# rbac.py - RBAC実装
import hashlib
import time
from typing import List, Set, Optional
from dataclasses import dataclass
from functools import lru_cache

@dataclass
class Permission:
    resource: str
    action: str
    
    def __str__(self):
        return f"{self.resource}:{self.action}"

@dataclass  
class Role:
    name: str
    permissions: Set[Permission]
    inherited_roles: Set[str] = None

class RBACManager:
    def __init__(self, db_connection):
        self.db = db_connection
        self._cache = {}
        self._cache_ttl = 300  # 5分キャッシュ
    
    @lru_cache(maxsize=1000)
    def get_user_permissions(self, username: str) -> Set[Permission]:
        """ユーザーの全権限を取得（継承込み）"""
        cache_key = f"user_perms:{username}"
        cached = self._get_from_cache(cache_key)
        if cached:
            return cached
        
        # ユーザーの直接割り当て役割取得
        user_roles = self._get_user_roles(username)
        all_permissions = set()
        
        # 各役割の権限を収集（継承含む）
        for role_name in user_roles:
            role_permissions = self._get_role_permissions_recursive(role_name)
            all_permissions.update(role_permissions)
        
        # キャッシュに保存
        self._set_cache(cache_key, all_permissions)
        return all_permissions
    
    def _get_role_permissions_recursive(self, role_name: str) -> Set[Permission]:
        """役割の権限を再帰的に取得（継承込み）"""
        permissions = set()
        
        # 直接権限の取得
        query = """
        SELECT p.resource, p.action 
        FROM permissions p
        JOIN role_permissions rp ON p.id = rp.permission_id
        JOIN roles r ON rp.role_id = r.id
        WHERE r.name = %s
        """
        
        cursor = self.db.cursor()
        cursor.execute(query, (role_name,))
        
        for resource, action in cursor.fetchall():
            permissions.add(Permission(resource, action))
        
        # 継承役割の権限取得
        inherited_query = """
        SELECT r2.name
        FROM roles r1
        JOIN role_hierarchy rh ON r1.id = rh.child_role_id
        JOIN roles r2 ON rh.parent_role_id = r2.id
        WHERE r1.name = %s
        """
        
        cursor.execute(inherited_query, (role_name,))
        for (inherited_role,) in cursor.fetchall():
            inherited_permissions = self._get_role_permissions_recursive(inherited_role)
            permissions.update(inherited_permissions)
        
        cursor.close()
        return permissions
    
    def check_permission(self, username: str, resource: str, action: str) -> bool:
        """権限チェック"""
        required_permission = Permission(resource, action)
        user_permissions = self.get_user_permissions(username)
        
        # 完全一致チェック
        if required_permission in user_permissions:
            return True
        
        # ワイルドカードチェック
        wildcard_permission = Permission(resource, "*")
        if wildcard_permission in user_permissions:
            return True
        
        resource_wildcard = Permission("*", action)
        if resource_wildcard in user_permissions:
            return True
        
        return False
    
    def _get_from_cache(self, key: str) -> Optional[Set[Permission]]:
        if key in self._cache:
            value, timestamp = self._cache[key]
            if time.time() - timestamp < self._cache_ttl:
                return value
            else:
                del self._cache[key]
        return None
    
    def _set_cache(self, key: str, value: Set[Permission]):
        self._cache[key] = (value, time.time())

# デコレータによる権限チェック
def require_permission(resource: str, action: str):
    def decorator(func):
        def wrapper(*args, **kwargs):
            # 現在のユーザー情報取得（実装依存）
            current_user = get_current_user()
            
            rbac = RBACManager(get_db_connection())
            if not rbac.check_permission(current_user, resource, action):
                raise PermissionError(f"Access denied: {resource}:{action}")
            
            return func(*args, **kwargs)
        return wrapper
    return decorator

# 使用例
@require_permission("user_management", "create")
def create_user(username: str, email: str):
    # ユーザー作成処理
    pass

@require_permission("financial_data", "read")  
def get_financial_report():
    # 財務データ取得処理
    pass

# 大規模環境向けRBAC最適化

class ScalableRBACManager(RBACManager):
    def __init__(self, db_connection, redis_client=None):
        super().__init__(db_connection)
        self.redis = redis_client
        self.batch_size = 1000
        
    def bulk_permission_check(self, checks: List[tuple]) -> List[bool]:
        """バッチ権限チェック"""
        results = []
        
