from __future__ import annotations

from cti import mitre

from cti.feeds.base import Feed, load_json

from cti.models import Indicator

class FeodoTracker(Feed):

    name = "feodo"

    url = "https://feodotracker.abuse.ch/downloads/ipblocklist.json"

    def parse(self, raw: str) -> list[Indicator]:

        entries = load_json(raw)

        indicators: list[Indicator] = []

        for entry in entries:

            ip = entry.get("ip_address")

            if not ip:

                continue

            malware = entry.get("malware")

            techniques = mitre.techniques_for_malware(malware)

            techniques += mitre.techniques_for_threat_type("botnet_cc")

            indicators.append(

                Indicator(

                    type="ip",

                    value=ip,

                    source=self.name,

                    threat_type="botnet_cc",

                    confidence=90,

                    malware=malware,

                    techniques=sorted(set(techniques)),

                    tags=[entry.get("status", "")],

                    first_seen=entry.get("first_seen"),

                )

            )

        return indicators