William Trujillo

import os
import requests
import logging

logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")

ABUSE_API_KEY = os.getenv("ABUSEIPDB_KEY")
FIREWALL_API = "https://api.perimetro.local/v1/rules"

def check_ip_reputation(ip: str) -> int:
    """Consulta la reputación de una IP en AbuseIPDB."""
    headers = {"Key": ABUSE_API_KEY, "Accept": "application/json"}
    params = {"ipAddress": ip, "maxAgeInDays": 30}
    try:
        r = requests.get("https://api.abuseipdb.com/api/v2/check", headers=headers, params=params, timeout=5)
        if r.status_code == 200:
            return r.json()["data"]["abuseConfidenceScore"]
    except Exception as e:
        logging.error(f"Error CTI: {e}")
    return 0

def execute_containment(ip: str, reason: str):
    """Bloquea la IP en el firewall perimetral si el score supera el 75%."""
    score = check_ip_reputation(ip)
    if score >= 75:
        payload = {"ip": ip, "action": "DROP", "reason": reason}
        logging.warning(f"[!] Score crítico ({score}%). Ejecutando bloqueo de {ip}...")
        # requests.post(FIREWALL_API, json=payload, verify=True)
        logging.info("[+] IP contenida exitosamente.")
        return True
    return False

if __name__ == "__main__":
    execute_containment("194.26.29.112", "Fuerza bruta repetida en SSH")