        # ユーザーごとにグループ化
        user_checks = {}
        for i, (username, resource, action) in enumerate(checks):
            if username not in user_checks:
                user_checks[username] = []
            user_checks[username].append((i, resource, action))
        
        # ユーザーごとに権限を一括取得
        for username, user_check_list in user_checks.items():
            user_permissions = self.get_user_permissions(username)
            
            for original_index, resource, action in user_check_list:
                result = self._check_permission_from_set(
                    user_permissions, resource, action
                )
                results.append((original_index, result))
        
        # 元の順序で結果を返す
        results.sort(key=lambda x: x[0])
        return [result for _, result in results]
    
    def preload_permissions(self, usernames: List[str]):
        """権限の事前ロード"""
        if not self.redis:
            return
        
        for username in usernames:
            permissions = self.get_user_permissions(username)
            cache_key = f"rbac:user:{username}"
            
            # Redis に JSON 形式で保存
            import json
            permissions_data = [
                {"resource": p.resource, "action": p.action} 
                for p in permissions
            ]
            self.redis.setex(
                cache_key, 
                300,  # 5分TTL
                json.dumps(permissions_data)
            )

# Python での高速暗号化実装
import ssl
import socket
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
from cryptography.hazmat.backends import default_backend
import time

class HighPerformanceTLS:
    def __init__(self):
        # ハードウェアアクセラレーション対応の確認
        self.backend = default_backend()
        self.cipher_suites = [
            'ECDHE-RSA-AES256-GCM-SHA384',
            'ECDHE-RSA-AES128-GCM-SHA256', 
            'AES256-GCM-SHA384',
            'AES128-GCM-SHA256'
        ]
    
    def create_ssl_context(self):
        """最適化されたSSLコンテキスト作成"""
        context = ssl.create_default_context()
        
        # 高速な暗号スイートを優先
        context.set_ciphers(':'.join(self.cipher_suites))
        
        # セッション再利用の有効化
        context.set_session_cache_mode(ssl.SESS_CACHE_CLIENT)
        
        # OCSP Stapling の有効化
        context.check_hostname = True
        context.verify_mode = ssl.CERT_REQUIRED
        
        return context
    
    def benchmark_encryption(self):
        """暗号化性能測定"""
        data = b'A' * 1024 * 1024  # 1MB
        key = AESGCM.generate_key(bit_length=256)
        aesgcm = AESGCM(key)
        nonce = b'0' * 12
        
        # AES-GCM暗号化測定
        start_time = time.time()
        iterations = 100
        
        for _ in range(iterations):
            encrypted = aesgcm.encrypt(nonce, data, None)
        
        end_time = time.time()
        total_data = len(data) * iterations
        throughput = total_data / (end_time - start_time) / (1024 * 1024)
        
        print(f"AES-GCM Throughput: {throughput:.2f} MB/s")
        return throughput

# TLS接続での性能測定
def measure_tls_performance():
    context = HighPerformanceTLS().create_ssl_context()
    
    # 接続確立時間測定
    start_time = time.time()
    
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    ssl_sock = context.wrap_socket(sock, server_hostname='example.com')
    ssl_sock.connect(('example.com', 443))
    
    handshake_time = time.time() - start_time
    
    # データ転送速度測定
    request = b'GET / HTTP/1.1\r\nHost: example.com\r\n\r\n'
    
    start_time = time.time()
    ssl_sock.send(request)
    response = ssl_sock.recv(4096)
    transfer_time = time.time() - start_time
    
    ssl_sock.close()
    
    print(f"TLS Handshake Time: {handshake_time:.3f}s")
    print(f"Data Transfer Time: {transfer_time:.3f}s")
    print(f"Cipher Suite: {ssl_sock.cipher()}")

# key_rotation.py - 自動鍵ローテーションシステム
import hvac
import schedule
import time
import logging
from datetime import datetime, timedelta
import mysql.connector
import json

class AutoKeyRotation:
    def __init__(self, vault_url, vault_token):
        self.vault_client = hvac.Client(url=vault_url, token=vault_token)
        self.logger = self._setup_logging()
        
    def _setup_logging(self):
        logging.basicConfig(
            level=logging.INFO,
            format='%(asctime)s - %(levelname)s - %(message)s',
            handlers=[
                logging.FileHandler('/var/log/key-rotation.log'),
                logging.StreamHandler()
            ]
        )
        return logging.getLogger(__name__)
    
    def rotate_database_credentials(self):
        """データベース認証情報のローテーション"""
        try:
            # 現在の認証情報取得
            current_creds = self.vault_client.read('database/creds/readwrite')
            
            if not current_creds:
                self.logger.error("Failed to retrieve current credentials")
                return False
            
            old_username = current_creds['data']['username']
            old_password = current_creds['data']['password']
            
