#!/usr/bin/env python3
# MISP威胁情报集成脚本

import json
import requests
from pymisp import PyMISP
import subprocess
import logging

class WazuhMISPIntegration:
    def __init__(self, misp_url, misp_key, wazuh_path):
        self.misp_url = misp_url
        self.misp_key = misp_key
        self.wazuh_path = wazuh_path
        self.misp = PyMISP(misp_url, misp_key, ssl=False)

        logging.basicConfig(level=logging.INFO)
        self.logger = logging.getLogger(__name__)

    def fetch_iocs(self, event_id=None, tags=None):
        """从MISP获取IOC"""
        try:
            if event_id:
                event = self.misp.get_event(event_id, pythonify=True)
                iocs = self.extract_iocs_from_event(event)
            else:
                # 获取最近24小时的IOC
                iocs = self.misp.search(
                    controller='attributes',
                    published=True,
                    timestamp='24h',
                    tags=tags
                )

            return iocs
        except Exception as e:
            self.logger.error(f"获取IOC失败: {e}")
            return []

    def extract_iocs_from_event(self, event):
        """从事件中提取IOC"""
        iocs = {
            'domains': [],
            'ips': [],
            'hashes': [],
            'urls': []
        }

        for attribute in event.attributes:
            if attribute.type == 'domain':
                iocs['domains'].append(attribute.value)
            elif attribute.type in ['ip-src', 'ip-dst']:
                iocs['ips'].append(attribute.value)
            elif attribute.type in ['md5', 'sha1', 'sha256']:
                iocs['hashes'].append(attribute.value)
            elif attribute.type == 'url':
                iocs['urls'].append(attribute.value)

        return iocs

    def update_wazuh_cdb(self, iocs):
        """更新Wazuh CDB数据库"""
        try:
            # 更新恶意域名列表
            with open(f'{self.wazuh_path}/etc/lists/malicious_domains', 'w') as f:
                for domain in iocs.get('domains', []):
                    f.write(f"{domain}:malicious_domain\n")

            # 更新恶意IP列表
            with open(f'{self.wazuh_path}/etc/lists/malicious_ips', 'w') as f:
                for ip in iocs.get('ips', []):
                    f.write(f"{ip}:malicious_ip\n")

            # 更新恶意哈希列表
            with open(f'{self.wazuh_path}/etc/lists/malicious_hashes', 'w') as f:
                for hash_val in iocs.get('hashes', []):
                    f.write(f"{hash_val}:malicious_hash\n")

            # 重启Wazuh服务以加载新数据
            subprocess.run(['systemctl', 'restart', 'wazuh-manager'])

            self.logger.info("Wazuh CDB数据库更新成功")

        except Exception as e:
            self.logger.error(f"更新CDB数据库失败: {e}")

    def create_ioc_rules(self, iocs):
        """基于IOC创建Wazuh规则"""
        rules_content = """
<group name="misp_iocs">
  <!-- 恶意域名检测 -->
  <rule id="100050" level="12">
    <decoded_as>web-log</decoded_as>
    <list field="url" lookup="match_key">etc/lists/malicious_domains</list>
    <description>Access to malicious domain detected</description>
    <group>misp,threat_intel,malicious_domain</group>
  </rule>

  <!-- 恶意IP通信检测 -->
  <rule id="100051" level="12">
    <list field="srcip" lookup="match_key">etc/lists/malicious_ips</list>
    <description>Communication with malicious IP detected</description>
    <group>misp,threat_intel,malicious_ip</group>
  </rule>

  <!-- 恶意文件哈希检测 -->
  <rule id="100052" level="12">
    <list field="hash" lookup="match_key">etc/lists/malicious_hashes</list>
    <description>Malicious file hash detected</description>
    <group>misp,threat_intel,malicious_hash</group>
  </rule>
</group>
"""

        try:
            with open(f'{self.wazuh_path}/etc/rules/misp_rules.xml', 'w') as f:
                f.write(rules_content)

            self.logger.info("MISP IOC规则创建成功")

        except Exception as e:
            self.logger.error(f"创建IOC规则失败: {e}")

