# Signature-based: Known attack patterns
ids_rules = {
    'sql_injection': r"(\bunion\b.*\bselect\b|\bor\b.*=.*)",
    'xss_attempt': r"(<script|javascript:|onerror=)",
    'directory_traversal': r"(\.\./|\.\.\\)",
}

# Behavioral/Anomaly-based: Unusual patterns
def detect_anomaly(network_traffic):
    """ML-based anomaly detection"""
    baseline = get_traffic_baseline()

    if traffic.volume > baseline.volume * 3:
        alert("Traffic volume anomaly detected")

    if traffic.destination_ports > 100:
        alert("Port scanning detected")

    if traffic.failed_logins > 5:
        alert("Brute force attack suspected")

# Example EDR behavioral rule
class RansomwareDetection:
    def __init__(self):
        self.file_encryption_threshold = 50
        self.suspicious_extensions = ['.encrypted', '.locked', '.crypto']

    def monitor_file_activity(self, process):
        """Detect rapid file encryption behavior"""
        encrypted_files = []

        for file_event in process.file_operations:
            if file_event.action == 'write':
                # Check for encryption indicators
                if self.is_encrypted(file_event.new_content):
                    encrypted_files.append(file_event.path)

                # Ransomware typically encrypts many files quickly
                if len(encrypted_files) > self.file_encryption_threshold:
                    self.respond_to_ransomware(process)

    def respond_to_ransomware(self, process):
        """Automated response to ransomware detection"""
        # 1. Kill the malicious process
        process.terminate()

        # 2. Isolate the endpoint
        self.network.quarantine_host(process.hostname)

        # 3. Alert security team
        self.alert_soc(
            severity='critical',
            threat='Ransomware detected',
            host=process.hostname,
            process=process.name
        )

        # 4. Create forensic snapshot
        self.capture_memory_dump(process.hostname)

# Automated patch management workflow
class PatchManagement:
    def __init__(self):
        self.patch_windows = {
            'critical': timedelta(days=7),
            'high': timedelta(days=14),
            'medium': timedelta(days=30),
            'low': timedelta(days=90)
        }

    def assess_vulnerabilities(self):
        """Scan for missing patches"""
        scan_results = vulnerability_scanner.scan_all_hosts()

        for vuln in scan_results:
            severity = vuln.cvss_severity
            deadline = datetime.now() + self.patch_windows[severity]

            self.create_patch_ticket(
                vulnerability=vuln,
                severity=severity,
                deadline=deadline
            )

    def deploy_patches(self, patch_group):
        """Phased rollout approach"""
        # Phase 1: Test environment (Day 0)
        self.deploy_to_group(patch_group, 'test')
        self.monitor_for_issues(duration=days(2))

        # Phase 2: Pilot group (Day 2)
        if not self.has_critical_issues():
            self.deploy_to_group(patch_group, 'pilot')
            self.monitor_for_issues(duration=days(3))

        # Phase 3: Production rollout (Day 5)
        if not self.has_critical_issues():
            self.deploy_to_group(patch_group, 'production')

# Conditional MFA based on risk
class AdaptiveMFA:
    def authenticate(self, user, context):
        """Risk-based authentication"""
        risk_score = self.calculate_risk(user, context)

        # Always require password
        if not self.verify_password(user):
            return False

        # MFA required based on risk
        if risk_score >= 70:
            # High risk: Require hardware key
            return self.require_fido2(user)

        elif risk_score >= 40:
            # Medium risk: Require TOTP or push
            return self.require_totp_or_push(user)

        elif risk_score >= 20:
            # Low risk: Optional MFA
            return self.optional_mfa(user)

        # Very low risk: Password only
        return True

    def calculate_risk(self, user, context):
        """Calculate authentication risk score"""
        score = 0

