from datetime import datetime
from typing import Optional

from pydantic import BaseModel

from py_ocsf_models.events.findings.category_uid import CategoryUID
from py_ocsf_models.events.findings.class_uid import ClassUID
from py_ocsf_models.events.findings.detection_finding_type_id import (
    DetectionFindingTypeID,
)
from py_ocsf_models.events.findings.finding import Finding
from py_ocsf_models.events.findings.impact_id import ImpactID
from py_ocsf_models.events.findings.risk_level_id import RiskLevelID
from py_ocsf_models.events.findings.status_id import StatusID
from py_ocsf_models.objects.api import API
from py_ocsf_models.objects.cloud import Cloud
from py_ocsf_models.objects.evidence_artifacts import EvidenceArtifacts
from py_ocsf_models.objects.remediation import Remediation
from py_ocsf_models.objects.resource_details import ResourceDetails
from py_ocsf_models.objects.vulnerability_details import VulnerabilityDetails


class DetectionFinding(Finding, BaseModel):
    """
    A Detection Finding describes detections or alerts generated by security products using correlation engines, detection engines or other methodologies. Note: if the product is a security control, the security_control profile should be applied and its attacks information should be duplicated into the finding_info object.

    Attributes:
    - Affected Resources (resources) [Recommended]: Describes details about resources that were the target of the activity that triggered the finding.
    - Category (category_name): The event category name, as defined by category_uid value: Findings.
    - Class (class_name) [Optional]: The event class name, as defined by class_uid value: Detection Finding.
    - Class ID (class_uid): The unique identifier of a class. A Class describes the attributes available in an event.
    - Cloud (cloud) [Optional]: Describes details about the Cloud environment where the event was originally created or logged.
    - Count (count) [Optional]: Number of times similar events occurred within a specified timeframe.
    - Duration (duration) [Optional]: Time span of the event, from start to end, in milliseconds.
    - Event Time (time) [Required]: The standardized time when the event occurred or the finding was created.
    - Event Time (time_dt) [Optional]: The standardized time when the event occurred or the finding was created, in datetime format.
    - Evidence Artifacts (evidences) [Optional]: Artifacts related to the security detection activities.
    - Impact (impact) [Optional]: The impact, normalized to the caption of the impact_id value. In the case of 'Other', it is defined by the event source.
    - Impact Score (impact_score) [Optional]: The impact of the finding, valid range 0-100.
    - Impact ID (impact_id) [Optional]: The normalized impact of the finding.
    - Remediation Guidance (remediation) [Optional]: Suggested steps to address the finding.
    - Risk Level (risk_level) [Optional]: The risk level, normalized to the caption of the risk_level_id value. In the case of 'Other', it is defined by the event source.
    - Risk Level ID (risk_level_id) [Optional]: The normalized risk level id.
    - Risk Score (risk_score) [Optional]: The risk score as reported by the event source.
    - Risk Details (risk_details) [Optional]: Additional details about the risk.
    - Status ID (status_id) [Optional]: The normalized identifier of the event/finding severity.
    - Timezone Offset (timezone_offset) [Optional]: Difference in minutes from UTC.
    - Type ID (type_uid): The event/finding type ID. It identifies the event's semantics and structure. The value is calculated by the logging system as: class_uid * 100 + activity_id.
    - Type Name (type_name) [Optional]: The event/finding type name, as defined by the type_uid.
    - Vulnerabilities (vulnerabilities) [Optional]: Vulnerabilities identified in the finding.

    If the Cloud profile is needed:
        - API Details (api) [Optional]: Describes details about a typical API (Application Programming Interface) call.
        - Cloud (cloud): Describes details about the Cloud environment where the event was originally created or logged
    """

    resources: Optional[list[ResourceDetails]] = None
    category_name: str = CategoryUID.Findings.name
    category_uid: int = CategoryUID.Findings.value
    class_name: Optional[str] = "Detection Finding"
    class_uid: int = ClassUID.DetectionFinding
    cloud: Optional[Cloud] = None
    api: Optional[API] = None
    count: Optional[int] = None
    duration: Optional[int] = None
    evidences: Optional[list[EvidenceArtifacts]] = None
    impact: Optional[str] = None
    impact_score: Optional[int] = None
    impact_id: Optional[ImpactID] = None
    remediation: Optional[Remediation] = None
    risk_level: Optional[str] = None
    risk_level_id: Optional[RiskLevelID] = None
    risk_score: Optional[int] = None
    risk_details: Optional[str] = None
    status_id: Optional[StatusID] = None
    time: int
    time_dt: Optional[datetime] = None
    timezone_offset: Optional[int] = None
    type_uid: DetectionFindingTypeID
    type_name: Optional[str] = None
    vulnerabilities: Optional[list[VulnerabilityDetails]] = None
