/**
 * Security Intelligence & Pattern Analysis
 * Algorithm-driven surveillance system for automatic pattern detection
 * Includes anomaly detection, threat intelligence, and predictive analysis
 * Enhanced with configurable thresholds and risk signatures (CWE-778)
 */

const logger = require('./logger');
const logAggregator = require('./logAggregator');
const { db } = require('../database/db');
const thresholdManager = require('./thresholdManager');
const riskSignatureManager = require('./riskSignatureManager');

class SecurityIntelligence {
  constructor() {
    this.patterns = new Map();
    this.anomalies = [];
    this.threatScore = 0;
    this.analysisInterval = 60000; // 1 minute
    this.initialize();
  }

  /**
   * Initialize security intelligence system
   */
  async initialize() {
    await this.createAnomaliesTable();
    await this.createThreatIntelligenceTable();
    
    // Start continuous monitoring
    setInterval(() => this.analyze(), this.analysisInterval);
    
    logger.info('[SecurityIntelligence] Initialized - Active monitoring enabled');
  }

  /**
   * Create anomalies table
   */
  async createAnomaliesTable() {
    return new Promise((resolve, reject) => {
      db.run(`
        CREATE TABLE IF NOT EXISTS security_anomalies (
          id INTEGER PRIMARY KEY AUTOINCREMENT,
          anomaly_id TEXT UNIQUE NOT NULL,
          type TEXT NOT NULL,
          severity TEXT NOT NULL,
          description TEXT NOT NULL,
          confidence REAL NOT NULL,
          affected_user_id INTEGER,
          affected_ip TEXT,
          pattern_data TEXT,
          related_logs TEXT,
          status TEXT DEFAULT 'open',
          resolved_at DATETIME,
          resolved_by INTEGER,
          resolution_notes TEXT,
          created_at DATETIME DEFAULT CURRENT_TIMESTAMP
        )
      `, (err) => {
        if (err) reject(err);
        else {
          db.run(`CREATE INDEX IF NOT EXISTS idx_anomalies_type ON security_anomalies(type, created_at DESC)`);
          db.run(`CREATE INDEX IF NOT EXISTS idx_anomalies_severity ON security_anomalies(severity, created_at DESC)`);
          db.run(`CREATE INDEX IF NOT EXISTS idx_anomalies_status ON security_anomalies(status, created_at DESC)`);
          resolve();
        }
      });
    });
  }

  /**
   * Create threat intelligence table
   */
  async createThreatIntelligenceTable() {
    return new Promise((resolve, reject) => {
      db.run(`
        CREATE TABLE IF NOT EXISTS threat_intelligence (
          id INTEGER PRIMARY KEY AUTOINCREMENT,
          indicator TEXT NOT NULL,
          indicator_type TEXT NOT NULL,
          threat_level TEXT NOT NULL,
          description TEXT,
          source TEXT,
          confidence REAL NOT NULL,
          first_seen DATETIME DEFAULT CURRENT_TIMESTAMP,
          last_seen DATETIME DEFAULT CURRENT_TIMESTAMP,
          occurrence_count INTEGER DEFAULT 1,
          metadata TEXT
        )
      `, (err) => {
        if (err) reject(err);
        else {
          db.run(`CREATE UNIQUE INDEX IF NOT EXISTS idx_threat_indicator ON threat_intelligence(indicator, indicator_type)`);
          db.run(`CREATE INDEX IF NOT EXISTS idx_threat_level ON threat_intelligence(threat_level, last_seen DESC)`);
          resolve();
        }
      });
    });
  }

  /**
   * Main analysis loop - runs continuously
   */
  async analyze() {
    try {
      logger.debug('[SecurityIntelligence] Running analysis cycle');

      // Run all detection algorithms in parallel
      await Promise.all([
        this.detectBruteForceAttacks(),
        this.detectAccountEnumeration(),
        this.detectPrivilegeEscalation(),
        this.detectAnomalousAccess(),
        this.detectSuspiciousIPs(),
        this.detectDataExfiltration(),
        this.detectSessionAnomalies(),
        this.detectRateLimitAbuse()
      ]);

      // Calculate overall threat score
      await this.calculateThreatScore();

    } catch (error) {
      logger.error('[SecurityIntelligence] Analysis cycle failed:', error);
    }
  }

