys())
                writer.writeheader()
                writer.writerows(results)
    else:
        with open(output_path, "w", encoding="utf-8") as f:
            json.dump(summary, f, indent=2)

    return summary


def main():
    parser = argparse.ArgumentParser(description="SSVC Vulnerability Triage Processor")
    parser.add_argument("--input", required=True, help="Path to vulnerability scan results")
    parser.add_argument("--output", default="ssvc_triage_report.json", help="Output report path")
    parser.add_argument(
        "--format",
        choices=["nessus", "openvas", "generic"],
        default="generic",
        help="Input format",
    )
    parser.add_argument(
        "--output-format", choices=["json", "csv"], default="json", help="Output format"
    )
    parser.add_argument("--nvd-api-key", help="NVD API key for higher rate limits")
    parser.add_argument(
        "--mission-prevalence",
        choices=["minimal", "support", "essential"],
        default="support",
        help="Default mission prevalence",
    )
    parser.add_argument(
        "--public-wellbeing",
        choices=["minimal", "material", "irreversible"],
        default="minimal",
        help="Default public well-being impact",
    )
    args = parser.parse_args()

    print("[*] Fetching CISA KEV catalog...")
    kev_set = fetch_kev_catalog()
    print(f"    Loaded {len(kev_set)} known exploited vulnerabilities")

    print(f"[*] Parsing input file: {args.input}")
    if args.format == "nessus":
        vulns = parse_nessus_csv(args.input)
    elif args.format == "openvas":
        vulns = parse_openvas_xml(args.input)
    else:
        vulns = parse_generic_csv(args.input)
    print(f"    Found {len(vulns)} vulnerability records")

    cve_ids = list({v["cve_id"] for v in vulns})
    print(f"[*] Fetching EPSS scores for {len(cve_ids)} unique CVEs...")
    epss_scores = fetch_epss_scores(cve_ids)

    print("[*] Running SSVC triage...")
    results = run_triage(
        vulns, kev_set, epss_scores, args.mission_prevalence, args.public_wellbeing
    )

    print(f"[*] Generating report: {args.output}")
    summary = generate_report(results, args.output, args.output_format)

    print("\n[+] SSVC Triage Summary:")
    for outcome, count in sorted(summary["outcome_counts"].items()):
        print(f"    {outcome}: {count}")
    print(f"    Total: {summary['total_vulnerabilities']}")


if __name__ == "__main__":
    main()