#!/usr/bin/env python3
import requests
import json
from datetime import datetime, timedelta

class PatchAssessment:
    def __init__(self, vuln_scanner_api, cmdb_api):
        self.vuln_api = vuln_scanner_api
        self.cmdb_api = cmdb_api

    def get_vulnerability_data(self):
        """Fetch vulnerability data from scanner"""
        response = self.vuln_api.get('/vulnerabilities')
        return [vuln for vuln in response.json() 
                if vuln['cvss_score'] >= 7.0]

    def categorize_patches(self, vulnerabilities):
        """Categorize patches by priority and timeline"""
        categories = {
            'critical': [],  # CVSS 9.0-10.0, active exploits
            'high': [],      # CVSS 7.0-8.9, network accessible
            'medium': [],    # CVSS 4.0-6.9
            'low': []        # CVSS 0.1-3.9
        }

        for vuln in vulnerabilities:
            if vuln['cvss_score'] >= 9.0 or vuln['exploited_in_wild']:
                categories['critical'].append(vuln)
            elif vuln['cvss_score'] >= 7.0:
                categories['high'].append(vuln)
            elif vuln['cvss_score'] >= 4.0:
                categories['medium'].append(vuln)
            else:
                categories['low'].append(vuln)

        return categories

    def generate_patch_schedule(self, categorized_patches):
        """Generate deployment timeline"""
        now = datetime.now()
        schedule = {
            'critical': now + timedelta(hours=72),
            'high': now + timedelta(days=7),
            'medium': now + timedelta(days=30),
            'low': now + timedelta(days=90)
        }
        return schedule

---
- name: Enterprise Patch Management Playbook
  hosts: "{{ target_group | default('patch_group_1') }}"
  serial: "{{ batch_size | default('25%') }}"
  max_fail_percentage: 10

  pre_tasks:
    - name: Create patch maintenance window
      uri:
        url: "{{ monitoring_api }}/maintenance"
        method: POST
        body_format: json
        body:
          host: "{{ inventory_hostname }}"
          duration: 3600

    - name: Verify system health pre-patch
      include_tasks: health_check.yml

    - name: Create system snapshot
      vmware_guest_snapshot:
        hostname: "{{ vcenter_host }}"
        username: "{{ vcenter_user }}"
        password: "{{ vcenter_pass }}"
        name: "{{ inventory_hostname }}"
        state: present
        snapshot_name: "pre-patch-{{ ansible_date_time.epoch }}"
        description: "Pre-patch snapshot"
      when: virtualization_platform == "vmware"

  tasks:
    - name: Update package cache
      package:
        update_cache: yes

    - name: Install security updates (RHEL/CentOS)
      yum:
        name: "*"
        state: latest
        security: yes
        update_cache: yes
      when: ansible_os_family == "RedHat"
      notify: reboot if required

    - name: Install security updates (Ubuntu/Debian)
      apt:
        upgrade: safe
        update_cache: yes
        cache_valid_time: 3600
      when: ansible_os_family == "Debian"
      notify: reboot if required

  post_tasks:
    - name: Verify system health post-patch
      include_tasks: health_check.yml

    - name: Update CMDB patch status
      uri:
        url: "{{ cmdb_api }}/servers/{{ inventory_hostname }}"
        method: PATCH
        body_format: json
        body:
          last_patched: "{{ ansible_date_time.iso8601 }}"
          patch_level: "{{ patch_bundle_id }}"

  handlers:
    - name: reboot if required
      reboot:
        reboot_timeout: 600
        test_command: systemctl is-system-running

#!/bin/bash
# patch-validation.sh

PATCH_ENV="${1:-staging}"
SERVICE_LIST="web app db cache"
HEALTH_CHECK_TIMEOUT=300

validate_patch_deployment() {
    local environment=$1
    local validation_results=()

    echo "Starting patch validation for ${environment} environment"

    # Service availability checks
    for service in $SERVICE_LIST; do
        echo "Checking ${service} service health..."

        response=$(curl -s -o /dev/null -w "%{http_code}" \
            "https://${service}-${environment}.company.com/health")

        if [[ $response == "200" ]]; then
            echo "✓ ${service} service is healthy"
            validation_results+=("${service}:PASS")
        else
            echo "✗ ${service} service failed health check (HTTP $response)"
            validation_results+=("${service}:FAIL")
        fi
    done

    # Performance baseline comparison
    python3 performance_regression_test.py --environment="$environment" \
        --baseline-window="7d" --threshold="15%"

    # Security scan validation
    nmap -sS -O "${environment}-subnet.company.com" > "/tmp/nmap-${environment}.txt"

    # Generate validation report
    generate_validation_report "$environment" "${validation_results[@]}"
}

generate_validation_report() {
    local env=$1
    shift
    local results=("$@")

    cat > "/tmp/patch-validation-${env}.json" << EOF
{
    "environment": "$env",
    "validation_timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "patch_bundle": "$PATCH_BUNDLE_ID",
    "results": [
EOF

    for result in "${results[@]}"; do
        service=$(echo "$result" | cut -d':' -f1)
        status=$(echo "$result" | cut -d':' -f2)
        echo "        {\"service\": \"$service\", \"status\": \"$status\"}," >> "/tmp/patch-validation-${env}.json"
    done

    echo "    ]" >> "/tmp/patch-validation-${env}.json"
    echo "}" >> "/tmp/patch-validation-${env}.json"
}

validate_patch_deployment "$PATCH_ENV"

-- Patch compliance report for audit requirements
WITH patch_status AS (
    SELECT 
        s.hostname,
        s.os_family,
        s.criticality_tier,
        s.last_patched,
        v.cve_id,
        v.cvss_score,
        v.published_date,
        CASE 
            WHEN v.cvss_score >= 9.0 THEN 72 -- hours
            WHEN v.cvss_score >= 7.0 THEN 168 -- 7 days
            WHEN v.cvss_score >= 4.0 THEN 720 -- 30 days
            ELSE 2160 -- 90 days
        END AS required_patch_hours,
        EXTRACT(EPOCH FROM (NOW() - v.published_date))/3600 as hours_since_published
    FROM servers s
    LEFT JOIN vulnerabilities v ON s.server_id = v.server_id
    WHERE v.status = 'OPEN'
)
SELECT 
    hostname,
    os_family,
    criticality_tier,
    COUNT(*) as open_vulnerabilities,
    COUNT(CASE WHEN hours_since_published > required_patch_hours THEN 1 END) as overdue_patches,
    ROUND(AVG(cvss_score), 2) as avg_cvss_score,
    MAX(last_patched) as last_patch_date,
    CASE 
        WHEN COUNT(CASE WHEN hours_since_published > required_patch_hours THEN 1 END) = 0 
        THEN 'COMPLIANT' 
        ELSE 'NON_COMPLIANT' 
    END as compliance_status
FROM patch_status
GROUP BY hostname, os_family, criticality_tier
ORDER BY overdue_patches DESC, avg_cvss_score DESC;