admin / Syanpse-Vanguard

"""Source-specific parsers: raw agent dict -> normalized EventModel.

Each parser is intentionally small and pure. Registering a new source type is a
one-function change; unknown types fall back to a permissive passthrough."""
from __future__ import annotations

from datetime import datetime, timezone
from typing import Callable

from sv.models.event import EventModel, Severity

Parser = Callable[[dict], EventModel]


def _ts(raw: dict) -> datetime:
    val = raw.get("ts")
    if isinstance(val, str):
        try:
            return datetime.fromisoformat(val.replace("Z", "+00:00"))
        except ValueError:
            pass
    elif isinstance(val, (int, float)):
        return datetime.fromtimestamp(val, tz=timezone.utc)
    return datetime.now(timezone.utc)


def _win_severity(level) -> Severity:
    # Windows Event Level: 1 Critical, 2 Error, 3 Warning, 4 Info, 5 Verbose
    return {1: Severity.CRITICAL, 2: Severity.ERROR, 3: Severity.WARNING,
            4: Severity.INFO, 5: Severity.DEBUG}.get(_int(level), Severity.INFO)


# High-signal event enrichment: EventID -> (category, action, severity, mitre).
# The mapped severity reflects *security* importance (a failed logon is Level=Info
# on the wire but we surface it as WARNING) and drives the coloured severity tags.
# Sources: MITRE ATT&CK technique IDs where a mapping is well established.
_SECURITY_MAP: dict[int, tuple] = {
    4624: ("authentication", "logon", Severity.INFO, None),
    4625: ("authentication", "logon_failed", Severity.WARNING, "T1110"),
    4634: ("authentication", "logoff", Severity.DEBUG, None),
    4648: ("authentication", "logon_explicit_creds", Severity.NOTICE, "T1078"),
    4672: ("authentication", "special_privileges_assigned", Severity.NOTICE, None),
    4720: ("iam", "user_created", Severity.NOTICE, "T1136"),
    4722: ("iam", "user_enabled", Severity.NOTICE, None),
    4725: ("iam", "user_disabled", Severity.NOTICE, None),
    4726: ("iam", "user_deleted", Severity.NOTICE, None),
    4728: ("iam", "member_added_global_group", Severity.WARNING, "T1098"),
    4732: ("iam", "member_added_local_group", Severity.WARNING, "T1098"),
    4756: ("iam", "member_added_universal_group", Severity.WARNING, "T1098"),
    4738: ("iam", "user_changed", Severity.NOTICE, None),
    4688: ("process", "process_created", Severity.INFO, None),
    4697: ("service", "service_installed", Severity.WARNING, "T1543.003"),
    4698: ("scheduled_task", "task_created", Severity.WARNING, "T1053.005"),
    4699: ("scheduled_task", "task_deleted", Severity.NOTICE, None),
    4719: ("log", "audit_policy_changed", Severity.WARNING, "T1562.002"),
    1102: ("log", "audit_log_cleared", Severity.CRITICAL, "T1070.001"),
    4768: ("authentication", "kerberos_tgt_requested", Severity.INFO, None),
    4769: ("authentication", "kerberos_tgs_requested", Severity.INFO, "T1558.003"),
    4771: ("authentication", "kerberos_preauth_failed", Severity.WARNING, "T1110"),
    4776: ("authentication", "ntlm_auth", Severity.INFO, None),
}
_SYSTEM_MAP: dict[int, tuple] = {
    7045: ("service", "service_installed", Severity.WARNING, "T1543.003"),
    7040: ("service", "service_start_type_changed", Severity.NOTICE, None),
}
_SYSMON_MAP: dict[int, tuple] = {
    1:  ("process", "process_created", Severity.INFO, "T1059"),
    3:  ("network", "network_connection", Severity.INFO, "T1071"),
    7:  ("process", "image_loaded", Severity.INFO, None),
    8:  ("process", "create_remote_thread", Severity.WARNING, "T1055"),
    10: ("process", "process_access", Severity.NOTICE, "T1003"),
    11: ("file", "file_created", Severity.INFO, None),
    12: ("registry", "registry_key_event", Severity.NOTICE, "T1112"),
    13: ("registry", "registry_value_set", Severity.NOTICE, "T1112"),
    22: ("network", "dns_query", Severity.INFO, None),
    23: ("file", "file_delete", Severity.NOTICE, "T1070.004"),
}
_POWERSHELL_MAP: dict[int, tuple] = {
    4104: ("powershell", "scriptblock_logged", Severity.NOTICE, "T1059.001"),
    4103: ("powershell", "module_logged", Severity.INFO, "T1059.001"),
    400:  ("powershell", "engine_started", Severity.INFO, None),
}
_DEFENDER_MAP: dict[int, tuple] = {
    1116: ("malware", "detection", Severity.CRITICAL, "T1204"),
    1117: ("malware", "action_taken", Severity.WARNING, None),
    5001: ("malware", "realtime_protection_disabled", Severity.CRITICAL, "T1562.001"),
    5007: ("malware", "configuration_changed", Severity.WARNING, "T1562.001"),
}


