pangea 0.0.45 → 0.0.46

data/lib/pangea/components/siem_security_platform/component.rb

@@ -1,2877 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'pangea/components/base'
-require 'pangea/components/siem_security_platform/types'
-
-module Pangea
-  module Components
-    module SiemSecurityPlatform
-      # SIEM Security Platform Component
-      # Implements comprehensive security information and event management
-      def siem_security_platform(name, attributes = {})
-        # Validate attributes
-        attrs = Attributes.new(attributes)
-        
-        # Component resources
-        resources = {
-          opensearch_domain: nil,
-          firehose_streams: {},
-          lambda_functions: {},
-          cloudwatch_logs: {},
-          s3_buckets: {},
-          sns_topics: {},
-          sqs_queues: {},
-          event_rules: {},
-          step_functions: {},
-          iam_roles: {},
-          security_groups: {},
-          kms_keys: {},
-          secrets: {},
-          alarms: {}
-        }
-        
-        # Create KMS key for encryption
-        kms_key_name = component_resource_name(name, :kms_key)
-        resources[:kms_keys][:main] = aws_kms_key(kms_key_name, {
-          description: "SIEM encryption key for #{name}",
-          key_policy: generate_kms_policy(name),
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        aws_kms_alias(:"#{kms_key_name}_alias", {
-          name: "alias/siem-#{name}",
-          target_key_id: resources[:kms_keys][:main].id
-        })
-        
-        # Create security group for OpenSearch
-        sg_name = component_resource_name(name, :opensearch_sg)
-        resources[:security_groups][:opensearch] = aws_security_group(sg_name, {
-          name: "siem-opensearch-#{name}",
-          description: "Security group for SIEM OpenSearch domain",
-          vpc_id: attrs.vpc_ref,
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        # Allow HTTPS access
-        aws_vpc_security_group_ingress_rule(:"#{sg_name}_https", {
-          security_group_id: resources[:security_groups][:opensearch].id,
-          description: "Allow HTTPS for OpenSearch",
-          from_port: 443,
-          to_port: 443,
-          ip_protocol: 'tcp',
-          cidr_ipv4: '10.0.0.0/8'
-        })
-        
-        # Create OpenSearch domain
-        domain_name = attrs.opensearch_config[:domain_name]
-        resources[:opensearch_domain] = aws_opensearch_domain(:"#{name}_opensearch", {
-          domain_name: domain_name,
-          engine_version: attrs.opensearch_config[:engine_version],
-          
-          cluster_config: {
-            instance_type: attrs.opensearch_config[:instance_type],
-            instance_count: attrs.opensearch_config[:instance_count],
-            dedicated_master_enabled: attrs.opensearch_config[:dedicated_master_enabled],
-            dedicated_master_type: attrs.opensearch_config[:dedicated_master_type],
-            dedicated_master_count: attrs.opensearch_config[:dedicated_master_count],
-            zone_awareness_enabled: attrs.opensearch_config[:zone_awareness_enabled],
-            zone_awareness_config: attrs.opensearch_config[:zone_awareness_enabled] ? {
-              availability_zone_count: attrs.opensearch_config[:availability_zone_count]
-            } : nil
-          },
-          
-          ebs_options: {
-            ebs_enabled: attrs.opensearch_config[:ebs_enabled],
-            volume_type: attrs.opensearch_config[:volume_type],
-            volume_size: attrs.opensearch_config[:volume_size],
-            iops: attrs.opensearch_config[:iops],
-            throughput: attrs.opensearch_config[:throughput]
-          },
-          
-          vpc_options: {
-            subnet_ids: attrs.subnet_refs.take(attrs.opensearch_config[:availability_zone_count] || 3),
-            security_group_ids: [resources[:security_groups][:opensearch].id]
-          },
-          
-          encrypt_at_rest: attrs.security_config[:enable_encryption_at_rest] ? {
-            enabled: true,
-            kms_key_id: resources[:kms_keys][:main].id
-          } : nil,
-          
-          node_to_node_encryption: {
-            enabled: attrs.security_config[:enable_encryption_in_transit]
-          },
-          
-          advanced_security_options: attrs.security_config[:enable_fine_grained_access] ? {
-            enabled: true,
-            internal_user_database_enabled: false,
-            master_user_options: {
-              master_user_arn: attrs.security_config[:master_user_arn]
-            }
-          } : nil,
-          
-          log_publishing_options: {
-            ES_APPLICATION_LOGS: {
-              enabled: true,
-              cloudwatch_log_group_arn: create_log_group(name, 'es-application', attrs, resources)
-            },
-            SEARCH_SLOW_LOGS: attrs.security_config[:enable_slow_logs] ? {
-              enabled: true,
-              cloudwatch_log_group_arn: create_log_group(name, 'es-slow', attrs, resources)
-            } : nil,
-            AUDIT_LOGS: attrs.security_config[:enable_audit_logs] ? {
-              enabled: true,
-              cloudwatch_log_group_arn: create_log_group(name, 'es-audit', attrs, resources)
-            } : nil
-          },
-          
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        # Create S3 bucket for Firehose backup
-        backup_bucket_name = component_resource_name(name, :backup_bucket)
-        resources[:s3_buckets][:backup] = create_secure_bucket(
-          backup_bucket_name,
-          "siem-backup-#{name}",
-          attrs,
-          resources
-        )
-        
-        # Create Firehose delivery streams for each log source
-        attrs.log_sources.each do |source|
-          create_firehose_stream(name, source, attrs, resources)
-        end
-        
-        # Create Lambda functions for data processing
-        create_processing_lambdas(name, attrs, resources)
-        
-        # Create correlation engine
-        create_correlation_engine(name, attrs, resources)
-        
-        # Create threat detection components
-        create_threat_detection(name, attrs, resources)
-        
-        # Create incident response automation
-        create_incident_response(name, attrs, resources)
-        
-        # Create monitoring and alerting
-        create_monitoring(name, attrs, resources)
-        
-        # Create dashboards
-        create_dashboards(name, attrs, resources)
-        
-        # Set up integrations
-        attrs.integrations.each do |integration|
-          create_integration(name, integration, attrs, resources)
-        end
-        