  /**
   * Detect brute force authentication attacks
   * Enhanced with configurable thresholds
   */
  async detectBruteForceAttacks() {
    // Get configured threshold or use default
    const thresholdConfig = await thresholdManager.getThresholds({ patternType: 'brute_force_attack' });
    const timeWindow = thresholdConfig[0]?.time_window_minutes || 10;
    const threshold = thresholdConfig[0]?.threshold_value || 10;
    const startTime = new Date(Date.now() - timeWindow * 60 * 1000).toISOString();

    return new Promise((resolve, reject) => {
      db.all(
        `SELECT ip_address, COUNT(*) as attempt_count, 
                MAX(timestamp) as last_attempt,
                GROUP_CONCAT(log_id) as log_ids
         FROM aggregated_logs
         WHERE category = 'authentication' 
           AND level IN ('warn', 'error')
           AND message LIKE '%failed%'
           AND timestamp >= ?
           AND ip_address IS NOT NULL
         GROUP BY ip_address
         HAVING attempt_count >= ?`,
        [startTime, threshold],
        async (err, rows) => {
          if (err) {
            reject(err);
            return;
          }

          for (const row of rows) {
            // Evaluate threshold
            const thresholdResult = await thresholdManager.evaluateThreshold(
              'brute_force_attack',
              'failed_login_count',
              row.attempt_count,
              { ip_address: row.ip_address, timeWindow }
            );

            if (!thresholdResult.exceeded) continue;

            const configuredThreshold = thresholdResult.thresholds[0];
            const severity = configuredThreshold?.severity || (row.attempt_count > 20 ? 'critical' : 'high');

            await this.createAnomaly({
              type: 'brute_force_attack',
              severity: severity,
              description: `Brute force attack detected from IP ${row.ip_address}: ${row.attempt_count} failed login attempts in ${timeWindow} minutes (threshold: ${threshold})`,
              confidence: Math.min(row.attempt_count / threshold, 1.0),
              affected_ip: row.ip_address,
              pattern_data: JSON.stringify({
                attemptCount: row.attempt_count,
                timeWindow: `${timeWindow} minutes`,
                threshold: threshold,
                thresholdExceeded: thresholdResult.exceeded,
                lastAttempt: row.last_attempt
              }),
              related_logs: row.log_ids
            });

            // Add to threat intelligence
            await this.addThreatIndicator(row.ip_address, 'ip', severity === 'critical' ? 'critical' : 'high', 'Brute force attack source');
          }

          resolve(rows.length);
        }
      );
    });
  }

  /**
   * Detect account enumeration attempts
   * Enhanced with configurable thresholds
   */
  async detectAccountEnumeration() {
    // Get configured threshold or use default
    const thresholdConfig = await thresholdManager.getThresholds({ patternType: 'credential_stuffing' });
    const timeWindow = thresholdConfig[0]?.time_window_minutes || 5;
    const threshold = thresholdConfig[0]?.threshold_value || 5;
    const startTime = new Date(Date.now() - timeWindow * 60 * 1000).toISOString();

    return new Promise((resolve, reject) => {
      db.all(
        `SELECT ip_address, 
                COUNT(DISTINCT json_extract(metadata, '$.username')) as unique_usernames,
                COUNT(*) as total_attempts,
                GROUP_CONCAT(log_id) as log_ids
         FROM aggregated_logs
         WHERE category = 'authentication'
           AND level = 'warn'
           AND timestamp >= ?
           AND ip_address IS NOT NULL
           AND metadata LIKE '%username%'
         GROUP BY ip_address
         HAVING unique_usernames >= ?`,
        [startTime, threshold],
        async (err, rows) => {
          if (err) {
            reject(err);
            return;
          }

          for (const row of rows) {
            await this.createAnomaly({
              type: 'account_enumeration',
              severity: 'medium',
              description: `Account enumeration detected from IP ${row.ip_address}: ${row.unique_usernames} different usernames tried in ${timeWindow} minutes`,
              confidence: Math.min(row.unique_usernames / (threshold * 2), 1.0),
              affected_ip: row.ip_address,
              pattern_data: JSON.stringify({
                uniqueUsernames: row.unique_usernames,
                totalAttempts: row.total_attempts,
                timeWindow: `${timeWindow} minutes`
              }),
              related_logs: row.log_ids
            });
          }