            # 新しい認証情報生成
            new_creds = self.vault_client.read('database/creds/readwrite')
            new_username = new_creds['data']['username']
            new_password = new_creds['data']['password']
            
            # アプリケーション設定更新
            self._update_application_config(new_username, new_password)
            
            # アプリケーション再起動
            self._restart_applications()
            
            # 動作確認
            if self._verify_database_connection(new_username, new_password):
                self.logger.info(f"Successfully rotated database credentials")
                return True
            else:
                self.logger.error("Database connection verification failed")
                return False
                
        except Exception as e:
            self.logger.error(f"Database credential rotation failed: {str(e)}")
            return False
    
    def rotate_encryption_keys(self):
        """暗号化キーのローテーション"""
        try:
            # Transit シークレットエンジン使用
            key_name = "application-key"
            
            # 新しいキーバージョン作成
            self.vault_client.write(f'transit/keys/{key_name}/rotate')
            
            # キー情報取得
            key_info = self.vault_client.read(f'transit/keys/{key_name}')
            latest_version = key_info['data']['latest_version']
            
            self.logger.info(f"Rotated encryption key to version {latest_version}")
            
            # 古いデータの再暗号化（バックグラウンド処理）
            self._schedule_reencryption(key_name, latest_version)
            
            return True
            
        except Exception as e:
            self.logger.error(f"Encryption key rotation failed: {str(e)}")
            return False
    
    def _update_application_config(self, username, password):
        """アプリケーション設定の更新"""
        config = {
            'database': {
                'username': username,
                'password': password,
                'host': 'localhost',
                'port': 3306,
                'database': 'app'
            }
        }
        
        with open('/etc/app/database.json', 'w') as f:
            json.dump(config, f, indent=2)
    
    def _restart_applications(self):
        """アプリケーションの再起動"""
        import subprocess
        try:
            subprocess.run(['systemctl', 'reload', 'webapp'], check=True)
            self.logger.info("Application reloaded successfully")
        except subprocess.CalledProcessError as e:
            self.logger.error(f"Application reload failed: {str(e)}")
    
    def _verify_database_connection(self, username, password):
        """データベース接続確認"""
        try:
            conn = mysql.connector.connect(
                host='localhost',
                user=username,
                password=password,
                database='app'
            )
            cursor = conn.cursor()
            cursor.execute("SELECT 1")
            cursor.fetchone()
            conn.close()
            return True
        except Exception:
            return False
    
    def _schedule_reencryption(self, key_name, new_version):
        """古いデータの再暗号化スケジューリング"""
        # 実際の実装では、キューシステム（RabbitMQ、Redis等）を使用
        self.logger.info(f"Scheduled reencryption with key version {new_version}")

# スケジューラー設定
def setup_rotation_schedule():
    rotator = AutoKeyRotation(
        vault_url='https://vault.example.com:8200',
        vault_token='hvs.CAESIG...'  # 実際の運用では適切な認証方法を使用
    )
    
    # データベース認証情報：毎日午前2時にローテーション
    schedule.every().day.at("02:00").do(rotator.rotate_database_credentials)
    
    # 暗号化キー：毎週日曜日午前3時にローテーション
    schedule.every().sunday.at("03:00").do(rotator.rotate_encryption_keys)
    
    # 監視ループ
    while True:
        schedule.run_pending()
        time.sleep(60)

if __name__ == "__main__":
    setup_rotation_schedule()