-        # Component outputs
-        outputs = {
-          opensearch_domain_endpoint: resources[:opensearch_domain].endpoint,
-          opensearch_domain_arn: resources[:opensearch_domain].arn,
-          opensearch_dashboard_url: "https://#{resources[:opensearch_domain].endpoint}/_dashboards/",
-          firehose_streams: resources[:firehose_streams].transform_values { |stream| stream.arn },
-          correlation_engine_arn: resources[:step_functions][:correlation_engine]&.arn,
-          incident_response_arn: resources[:step_functions][:incident_response]&.arn,
-          security_score: calculate_siem_security_score(attrs),
-          compliance_status: generate_siem_compliance_status(attrs)
-        }
-        
-        # Create component reference
-        create_component_reference(
-          'siem_security_platform',
-          name,
-          attrs.to_h,
-          resources,
-          outputs
-        )
-      end
-      
-      private
-      
-      def generate_kms_policy(name)
-        JSON.pretty_generate({
-          Version: "2012-10-17",
-          Statement: [
-            {
-              Sid: "Enable IAM User Permissions",
-              Effect: "Allow",
-              Principal: {
-                AWS: "arn:aws:iam::#{aws_account_id}:root"
-              },
-              Action: "kms:*",
-              Resource: "*"
-            },
-            {
-              Sid: "Allow use of the key for SIEM services",
-              Effect: "Allow",
-              Principal: {
-                Service: [
-                  "es.amazonaws.com",
-                  "firehose.amazonaws.com",
-                  "lambda.amazonaws.com",
-                  "logs.amazonaws.com"
-                ]
-              },
-              Action: [
-                "kms:Decrypt",
-                "kms:GenerateDataKey"
-              ],
-              Resource: "*"
-            }
-          ]
-        })
-      end
-      
-      def create_log_group(name, type, attrs, resources)
-        log_group_name = component_resource_name(name, :log_group, type)
-        log_group = aws_cloudwatch_log_group(log_group_name, {
-          name: "/aws/siem/#{name}/#{type}",
-          retention_in_days: attrs.incident_response[:retention_days],
-          kms_key_id: resources[:kms_keys][:main].arn,
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        resources[:cloudwatch_logs][type] = log_group
-        log_group.arn
-      end
-      
-      def create_secure_bucket(bucket_name, bucket_id, attrs, resources)
-        bucket = aws_s3_bucket(bucket_name, {
-          bucket: bucket_id,
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        # Enable versioning
-        aws_s3_bucket_versioning(:"#{bucket_name}_versioning", {
-          bucket: bucket.id,
-          versioning_configuration: {
-            status: "Enabled"
-          }
-        })
-        
-        # Enable encryption
-        aws_s3_bucket_server_side_encryption_configuration(:"#{bucket_name}_encryption", {
-          bucket: bucket.id,
-          rule: {
-            apply_server_side_encryption_by_default: {
-              sse_algorithm: "aws:kms",
-              kms_master_key_id: resources[:kms_keys][:main].id
-            },
-            bucket_key_enabled: true
-          }
-        })
-        
-        # Block public access
-        aws_s3_bucket_public_access_block(:"#{bucket_name}_pab", {
-          bucket: bucket.id,
-          block_public_acls: true,
-          block_public_policy: true,
-          ignore_public_acls: true,
-          restrict_public_buckets: true
-        })
-        
-        # Add lifecycle rules
-        aws_s3_bucket_lifecycle_configuration(:"#{bucket_name}_lifecycle", {
-          bucket: bucket.id,
-          rule: [
-            {
-              id: "transition-to-glacier",
-              status: "Enabled",
-              transition: [
-                {
-                  days: 90,
-                  storage_class: "GLACIER"
-                }
-              ],
-              expiration: {
-                days: attrs.compliance_config[:audit_trail_retention]
-              }
-            }
-          ]
-        })
-        
-        bucket
-      end
-      
-      def create_firehose_stream(name, source, attrs, resources)
-        stream_name = component_resource_name(name, :firehose, source[:name])
-        
-        # Create IAM role for Firehose
-        role_name = component_resource_name(name, :firehose_role, source[:name])
-        resources[:iam_roles][:"firehose_#{source[:name]}"] = create_firehose_role(
-          role_name,
-          attrs,
-          resources
-        )
-        
-        # Create processing Lambda if transformation is needed
-        processor_arn = nil
-        if attrs.firehose_config[:enable_data_transformation] || source[:transformation]
-          processor_arn = create_stream_processor(name, source, attrs, resources)
-        end
-        
-        resources[:firehose_streams][source[:name]] = aws_kinesis_firehose_delivery_stream(stream_name, {
-          name: "siem-#{name}-#{source[:name]}",
-          destination: "opensearch",
-          
-          opensearch_configuration: {
-            domain_arn: resources[:opensearch_domain].arn,
-            index_name: "siem-#{source[:type]}",
-            index_rotation_period: "OneDay",
-            type_name: "_doc",
-            role_arn: resources[:iam_roles][:"firehose_#{source[:name]}"].arn,
-            
-            buffering_hints: {
-              interval_in_seconds: attrs.firehose_config[:buffer_interval],
-              size_in_mbs: attrs.firehose_config[:buffer_size]
-            },
-            
-            cloudwatch_logging_options: {
-              enabled: true,
-              log_group_name: "/aws/kinesisfirehose/siem-#{name}",
-              log_stream_name: source[:name]
-            },
-            
-            processing_configuration: processor_arn ? {
-              enabled: true,
-              processors: [{
-                type: "Lambda",
-                parameters: [{
-                  parameter_name: "LambdaArn",
-                  parameter_value: processor_arn
-                }]
-              }]
-            } : nil,
-            
-            s3_configuration: {
-              bucket_arn: resources[:s3_buckets][:backup].arn,
-              prefix: "#{source[:type]}/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/",
-              error_output_prefix: "#{attrs.firehose_config[:error_output_prefix]}#{source[:type]}/",
-              compression_format: attrs.firehose_config[:compression_format],
-              role_arn: resources[:iam_roles][:"firehose_#{source[:name]}"].arn
