# Example of a basic security automation script
import requests
import json
import logging

# Setup logging
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')

# API configuration
API_KEY = "your_api_key_here"
ENDPOINT = "https://api.threatintel.example.com/v1/lookup"

def enrich_ioc(indicator, indicator_type):
    """Enriches indicators of compromise with threat intelligence data"""
    headers = {
        "Authorization": f"Bearer {API_KEY}",
        "Content-Type": "application/json"
    }

    payload = {
        "indicator": indicator,
        "type": indicator_type
    }

    try:
        response = requests.post(ENDPOINT, headers=headers, data=json.dumps(payload))
        response.raise_for_status()

        return response.json()
    except Exception as e:
        logging.error(f"Error enriching IOC {indicator}: {str(e)}")
        return None

def process_alerts(alerts_file):
    """Process alerts from SIEM export and enrich with threat intelligence"""
    with open(alerts_file, 'r') as f:
        alerts = json.load(f)

    enriched_alerts = []

    for alert in alerts:
        ip_addresses = alert.get("source_ips", []) + alert.get("destination_ips", [])

        for ip in ip_addresses:
            enrichment = enrich_ioc(ip, "ip")
            if enrichment:
                alert["enrichment"] = alert.get("enrichment", {})
                alert["enrichment"][ip] = enrichment

        enriched_alerts.append(alert)

    with open('enriched_alerts.json', 'w') as f:
        json.dump(enriched_alerts, f, indent=4)

    logging.info(f"Processed {len(alerts)} alerts, saved to enriched_alerts.json")

if __name__ == "__main__":
    process_alerts("alerts.json")