def _win_meta(channel: str, event_id: int | None) -> tuple | None:
    if event_id is None:
        return None
    ch = (channel or "").lower()
    if "sysmon" in ch:
        return _SYSMON_MAP.get(event_id)
    if "powershell" in ch:
        return _POWERSHELL_MAP.get(event_id)
    if "defender" in ch:
        return _DEFENDER_MAP.get(event_id)
    if "system" in ch:
        return _SYSTEM_MAP.get(event_id) or _SECURITY_MAP.get(event_id)
    return _SECURITY_MAP.get(event_id)


def parse_winlog(raw: dict) -> EventModel:
    f = raw.get("fields", {})
    channel = f.get("Channel", "")
    event_id = _int(f.get("EventID") or f.get("event_id"))

    category = channel or None
    action = f.get("Task")
    severity = _win_severity(f.get("Level"))
    mitre = None

    meta = _win_meta(channel, event_id)
    if meta:
        m_cat, m_action, m_sev, m_mitre = meta
        category = m_cat
        action = m_action
        severity = m_sev            # security-weighted severity drives the UI colour
        mitre = m_mitre

    return EventModel(
        ts=_ts(raw), source_type="winlog", host=raw.get("host", "unknown"),
        host_ip=f.get("host_ip"),
        event_id=event_id,
        severity=severity,
        category=category,
        action=action,
        outcome=_win_outcome(f.get("Keywords")),
        user_name=f.get("TargetUserName") or f.get("SubjectUserName"),
        process_name=f.get("NewProcessName") or f.get("Image"),
        mitre_technique=mitre,
        message=raw.get("message", ""),
        raw=f,
    )


def parse_journald(raw: dict) -> EventModel:
    f = raw.get("fields", {})
    return EventModel(
        ts=_ts(raw), source_type="journald", host=raw.get("host", "unknown"),
        severity=_syslog_sev(f.get("PRIORITY")),
        process_name=f.get("_COMM") or f.get("SYSLOG_IDENTIFIER"),
        user_name=f.get("_UID"),
        category=f.get("_SYSTEMD_UNIT"),
        message=raw.get("message", "") or f.get("MESSAGE", ""),
        raw=f,
    )


def parse_syslog(raw: dict) -> EventModel:
    f = raw.get("fields", {})
    return EventModel(
        ts=_ts(raw), source_type="syslog", host=raw.get("host", "unknown"),
        host_ip=f.get("host_ip"),
        severity=_syslog_sev(f.get("severity")),
        process_name=f.get("appname") or f.get("tag"),
        message=raw.get("message", ""),
        raw=f,
    )


def parse_auditd(raw: dict) -> EventModel:
    f = raw.get("fields", {})
    return EventModel(
        ts=_ts(raw), source_type="auditd", host=raw.get("host", "unknown"),
        severity=Severity.NOTICE,
        action=f.get("type"),                         # SYSCALL | USER_LOGIN | ...
        outcome=f.get("res"),                         # success | failed
        user_name=f.get("acct") or f.get("uid"),
        message=raw.get("message", ""),
        raw=f,
    )


def parse_ironnode(raw: dict) -> EventModel:
    """Events pushed by a Synapse-suite app (IronNode) via POST /v1/ingest/events.
    The sender delivers already-normalized top-level fields (syslog-scale
    severity, category, MITRE), so we map them straight through."""
    return EventModel(
        ts=_ts(raw), source_type="ironnode", host=raw.get("host", "ironnode"),
        host_ip=raw.get("host_ip"),
        event_id=_int(raw.get("event_id")),
        severity=_sev_int(raw.get("severity")),
        category=raw.get("category"),
        action=raw.get("action"),
        outcome=raw.get("outcome"),
        user_name=raw.get("user_name"),
        mitre_technique=raw.get("mitre_technique"),
        message=raw.get("message", ""),
        raw=raw.get("fields", {}) or {},
    )


def parse_default(raw: dict) -> EventModel:
    return EventModel(
        ts=_ts(raw), source_type=raw.get("source_type", "unknown"),
        host=raw.get("host", "unknown"),
        message=raw.get("message", ""),
        raw=raw.get("fields", {}),
    )


_REGISTRY: dict[str, Parser] = {
    "winlog": parse_winlog,
    "journald": parse_journald,
    "syslog": parse_syslog,
    "auditd": parse_auditd,
    "ironnode": parse_ironnode,
}


def normalize(raw: dict) -> EventModel:
    return _REGISTRY.get(raw.get("source_type", ""), parse_default)(raw)


# --- helpers ----------------------------------------------------------------
def _int(v) -> int | None:
    try:
        return int(v)
    except (TypeError, ValueError):
        return None


def _sev_int(v) -> Severity:
    """Clamp an integer to the syslog 0..7 scale; default INFO."""
    n = _int(v)
    if n is None:
        return Severity.INFO
    return Severity(min(7, max(0, n)))


def _syslog_sev(v) -> Severity:
    n = _int(v)
    if n is None:
        return Severity.INFO
    try:
        return Severity(n & 0x7)   # low 3 bits if a full PRI value slipped through
    except ValueError:
        return Severity.INFO


def _win_outcome(keywords) -> str | None:
    if keywords is None:
        return None
    s = str(keywords).lower()
    if "audit success" in s or "0x8020" in s:
        return "success"
    if "audit failure" in s or "0x8010" in s:
        return "failure"
    return None