using Pkg
Pkg.add(url="https://github.com/nullsec-security/vortex")

using Vortex

# Create the threat intelligence engine
engine = create_vortex_engine()

# Add threat feeds
add_feed!(engine, urlhaus_feed())
add_feed!(engine, feodo_tracker_feed())
add_feed!(engine, alienvault_otx_feed("YOUR_API_KEY"))
add_feed!(engine, spamhaus_drop_feed())

# Start the engine (begins polling feeds)
start!(engine)

# Search for an IOC
results = search_ioc(engine, "8.8.8.8")
for ioc in results
    println("Found: $(ioc.value) - Risk: $(ioc.risk_score)")
end

# Bulk check
iocs_to_check = ["192.168.1.1", "malware.example.com", "suspicious.ru"]
matches = search_bulk(engine, iocs_to_check)

# Check engine status
status(engine)

# Quick hunt
result = threat_hunt(engine, "cobalt")

# Hunt for C2 infrastructure
query = hunt_c2_infrastructure()
c2_result = execute_hunt(engine, query)

# Hunt for recent high-risk threats
query = hunt_recent_threats(24)  # Last 24 hours
recent = execute_hunt(engine, query)

# Custom hunt query
custom_query = create_hunt_query(
    name="My Hunt",
    ioc_types=[IOC_IP, IOC_DOMAIN],
    tags=["ransomware", "c2"],
    min_risk_score=60.0,
    date_from=now() - Day(7)
)
result = execute_hunt(engine, custom_query)

# Generate report
report = export_hunt_report(result; detailed=true)
println(report)

# Add default alert rules
for rule in default_alert_rules()
    add_alert_rule!(engine, rule)
end

# Create custom alert rule
my_rule = create_alert_rule(
    name="Critical Ransomware",
    alert_type=ALERT_IOC_MATCH,
    severity=ALERT_CRITICAL,
    tags=["ransomware", "lockbit", "blackcat"],
    min_risk_score=70.0,
    notify_webhook=["https://hooks.slack.com/services/..."]
)
add_alert_rule!(engine, my_rule)

# Check alerts
alerts = get_alerts(engine)
for alert in alerts
    println("$(alert.severity): $(alert.title)")
end

# Acknowledge an alert
acknowledge_alert!(alerts[1]; by="analyst@company.com")

# Resolve an alert
resolve_alert!(alerts[1]; 
    by="analyst@company.com",
    notes="Confirmed false positive - internal testing"
)

# Correlation analysis
iocs = collect(values(engine.iocs))
correlations = correlate_iocs(iocs[1:100])
for corr in correlations
    println("Correlated: $(corr.source_ioc) <-> $(length(corr.related_iocs)) IOCs")
end

# Build correlation graph
graph = build_graph(iocs)
components = find_components(graph)
centrality = calculate_centrality(graph)

# Clustering
clusters = cluster_threats(engine; k=10)
for cluster in clusters
    println("$(cluster.label): $(cluster.size) IOCs, avg risk: $(cluster.avg_score)")
end

# Anomaly detection
anomalies = detect_anomalies(engine; contamination=0.1)
for anom in anomalies[1:10]
    println("Anomaly score: $(anom.anomaly_score) - $(anom.explanation)")
end

# Threat scoring
model = ScoringModel()
for ioc in iocs[1:10]
    score = score_ioc(ioc, model)
    println("$(ioc.value): $(score.score) ($(score.risk_level))")
end

# Create enrichment providers
providers = [
    geoip_provider(),
    virustotal_enrichment_provider("YOUR_VT_API_KEY"),
    abuseipdb_provider("YOUR_ABUSEIPDB_KEY")
]

# Enrich an IOC
ioc = get_ioc(engine, "192.168.1.1")
enriched = full_enrich(ioc; providers=providers)

# Access enrichment data
if enriched.geoip !== nothing
    println("Location: $(enriched.geoip.city), $(enriched.geoip.country_name)")
    println("ASN: $(enriched.geoip.asn) - $(enriched.geoip.org)")
end

for rep in enriched.reputation
    println("$(rep.source): $(rep.score) ($(rep.detection_count) detections)")
end

# Export to STIX 2.1
stix_bundle = export_stix(iocs)
write("threat_intel.stix.json", stix_bundle)

# Export to MISP
misp_event = export_misp(iocs; event_info="Weekly IOC Export")
write("threat_intel.misp.json", misp_event)

# Export to CSV
csv_data = export_csv(iocs)
write("iocs.csv", csv_data)

# Export to detection rules
snort_rules = export_snort(iocs)
suricata_rules = export_suricata(iocs)
yara_rules = export_yara(iocs)
sigma_rules = export_sigma(iocs)

# Export with filtering
config = ExportConfig(
    FORMAT_STIX,
    true,   # include_metadata
    false,  # include_enrichment
    true,   # pretty_print
    5000,   # max_items
    true,   # stix_bundle
    false,  # misp_galaxy
    ',',    # csv_delimiter
    0.5,    # min_confidence
    50.0,   # min_risk_score
    [IOC_IP, IOC_DOMAIN]  # ioc_types
)
filtered_export = export_stix(iocs; config=config)

# Create intel store
store = create_intel_store()

# Store IOCs
store_ioc!(store, ioc)
store_iocs!(store, iocs)

# Query store
query = create_query(
    ioc_types=[IOC_IP],
    min_risk_score=50.0,
    tags=["c2", "malware"],
    sort_by=:risk_score,
    limit=100
)
results = execute_query(store, query)

# Save to disk
save_store(store, "intel_store.json")

# Load from disk
store = load_store("intel_store.json")

# Get statistics
stats = store_stats(store)
println("Total IOCs: $(stats["total_iocs"])")
println("Risk distribution: $(stats["risk_distribution"])")

# Create custom feed
my_feed = custom_feed(
    name="My Internal Feed",
    url="https://internal.company.com/iocs.json",
    api_key="...",
    format="json",
    poll_interval=300
)
add_feed!(engine, my_feed)