Deliver Enterprise Alerts to a Ticket Queue

import json
import os
from pathlib import Path

import requests

ALERTS_URL = "https://fullhunt.io/api/v1/enterprise/alerts"
API_KEY = os.environ["FULLHUNT_API_KEY"]
ORG_ID = os.environ["FULLHUNT_ORG_ID"]
SINK_URL = os.environ["FULLHUNT_TICKET_WEBHOOK"]
FROM_DATE = os.environ.get("FULLHUNT_ALERT_FROM")
TO_DATE = os.environ.get("FULLHUNT_ALERT_TO")
STATE_PATH = Path(os.environ.get("FULLHUNT_ALERT_STATE", f"alerts-{ORG_ID}.json"))
BASELINE_ONLY = os.environ.get("FULLHUNT_BASELINE_ONLY") == "1"
HEADERS = {"X-API-KEY": API_KEY}
PAGE_SIZE = 500
MAX_PAGES = 100


def load_seen():
    if not STATE_PATH.exists():
        return set()
    return set(json.loads(STATE_PATH.read_text(encoding="utf-8")).get("seen", []))


def save_seen(seen):
    temporary = STATE_PATH.with_suffix(STATE_PATH.suffix + ".tmp")
    temporary.write_text(json.dumps({"seen": sorted(seen)}, indent=2) + "\n", encoding="utf-8")
    temporary.replace(STATE_PATH)


def fetch_alerts(session):
    records = []
    for page in range(1, MAX_PAGES + 1):
        params = {"org": ORG_ID, "page": page}
        if FROM_DATE:
            params["from"] = FROM_DATE
        if TO_DATE:
            params["to"] = TO_DATE
        response = session.get(ALERTS_URL, headers=HEADERS, params=params, timeout=30)
        response.raise_for_status()
        items = response.json()
        if not isinstance(items, list):
            raise ValueError("Unexpected Enterprise alerts response")
        records.extend(items)
        if len(items) < PAGE_SIZE:
            return records
    raise RuntimeError("Alert collection reached FULLHUNT MAX_PAGES guard")


def normalize(alert):
    alert_id = str(alert["id"])
    return {
        "idempotency_key": f"fullhunt-alert:{ORG_ID}:{alert_id}",
        "source": "fullhunt-enterprise-alerts",
        "source_record": alert_id,
        "organization_id": ORG_ID,
        "asset": alert.get("host"),
        "type": alert.get("type"),
        "title": alert.get("title"),
        "message": alert.get("message"),
        "observed_at": alert.get("timestamp"),
    }


def main():
    seen = load_seen()
    delivered = 0

    with requests.Session() as session:
        alerts = sorted(fetch_alerts(session), key=lambda item: item.get("timestamp") or 0)
        for alert in alerts:
            key = f"{ORG_ID}:{alert['id']}"
            if key in seen:
                continue
            if not BASELINE_ONLY:
                response = session.post(SINK_URL, json=normalize(alert), timeout=30)
                response.raise_for_status()
                delivered += 1
            seen.add(key)
            save_seen(seen)

    print(json.dumps({"observed": len(alerts), "delivered": delivered, "baseline_only": BASELINE_ONLY}))


if __name__ == "__main__":
    main()