from sigma.pipelines.common import (
    logsource_windows_file_access,
    logsource_windows_file_change,
    logsource_windows_file_delete,
    logsource_windows_file_event,
    logsource_windows_file_rename,
    logsource_windows_image_load,
    logsource_windows_network_connection,
    logsource_windows_process_creation,
    logsource_windows_registry_add,
    logsource_windows_registry_delete,
    logsource_windows_registry_event,
    logsource_windows_registry_set,
)
from sigma.pipelines.kusto_common.schema import FieldMappings


class AzureMonitorFieldMappings(FieldMappings):
    pass


# Just map to SecurityEvent for now until we have more mappings for other tables
CATEGORY_TO_TABLE_MAPPINGS = {
    "process_creation": "SecurityEvent",
    "image_load": "SecurityEvent",
    "file_access": "SecurityEvent",
    "file_change": "SecurityEvent",
    "file_delete": "SecurityEvent",
    "file_event": "SecurityEvent",
    "file_rename": "SecurityEvent",
    "registry_add": "SecurityEvent",
    "registry_delete": "SecurityEvent",
    "registry_event": "SecurityEvent",
    "registry_set": "SecurityEvent",
    "network_connection": "SecurityEvent",
}

## Rule Categories -> RuleConditions
CATEGORY_TO_CONDITIONS_MAPPINGS = {
    "process_creation": logsource_windows_process_creation(),
    "image_load": logsource_windows_image_load(),
    "file_access": logsource_windows_file_access(),
    "file_change": logsource_windows_file_change(),
    "file_delete": logsource_windows_file_delete(),
    "file_event": logsource_windows_file_event(),
    "file_rename": logsource_windows_file_rename(),
    "registry_add": logsource_windows_registry_add(),
    "registry_delete": logsource_windows_registry_delete(),
    "registry_event": logsource_windows_registry_event(),
    "registry_set": logsource_windows_registry_set(),
    "network_connection": logsource_windows_network_connection(),
}


AZURE_MONITOR_FIELD_MAPPINGS = AzureMonitorFieldMappings(
    table_mappings={
        "SecurityEvent": {
            "CommandLine": "CommandLine",
            "Image": "NewProcessName",
            "ParentImage": "ParentProcessName",
            "User": "SubjectUserName",
            "TargetFilename": "ObjectName",
            "SourceIp": "IpAddress",
            "DestinationIp": "DestinationIp",
            "DestinationPort": "DestinationPort",
            "SourcePort": "SourcePort",
            "SourceHostname": "WorkstationName",
            "DestinationHostname": "DestinationHostname",
            "EventID": "EventID",
            "ProcessId": "NewProcessId",
            "ProcessName": "NewProcessName",
            "LogonType": "LogonType",
            "TargetUserName": "TargetUserName",
            "TargetDomainName": "TargetDomainName",
            "TargetLogonId": "TargetLogonId",
            "Status": "Status",
            "SubStatus": "SubStatus",
            "ObjectType": "ObjectType",
            "ShareName": "ShareName",
            "AccessMask": "AccessMask",
            "ServiceName": "ServiceName",
            "TicketOptions": "TicketOptions",
            "TicketEncryptionType": "TicketEncryptionType",
            "TransmittedServices": "TransmittedServices",
            "WorkstationName": "WorkstationName",
            "LogonProcessName": "LogonProcessName",
            "LogonGuid": "LogonGuid",
            "Category": "EventSourceName",
            "Hashes": "FileHash",
            "TargetObject": "ObjectName",
        },
        "SigninLogs": {
            "User": "UserPrincipalName",
            "TargetUserName": "UserPrincipalName",
            "src_ip": "IPAddress",
            "IpAddress": "IPAddress",
            "app": "AppDisplayName",
            "Application": "AppDisplayName",
            "AuthenticationMethod": "AuthenticationMethodsUsed",
            "Status": "Status",
            "ResultType": "ResultType",
            "ResultDescription": "ResultDescription",
            "UserAgent": "UserAgent",
            "Location": "Location",
            "ClientAppUsed": "ClientAppUsed",
            "DeviceDetail": "DeviceDetail",
            "CorrelationId": "CorrelationId",
            "ConditionalAccessStatus": "ConditionalAccessStatus",
            "RiskLevelAggregated": "RiskLevelAggregated",
            "RiskLevelDuringSignIn": "RiskLevelDuringSignIn",
            "RiskDetail": "RiskDetail",
            "RiskState": "RiskState",
            "MfaDetail": "MfaDetail",
            "NetworkLocationDetails": "NetworkLocationDetails",
            "AuthenticationProtocol": "AuthenticationProtocol",
            "AuthenticationRequirement": "AuthenticationRequirement",
            "SignInIdentifier": "SignInIdentifier",
            "SignInIdentifierType": "SignInIdentifierType",
            "ResourceDisplayName": "ResourceDisplayName",
            "ResourceIdentity": "ResourceIdentity",
            "AppId": "AppId",
            "AuthenticationProcessingDetails": "AuthenticationProcessingDetails",
            "IsInteractive": "IsInteractive",
            "TokenIssuerName": "TokenIssuerName",
            "TokenIssuerType": "TokenIssuerType",
            "UserType": "UserType",
            "IPAddress": "IPAddress",
            "AutonomousSystemNumber": "AutonomousSystemNumber",
        },
    },
    generic_mappings={},
)