          resolve(rows.length);
        }
      );
    });
  }

  /**
   * Detect privilege escalation attempts
   */
  async detectPrivilegeEscalation() {
    const timeWindow = 30; // minutes
    const startTime = new Date(Date.now() - timeWindow * 60 * 1000).toISOString();

    return new Promise((resolve, reject) => {
      db.all(
        `SELECT user_id, ip_address,
                COUNT(*) as escalation_attempts,
                GROUP_CONCAT(log_id) as log_ids
         FROM aggregated_logs
         WHERE category = 'authorization'
           AND (message LIKE '%denied%' OR message LIKE '%unauthorized%')
           AND timestamp >= ?
           AND user_id IS NOT NULL
         GROUP BY user_id, ip_address
         HAVING escalation_attempts >= 3`,
        [startTime],
        async (err, rows) => {
          if (err) {
            reject(err);
            return;
          }

          for (const row of rows) {
            await this.createAnomaly({
              type: 'privilege_escalation',
              severity: 'critical',
              description: `Privilege escalation attempt detected: User ${row.user_id} attempted ${row.escalation_attempts} unauthorized actions`,
              confidence: 0.85,
              affected_user_id: row.user_id,
              affected_ip: row.ip_address,
              pattern_data: JSON.stringify({
                escalationAttempts: row.escalation_attempts,
                timeWindow: `${timeWindow} minutes`
              }),
              related_logs: row.log_ids
            });
          }

          resolve(rows.length);
        }
      );
    });
  }

  /**
   * Detect anomalous access patterns
   */
  async detectAnomalousAccess() {
    const timeWindow = 60; // minutes
    const startTime = new Date(Date.now() - timeWindow * 60 * 1000).toISOString();

    // Detect access from unusual hours (2 AM - 5 AM)
    return new Promise((resolve, reject) => {
      db.all(
        `SELECT user_id, ip_address, 
                COUNT(*) as access_count,
                GROUP_CONCAT(log_id) as log_ids
         FROM aggregated_logs
         WHERE category IN ('access', 'security_audit')
           AND timestamp >= ?
           AND CAST(strftime('%H', timestamp) AS INTEGER) BETWEEN 2 AND 5
           AND user_id IS NOT NULL
         GROUP BY user_id, ip_address
         HAVING access_count >= 3`,
        [startTime],
        async (err, rows) => {
          if (err) {
            reject(err);
            return;
          }

          for (const row of rows) {
            await this.createAnomaly({
              type: 'anomalous_access',
              severity: 'medium',
              description: `Unusual access pattern: User ${row.user_id} accessed system during off-hours (${row.access_count} times)`,
              confidence: 0.7,
              affected_user_id: row.user_id,
              affected_ip: row.ip_address,
              pattern_data: JSON.stringify({
                accessCount: row.access_count,
                timeRange: '2 AM - 5 AM'
              }),
              related_logs: row.log_ids
            });
          }

          resolve(rows.length);
        }
      );
    });
  }

  /**
   * Detect suspicious IP addresses
   */
  async detectSuspiciousIPs() {
    const timeWindow = 60; // minutes
    const threshold = 100; // requests
    const startTime = new Date(Date.now() - timeWindow * 60 * 1000).toISOString();

    return new Promise((resolve, reject) => {
      db.all(
        `SELECT ip_address,
                COUNT(*) as request_count,
                COUNT(DISTINCT user_id) as unique_users,
                COUNT(CASE WHEN level = 'error' THEN 1 END) as error_count,
                GROUP_CONCAT(DISTINCT source) as sources
         FROM aggregated_logs
         WHERE timestamp >= ?
           AND ip_address IS NOT NULL
         GROUP BY ip_address
         HAVING request_count >= ? OR unique_users >= 10`,
        [startTime, threshold],
        async (err, rows) => {
          if (err) {
            reject(err);
            return;
          }

          for (const row of rows) {
            let severity = 'low';
            let reason = [];

            if (row.request_count >= threshold * 2) {
              severity = 'high';
              reason.push(`excessive requests (${row.request_count})`);
            } else if (row.request_count >= threshold) {
              severity = 'medium';
              reason.push(`high request volume (${row.request_count})`);
            }

            if (row.unique_users >= 10) {
              severity = 'high';
              reason.push(`multiple user accounts (${row.unique_users})`);
            }