# ids_tuning.py - IDS誤検知分析・チューニングツール
import json
import re
from collections import defaultdict, Counter
from datetime import datetime, timedelta
import pandas as pd
import matplotlib.pyplot as plt

class IDSTuningAnalyzer:
    def __init__(self, eve_log_path):
        self.eve_log_path = eve_log_path
        self.alerts = []
        self.false_positives = []
        
    def load_alerts(self, hours=24):
        """過去24時間のアラートロード"""
        cutoff_time = datetime.now() - timedelta(hours=hours)
        
        with open(self.eve_log_path, 'r') as f:
            for line in f:
                try:
                    event = json.loads(line)
                    if event.get('event_type') == 'alert':
                        event_time = datetime.fromisoformat(
                            event['timestamp'].replace('Z', '+00:00')
                        )
                        if event_time > cutoff_time:
                            self.alerts.append(event)
                except json.JSONDecodeError:
                    continue
    
    def analyze_alert_patterns(self):
        """アラートパターン分析"""
        signature_counts = Counter()
        source_ip_counts = Counter()
        dest_port_counts = Counter()
        hourly_distribution = defaultdict(int)
        
        for alert in self.alerts:
            # シグネチャ別集計
            signature = alert['alert']['signature']
            signature_counts[signature] += 1
            
            # 送信元IP別集計
            src_ip = alert['src_ip']
            source_ip_counts[src_ip] += 1
            
            # 宛先ポート別集計
            dest_port = alert.get('dest_port', 0)
            dest_port_counts[dest_port] += 1
            
            # 時間別分布
            hour = datetime.fromisoformat(
                alert['timestamp'].replace('Z', '+00:00')
            ).hour
            hourly_distribution[hour] += 1
        
        return {
            'signatures': signature_counts,
            'source_ips': source_ip_counts,
            'dest_ports': dest_port_counts,
            'hourly': dict(hourly_distribution)
        }
    
    def identify_false_positives(self):
        """誤検知候補の特定"""
        patterns = self.analyze_alert_patterns()
        
        # 高頻度かつ単一IPからのアラート（誤検知候補）
        suspicious_patterns = []
        
        for signature, count in patterns['signatures'].most_common(20):
            # 同一シグネチャのアラートを分析
            signature_alerts = [
                a for a in self.alerts 
                if a['alert']['signature'] == signature
            ]
            
            source_ips = [a['src_ip'] for a in signature_alerts]
            ip_diversity = len(set(source_ips)) / len(source_ips)
            
            # 多数のアラートが少数のIPから発生している場合
            if count > 100 and ip_diversity < 0.1:
                suspicious_patterns.append({
                    'signature': signature,
                    'count': count,
                    'ip_diversity': ip_diversity,
                    'main_sources': Counter(source_ips).most_common(3)
                })
        
        return suspicious_patterns
    
    def generate_tuning_recommendations(self):
        """チューニング推奨事項生成"""
        false_positive_candidates = self.identify_false_positives()
        recommendations = []
        
        for fp in false_positive_candidates:
            # 送信元IPが内部ネットワークの場合
            main_ip = fp['main_sources'][0][0]
            if self._is_internal_ip(main_ip):
                recommendations.append({
                    'type': 'whitelist',
                    'signature': fp['signature'],
                    'description': f"Add {main_ip} to whitelist for signature",
                    'rule_modification': f"pass tcp {main_ip} any -> any any (msg:\"Whitelist for {main_ip}\"; sid:9000001;)"
                })
            
            # 閾値調整推奨
            if fp['count'] > 1000:
                recommendations.append({
                    'type': 'threshold',
                    'signature': fp['signature'],
                    'description': "Increase threshold to reduce noise",
                    'rule_modification': f"threshold: type threshold, track by_src, count 10, seconds 60;"
                })
        
        return recommendations
    
    def _is_internal_ip(self, ip):
        """内部IPアドレスかどうか判定"""
        import ipaddress
        private_ranges = [
            ipaddress.ip_network('192.168.0.0/16'),
            ipaddress.ip_network('10.0.0.0/8'),
            ipaddress.ip_network('172.16.0.0/12')
        ]
        
        try:
            ip_obj = ipaddress.ip_address(ip)
            return any(ip_obj in network for network in private_ranges)
        except ValueError:
            return False
    
    def generate_report(self):
        """チューニングレポート生成"""
        patterns = self.analyze_alert_patterns()
        recommendations = self.generate_tuning_recommendations()
        
        report = f"""
IDS Tuning Report - {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}
============================================================

Alert Summary:
- Total Alerts: {len(self.alerts)}
- Unique Signatures: {len(patterns['signatures'])}
- Unique Source IPs: {len(patterns['source_ips'])}