        # New device
        if not context.device_id in user.known_devices:
            score += 30

        # Unusual location
        if context.location not in user.typical_locations:
            score += 25

        # Unusual time
        if not self.is_typical_login_time(user, context.time):
            score += 15

        # Failed attempts recently
        score += user.recent_failed_logins * 10

        # Privileged account
        if user.is_privileged:
            score += 20

        return min(score, 100)

# Temporary privilege elevation
class JITAccessManager:
    def request_elevated_access(self, user, resource, justification):
        """Request temporary admin access"""
        # Require approval for production systems
        if resource.environment == 'production':
            approval = self.request_manager_approval(
                user=user,
                resource=resource,
                justification=justification,
                duration=hours(4)
            )

            if not approval.approved:
                return AccessDenied("Manager approval required")

        # Grant temporary access
        access_grant = self.create_temp_access(
            user=user,
            resource=resource,
            permissions=['admin'],
            expires=datetime.now() + timedelta(hours=4)
        )

        # Session monitoring
        self.monitor_session(access_grant, recording=True)

        # Automatic revocation
        self.schedule_revocation(access_grant)

        return access_grant

    def monitor_session(self, access_grant, recording=True):
        """Monitor privileged session activity"""
        session_monitor = SessionRecorder(
            user=access_grant.user,
            resource=access_grant.resource,
            record_keystrokes=recording,
            record_screen=recording
        )

        # Alert on suspicious activity
        for action in session_monitor.actions:
            if self.is_suspicious(action):
                self.alert_security_team(access_grant, action)

# Quarterly access review automation
class AccessReviewManager:
    def conduct_quarterly_review(self):
        """Automated access certification process"""
        # Identify accounts requiring review
        accounts_to_review = self.get_active_accounts()

        for account in accounts_to_review:
            # Determine reviewer (manager or resource owner)
            reviewer = self.get_reviewer(account)

            # Generate review package
            review_package = {
                'user': account.user,
                'access_summary': self.summarize_access(account),
                'last_login': account.last_login,
                'high_risk_access': self.identify_risky_access(account),
                'recommended_action': self.recommend_action(account)
            }

            # Send for review
            self.send_review_request(reviewer, review_package)

    def recommend_action(self, account):
        """AI-based access recommendation"""
        recommendations = []

        # Inactive account
        if account.last_login < datetime.now() - timedelta(days=90):
            recommendations.append("DISABLE: No activity in 90 days")

        # Over-privileged
        granted_permissions = set(account.permissions)
        used_permissions = set(account.permissions_used)
        unused = granted_permissions - used_permissions

        if len(unused) > 0:
            recommendations.append(f"REVOKE: Unused permissions: {unused}")

        # Orphaned account (manager left)
        if not account.manager.is_active:
            recommendations.append("REVIEW: Manager no longer active")

        return recommendations

# DLP rule engine
class DLPEngine:
    def __init__(self):
        self.patterns = {
            'ssn': r'\b\d{3}-\d{2}-\d{4}\b',
            'credit_card': r'\b\d{4}[- ]?\d{4}[- ]?\d{4}[- ]?\d{4}\b',
            'api_key': r'api[_-]?key["\']?\s*[:=]\s*["\']?[a-zA-Z0-9]{32,}',
            'aws_key': r'AKIA[0-9A-Z]{16}',
        }

    def scan_content(self, content, action_context):
        """Scan content for sensitive data"""
        findings = []

        for data_type, pattern in self.patterns.items():
            matches = re.findall(pattern, content)
            if matches:
                findings.append({
                    'type': data_type,
                    'count': len(matches),
                    'severity': self.get_severity(data_type)
                })

        if findings:
            return self.enforce_policy(findings, action_context)

        return PolicyAction.ALLOW

    def enforce_policy(self, findings, context):
        """Enforce DLP policy based on context"""
        severity = max(f['severity'] for f in findings)

        # Email: Block high severity
        if context.channel == 'email' and severity == 'high':
            return PolicyAction.BLOCK