-            },
-            
-            vpc_config: {
-              subnet_ids: attrs.subnet_refs,
-              security_group_ids: [resources[:security_groups][:opensearch].id],
-              role_arn: resources[:iam_roles][:"firehose_#{source[:name]}"].arn
-            }
-          },
-          
-          tags: component_tags('siem_security_platform', name, attrs.tags.merge(
-            LogSource: source[:name]
-          ))
-        })
-        
-        # Configure log source subscription
-        configure_log_source_subscription(name, source, attrs, resources)
-      end
-      
-      def create_firehose_role(role_name, attrs, resources)
-        role = aws_iam_role(role_name, {
-          name: role_name.to_s,
-          assume_role_policy: JSON.pretty_generate({
-            Version: "2012-10-17",
-            Statement: [{
-              Action: "sts:AssumeRole",
-              Effect: "Allow",
-              Principal: {
-                Service: "firehose.amazonaws.com"
-              }
-            }]
-          }),
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        # Create and attach policy
-        policy_name = :"#{role_name}_policy"
-        policy = aws_iam_role_policy(policy_name, {
-          role: role.id,
-          policy: JSON.pretty_generate({
-            Version: "2012-10-17",
-            Statement: [
-              {
-                Effect: "Allow",
-                Action: [
-                  "es:ESHttpPost",
-                  "es:ESHttpPut"
-                ],
-                Resource: [
-                  resources[:opensearch_domain].arn,
-                  "#{resources[:opensearch_domain].arn}/*"
-                ]
-              },
-              {
-                Effect: "Allow",
-                Action: [
-                  "s3:GetObject",
-                  "s3:PutObject"
-                ],
-                Resource: "#{resources[:s3_buckets][:backup].arn}/*"
-              },
-              {
-                Effect: "Allow",
-                Action: [
-                  "kms:Decrypt",
-                  "kms:GenerateDataKey"
-                ],
-                Resource: resources[:kms_keys][:main].arn
-              },
-              {
-                Effect: "Allow",
-                Action: [
-                  "logs:CreateLogGroup",
-                  "logs:CreateLogStream",
-                  "logs:PutLogEvents"
-                ],
-                Resource: "*"
-              },
-              {
-                Effect: "Allow",
-                Action: [
-                  "lambda:InvokeFunction"
-                ],
-                Resource: "arn:aws:lambda:*:*:function:siem-*"
-              }
-            ]
-          })
-        })
-        
-        role
-      end
-      
-      def create_stream_processor(name, source, attrs, resources)
-        processor_name = component_resource_name(name, :processor, source[:name])
-        
-        # Create Lambda function
-        lambda_function = aws_lambda_function(processor_name, {
-          function_name: "siem-processor-#{name}-#{source[:name]}",
-          runtime: "python3.11",
-          handler: "index.lambda_handler",
-          role: create_lambda_execution_role(name, "processor-#{source[:name]}", attrs, resources),
-          timeout: 300,
-          memory_size: 512,
-          
-          environment: {
-            variables: {
-              LOG_SOURCE_TYPE: source[:type],
-              LOG_FORMAT: source[:format],
-              ENABLE_ENRICHMENT: source[:enrichment].to_s,
-              THREAT_INTEL_TABLE: resources[:dynamodb_tables]&.dig(:threat_intel)&.name || ""
-            }
-          },
-          
-          code: {
-            zip_file: generate_processor_code(source)
-          },
-          
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        resources[:lambda_functions][:"processor_#{source[:name]}"] = lambda_function
-        lambda_function.arn
-      end
-      
-      def generate_processor_code(source)
-        <<~PYTHON
-          import json
-          import base64
-          import os
-          import boto3
-          from datetime import datetime
-          import re
-          import ipaddress
-          
-          def lambda_handler(event, context):
-              output_records = []
-              
-              for record in event['records']:
-                  # Decode the data
-                  payload = base64.b64decode(record['data']).decode('utf-8')
-                  
-                  try:
-                      # Parse based on format
-                      parsed_data = parse_log_data(payload, os.environ['LOG_FORMAT'])
-                      
-                      # Add metadata
-                      parsed_data['@timestamp'] = datetime.utcnow().isoformat()
-                      parsed_data['log_source'] = os.environ['LOG_SOURCE_TYPE']
-                      parsed_data['processing_timestamp'] = datetime.utcnow().isoformat()
-                      
-                      # Enrich data if enabled
-                      if os.environ.get('ENABLE_ENRICHMENT', 'false').lower() == 'true':
-                          parsed_data = enrich_data(parsed_data)
-                      
-                      # Normalize fields
-                      parsed_data = normalize_fields(parsed_data)
-                      
-                      # Convert back to JSON
-                      output_data = json.dumps(parsed_data) + '\\n'
-                      
-                      output_records.append({
-                          'recordId': record['recordId'],
-                          'result': 'Ok',
-                          'data': base64.b64encode(output_data.encode('utf-8')).decode('utf-8')
-                      })
-                      
-                  except Exception as e:
-                      # Send failed records to error output
-                      output_records.append({
-                          'recordId': record['recordId'],
-                          'result': 'ProcessingFailed',
-                          'data': record['data']
-                      })
-              
-              return {'records': output_records}
-          
-          def parse_log_data(data, format_type):
-              if format_type == 'json':
-                  return json.loads(data)
-              elif format_type == 'csv':
-                  # Implement CSV parsing
-                  return parse_csv(data)
-              elif format_type == 'syslog':
-                  # Implement syslog parsing
-                  return parse_syslog(data)
-              else:
-                  return {'raw_data': data}
-          
-          def enrich_data(data):
-              # Add GeoIP enrichment
-              if 'source_ip' in data:
-                  data['source_geo'] = lookup_geoip(data['source_ip'])
-              
-              # Add threat intelligence enrichment
-              if 'source_ip' in data or 'domain' in data:
-                  data['threat_intel'] = check_threat_intel(data)
-              
-              # Add user context
-              if 'user_id' in data:
-                  data['user_context'] = get_user_context(data['user_id'])
-              
-              return data
-          
-          def normalize_fields(data):
-              # Normalize common field names
-              field_mappings = {
-                  'src_ip': 'source_ip',
-                  'dst_ip': 'destination_ip',
-                  'src_port': 'source_port',
-                  'dst_port': 'destination_port',
-                  'username': 'user_name',
-                  'userid': 'user_id'
-              }
-              
-              for old_field, new_field in field_mappings.items():
-                  if old_field in data:
-                      data[new_field] = data.pop(old_field)
-              
-              return data
-          
-          def parse_csv(data):
-              # Implement CSV parsing logic
-              return {'raw': data}
-          
-          def parse_syslog(data):
-              # Implement syslog parsing logic
-              return {'raw': data}
-          
-          def lookup_geoip(ip):
-              # Implement GeoIP lookup
-              return {'country': 'US', 'city': 'Unknown'}
-          
-          def check_threat_intel(data):
-              # Implement threat intelligence lookup
-              return {'reputation': 'clean', 'score': 0}
-          
-          def get_user_context(user_id):
-              # Implement user context lookup
-              return {'department': 'Unknown', 'risk_score': 0}
-        PYTHON
-      end
-      
-      def create_lambda_execution_role(name, function_type, attrs, resources)
-        role_name = component_resource_name(name, :lambda_role, function_type)
-        role = aws_iam_role(role_name, {
-          name: role_name.to_s,
-          assume_role_policy: JSON.pretty_generate({
-            Version: "2012-10-17",
-            Statement: [{
-              Action: "sts:AssumeRole",
-              Effect: "Allow",
-              Principal: {
-                Service: "lambda.amazonaws.com"
-              }
-            }]
-          }),
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        # Attach basic execution policy
-        aws_iam_role_policy_attachment(:"#{role_name}_basic", {
-          role: role.name,
-          policy_arn: "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-        })
-        
-        # Attach VPC execution policy if needed
-        aws_iam_role_policy_attachment(:"#{role_name}_vpc", {
-          role: role.name,
-          policy_arn: "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole"
-        })
-        
-        # Create custom policy for SIEM operations
-        custom_policy = aws_iam_role_policy(:"#{role_name}_custom", {
-          role: role.id,
-          policy: JSON.pretty_generate({
-            Version: "2012-10-17",
-            Statement: [
-              {
-                Effect: "Allow",
-                Action: [
-                  "es:ESHttpPost",
-                  "es:ESHttpGet"
-                ],
-                Resource: "#{resources[:opensearch_domain].arn}/*"
-              },
-              {
-                Effect: "Allow",
-                Action: [
-                  "dynamodb:GetItem",
-                  "dynamodb:Query",
-                  "dynamodb:Scan"
-                ],
-                Resource: "arn:aws:dynamodb:*:*:table/siem-*"
-              },
-              {
-                Effect: "Allow",
-                Action: [
-                  "kms:Decrypt"
-                ],
-                Resource: resources[:kms_keys][:main].arn
-              },
-              {
-                Effect: "Allow",
-                Action: [
-                  "sns:Publish"
-                ],
-                Resource: "arn:aws:sns:*:*:siem-*"
-              }
-            ]
-          })
-        })
-        
-        resources[:iam_roles][function_type.to_sym] = role
-        role.arn
-      end
-      
-      def configure_log_source_subscription(name, source, attrs, resources)
-        case source[:type]
-        when 'cloudwatch'
-          if source[:log_group_name]
-            # Create subscription filter
-            aws_cloudwatch_log_subscription_filter(:"#{name}_#{source[:name]}_subscription", {
-              name: "siem-#{name}-#{source[:name]}",
-              log_group_name: source[:log_group_name],
-              filter_pattern: "",
-              destination_arn: resources[:firehose_streams][source[:name]].arn,
-              role_arn: create_logs_role(name, source[:name], attrs, resources)
-            })
-          end
-        when 's3_access'
-          # Configure S3 bucket logging
-          if source[:s3_bucket]
-            aws_s3_bucket_logging(:"#{name}_#{source[:name]}_logging", {
-              bucket: source[:s3_bucket],
-              target_bucket: resources[:s3_buckets][:backup].id,
-              target_prefix: "s3-access-logs/#{source[:s3_bucket]}/"
-            })
-          end
-        end
-      end
-      
-      def create_logs_role(name, source_name, attrs, resources)
-        role_name = component_resource_name(name, :logs_role, source_name)
-        role = aws_iam_role(role_name, {
-          name: role_name.to_s,
-          assume_role_policy: JSON.pretty_generate({
-            Version: "2012-10-17",
-            Statement: [{
-              Action: "sts:AssumeRole",
-              Effect: "Allow",
-              Principal: {
-                Service: "logs.amazonaws.com"
-              }
-            }]
-          }),
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        aws_iam_role_policy(:"#{role_name}_policy", {
-          role: role.id,
-          policy: JSON.pretty_generate({
-            Version: "2012-10-17",
-            Statement: [{
-              Effect: "Allow",
-              Action: [
-                "firehose:PutRecord",
-                "firehose:PutRecordBatch"
-              ],
-              Resource: resources[:firehose_streams][source_name].arn
-            }]
-          })
-        })
-        
-        role.arn
-      end
-      
-      def create_processing_lambdas(name, attrs, resources)