Top 10 Alert Signatures:
"""
        for sig, count in patterns['signatures'].most_common(10):
            report += f"- {sig}: {count} alerts\n"
        
        report += "\nTuning Recommendations:\n"
        for i, rec in enumerate(recommendations, 1):
            report += f"{i}. {rec['type'].upper()}: {rec['description']}\n"
            report += f"   Rule: {rec['rule_modification']}\n\n"
        
        return report

# 使用例
if __name__ == "__main__":
    analyzer = IDSTuningAnalyzer('/var/log/suricata/eve.json')
    analyzer.load_alerts(hours=24)
    
    report = analyzer.generate_report()
    print(report)
    
    # レポートをファイルに保存
    with open('/var/log/suricata/tuning_report.txt', 'w') as f:
        f.write(report)

# correlation_engine.py - セキュリティイベント相関エンジン
import json
import redis
from datetime import datetime, timedelta
from collections import defaultdict
import logging

class SecurityCorrelationEngine:
    def __init__(self, redis_host='localhost', redis_port=6379):
        self.redis_client = redis.Redis(host=redis_host, port=redis_port, decode_responses=True)
        self.logger = self._setup_logging()
        
        # 相関ルール定義
        self.correlation_rules = [
            self.brute_force_detection,
            self.lateral_movement_detection,
            self.data_exfiltration_detection,
            self.privilege_escalation_detection
        ]
    
    def _setup_logging(self):
        logging.basicConfig(
            level=logging.INFO,
            format='%(asctime)s - %(levelname)s - %(message)s'
        )
        return logging.getLogger(__name__)
    
    def process_event(self, event):
        """セキュリティイベント処理"""
        # イベントを Redis に一時保存
        event_key = f"event:{event['src_ip']}:{int(datetime.now().timestamp())}"
        self.redis_client.setex(event_key, 3600, json.dumps(event))  # 1時間保持
        
        # 各相関ルールを実行
        for rule in self.correlation_rules:
            try:
                correlation_result = rule(event)
                if correlation_result:
                    self._generate_alert(correlation_result)
            except Exception as e:
                self.logger.error(f"Error in correlation rule {rule.__name__}: {str(e)}")
    
    def brute_force_detection(self, event):
        """ブルートフォース攻撃検出"""
        if event.get('event_category') not in ['failed_login', 'ssh_auth_failure']:
            return None
        
        src_ip = event['src_ip']
        window_key = f"brute_force:{src_ip}"
        
        # 過去10分間の失敗回数を記録
        current_time = int(datetime.now().timestamp())
        self.redis_client.zadd(window_key, {current_time: current_time})
        self.redis_client.expire(window_key, 600)  # 10分間保持
        
        # 10分間で5回以上の失敗
        ten_minutes_ago = current_time - 600
        failure_count = self.redis_client.zcount(window_key, ten_minutes_ago, current_time)
        
        if failure_count >= 5:
            return {
                'correlation_type': 'brute_force_attack',
                'severity': 'high',
                'src_ip': src_ip,
                'failure_count': failure_count,
                'time_window': '10_minutes',
                'description': f'Brute force attack detected from {src_ip} with {failure_count} failures'
            }
        
        return None
    
    def lateral_movement_detection(self, event):
        """横方向移動検出"""
        if event.get('event_category') != 'successful_login':
            return None
        
        src_ip = event['src_ip']
        dest_ip = event.get('dest_ip', '')
        user = event.get('username', '')
        
        # 同一ユーザーの異なるホストへのログイン追跡
        movement_key = f"lateral_movement:{user}"
        current_time = int(datetime.now().timestamp())
        
        # 過去1時間のログイン先を記録
        login_record = {
            'timestamp': current_time,
            'src_ip': src_ip,
            'dest_ip': dest_ip
        }
        
        self.redis_client.lpush(movement_key, json.dumps(login_record))
        self.redis_client.expire(movement_key, 3600)  # 1時間保持
        
        # 過去1時間のログイン履歴を分析
        login_history = []
        for record_json in self.redis_client.lrange(movement_key, 0, -1):
            record = json.loads(record_json)
            if current_time - record['timestamp'] <= 3600:  # 1時間以内
                login_history.append(record)
        
