from flask import Flask, render_template, jsonify, request
from flask_socketio import SocketIO, emit
import json
import sqlite3
from datetime import datetime, timedelta
import threading

app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key'
socketio = SocketIO(app, cors_allowed_origins="*")

class SecurityDashboard:
    def __init__(self):
        self.incidents = []
        self.alerts = []
        self.metrics = {
            'total_alerts': 0,
            'critical_incidents': 0,
            'blocked_attacks': 0,
            'system_health': 95
        }
        self.init_database()
        
    def init_database(self):
        """Initialize SQLite database for storing security events"""
        conn = sqlite3.connect('security_data.db')
        cursor = conn.cursor()
        
        cursor.execute('''
            CREATE TABLE IF NOT EXISTS security_events (
                id INTEGER PRIMARY KEY AUTOINCREMENT,
                timestamp TEXT,
                event_type TEXT,
                severity TEXT,
                source_ip TEXT,
                description TEXT,
                status TEXT
            )
        ''')
        
        cursor.execute('''
            CREATE TABLE IF NOT EXISTS threat_intel (
                id INTEGER PRIMARY KEY AUTOINCREMENT,
                ioc TEXT,
                ioc_type TEXT,
                threat_level TEXT,
                first_seen TEXT,
                last_seen TEXT,
                source TEXT
            )
        ''')
        
        conn.commit()
        conn.close()
    
    def add_security_event(self, event_type, severity, source_ip, description):
        """Add new security event to database and real-time feed"""
        conn = sqlite3.connect('security_data.db')
        cursor = conn.cursor()
        
        cursor.execute('''
            INSERT INTO security_events 
            (timestamp, event_type, severity, source_ip, description, status)
            VALUES (?, ?, ?, ?, ?, ?)
        ''', (datetime.now().isoformat(), event_type, severity, 
              source_ip, description, 'Active'))
        
        conn.commit()
        conn.close()
        
        # Emit real-time update to connected clients
        socketio.emit('new_alert', {
            'timestamp': datetime.now().strftime('%H:%M:%S'),
            'type': event_type,
            'severity': severity,
            'source': source_ip,
            'description': description
        })

@app.route('/')
def dashboard():
    """Main dashboard page"""
    return render_template('dashboard.html')

@app.route('/api/alerts')
def get_alerts():
    """API endpoint for recent alerts"""
    conn = sqlite3.connect('security_data.db')
    cursor = conn.cursor()
    
    cursor.execute('''
        SELECT * FROM security_events 
        WHERE timestamp > ? 
        ORDER BY timestamp DESC LIMIT 100
    ''', (datetime.now() - timedelta(hours=24)).isoformat())
    
    alerts = cursor.fetchall()
    conn.close()
    
    return jsonify([{
        'id': alert[0],
        'timestamp': alert[1],
        'type': alert[2],
        'severity': alert[3],
        'source': alert[4],
        'description': alert[5],
        'status': alert[6]
    } for alert in alerts])

@app.route('/api/metrics')
def get_metrics():
    """API endpoint for dashboard metrics"""
    conn = sqlite3.connect('security_data.db')
    cursor = conn.cursor()
    
    # Get alert counts by severity
    cursor.execute('''
        SELECT severity, COUNT(*) FROM security_events 
        WHERE timestamp > ? 
        GROUP BY severity
    ''', ((datetime.now() - timedelta(hours=24)).isoformat(),))
    
    severity_counts = dict(cursor.fetchall())
    
    # Calculate metrics
    metrics = {
        'total_alerts': sum(severity_counts.values()),
        'critical_alerts': severity_counts.get('Critical', 0),
        'high_alerts': severity_counts.get('High', 0),
        'medium_alerts': severity_counts.get('Medium', 0),
        'low_alerts': severity_counts.get('Low', 0),
        'blocked_attacks': severity_counts.get('Critical', 0) * 2,
        'system_health': 98.5 - (severity_counts.get('Critical', 0) * 0.5)
    }
    
    conn.close()
    return jsonify(metrics)