-        # Create Lambda for correlation engine
-        correlation_lambda = component_resource_name(name, :correlation_lambda)
-        resources[:lambda_functions][:correlation] = aws_lambda_function(correlation_lambda, {
-          function_name: "siem-correlation-#{name}",
-          runtime: "python3.11",
-          handler: "index.lambda_handler",
-          role: create_lambda_execution_role(name, "correlation", attrs, resources),
-          timeout: 900,
-          memory_size: 3008,
-          
-          environment: {
-            variables: {
-              OPENSEARCH_ENDPOINT: resources[:opensearch_domain].endpoint,
-              CORRELATION_RULES: JSON.generate(attrs.correlation_rules),
-              SNS_TOPIC_ARN: create_alert_topic(name, attrs, resources)
-            }
-          },
-          
-          code: {
-            zip_file: generate_correlation_engine_code()
-          },
-          
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        # Create Lambda for threat detection
-        if attrs.threat_detection[:enable_ml_detection]
-          ml_lambda = component_resource_name(name, :ml_detection_lambda)
-          resources[:lambda_functions][:ml_detection] = aws_lambda_function(ml_lambda, {
-            function_name: "siem-ml-detection-#{name}",
-            runtime: "python3.11",
-            handler: "index.lambda_handler",
-            role: create_lambda_execution_role(name, "ml-detection", attrs, resources),
-            timeout: 900,
-            memory_size: 3008,
-            
-            environment: {
-              variables: {
-                OPENSEARCH_ENDPOINT: resources[:opensearch_domain].endpoint,
-                ANOMALY_DETECTORS: JSON.generate(attrs.threat_detection[:anomaly_detectors]),
-                ENABLE_BEHAVIOR_ANALYTICS: attrs.threat_detection[:enable_behavior_analytics].to_s
-              }
-            },
-            
-            code: {
-              zip_file: generate_ml_detection_code()
-            },
-            
-            tags: component_tags('siem_security_platform', name, attrs.tags)
-          })
-        end
-      end
-      
-      def generate_correlation_engine_code
-        <<~PYTHON
-          import json
-          import boto3
-          import os
-          from opensearchpy import OpenSearch
-          from datetime import datetime, timedelta
-          import re
-          
-          def lambda_handler(event, context):
-              # Initialize OpenSearch client
-              es = OpenSearch(
-                  hosts=[{'host': os.environ['OPENSEARCH_ENDPOINT'], 'port': 443}],
-                  http_auth=get_auth(),
-                  use_ssl=True,
-                  verify_certs=True
-              )
-              
-              # Load correlation rules
-              rules = json.loads(os.environ['CORRELATION_RULES'])
-              
-              # Process each rule
-              alerts = []
-              for rule in rules:
-                  if rule.get('enabled', True):
-                      matches = evaluate_rule(es, rule)
-                      if matches:
-                          alert = create_alert(rule, matches)
-                          alerts.append(alert)
-                          send_alert(alert)
-              
-              return {
-                  'statusCode': 200,
-                  'body': json.dumps({
-                      'processed_rules': len(rules),
-                      'alerts_generated': len(alerts)
-                  })
-              }
-          
-          def evaluate_rule(es, rule):
-              # Build query based on rule type
-              if rule['rule_type'] == 'threshold':
-                  return evaluate_threshold_rule(es, rule)
-              elif rule['rule_type'] == 'pattern':
-                  return evaluate_pattern_rule(es, rule)
-              elif rule['rule_type'] == 'anomaly':
-                  return evaluate_anomaly_rule(es, rule)
-              elif rule['rule_type'] == 'sequence':
-                  return evaluate_sequence_rule(es, rule)
-              elif rule['rule_type'] == 'statistical':
-                  return evaluate_statistical_rule(es, rule)
-              
-              return []
-          
-          def evaluate_threshold_rule(es, rule):
-              # Implement threshold-based detection
-              time_window = rule.get('time_window', 300)
-              query = build_query_from_conditions(rule['conditions'], time_window)
-              
-              response = es.search(
-                  index='siem-*',
-                  body=query,
-                  size=0
-              )
-              
-              doc_count = response['hits']['total']['value']
-              threshold = rule.get('threshold', 10)
-              
-              if doc_count >= threshold:
-                  return [{
-                      'count': doc_count,
-                      'threshold': threshold,
-                      'time_window': time_window
-                  }]
-              
-              return []
-          
-          def evaluate_pattern_rule(es, rule):
-              # Implement pattern-based detection
-              query = build_pattern_query(rule['conditions'])
-              
-              response = es.search(
-                  index='siem-*',
-                  body=query,
-                  size=100
-              )
-              
-              return response['hits']['hits']
-          
-          def evaluate_anomaly_rule(es, rule):
-              # Implement anomaly detection using ML
-              # This would typically use OpenSearch ML features
-              return []
-          
-          def evaluate_sequence_rule(es, rule):
-              # Implement sequence-based detection
-              # Look for specific sequences of events
-              return []
-          
-          def evaluate_statistical_rule(es, rule):
-              # Implement statistical anomaly detection
-              # Calculate baselines and detect deviations
-              return []
-          
-          def build_query_from_conditions(conditions, time_window):
-              must_clauses = []
-              
-              for condition in conditions:
-                  if 'field' in condition and 'value' in condition:
-                      must_clauses.append({
-                          'match': {
-                              condition['field']: condition['value']
-                          }
-                      })
-              
-              return {
-                  'query': {
-                      'bool': {
-                          'must': must_clauses,
