"""
Vulnerability Management pillar generator.
"""

from typing import Dict, Any, List
from ..models import CyberdefensePillar, LogSeverity, AttackTactic, PillarAttackPattern
from .base_pillar_generator import BasePillarGenerator


class VulnerabilityManagementGenerator(BasePillarGenerator):
    """Generator for Vulnerability Management pillar."""
    
    def get_pillar(self) -> CyberdefensePillar:
        return CyberdefensePillar.VULNERABILITY_MANAGEMENT
    
    def _setup_attack_patterns(self) -> Dict[str, PillarAttackPattern]:
        """Setup vulnerability management attack patterns."""
        return {
            'vulnerability_exploitation': PillarAttackPattern(
                pillar=CyberdefensePillar.VULNERABILITY_MANAGEMENT,
                attack_type='vulnerability_exploitation',
                severity=LogSeverity.HIGH,
                description='Vulnerability exploitation attack',
                tactic=AttackTactic.INITIAL_ACCESS,
                weight=0.25,
                indicators=['vulnerability_abuse', 'exploit_usage', 'vulnerability_attack'],
                log_sources=['vulnerability_logs', 'exploit_logs', 'security_logs'],
                mitigation_controls=['vulnerability_patching', 'exploit_protection', 'vulnerability_monitoring']
            ),
            'zero_day_exploitation': PillarAttackPattern(
                pillar=CyberdefensePillar.VULNERABILITY_MANAGEMENT,
                attack_type='zero_day_exploitation',
                severity=LogSeverity.CRITICAL,
                description='Zero-day vulnerability exploitation',
                tactic=AttackTactic.INITIAL_ACCESS,
                weight=0.2,
                indicators=['zero_day_usage', 'unknown_vulnerability', 'unpatched_exploit'],
                log_sources=['vulnerability_logs', 'exploit_logs', 'security_logs'],
                mitigation_controls=['behavioral_detection', 'exploit_protection', 'vulnerability_monitoring']
            ),
            'vulnerability_scan_evasion': PillarAttackPattern(
                pillar=CyberdefensePillar.VULNERABILITY_MANAGEMENT,
                attack_type='vulnerability_scan_evasion',
                severity=LogSeverity.MEDIUM,
                description='Vulnerability scan evasion',
                tactic=AttackTactic.DEFENSE_EVASION,
                weight=0.15,
                indicators=['scan_evasion', 'vulnerability_hiding', 'scan_bypass'],
                log_sources=['scan_logs', 'vulnerability_logs', 'security_logs'],
                mitigation_controls=['scan_validation', 'vulnerability_verification', 'scan_monitoring']
            ),
            'patch_management_bypass': PillarAttackPattern(
                pillar=CyberdefensePillar.VULNERABILITY_MANAGEMENT,
                attack_type='patch_management_bypass',
                severity=LogSeverity.HIGH,
                description='Patch management bypass',
                tactic=AttackTactic.DEFENSE_EVASION,
                weight=0.15,
                indicators=['patch_bypass', 'update_evasion', 'patch_manipulation'],
                log_sources=['patch_logs', 'update_logs', 'security_logs'],
                mitigation_controls=['patch_enforcement', 'update_validation', 'patch_monitoring']
            ),
            'vulnerability_disclosure_abuse': PillarAttackPattern(
                pillar=CyberdefensePillar.VULNERABILITY_MANAGEMENT,
                attack_type='vulnerability_disclosure_abuse',
                severity=LogSeverity.MEDIUM,
                description='Vulnerability disclosure abuse',
                tactic=AttackTactic.INITIAL_ACCESS,
                weight=0.1,
                indicators=['disclosure_abuse', 'vulnerability_exploitation', 'disclosure_manipulation'],
                log_sources=['disclosure_logs', 'vulnerability_logs', 'security_logs'],
                mitigation_controls=['disclosure_management', 'vulnerability_validation', 'disclosure_monitoring']
            ),
            'vulnerability_assessment_manipulation': PillarAttackPattern(
                pillar=CyberdefensePillar.VULNERABILITY_MANAGEMENT,
                attack_type='vulnerability_assessment_manipulation',
                severity=LogSeverity.MEDIUM,
                description='Vulnerability assessment manipulation',
                tactic=AttackTactic.DEFENSE_EVASION,
                weight=0.1,
                indicators=['assessment_manipulation', 'vulnerability_hiding', 'assessment_tampering'],
                log_sources=['assessment_logs', 'vulnerability_logs', 'security_logs'],
                mitigation_controls=['assessment_validation', 'vulnerability_verification', 'assessment_monitoring']
            ),
            'vulnerability_management_evasion': PillarAttackPattern(
                pillar=CyberdefensePillar.VULNERABILITY_MANAGEMENT,
                attack_type='vulnerability_management_evasion',
                severity=LogSeverity.LOW,
                description='Vulnerability management evasion',
                tactic=AttackTactic.DEFENSE_EVASION,
                weight=0.05,
                indicators=['management_evasion', 'vulnerability_bypass', 'management_avoidance'],
                log_sources=['management_logs', 'vulnerability_logs', 'security_logs'],
                mitigation_controls=['management_monitoring', 'vulnerability_detection', 'management_validation']
            )
        }
    
    def _get_normal_activities(self) -> List[str]:
        """Return list of normal vulnerability management activities."""
        return [
            "Vulnerability scan completion",
            "Vulnerability assessment",
            "Patch management process",
            "Vulnerability prioritization",
            "Vulnerability remediation",
            "Vulnerability management training",
            "Vulnerability management policy update",
            "Vulnerability management audit",
            "Vulnerability management metrics collection",
            "Vulnerability management tool configuration",
            "Vulnerability management process improvement",
            "Vulnerability management risk assessment",
            "Vulnerability management compliance check",
            "Vulnerability management awareness training",
            "Vulnerability management governance review",
            "Vulnerability management certification",
            "Vulnerability management monitoring",
            "Vulnerability management communication",
            "Vulnerability management incident response",
            "Vulnerability management continuous improvement"
        ]

