SIEM, SOC, and Threat Detection

# Python: query Elasticsearch for security events
from elasticsearch import Elasticsearch
from datetime import datetime, timedelta

es = Elasticsearch(
    'https://localhost:9200',
    basic_auth=('elastic', 'password'),
    ca_certs='/etc/elasticsearch/certs/http_ca.crt',
)

# Find failed SSH logins in the last hour
query = {
    "bool": {
        "must": [
            {"match": {"event.action": "ssh_login"}},
            {"match": {"event.outcome": "failure"}},
            {"range": {
                "@timestamp": {
                    "gte": (datetime.utcnow() - timedelta(hours=1)).isoformat(),
                    "lte": "now"
                }
            }}
        ]
    }
}

result = es.search(index='filebeat-*', query=query, size=100)
for hit in result['hits']['hits']:
    src = hit['_source']
    print(f"{src.get('@timestamp')}: Failed SSH from {src.get('source', {}).get('ip')} "
          f"for user {src.get('user', {}).get('name')}")

# Parse Suricata EVE JSON logs
import json

def parse_suricata_alerts(logfile: str):
    with open(logfile) as f:
        for line in f:
            event = json.loads(line)
            if event.get('event_type') == 'alert':
                alert = event['alert']
                print(
                    f"{event['timestamp']} "
                    f"[{alert['severity']}] {alert['signature']} "
                    f"({event.get('src_ip')}:{event.get('src_port')} → "
                    f"{event.get('dest_ip')}:{event.get('dest_port')})"
                )

parse_suricata_alerts('/var/log/suricata/eve.json')

import logging
import json
import time

class SecurityLogger:
    """Emit structured security events to stdout (collected by log aggregator)."""

    def __init__(self, service_name: str):
        self.service = service_name

    def _emit(self, level: str, event_type: str, **fields):
        record = {
            "timestamp": time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()),
            "level": level,
            "service": self.service,
            "event_type": event_type,
            **fields,
        }
        print(json.dumps(record), flush=True)

    def auth_success(self, user_id: str, ip: str, method: str):
        self._emit("INFO", "auth.success",
                   user_id=user_id, source_ip=ip, auth_method=method)

    def auth_failure(self, username: str, ip: str, reason: str):
        self._emit("WARN", "auth.failure",
                   username=username, source_ip=ip, reason=reason)

    def privilege_escalation(self, user_id: str, from_role: str, to_role: str):
        self._emit("WARN", "authz.privilege_change",
                   user_id=user_id, from_role=from_role, to_role=to_role)

    def data_access(self, user_id: str, resource: str, action: str, outcome: str):
        self._emit("INFO", "data.access",
                   user_id=user_id, resource=resource, action=action, outcome=outcome)

logger = SecurityLogger("payment-api")
logger.auth_failure("alice", "203.0.113.42", "invalid_password")
# Output: {"timestamp": "...", "level": "WARN", "service": "payment-api",
#           "event_type": "auth.failure", "username": "alice",
#           "source_ip": "203.0.113.42", "reason": "invalid_password"}

# Simple SOAR playbook: respond to failed SSH brute force
import requests
import subprocess
import json
from datetime import datetime

THREAT_INTEL_API = 'https://api.abuseipdb.com/api/v2/check'
ABUSEIPDB_KEY = 'your-api-key'          # load from OpenBao in production

def check_threat_intel(ip: str) -> dict:
    """Check an IP against AbuseIPDB threat intelligence."""
    resp = requests.get(
        THREAT_INTEL_API,
        headers={'Key': ABUSEIPDB_KEY, 'Accept': 'application/json'},
        params={'ipAddress': ip, 'maxAgeInDays': 90},
    )
    return resp.json().get('data', {})

def block_ip_firewall(ip: str):
    """Add a firewall rule to block the IP."""
    subprocess.run(
        ['iptables', '-A', 'INPUT', '-s', ip, '-j', 'DROP'],
        check=True
    )
    print(f"[{datetime.now()}] Blocked {ip} at firewall")

def create_ticket(ip: str, abuse_score: int, event_count: int):
    """Create a ticket in the ticketing system (example: plain log)."""
    ticket = {
        'timestamp': datetime.now().isoformat(),
        'title': f'SSH brute force from {ip}',
        'priority': 'P1' if abuse_score > 50 else 'P2',
        'details': {
            'source_ip': ip,
            'abuse_confidence_score': abuse_score,
            'failed_logins': event_count,
        }
    }
    print(f"TICKET: {json.dumps(ticket, indent=2)}")

def handle_ssh_brute_force(source_ip: str, event_count: int):
    """Main playbook: investigate and respond to SSH brute force."""
    intel = check_threat_intel(source_ip)
    abuse_score = intel.get('abuseConfidenceScore', 0)
    is_known_attacker = abuse_score > 25

    if is_known_attacker:
        block_ip_firewall(source_ip)
        create_ticket(source_ip, abuse_score, event_count)
    elif event_count > 50:
        # High volume even from unknown IP — block temporarily
        block_ip_firewall(source_ip)
        create_ticket(source_ip, abuse_score, event_count)
    else:
        print(f"[INFO] {source_ip}: {event_count} failures, score {abuse_score} — monitoring")

# Trigger from SIEM alert
handle_ssh_brute_force('203.0.113.42', event_count=75)