# Create a virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install core dependencies
pip install requests pydantic python-dotenv loguru

# Initialize project
npm init -y

# Install dependencies
npm install axios dotenv zod winston
# For TypeScript support
npm install --save-dev typescript @types/node

import os
import asyncio
from typing import List
from pydantic import BaseModel, Field
from loguru import logger
from dotenv import load_dotenv

# Load environment variables
load_dotenv()

# --- Data Models ---

class BreachEvent(BaseModel):
    """Schema for a confirmed data breach alert."""
    incident_id: str
    affected_entity: str
    records_exposed: int = Field(gt=0)
    data_types: List[str]
    severity: str = Field(pattern="^(CRITICAL|HIGH|MEDIUM)$")

# --- Mitigation Logic ---

class IncidentResponseOrchestrator:
    def __init__(self):
        self.api_key = os.getenv("SECURITY_API_KEY")
        
    async def rotate_credentials(self, entity: str):
        """Simulates rotating API keys and resetting user sessions."""
        logger.warning(f"ACTION: Rotating all credentials for {entity}...")
        await asyncio.sleep(1)  # Simulate network I/O
        logger.success(f"SUCCESS: Credentials rotated for {entity}")

    async def notify_customers(self, count: int):
        """Simulates mass notification via email/SMS."""
        logger.info(f"ACTION: Initiating notification sequence for {count} customers...")
        await asyncio.sleep(1.5)
        logger.success(f"SUCCESS: {count} notifications dispatched.")

    async def run_mitigation_workflow(self, event: BreachEvent):
        """The main orchestration workflow."""
        logger.error(f"!!! BREACH DETECTED: {event.incident_id}!!!")
        logger.info(f"Entity: {event.affected_entity} | Records: {event.records_exposed}")
        
        try:
            # Execute mitigation tasks concurrently for speed
            await asyncio.gather(
                self.rotate_credentials(event.affected_entity),
                self.notify_customers(event.records_exposed)
            )
            logger.success(f"Workflow completed for {event.incident_id}")
        except Exception as e:
            logger.critical(f"Workflow failed: {str(e)}")

# --- Main Execution ---

async def main():
    orchestrator = IncidentResponseOrchestrator()
    
    # Mocking an incoming alert (e.g., from a SIEM webhook)
    raw_data = {
        "incident_id": "INC-2023-ORIGIN-001",
        "affected_entity": "Origin Energy",
        "records_exposed": 2000000,
        "data_types": ["Email", "Address", "Account Number"],
        "severity": "CRITICAL"
    }
    
    # Validate data
    try:
        event = BreachEvent(**raw_data)
        await orchestrator.run_mitigation_workflow(event)
    except Exception as e:
        logger.error(f"Invalid event data received: {e}")

if __name__ == "__main__":
    asyncio.run(main())

import dotenv from 'dotenv';
import { z } from 'zod';
import winston from 'winston';

dotenv.config();

// --- Configuration & Logger ---
const logger = winston.createLogger({
    level: 'info',
    format: winston.format.combine(
        winston.format.timestamp(),
        winston.format.json()
    ),
    transports: [new winston.transports.Console()],
});

// --- Schema Definition ---
const BreachEventSchema = z.object({
    incidentId: z.string(),
    entityName: z.string(),
    impactCount: z.number().positive(),
    severity: z.enum(['CRITICAL', 'HIGH', 'MEDIUM']),
    exposedFields: z.array(z.string()),
});

type BreachEvent = z.infer<typeof BreachEventSchema>;

// --- Orchestrator Class ---
class IncidentResponseManager {
    private apiKey: string;

    constructor() {
        this.apiKey = process.env.SECURITY_API_KEY || '';
        if (!this.apiKey) throw new Error("Missing SECURITY_API_KEY");
    }

    private async revokeAccess(entity: string): Promise<void> {
        logger.warn(`[MITIGATION] Revoking sessions for ${entity}`);
        // Simulate API Call to IAM
        return new Promise(res => setTimeout(res, 1000));
    }

    private async triggerAlertSystem(count: number): Promise<void> {
        logger.warn(`[MITIGATION] Dispatching alerts for ${count} users`);
        // Simulate API Call to SendGrid
        return new Promise(res => setTimeout(res, 1000));
    }

    public async handleBreach(data: unknown): Promise<void> {
        try {
            // 1. Validate Input
            const event = BreachEventSchema.parse(data);
            logger.error(`CRITICAL BREACH DETECTED: ${event.incidentId}`);

            // 2. Execute Parallel Mitigation
            await Promise.all([
                this.revokeAccess(event.entityName),
                this.triggerAlertSystem(event.impactCount)
            ]);

            logger.info(`Mitigation workflow completed for ${event.incidentId}`);
        } catch (error) {
            if (error instanceof z.ZodError) {
                logger.error('Invalid Breach Event Schema', error.errors);
            } else {
                logger.error('System Failure during mitigation', error);
            }
        }
    }
}

// --- Execution ---
const manager = new IncidentResponseManager();

const mockBreachPayload = {
    incidentId: "AUTH-9921",
    entityName: "Origin Energy",
    impactCount: 2000000,
    severity: "CRITICAL",
    exposedFields: ["PII", "Billing Info"]
};

manager.handleBreach(mockBreachPayload);

# Security API Credentials
SECURITY_API_KEY=sk_live_51MzX...
SIEM_ENDPOINT=https://api.datadog.com/v2/events

# Notification Settings
EMAIL_SERVICE_API_KEY=SG.example_key
SMS_GATEWAY_ID=tw_12345

# Log Settings
LOG_LEVEL=DEBUG