-                          'filter': {
-                              'range': {
-                                  '@timestamp': {
-                                      'gte': f'now-{time_window}s'
-                                  }
-                              }
-                          }
-                      }
-                  }
-              }
-          
-          def build_pattern_query(conditions):
-              # Build complex pattern queries
-              return build_query_from_conditions(conditions, 3600)
-          
-          def create_alert(rule, matches):
-              return {
-                  'rule_name': rule['name'],
-                  'severity': rule['severity'],
-                  'description': rule['description'],
-                  'matches': len(matches),
-                  'timestamp': datetime.utcnow().isoformat(),
-                  'actions': rule['actions']
-              }
-          
-          def send_alert(alert):
-              sns = boto3.client('sns')
-              
-              message = {
-                  'default': json.dumps(alert),
-                  'email': format_email_alert(alert),
-                  'sms': format_sms_alert(alert)
-              }
-              
-              sns.publish(
-                  TopicArn=os.environ['SNS_TOPIC_ARN'],
-                  Message=json.dumps(message),
-                  MessageStructure='json',
-                  Subject=f"SIEM Alert: {alert['rule_name']} - {alert['severity'].upper()}"
-              )
-          
-          def format_email_alert(alert):
-              return f"""
-              Security Alert: {alert['rule_name']}
-              
-              Severity: {alert['severity'].upper()}
-              Time: {alert['timestamp']}
-              
-              Description: {alert['description']}
-              
-              Number of matches: {alert['matches']}
-              
-              Required Actions: {', '.join(alert['actions'])}
-              """
-          
-          def format_sms_alert(alert):
-              return f"SIEM Alert: {alert['rule_name']} ({alert['severity']}) - {alert['matches']} matches detected"
-          
-          def get_auth():
-              # Implement authentication for OpenSearch
-              # This could use IAM roles or stored credentials
-              return None
-        PYTHON
-      end
-      
-      def generate_ml_detection_code
-        <<~PYTHON
-          import json
-          import boto3
-          import os
-          import numpy as np
-          from opensearchpy import OpenSearch
-          from datetime import datetime, timedelta
-          from sklearn.ensemble import IsolationForest
-          from sklearn.preprocessing import StandardScaler
-          
-          def lambda_handler(event, context):
-              # Initialize OpenSearch client
-              es = OpenSearch(
-                  hosts=[{'host': os.environ['OPENSEARCH_ENDPOINT'], 'port': 443}],
-                  http_auth=get_auth(),
-                  use_ssl=True,
-                  verify_certs=True
-              )
-              
-              # Load anomaly detectors configuration
-              detectors = json.loads(os.environ['ANOMALY_DETECTORS'])
-              
-              results = []
-              for detector in detectors:
-                  anomalies = run_anomaly_detection(es, detector)
-                  if anomalies:
-                      results.extend(anomalies)
-              
-              # Run behavior analytics if enabled
-              if os.environ.get('ENABLE_BEHAVIOR_ANALYTICS', 'false').lower() == 'true':
-                  behavior_anomalies = run_behavior_analytics(es)
-                  results.extend(behavior_anomalies)
-              
-              return {
-                  'statusCode': 200,
-                  'body': json.dumps({
-                      'anomalies_detected': len(results),
-                      'results': results
-                  })
-              }
-          
-          def run_anomaly_detection(es, detector):
-              # Fetch data for analysis
-              data = fetch_detector_data(es, detector)
-              
-              if not data:
-                  return []
-              
-              # Prepare features
-              features = prepare_features(data, detector)
-              
-              # Run anomaly detection based on type
-              if detector['type'] == 'statistical':
-                  return detect_statistical_anomalies(features, detector)
-              elif detector['type'] == 'machine_learning':
-                  return detect_ml_anomalies(features, detector)
-              elif detector['type'] == 'pattern_based':
-                  return detect_pattern_anomalies(data, detector)
-              
-              return []
-          
-          def fetch_detector_data(es, detector):
-              # Fetch relevant data based on detector configuration
-              baseline_period = detector.get('baseline_period', 7)
-              
-              query = {
-                  'query': {
-                      'range': {
-                          '@timestamp': {
-                              'gte': f'now-{baseline_period}d'
-                          }
-                      }
-                  },
-                  'size': 10000,
-                  'sort': [{'@timestamp': 'desc'}]
-              }
-              
-              response = es.search(index='siem-*', body=query)
-              return [hit['_source'] for hit in response['hits']['hits']]
-          
-          def prepare_features(data, detector):
-              # Extract numerical features for ML analysis
-              features = []
-              
-              for record in data:
-                  feature_vector = []
-                  
-                  # Extract relevant features based on detector config
-                  if 'response_time' in record:
-                      feature_vector.append(float(record['response_time']))
-                  if 'bytes_transferred' in record:
-                      feature_vector.append(float(record['bytes_transferred']))
-                  if 'error_count' in record:
-                      feature_vector.append(float(record['error_count']))
-                  
-                  if feature_vector:
-                      features.append(feature_vector)
-              
-              return np.array(features) if features else np.array([])
-          
-          def detect_statistical_anomalies(features, detector):
-              if len(features) == 0:
-                  return []
-              
