import json, os, sys, urllib.request, urllib.parse, urllib.error

GRAPHQL = "/web/api/v2.1/unifiedalerts/graphql"

QUERY = """
query GetAlertDetails($id: ID!) {
  alert(id: $id) {
    id externalId name description severity status classification confidenceLevel
    analystVerdict result detectedAt createdAt updatedAt firstSeenAt lastSeenAt
    storylineId attackSurfaces noteExists
    asset { id name osType osVersion agentVersion lastLoggedInUser }
    assignee { userId fullName email }
    detectionSource { vendor product engine }
    process { cmdLine parentName username file { name path md5 sha1 sha256 size } }
    indicators { uid type message severity eventTime
      attacks { tactic { name uid } technique { name uid } }
      observables { name value type typeName } }
    observables { name value type typeName }
    relatedAlerts { id name }
  }
}
"""


def _cfg():
    s = json.loads(os.environ.get("INTEGRATION_SECRETS", "{}"))
    base = str(s.get("url") or "").rstrip("/")
    headers = {"Authorization": "ApiToken " + s.get("api_token", ""), "Content-Type": "application/json", "Accept": "application/json"}
    return base, headers


def _inputs():
    return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))


def _graphql(query, variables):
    base, headers = _cfg()
    data = json.dumps({"query": query, "variables": variables}).encode("utf-8")
    req = urllib.request.Request(base + GRAPHQL, data=data, headers=headers, method="POST")
    with urllib.request.urlopen(req, timeout=90) as r:
        raw = r.read()
        resp = json.loads(raw) if raw else {}
    if resp.get("errors"):
        raise RuntimeError("GraphQL: " + "; ".join(e.get("message", str(e)) for e in resp["errors"]))
    return resp


def run():
    alert_id = _inputs().get("alert_id", "")
    resp = _graphql(QUERY, {"id": alert_id})
    print(json.dumps(resp.get("data", {}).get("alert", {})))


try:
    run()
except urllib.error.HTTPError as e:
    print(json.dumps({"error": "HTTP " + str(e.code), "detail": e.read().decode("utf-8", "replace")}))
    sys.exit(1)
except Exception as e:
    print(json.dumps({"error": str(e)}))
    sys.exit(1)