# Create a virtual environment
python -m venv venv
source venv/bin/activate  # On Windows use: venv\Scripts\activate

# Install core dependencies
pip install requests python-dotenv openai pandas

# Initialize project
npm init -y

# Install core dependencies
npm install axios dotenv openai typescript ts-node @types/node

import os
import json
import logging
from datetime import datetime
from typing import Dict, Any
from openai import OpenAI
from dotenv import load_dotenv

# Setup logging for production audit trails
logging.basicConfig(level=logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
logger = logging.getLogger(__name__)

load_dotenv()

class SecurityMonitor:
    def __init__(self):
        # Initialize OpenAI client for advanced pattern recognition
        self.ai_client = OpenAI(api_key=os.getenv("OPENAI_API_KEY"))
        self.threshold = 0.8  # Confidence threshold for anomaly detection

    def fetch_system_logs(self) -> list:
        """
        Simulates fetching logs from Microsoft Defender via API.
        In production, replace with an actual Azure Graph API call.
        """
        return [
            {"timestamp": "2023-10-27T10:00:01Z", "event": "Process_Start", "user": "System", "path": "C:\\Windows\\System32\\cmd.exe"},
            {"timestamp": "2023-10-27T10:00:05Z", "event": "Privilege_Escalation", "user": "cmd.exe", "target": "SYSTEM"},
            {"timestamp": "2023-10-27T10:00:10Z", "event": "Network_Connection", "user": "SYSTEM", "remote_ip": "192.168.1.50"}
        ]

    def analyze_anomaly(self, logs: list) -> bool:
        """
        Uses LLM to analyze log patterns for zero-day indicators.
        """
        try:
            prompt = f"Analyze these system logs for signs of a zero-day exploit or unauthorized privilege escalation. Respond ONLY with 'THREAT' or 'SAFE'. \nLogs: {json.dumps(logs)}"
            
            response = self.ai_client.chat.completions.create(
                model="gpt-4",
                messages=[{"role": "user", "content": prompt}],
                temperature=0
            )
            
            decision = response.choices[0].message.content.strip()
            return decision == "THREAT"

        except Exception as e:
            logger.error(f"AI Analysis failed: {str(e)}")
            return False

    def run_security_check(self):
        logger.info("Starting security scan...")
        logs = self.fetch_system_logs()
        
        if self.analyze_anomaly(logs):
            logger.warning("!!! ALERT: Anomalous activity detected (Potential Zero-Day)!!!")
            self.trigger_incident_response()
        else:
            logger.info("System status: Normal.")

    def trigger_incident_response(self):
        # Logic to isolate the host or alert the SOC
        logger.critical("ACTION REQUIRED: Initiating host isolation protocol.")

if __name__ == "__main__":
    monitor = SecurityMonitor()
    monitor.run_security_check()

import axios from 'axios';
import * as dotenv from 'dotenv';

dotenv.config();

interface SecurityEvent {
    timestamp: string;
    event: string;
    severity: 'Low' | 'Medium' | 'High' | 'Critical';
}

class DefenderShield {
    private apiUrl: string;

    constructor() {
        this.apiUrl = process.env.DEFENDER_API_URL || '';
    }

    /**
     * Validates incoming events against known RoguePlanet attack patterns
     * (e.g., unexpected SYSTEM-level shell spawns)
     */
    public async inspectEvent(event: SecurityEvent): Promise<void> {
        try {
            console.log(`[${event.timestamp}] Inspecting: ${event.event}`);

            // Pattern Matching: Detecting potential RoguePlanet behavior
            if (this.isSuspicious(event)) {
                await this.handleThreat(event);
            }
        } catch (error) {
            console.error("Error during event inspection:", error);
        }
    }

    private isSuspicious(event: SecurityEvent): boolean {
        // Logic: Detect high severity events that don't match standard user profiles
        const roguePlanetPatterns = ['Privilege_Escalation', 'Kernel_Memory_Write'];
        return event.severity === 'Critical' || roguePlanetPatterns.includes(event.event);
    }

    private async handleThreat(event: SecurityEvent): Promise<void> {
        console.error(`🚨 THREAT DETECTED: ${event.event} | Severity: ${event.severity}`);
        
        // In a real scenario, we would call the Microsoft Graph API to isolate the machine
        try {
            // Mock API Call
            // await axios.post(`${this.apiUrl}/machines/${id}/isolate`, { reason: 'Zero-Day Detection' });
            console.log("✅ Mitigation Action: Machine isolation request sent to Azure.");
        } catch (err) {
            console.error("Failed to execute mitigation!");
        }
    }
}

// --- TEST SUITE ---
const shield = new DefenderShield();

// Test Case 1: Normal activity
shield.inspectEvent({
    timestamp: new Date().toISOString(),
    event: 'File_Access',
    severity: 'Low'
});

// Test Case 2: Potential RoguePlanet Zero-Day behavior
shield.inspectEvent({
    timestamp: new Date().toISOString(),
    event: 'Privilege_Escalation',
    severity: 'Critical'
});

# Azure / Microsoft Graph API
AZURE_TENANT_ID=your-tenant-id-here
AZURE_CLIENT_ID=your-client-id-here
AZURE_CLIENT_SECRET=your-client-secret-here

# AI Analysis (Optional for advanced pattern detection)
OPENAI_API_KEY=sk-xxxxxxxxxxxxxxxxxxxx

# Security Settings
DETECTION_THRESHOLD=0.85
LOG_LEVEL=INFO