        # Cloud upload: Quarantine and alert
        if context.channel == 'cloud_storage':
            self.quarantine_file(context.file)
            self.alert_security(findings, context)
            return PolicyAction.BLOCK

        # Internal transfer: Audit only
        if context.destination.is_internal:
            self.audit_log(findings, context)
            return PolicyAction.ALLOW

        # Default: Block external transfer
        return PolicyAction.BLOCK

# Application-level encryption
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.backends import default_backend
import os

class DataEncryption:
    def __init__(self, key_management_service):
        self.kms = key_management_service

    def encrypt_sensitive_data(self, plaintext, data_classification):
        """Encrypt data using AES-256-GCM"""
        # Retrieve encryption key from KMS
        data_key = self.kms.get_data_key(classification=data_classification)

        # Generate nonce (never reuse with same key!)
        nonce = os.urandom(12)

        # Encrypt with authenticated encryption
        aesgcm = AESGCM(data_key)
        ciphertext = aesgcm.encrypt(nonce, plaintext.encode(), None)

        # Return nonce + ciphertext (nonce is not secret)
        return {
            'nonce': nonce.hex(),
            'ciphertext': ciphertext.hex(),
            'key_id': data_key.id,
            'algorithm': 'AES-256-GCM'
        }

    def decrypt_sensitive_data(self, encrypted_data):
        """Decrypt data and verify authenticity"""
        # Retrieve decryption key
        data_key = self.kms.get_key_by_id(encrypted_data['key_id'])

        # Decrypt and verify
        aesgcm = AESGCM(data_key)
        nonce = bytes.fromhex(encrypted_data['nonce'])
        ciphertext = bytes.fromhex(encrypted_data['ciphertext'])

        try:
            plaintext = aesgcm.decrypt(nonce, ciphertext, None)
            return plaintext.decode()
        except Exception:
            # Authentication failed - data tampered
            raise IntegrityError("Data authentication failed")

# FastAPI with security best practices
from fastapi import FastAPI, Depends, HTTPException, Security
from fastapi.security import OAuth2PasswordBearer, APIKeyHeader
from slowapi import Limiter, _rate_limit_exceeded_handler
from slowapi.util import get_remote_address

app = FastAPI()
limiter = Limiter(key_func=get_remote_address)
app.state.limiter = limiter
app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")
api_key_header = APIKeyHeader(name="X-API-Key")

# Rate limiting by endpoint sensitivity
@app.get("/api/public")
@limiter.limit("100/minute")
async def public_endpoint(request: Request):
    """Public endpoint with generous rate limit"""
    return {"message": "Public data"}

@app.get("/api/search")
@limiter.limit("20/minute")
async def search_endpoint(request: Request, token: str = Depends(oauth2_scheme)):
    """Authenticated endpoint with moderate rate limit"""
    user = verify_token(token)
    return {"results": search_data(user)}

@app.post("/api/sensitive")
@limiter.limit("5/minute")
async def sensitive_endpoint(request: Request, token: str = Depends(oauth2_scheme)):
    """Sensitive operation with strict rate limit"""
    user = verify_token(token)

    # Additional security checks
    if not user.is_authorized_for_sensitive_ops():
        raise HTTPException(status_code=403, detail="Insufficient privileges")

    # Require MFA for sensitive operations
    if not verify_mfa_token(request.headers.get("X-MFA-Token")):
        raise HTTPException(status_code=403, detail="MFA required")

    return perform_sensitive_operation(user)

# Input validation
from pydantic import BaseModel, validator, Field

class UserInput(BaseModel):
    username: str = Field(..., min_length=3, max_length=50, regex=r'^[a-zA-Z0-9_]+$')
    email: str = Field(..., regex=r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$')

    @validator('username')
    def username_must_not_be_reserved(cls, v):
        reserved = ['admin', 'root', 'system']
        if v.lower() in reserved:
            raise ValueError('Reserved username')
        return v

