CREATE TABLE IF NOT EXISTS users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50) NOT NULL UNIQUE,
    password VARCHAR(255) NOT NULL,
    role VARCHAR(20) DEFAULT 'analyst',
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE TABLE IF NOT EXISTS cases (
    id INT AUTO_INCREMENT PRIMARY KEY,
    title VARCHAR(255) NOT NULL,
    status ENUM('open', 'investigating', 'resolved', 'closed') DEFAULT 'open',
    severity ENUM('low', 'medium', 'high', 'critical') DEFAULT 'low',
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
);

CREATE TABLE IF NOT EXISTS alerts (
    id INT AUTO_INCREMENT PRIMARY KEY,
    wazuh_alert_id VARCHAR(100) NOT NULL,
    rule_id INT NOT NULL,
    rule_level INT NOT NULL,
    description TEXT,
    agent_id VARCHAR(50),
    agent_name VARCHAR(100),
    agent_ip VARCHAR(50),
    full_log TEXT,
    raw_data JSON,
    case_id INT,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY (case_id) REFERENCES cases(id) ON DELETE SET NULL
);

CREATE TABLE IF NOT EXISTS playbooks (
    id INT AUTO_INCREMENT PRIMARY KEY,
    name VARCHAR(100) NOT NULL,
    description TEXT,
    trigger_rule_id INT, -- If this rule ID triggers, run playbook
    trigger_level INT,   -- OR if alert level >= this, run playbook
    is_active BOOLEAN DEFAULT TRUE,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE TABLE IF NOT EXISTS playbook_actions (
    id INT AUTO_INCREMENT PRIMARY KEY,
    playbook_id INT NOT NULL,
    action_type VARCHAR(50) NOT NULL, -- e.g., 'wazuh_active_response', 'virustotal_scan', 'slack_notify'
    action_params JSON, -- e.g., {"command": "firewall-drop", "target": "agent"}
    sequence INT DEFAULT 1,
    FOREIGN KEY (playbook_id) REFERENCES playbooks(id) ON DELETE CASCADE
);

CREATE TABLE IF NOT EXISTS action_logs (
    id INT AUTO_INCREMENT PRIMARY KEY,
    alert_id INT,
    playbook_id INT,
    action_id INT,
    status ENUM('pending', 'success', 'failed') DEFAULT 'pending',
    result_message TEXT,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY (alert_id) REFERENCES alerts(id) ON DELETE CASCADE,
    FOREIGN KEY (playbook_id) REFERENCES playbooks(id) ON DELETE SET NULL,
    FOREIGN KEY (action_id) REFERENCES playbook_actions(id) ON DELETE SET NULL
);

CREATE TABLE IF NOT EXISTS ai_remediation_cache (
    rule_id INT PRIMARY KEY,
    recommendation TEXT,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);