if __name__ == '__main__':
    security_dashboard = SecurityDashboard()
    socketio.run(app, debug=True, host='0.0.0.0', port=5000)

def simulate_security_events():
    """Simulate incoming security events for demo purposes"""
    import random
    import time
    
    event_types = ['Intrusion Attempt', 'Malware Detection', 'DDoS Attack', 'Data Exfiltration']
    severities = ['Critical', 'High', 'Medium', 'Low']
    source_ips = ['192.168.1.100', '10.0.0.50', '172.16.0.25', '203.0.113.10']
    
    while True:
        event = {
            'type': random.choice(event_types),
            'severity': random.choice(severities),
            'source_ip': random.choice(source_ips),
            'description': f"Suspicious activity detected from {random.choice(source_ips)}"
        }
        
        security_dashboard.add_security_event(
            event['type'], event['severity'], 
            event['source_ip'], event['description']
        )
        
        time.sleep(random.randint(5, 30))  # Random intervals

# Start background thread for event simulation
import threading
event_thread = threading.Thread(target=simulate_security_events, daemon=True)
event_thread.start()

def integrate_with_splunk():
    """Example Splunk integration"""
    import requests
    
    def send_to_splunk(event_data):
        splunk_url = "https://your-splunk-instance:8088/services/collector"
        headers = {"Authorization": "Splunk your-token"}
        
        payload = {
            "event": event_data,
            "sourcetype": "security_dashboard",
            "index": "security"
        }
        
        response = requests.post(splunk_url, json=payload, headers=headers)
        return response.status_code == 200

def integrate_with_elk():
    """Example ELK Stack integration"""
    from elasticsearch import Elasticsearch
    
    es = Elasticsearch(['your-elasticsearch-cluster'])
    
    def send_to_elk(event_data):
        doc = {
            'timestamp': datetime.now(),
            'event': event_data,
            '@timestamp': datetime.now().isoformat()
        }
        
        es.index(index="security-events", body=doc)

def update_threat_intel():
    """Update threat intelligence from external feeds"""
    # Example: Fetch from AlienVault OTX, VirusTotal, etc.
    threat_feeds = [
        'https://reputation.alienvault.com/reputation.data',
        'https://rules.emergingthreats.net/blockrules/compromised-ips.txt'
    ]
    
    for feed_url in threat_feeds:
        response = requests.get(feed_url)
        if response.status_code == 200:
            process_threat_feed(response.text)

def process_threat_feed(feed_data):
    """Process and store threat intelligence data"""
    conn = sqlite3.connect('security_data.db')
    cursor = conn.cursor()
    
    for line in feed_data.split('\n'):
        if line.strip() and not line.startswith('#'):
            ip = line.strip().split()[0]
            cursor.execute('''
                INSERT OR REPLACE INTO threat_intel 
                (ioc, ioc_type, threat_level, last_seen, source)
                VALUES (?, ?, ?, ?, ?)
            ''', (ip, 'IP', 'High', datetime.now().isoformat(), 'External Feed'))
    
    conn.commit()
    conn.close()

from sklearn.ensemble import IsolationForest
import pandas as pd

class AnomalyDetector:
    def __init__(self):
        self.model = IsolationForest(contamination=0.1, random_state=42)
        self.is_trained = False
    
    def train_model(self, historical_data):
        """Train anomaly detection model on historical security events"""
        df = pd.DataFrame(historical_data)
        features = self.extract_features(df)
        self.model.fit(features)
        self.is_trained = True
    
    def detect_anomaly(self, event_data):
        """Detect if new event is anomalous"""
        if not self.is_trained:
            return False
            
        features = self.extract_features(pd.DataFrame([event_data]))
        prediction = self.model.predict(features)
        return prediction[0] == -1  # -1 indicates anomaly
    
    def extract_features(self, df):
        """Extract numerical features from event data"""
        # Convert categorical data to numerical
        features = pd.get_dummies(df[['event_type', 'severity']])
        features['hour'] = pd.to_datetime(df['timestamp']).dt.hour
        features['day_of_week'] = pd.to_datetime(df['timestamp']).dt.dayofweek
        return features