# Automated incident response orchestration
class IncidentResponseOrchestrator:
    def handle_security_alert(self, alert):
        """Automated incident response workflow"""
        # 1. Classify incident
        severity = self.classify_severity(alert)
        incident = self.create_incident_ticket(alert, severity)

        # 2. Initial containment (automated for known threats)
        if alert.threat_type in self.known_threats:
            self.auto_contain(alert)

        # 3. Evidence collection
        self.collect_evidence(alert)

        # 4. Notifications
        self.notify_stakeholders(incident)

        # 5. Execute playbook
        playbook = self.get_playbook(alert.threat_type)
        self.execute_playbook(playbook, incident)

    def auto_contain(self, alert):
        """Automatic containment actions"""
        if alert.threat_type == 'ransomware':
            # Isolate infected host
            self.network.quarantine_host(alert.source_host)

            # Disable user account
            self.iam.disable_user(alert.affected_user)

            # Kill malicious process
            self.edr.kill_process(alert.source_host, alert.process_id)

        elif alert.threat_type == 'data_exfiltration':
            # Block outbound connection
            self.firewall.block_ip(alert.destination_ip)

            # Revoke user session
            self.iam.revoke_sessions(alert.affected_user)

        elif alert.threat_type == 'credential_compromise':
            # Force password reset
            self.iam.force_password_reset(alert.affected_user)

            # Invalidate all sessions
            self.iam.revoke_all_sessions(alert.affected_user)

            # Require MFA re-enrollment
            self.mfa.reset_factors(alert.affected_user)

    def collect_evidence(self, alert):
        """Automated evidence collection"""
        evidence = {
            'timestamp': datetime.now(),
            'alert_details': alert.to_dict(),
            'network_logs': self.siem.get_logs(alert.source_host, hours=24),
            'endpoint_logs': self.edr.get_logs(alert.source_host),
            'memory_dump': self.edr.capture_memory(alert.source_host),
            'network_capture': self.network.capture_traffic(alert.source_host),
        }

        self.evidence_locker.store(evidence, chain_of_custody=True)

# Security metrics dashboard
class SecurityMetrics:
    def calculate_monthly_metrics(self):
        """Generate executive security dashboard"""
        return {
            # Detection metrics
            'mean_time_to_detect': self.calculate_mttd(),  # Target: < 24 hours
            'detection_coverage': self.calculate_coverage(),  # Target: > 90%
            'false_positive_rate': self.calculate_fpr(),  # Target: < 10%

            # Response metrics
            'mean_time_to_respond': self.calculate_mttr(),  # Target: < 1 hour
            'mean_time_to_recover': self.calculate_mttr_recovery(),  # Target: < 4 hours
            'incident_resolution_rate': self.calculate_resolution_rate(),  # Target: > 95%

            # Vulnerability metrics
            'time_to_patch_critical': self.avg_patch_time('critical'),  # Target: < 7 days
            'vulnerability_remediation_rate': self.remediation_rate(),  # Target: > 90%

            # Compliance metrics
            'mfa_enrollment_rate': self.mfa_adoption(),  # Target: 100%
            'security_training_completion': self.training_completion(),  # Target: 100%
            'policy_compliance_score': self.compliance_score(),  # Target: > 95%

            # User behavior
            'phishing_click_rate': self.phishing_test_results(),  # Target: < 5%
            'policy_violations': self.count_policy_violations(),  # Target: Decreasing trend
        }

    def calculate_mttd(self):
        """Mean Time to Detect: Time from compromise to detection"""
        incidents = self.get_incidents(last_30_days=True)
        detection_times = []

        for incident in incidents:
            if incident.compromise_time and incident.detection_time:
                delta = incident.detection_time - incident.compromise_time
                detection_times.append(delta.total_seconds() / 3600)  # hours

        return sum(detection_times) / len(detection_times) if detection_times else 0