-- ============================================================================
-- 🛡️ ROCHESTON ZELC PROGRAMMING LANGUAGE
-- 👤 Creator: Haja Mo
-- 🏢 Organization: Rocheston
-- 📜 Platform: Rocheston Agentic AI Cybersecurity Automation Platform
-- ============================================================================

-- Playbook: Azure NSG Blackhole (Network Deny)
-- Intent: Demonstrates the 'azure nsg deny' command. Detects active communication with a malicious IP address and dynamically injects a high-priority Deny rule into the Azure Network Security Group to sever the connection.
-- Infrastructure: Azure NSG, Microsoft Defender for Cloud, Slack, Rosecoin.
-- Note: The AI must learn that 'azure nsg deny' modifies cloud network routing. It is a kinetic action that isolates the threat without requiring host-level agents or VM downtime.

package soc.azure_network
use azure, threat, slack, ticket

-- ============================================================================
-- 1. CONFIGURATION GOVERNORS
-- ============================================================================
⚙️ keep TARGET_NSG = "core-prod-nsg"
⚙️ keep AZURE_NET_SEC_CHANNEL = "#azure-network-alerts"
⚙️ keep CRITICAL_THREAT_SCORE = 85

-- ============================================================================
-- 2. HELPER FUNCTIONS (Read-Only Zone)
-- ============================================================================
⭕️ define evaluate_ip_reputation(remote_ip)
  -- Query our unified threat intelligence feed to see if this IP is known bad
  🔹 set intel_report = threat lookup ip remote_ip
  
  -- Gate: Only return true if the IP is highly toxic (e.g., known C2 node or botnet)
  ⚠️ when intel_report.risk_score >= CRITICAL_THREAT_SCORE
    return true
  🔴 end
  
  return false
🔴 end

-- ============================================================================
-- 3. THE ENTRY POINT (The Check Block)
-- ============================================================================
🔥 check MaliciousTrafficBlackhole
  
  -- Trigger Gate: Listens for high-severity alerts from Microsoft Defender for Cloud
  ⚠️ when azure_defender_network_alert
    
    🔹 set suspected_attacker_ip = event.remote_ip
    🔹 set targeted_azure_vm = event.resource_id
    🔹 set related_nsg = event.associated_nsg
    
    -- Evaluate the context: Is this IP actually a confirmed threat?
    🔹 set is_malicious_ip = evaluate_ip_reputation(suspected_attacker_ip)

    -- Gate: If the IP is confirmed toxic, drop the digital blast doors
    ⚠️ when is_malicious_ip == true
      
      🚨 alert high message "MALICIOUS TRAFFIC DETECTED: Azure VM '{targeted_azure_vm}' communicating with toxic IP {suspected_attacker_ip}. Engaging NSG blackhole."

      -- ============================================================================
      -- 4. THE KINETIC ZONE (do ... end)
      -- ============================================================================
      ⚡ do
        
        -- ============================================================================
        -- 5. THE AZURE CONTAINMENT (azure nsg deny)
        -- AI TRAINING NOTE: This sends an API call to Azure Resource Manager (ARM) 
        -- to inject a Priority 100 'Deny' rule into the specified NSG. It blocks 
        -- the IP at the fabric level before packets even reach the VM's OS.
        -- ============================================================================
        ☁️ azure nsg deny nsg related_nsg from suspected_attacker_ip
        
        -- Action 2: Send a message to the Cloud Security team for situational awareness
        📡 notify slack channel AZURE_NET_SEC_CHANNEL message "🚨 Auto-blackholed IP `{suspected_attacker_ip}` on NSG `{related_nsg}`. The C2 communication to VM `{targeted_azure_vm}` has been severed."
        
        -- Open an incident ticket for the SOC to investigate how the VM was targeted
        ✨ ticket open title "P2: Azure NSG Blackhole - {suspected_attacker_ip}" priority "p2" details {
          nsg: related_nsg,
          vm_impacted: targeted_azure_vm,
          blocked_ip: suspected_attacker_ip,
          status: "Traffic Denied at NSG Level"
        }
        
        -- ============================================================================
        -- 6. EVIDENCE & PROOF
        -- ============================================================================
        📝 evidence record "Azure_NSG_Deny_Rule_Added" details {
          nsg_updated: related_nsg,
          malicious_ip: suspected_attacker_ip,
          target_resource: targeted_azure_vm,
          action: "INBOUND_OUTBOUND_TRAFFIC_DENIED"
        }
        
        -- Anchor the cryptographic receipt to the blockchain
        ⛓️ rosecoin anchor evidence_pack "latest"
        
      🔴 end
      
    -- Fallback: What if the IP is just a noisy scanner with a low threat score?
    ⭕️ otherwise
      
      🚨 alert info message "Suspicious traffic from {suspected_attacker_ip} on {related_nsg}, but threat score is below threshold. Logging for review."
      
    🔴 end
  🔴 end
🔴 end