            if (row.error_count > row.request_count * 0.3) {
              severity = 'high';
              reason.push(`high error rate (${row.error_count})`);
            }

            await this.createAnomaly({
              type: 'suspicious_ip',
              severity,
              description: `Suspicious IP activity from ${row.ip_address}: ${reason.join(', ')}`,
              confidence: 0.75,
              affected_ip: row.ip_address,
              pattern_data: JSON.stringify({
                requestCount: row.request_count,
                uniqueUsers: row.unique_users,
                errorCount: row.error_count,
                sources: row.sources
              }),
              related_logs: null
            });

            if (severity === 'high') {
              await this.addThreatIndicator(row.ip_address, 'ip', severity, reason.join(', '));
            }
          }

          resolve(rows.length);
        }
      );
    });
  }

  /**
   * Detect potential data exfiltration
   */
  async detectDataExfiltration() {
    const timeWindow = 30; // minutes
    const downloadThreshold = 5; // Large downloads
    const startTime = new Date(Date.now() - timeWindow * 60 * 1000).toISOString();

    return new Promise((resolve, reject) => {
      db.all(
        `SELECT user_id, ip_address,
                COUNT(*) as download_count,
                GROUP_CONCAT(log_id) as log_ids
         FROM aggregated_logs
         WHERE category = 'access'
           AND (message LIKE '%download%' OR message LIKE '%export%' OR message LIKE '%backup%')
           AND timestamp >= ?
           AND user_id IS NOT NULL
         GROUP BY user_id, ip_address
         HAVING download_count >= ?`,
        [startTime, downloadThreshold],
        async (err, rows) => {
          if (err) {
            reject(err);
            return;
          }

          for (const row of rows) {
            await this.createAnomaly({
              type: 'data_exfiltration',
              severity: 'high',
              description: `Potential data exfiltration: User ${row.user_id} performed ${row.download_count} download/export operations in ${timeWindow} minutes`,
              confidence: 0.8,
              affected_user_id: row.user_id,
              affected_ip: row.ip_address,
              pattern_data: JSON.stringify({
                downloadCount: row.download_count,
                timeWindow: `${timeWindow} minutes`
              }),
              related_logs: row.log_ids
            });
          }

          resolve(rows.length);
        }
      );
    });
  }

  /**
   * Detect session anomalies
   */
  async detectSessionAnomalies() {
    const timeWindow = 24; // hours
    const startTime = new Date(Date.now() - timeWindow * 60 * 60 * 1000).toISOString();

    // Detect impossible travel (same user, different locations in short time)
    return new Promise((resolve, reject) => {
      db.all(
        `SELECT user_id,
                COUNT(DISTINCT ip_address) as unique_ips,
                GROUP_CONCAT(DISTINCT ip_address) as ips,
                COUNT(*) as session_count
         FROM aggregated_logs
         WHERE category = 'authentication'
           AND message LIKE '%login%success%'
           AND timestamp >= ?
           AND user_id IS NOT NULL
         GROUP BY user_id
         HAVING unique_ips >= 5`,
        [startTime],
        async (err, rows) => {
          if (err) {
            reject(err);
            return;
          }

          for (const row of rows) {
            await this.createAnomaly({
              type: 'session_anomaly',
              severity: 'medium',
              description: `Session anomaly: User ${row.user_id} logged in from ${row.unique_ips} different IP addresses in ${timeWindow} hours`,
              confidence: 0.7,
              affected_user_id: row.user_id,
              pattern_data: JSON.stringify({
                uniqueIPs: row.unique_ips,
                ipAddresses: row.ips.split(','),
                sessionCount: row.session_count,
                timeWindow: `${timeWindow} hours`
              }),
              related_logs: null
            });
          }

          resolve(rows.length);
        }
      );
    });
  }

  /**
   * Detect rate limit abuse
   */
  async detectRateLimitAbuse() {
    const timeWindow = 15; // minutes
    const startTime = new Date(Date.now() - timeWindow * 60 * 1000).toISOString();

    return new Promise((resolve, reject) => {
      db.all(
        `SELECT ip_address,
                COUNT(*) as blocked_count,
                GROUP_CONCAT(log_id) as log_ids
         FROM aggregated_logs
         WHERE category = 'system'
           AND message LIKE '%rate limit%'
           AND timestamp >= ?
           AND ip_address IS NOT NULL
         GROUP BY ip_address
         HAVING blocked_count >= 5`,
        [startTime],
        async (err, rows) => {
          if (err) {
            reject(err);
            return;
          }