-              # Calculate statistics
-              mean = np.mean(features, axis=0)
-              std = np.std(features, axis=0)
-              
-              # Detect outliers
-              anomalies = []
-              sensitivity_factor = {
-                  'low': 3,
-                  'medium': 2,
-                  'high': 1
-              }.get(detector.get('sensitivity', 'medium'), 2)
-              
-              for i, feature in enumerate(features):
-                  z_scores = np.abs((feature - mean) / (std + 1e-10))
-                  if np.any(z_scores > sensitivity_factor):
-                      anomalies.append({
-                          'type': 'statistical_anomaly',
-                          'detector': detector['name'],
-                          'index': i,
-                          'z_scores': z_scores.tolist(),
-                          'severity': calculate_severity(z_scores, sensitivity_factor)
-                      })
-              
-              return anomalies
-          
-          def detect_ml_anomalies(features, detector):
-              if len(features) < 10:
-                  return []
-              
-              # Normalize features
-              scaler = StandardScaler()
-              features_normalized = scaler.fit_transform(features)
-              
-              # Train Isolation Forest
-              contamination = {
-                  'low': 0.01,
-                  'medium': 0.05,
-                  'high': 0.1
-              }.get(detector.get('sensitivity', 'medium'), 0.05)
-              
-              model = IsolationForest(
-                  contamination=contamination,
-                  random_state=42
-              )
-              
-              predictions = model.fit_predict(features_normalized)
-              
-              # Identify anomalies
-              anomalies = []
-              for i, pred in enumerate(predictions):
-                  if pred == -1:
-                      anomalies.append({
-                          'type': 'ml_anomaly',
-                          'detector': detector['name'],
-                          'index': i,
-                          'anomaly_score': model.score_samples([features_normalized[i]])[0],
-                          'severity': 'high' if model.score_samples([features_normalized[i]])[0] < -0.5 else 'medium'
-                      })
-              
-              return anomalies
-          
-          def detect_pattern_anomalies(data, detector):
-              # Implement pattern-based anomaly detection
-              # Look for unusual patterns in categorical data
-              anomalies = []
-              
-              # Example: Detect unusual user behavior patterns
-              user_activities = {}
-              for record in data:
-                  if 'user_id' in record and 'action' in record:
-                      user_id = record['user_id']
-                      if user_id not in user_activities:
-                          user_activities[user_id] = []
-                      user_activities[user_id].append(record['action'])
-              
-              # Detect anomalous activity sequences
-              for user_id, activities in user_activities.items():
-                  if is_anomalous_sequence(activities):
-                      anomalies.append({
-                          'type': 'pattern_anomaly',
-                          'detector': detector['name'],
-                          'user_id': user_id,
-                          'pattern': activities[-10:],  # Last 10 activities
-                          'severity': 'high'
-                      })
-              
-              return anomalies
-          
-          def run_behavior_analytics(es):
-              # Implement User and Entity Behavior Analytics (UEBA)
-              anomalies = []
-              
-              # Analyze user behavior
-              user_anomalies = analyze_user_behavior(es)
-              anomalies.extend(user_anomalies)
-              
-              # Analyze entity behavior
-              entity_anomalies = analyze_entity_behavior(es)
-              anomalies.extend(entity_anomalies)
-              
-              return anomalies
-          
-          def analyze_user_behavior(es):
-              # Implement user behavior analysis
-              # Look for unusual login times, locations, access patterns
-              return []
-          
-          def analyze_entity_behavior(es):
-              # Implement entity behavior analysis
-              # Look for unusual system behavior, process execution, network connections
-              return []
-          
-          def is_anomalous_sequence(activities):
-              # Implement sequence anomaly detection logic
-              # This is a simplified example
-              suspicious_sequences = [
-                  ['login', 'privilege_escalation', 'data_export'],
-                  ['failed_login', 'failed_login', 'failed_login', 'successful_login'],
-                  ['access_sensitive_data', 'download_large_file', 'delete_logs']
-              ]
-              
-              for suspicious in suspicious_sequences:
-                  if all(activity in activities for activity in suspicious):
-                      return True
-              
-              return False
-          
-          def calculate_severity(z_scores, threshold):
-              max_z = np.max(z_scores)
-              if max_z > threshold * 2:
-                  return 'critical'
-              elif max_z > threshold * 1.5:
-                  return 'high'
-              elif max_z > threshold:
-                  return 'medium'
-              else:
-                  return 'low'
-          
-          def get_auth():
-              # Implement authentication
-              return None
-        PYTHON
-      end
-      
-      def create_alert_topic(name, attrs, resources)
-        topic_name = component_resource_name(name, :alert_topic)
-        topic = aws_sns_topic(topic_name, {
-          name: "siem-alerts-#{name}",
-          kms_master_key_id: resources[:kms_keys][:main].id,
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        resources[:sns_topics][:alerts] = topic
-        topic.arn
-      end
-      
-      def create_correlation_engine(name, attrs, resources)
-        # Create Step Functions state machine for correlation workflow
-        state_machine_name = component_resource_name(name, :correlation_engine)
-        
-        resources[:step_functions][:correlation_engine] = aws_sfn_state_machine(state_machine_name, {
-          name: "siem-correlation-engine-#{name}",