# 使用示例
if __name__ == "__main__":
    misp_integration = WazuhMISPIntegration(
        misp_url="https://misp.example.com",
        misp_key="YOUR_MISP_KEY",
        wazuh_path="/var/ossec"
    )

    # 获取威胁情报
    iocs = misp_integration.fetch_iocs(tags=['malware', 'botnet'])

    # 更新Wazuh
    misp_integration.update_wazuh_cdb(iocs)
    misp_integration.create_ioc_rules(iocs)

#!/usr/bin/env python3
# Wazuh性能监控脚本

import psutil
import json
import time
import requests
from datetime import datetime

class WazuhMonitor:
    def __init__(self):
        self.indexer_url = "http://localhost:9200"
        self.metrics = {}

    def collect_system_metrics(self):
        """收集系统指标"""
        self.metrics.update({
            'timestamp': datetime.now().isoformat(),
            'cpu_percent': psutil.cpu_percent(interval=1),
            'memory_usage': psutil.virtual_memory()._asdict(),
            'disk_usage': psutil.disk_usage('/')._asdict(),
            'network_io': psutil.net_io_counters()._asdict(),
            'load_average': psutil.getloadavg()
        })

    def collect_wazuh_metrics(self):
        """收集Wazuh指标"""
        try:
            # Manager状态
            manager_stats = self.get_manager_stats()

            # Indexer状态
            indexer_stats = self.get_indexer_stats()

            self.metrics.update({
                'wazuh_manager': manager_stats,
                'wazuh_indexer': indexer_stats
            })

        except Exception as e:
            print(f"收集Wazuh指标失败: {e}")

    def get_manager_stats(self):
        """获取Manager统计信息"""
        try:
            # 读取统计文件
            with open('/var/ossec/var/run/ossec-analysisd.state', 'r') as f:
                stats = {}
                for line in f:
                    if '=' in line:
                        key, value = line.strip().split('=', 1)
                        stats[key] = value
                return stats
        except:
            return {}

    def get_indexer_stats(self):
        """获取Indexer统计信息"""
        try:
            response = requests.get(f"{self.indexer_url}/_cluster/stats")
            return response.json()
        except:
            return {}

    def check_thresholds(self):
        """检查阈值告警"""
        alerts = []

        # CPU使用率告警
        if self.metrics.get('cpu_percent', 0) > 80:
            alerts.append({
                'level': 'warning',
                'metric': 'cpu_usage',
                'value': self.metrics['cpu_percent'],
                'threshold': 80
            })

        # 内存使用率告警
        memory_percent = self.metrics.get('memory_usage', {}).get('percent', 0)
        if memory_percent > 85:
            alerts.append({
                'level': 'critical',
                'metric': 'memory_usage',
                'value': memory_percent,
                'threshold': 85
            })

        # 磁盘使用率告警
        disk_percent = (self.metrics.get('disk_usage', {}).get('used', 0) /
                       self.metrics.get('disk_usage', {}).get('total', 1)) * 100
        if disk_percent > 90:
            alerts.append({
                'level': 'critical',
                'metric': 'disk_usage',
                'value': disk_percent,
                'threshold': 90
            })

        return alerts

    def send_to_wazuh(self, data):
        """发送数据到Wazuh"""
        try:
            log_entry = {
                'timestamp': datetime.now().isoformat(),
                'source': 'wazuh_monitor',
                'data': data
            }

            # 写入日志文件，由Wazuh Agent收集
            with open('/var/log/wazuh_monitor.log', 'a') as f:
                f.write(json.dumps(log_entry) + '\n')

        except Exception as e:
            print(f"发送数据失败: {e}")

    def run_monitoring(self):
        """运行监控"""
        self.collect_system_metrics()
        self.collect_wazuh_metrics()

        alerts = self.check_thresholds()

        # 发送指标
        self.send_to_wazuh(self.metrics)

        # 发送告警
        for alert in alerts:
            self.send_to_wazuh(alert)

        print(f"监控完成 - 指标已收集，发现 {len(alerts)} 个告警")

if __name__ == "__main__":
    monitor = WazuhMonitor()
    monitor.run_monitoring()