          for (const row of rows) {
            await this.createAnomaly({
              type: 'rate_limit_abuse',
              severity: 'medium',
              description: `Rate limit abuse: IP ${row.ip_address} was rate-limited ${row.blocked_count} times in ${timeWindow} minutes`,
              confidence: 0.9,
              affected_ip: row.ip_address,
              pattern_data: JSON.stringify({
                blockedCount: row.blocked_count,
                timeWindow: `${timeWindow} minutes`
              }),
              related_logs: row.log_ids
            });

            await this.addThreatIndicator(row.ip_address, 'ip', 'medium', 'Rate limit abuse');
          }

          resolve(rows.length);
        }
      );
    });
  }

  /**
   * Create anomaly record
   */
  async createAnomaly(details) {
    const anomalyId = `ANOM-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;

    // Check if similar anomaly exists (deduplication)
    const existing = await this.findSimilarAnomaly(details);
    if (existing) {
      logger.debug(`[SecurityIntelligence] Similar anomaly exists: ${existing.anomaly_id}`);
      return existing.anomaly_id;
    }

    return new Promise((resolve, reject) => {
      db.run(
        `INSERT INTO security_anomalies 
         (anomaly_id, type, severity, description, confidence, affected_user_id, affected_ip, pattern_data, related_logs)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
        [
          anomalyId,
          details.type,
          details.severity,
          details.description,
          details.confidence,
          details.affected_user_id || null,
          details.affected_ip || null,
          details.pattern_data,
          details.related_logs
        ],
        (err) => {
          if (err) {
            reject(err);
          } else {
            logger.warn(`[SecurityIntelligence] Anomaly detected: ${details.type} - ${details.severity} - ${details.description}`);
            
            // Log to aggregated logs as well
            logAggregator.aggregate('security_intelligence', 'warn', 'security', details.description, {
              anomalyId,
              type: details.type,
              severity: details.severity,
              confidence: details.confidence
            });

            resolve(anomalyId);
          }
        }
      );
    });
  }

  /**
   * Find similar anomaly (deduplication)
   */
  async findSimilarAnomaly(details) {
    const recentTime = new Date(Date.now() - 10 * 60 * 1000).toISOString(); // Last 10 minutes

    return new Promise((resolve, reject) => {
      db.get(
        `SELECT * FROM security_anomalies
         WHERE type = ?
           AND severity = ?
           AND (affected_user_id = ? OR affected_ip = ?)
           AND status = 'open'
           AND created_at >= ?
         ORDER BY created_at DESC
         LIMIT 1`,
        [details.type, details.severity, details.affected_user_id, details.affected_ip, recentTime],
        (err, row) => {
          if (err) reject(err);
          else resolve(row);
        }
      );
    });
  }

  /**
   * Add threat indicator to intelligence database
   */
  async addThreatIndicator(indicator, type, level, description) {
    return new Promise((resolve, reject) => {
      db.run(
        `INSERT INTO threat_intelligence (indicator, indicator_type, threat_level, description, confidence, source)
         VALUES (?, ?, ?, ?, 0.8, 'internal_detection')
         ON CONFLICT(indicator, indicator_type) DO UPDATE SET
           last_seen = CURRENT_TIMESTAMP,
           occurrence_count = occurrence_count + 1,
           threat_level = ?,
           description = ?`,
        [indicator, type, level, description, level, description],
        (err) => {
          if (err) reject(err);
          else {
            logger.info(`[SecurityIntelligence] Threat indicator added: ${type}=${indicator} (${level})`);
            resolve();
          }
        }
      );
    });
  }

  /**
   * Calculate overall threat score (0-100)
   */
  async calculateThreatScore() {
    return new Promise((resolve, reject) => {
      db.get(
        `SELECT 
          COUNT(CASE WHEN severity = 'critical' AND status = 'open' THEN 1 END) as critical_count,
          COUNT(CASE WHEN severity = 'high' AND status = 'open' THEN 1 END) as high_count,
          COUNT(CASE WHEN severity = 'medium' AND status = 'open' THEN 1 END) as medium_count,
          COUNT(CASE WHEN severity = 'low' AND status = 'open' THEN 1 END) as low_count
         FROM security_anomalies
         WHERE created_at >= datetime('now', '-24 hours')`,
        [],
        (err, row) => {
          if (err) {
            reject(err);
            return;
          }