        # 異なるホストへの短時間でのログイン検出
        unique_hosts = set(record['dest_ip'] for record in login_history)
        if len(unique_hosts) >= 3:  # 1時間に3台以上の異なるホスト
            return {
                'correlation_type': 'lateral_movement',
                'severity': 'high',
                'username': user,
                'hosts_accessed': list(unique_hosts),
                'time_window': '1_hour',
                'description': f'Lateral movement detected for user {user} across {len(unique_hosts)} hosts'
            }
        
        return None
    
    def data_exfiltration_detection(self, event):
        """データ流出検出"""
        if event.get('event_category') not in ['file_transfer', 'large_data_transfer']:
            return None
        
        src_ip = event['src_ip']
        bytes_transferred = event.get('bytes_transferred', 0)
        
        # 大容量データ転送の追跡
        exfil_key = f"data_exfil:{src_ip}"
        current_time = int(datetime.now().timestamp())
        
        # 過去30分間の転送量を記録
        self.redis_client.zadd(exfil_key, {current_time: bytes_transferred})
        self.redis_client.expire(exfil_key, 1800)  # 30分保持
        
        # 30分間の総転送量計算
        thirty_minutes_ago = current_time - 1800
        transfer_records = self.redis_client.zrangebyscore(
            exfil_key, thirty_minutes_ago, current_time, withscores=True
        )
        
        total_bytes = sum(score for _, score in transfer_records)
        
        # 30分間で1GB以上の転送
        if total_bytes > 1024 * 1024 * 1024:  # 1GB
            return {
                'correlation_type': 'data_exfiltration',
                'severity': 'critical',
                'src_ip': src_ip,
                'total_bytes': total_bytes,
                'time_window': '30_minutes',
                'description': f'Potential data exfiltration: {total_bytes / (1024**3):.2f}GB transferred from {src_ip}'
            }
        
        return None
    
    def privilege_escalation_detection(self, event):
        """権限昇格検出"""
        if event.get('event_category') != 'privilege_change':
            return None
        
        user = event.get('username', '')
        old_privileges = event.get('old_privileges', [])
        new_privileges = event.get('new_privileges', [])
        
        # 管理者権限への昇格検出
        admin_privileges = ['admin', 'root', 'administrator', 'sudo']
        old_admin = any(priv in admin_privileges for priv in old_privileges)
        new_admin = any(priv in admin_privileges for priv in new_privileges)
        
        if not old_admin and new_admin:
            return {
                'correlation_type': 'privilege_escalation',
                'severity': 'high',
                'username': user,
                'old_privileges': old_privileges,
                'new_privileges': new_privileges,
                'description': f'Privilege escalation detected for user {user} to admin level'
            }
        
        return None
    
    def _generate_alert(self, correlation_result):
        """相関結果からアラート生成"""
        alert = {
            'timestamp': datetime.now().isoformat(),
            'alert_type': 'correlation_alert',
            'correlation_type': correlation_result['correlation_type'],
            'severity': correlation_result['severity'],
            'description': correlation_result['description'],
            'details': correlation_result
        }
        
        # アラートをログ出力
        self.logger.warning(f"CORRELATION ALERT: {alert['description']}")
        
        # Elasticsearch にアラート送信
        self._send_to_elasticsearch(alert)
        
        # 高重要度アラートの場合、即座に通知
        if correlation_result['severity'] in ['high', 'critical']:
            self._send_immediate_notification(alert)
    
    def _send_to_elasticsearch(self, alert):
        """Elasticsearch にアラート送信"""
        # 実装例（実際にはElasticsearchクライアントを使用）
        print(f"Sending to Elasticsearch: {json.dumps(alert, indent=2)}")
    
    def _send_immediate_notification(self, alert):
        """即座の通知送信"""
        # 実装例（実際にはSlack、メール、SMS等の通知システムを使用）
        print(f"IMMEDIATE NOTIFICATION: {alert['description']}")

# 使用例
if __name__ == "__main__":
    engine = SecurityCorrelationEngine()
    
    # サンプルイベント処理
    sample_events = [
        {
            'src_ip': '192.168.1.100',
            'dest_ip': '192.168.1.10',
            'event_category': 'failed_login',
            'username': 'admin',
            'timestamp': datetime.now().isoformat()
        },
        {
            'src_ip': '192.168.1.100',
            'dest_ip': '192.168.1.20',
            'event_category': 'successful_login',
            'username': 'user1',
            'timestamp': datetime.now().isoformat()
        }
    ]
    
    for event in sample_events:
        engine.process_event(event)