const mysql = require('mysql2/promise');

const dbConfig = {
    host: 'localhost',
    user: 'root',
    password: '',
    database: 'infosecl_platform',
};

async function patchDataV2() {
    const connection = await mysql.createConnection(dbConfig);
    console.log('Connected to database.');

    try {
        // --- Fix Alert 269 (EDR - BlackEnergy) V2 ---
        // Goal: raw_log must contain BOTH the process_tree (for Visualizer) AND the flat IOCs (for User/Playbook correlation).
        
        const processTree269 = [
            {
                "id": 100,
                "name": "winword.exe",
                "pid": 4321,
                "user": "jdoe",
                "cmd": "winword.exe /n \"C:\\Users\\jdoe\\Downloads\\invoice.doc\"",
                "integrity": "Medium",
                "children": [101]
            },
            {
                "id": 101,
                "name": "powershell.exe",
                "pid": 5100,
                "user": "jdoe",
                "cmd": "powershell.exe -nop -enc AAB...",
                "integrity": "High",
                "children": [102],
                "highlight": true
            },
            {
                "id": 102,
                "name": "conhost.exe",
                "pid": 5101,
                "user": "jdoe",
                "cmd": "conhost.exe",
                "integrity": "High",
                "children": []
            }
        ];

        const raw269 = {
            "timestamp": "2023-10-05T14:23:11Z",
            "event_id": "987654321",
            "hostname": "CORP-ENDPOINT-23",
            "os": "Windows 10 Enterprise",
            "username": "jdoe",
            "internal_ip": "192.168.1.45",     // Restored IOC
            "external_ip": "203.0.113.50",     // Restored IOC
            "file_path": "C:\\Users\\jdoe\\Downloads\\invoice.doc", // Restored IOC
            "file_hash": "d41d8cd98f00b204e9800998ecf8427e",        // Restored IOC
            "malware_name": "BlackEnergy",
            "alert_signature": "BlackEnergy Malware Execution",
            "process_tree": processTree269     // Keeps Visualizer working
        };
        
        // Simulation data remains the same (Visualizer works fine)
        const sim269 = {
            "tool": "EDR",
            "evidence": {
                "hostname": "CORP-ENDPOINT-23",
                "os": "Windows 10 Enterprise",
                "process_tree": processTree269,
                "network_connections": [
                    {"pid": 5100, "remote_ip": "203.0.113.50", "port": 443, "state": "ESTABLISHED", "process": "powershell.exe"}
                ]
            }
        };

        await connection.execute(
            'UPDATE alerts SET raw_log = ?, simulation_data = ? WHERE id = 269',
            [JSON.stringify(raw269), JSON.stringify(sim269)]
        );
        console.log('✅ Patched Alert 269 V2 (Restored IOCs + Tree)');

    } catch (e) {
        console.error('Error patching DB:', e);
    } finally {
        await connection.end();
    }
}

patchDataV2();