          // Weight severity levels
          const score = Math.min(
            (row.critical_count * 40) +
            (row.high_count * 20) +
            (row.medium_count * 10) +
            (row.low_count * 5),
            100
          );

          this.threatScore = score;

          if (score >= 80) {
            logger.error(`[SecurityIntelligence] CRITICAL THREAT LEVEL: ${score}/100`);
          } else if (score >= 50) {
            logger.warn(`[SecurityIntelligence] HIGH THREAT LEVEL: ${score}/100`);
          } else if (score >= 20) {
            logger.info(`[SecurityIntelligence] MEDIUM THREAT LEVEL: ${score}/100`);
          } else {
            logger.debug(`[SecurityIntelligence] LOW THREAT LEVEL: ${score}/100`);
          }

          resolve(score);
        }
      );
    });
  }

  /**
   * Get active anomalies
   */
  async getAnomalies(filters = {}) {
    const {
      status = 'open',
      severity,
      type,
      limit = 100,
      offset = 0
    } = filters;

    let whereClause = ['status = ?'];
    let params = [status];

    if (severity) {
      whereClause.push('severity = ?');
      params.push(severity);
    }

    if (type) {
      whereClause.push('type = ?');
      params.push(type);
    }

    params.push(limit, offset);

    return new Promise((resolve, reject) => {
      db.all(
        `SELECT * FROM security_anomalies
         WHERE ${whereClause.join(' AND ')}
         ORDER BY created_at DESC
         LIMIT ? OFFSET ?`,
        params,
        (err, rows) => {
          if (err) reject(err);
          else resolve(rows);
        }
      );
    });
  }

  /**
   * Resolve anomaly
   */
  async resolveAnomaly(anomalyId, resolvedBy, notes) {
    return new Promise((resolve, reject) => {
      db.run(
        `UPDATE security_anomalies
         SET status = 'resolved',
             resolved_at = CURRENT_TIMESTAMP,
             resolved_by = ?,
             resolution_notes = ?
         WHERE anomaly_id = ?`,
        [resolvedBy, notes, anomalyId],
        (err) => {
          if (err) reject(err);
          else {
            logger.info(`[SecurityIntelligence] Anomaly resolved: ${anomalyId} by user ${resolvedBy}`);
            resolve();
          }
        }
      );
    });
  }

  /**
   * Get threat intelligence
   */
  async getThreatIntelligence(filters = {}) {
    const { level, type, limit = 100 } = filters;

    let whereClause = [];
    let params = [];

    if (level) {
      whereClause.push('threat_level = ?');
      params.push(level);
    }

    if (type) {
      whereClause.push('indicator_type = ?');
      params.push(type);
    }

    const where = whereClause.length > 0 ? `WHERE ${whereClause.join(' AND ')}` : '';
    params.push(limit);

    return new Promise((resolve, reject) => {
      db.all(
        `SELECT * FROM threat_intelligence ${where}
         ORDER BY last_seen DESC, occurrence_count DESC
         LIMIT ?`,
        params,
        (err, rows) => {
          if (err) reject(err);
          else resolve(rows);
        }
      );
    });
  }

  /**
   * Get security intelligence dashboard data
   */
  async getDashboardData() {
    const [anomalies, threats, score] = await Promise.all([
      this.getAnomalies({ status: 'open', limit: 50 }),
      this.getThreatIntelligence({ limit: 20 }),
      this.calculateThreatScore()
    ]);

    const anomalyStats = {
      critical: anomalies.filter(a => a.severity === 'critical').length,
      high: anomalies.filter(a => a.severity === 'high').length,
      medium: anomalies.filter(a => a.severity === 'medium').length,
      low: anomalies.filter(a => a.severity === 'low').length
    };

    return {
      threatScore: score,
      anomalies: anomalies.slice(0, 10),
      anomalyStats,
      threats: threats.slice(0, 10),
      timestamp: new Date().toISOString()
    };
  }
}

// Create singleton instance
const securityIntelligence = new SecurityIntelligence();

module.exports = securityIntelligence;