-          role_arn: create_step_functions_role(name, "correlation", attrs, resources),
-          
-          definition: JSON.pretty_generate({
-            Comment: "SIEM Correlation Engine",
-            StartAt: "CollectEvents",
-            States: {
-              CollectEvents: {
-                Type: "Task",
-                Resource: resources[:lambda_functions][:correlation].arn,
-                Next: "EvaluateRules"
-              },
-              EvaluateRules: {
-                Type: "Parallel",
-                Branches: attrs.correlation_rules.map do |rule|
-                  {
-                    StartAt: "Evaluate#{rule[:name].gsub(/\s+/, '')}",
-                    States: {
-                      "Evaluate#{rule[:name].gsub(/\s+/, '')}" => {
-                        Type: "Task",
-                        Resource: resources[:lambda_functions][:correlation].arn,
-                        Parameters: {
-                          "rule.$" => rule.to_json,
-                          "events.$" => "$"
-                        },
-                        End: true
-                      }
-                    }
-                  }
-                end,
-                Next: "ProcessAlerts"
-              },
-              ProcessAlerts: {
-                Type: "Task",
-                Resource: "arn:aws:states:::lambda:invoke",
-                Parameters: {
-                  FunctionName: resources[:lambda_functions][:correlation].arn,
-                  Payload: {
-                    "action" => "process_alerts",
-                    "results.$" => "$"
-                  }
-                },
-                End: true
-              }
-            }
-          }),
-          
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-      end
-      
-      def create_step_functions_role(name, purpose, attrs, resources)
-        role_name = component_resource_name(name, :sfn_role, purpose)
-        role = aws_iam_role(role_name, {
-          name: role_name.to_s,
-          assume_role_policy: JSON.pretty_generate({
-            Version: "2012-10-17",
-            Statement: [{
-              Action: "sts:AssumeRole",
-              Effect: "Allow",
-              Principal: {
-                Service: "states.amazonaws.com"
-              }
-            }]
-          }),
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        aws_iam_role_policy(:"#{role_name}_policy", {
-          role: role.id,
-          policy: JSON.pretty_generate({
-            Version: "2012-10-17",
-            Statement: [
-              {
-                Effect: "Allow",
-                Action: [
-                  "lambda:InvokeFunction"
-                ],
-                Resource: "arn:aws:lambda:*:*:function:siem-*"
-              },
-              {
-                Effect: "Allow",
-                Action: [
-                  "xray:PutTraceSegments",
-                  "xray:PutTelemetryRecords"
-                ],
-                Resource: "*"
-              }
-            ]
-          })
-        })
-        
-        role.arn
-      end
-      
-      def create_threat_detection(name, attrs, resources)
-        # Create DynamoDB table for threat intelligence
-        if attrs.threat_detection[:threat_intel_feeds] && !attrs.threat_detection[:threat_intel_feeds].empty?
-          table_name = component_resource_name(name, :threat_intel_table)
-          resources[:dynamodb_tables] ||= {}
-          resources[:dynamodb_tables][:threat_intel] = aws_dynamodb_table(table_name, {
-            name: "siem-threat-intel-#{name}",
-            billing_mode: "PAY_PER_REQUEST",
-            
-            attribute: [
-              {
-                name: "indicator",
-                type: "S"
-              },
-              {
-                name: "indicator_type",
-                type: "S"
-              }
-            ],
-            
-            hash_key: "indicator",
-            range_key: "indicator_type",
-            
-            global_secondary_index: [
-              {
-                name: "TypeIndex",
-                hash_key: "indicator_type",
-                projection_type: "ALL"
-              }
-            ],
-            
-            point_in_time_recovery: {
-              enabled: true
-            },
-            
-            server_side_encryption: {
-              enabled: true,
-              kms_key_id: resources[:kms_keys][:main].id
-            },
-            
-            tags: component_tags('siem_security_platform', name, attrs.tags)
-          })
-          
-          # Create Lambda for threat intel updates
-          threat_intel_lambda = component_resource_name(name, :threat_intel_updater)
-          resources[:lambda_functions][:threat_intel_updater] = aws_lambda_function(threat_intel_lambda, {
-            function_name: "siem-threat-intel-updater-#{name}",
-            runtime: "python3.11",
-            handler: "index.lambda_handler",
-            role: create_lambda_execution_role(name, "threat-intel-updater", attrs, resources),
-            timeout: 900,
-            memory_size: 1024,
-            
-            environment: {
-              variables: {
-                THREAT_INTEL_TABLE: resources[:dynamodb_tables][:threat_intel].name,
-                THREAT_FEEDS: JSON.generate(attrs.threat_detection[:threat_intel_feeds])
-              }
-            },
-            
-            code: {
-              zip_file: generate_threat_intel_updater_code()
-            },
-            
-            tags: component_tags('siem_security_platform', name, attrs.tags)
-          })
-          
-          # Schedule threat intel updates
-          attrs.threat_detection[:threat_intel_feeds].each do |feed|
-            rule_name = component_resource_name(name, :threat_intel_rule, feed[:name])
-            rule = aws_cloudwatch_event_rule(rule_name, {
-              name: "siem-threat-intel-#{name}-#{feed[:name]}",
-              description: "Update threat intelligence feed: #{feed[:name]}",
-              schedule_expression: "rate(#{feed[:update_frequency] / 60} minutes)",
-              tags: component_tags('siem_security_platform', name, attrs.tags)
-            })
-            
-            aws_cloudwatch_event_target(:"#{rule_name}_target", {
-              rule: rule.name,
-              arn: resources[:lambda_functions][:threat_intel_updater].arn,
-              input: JSON.generate({ feed: feed })
-            })
-            
-            resources[:event_rules][:"threat_intel_#{feed[:name]}"] = rule
-          end
-        end
-      end
-      
-      def generate_threat_intel_updater_code
-        <<~PYTHON
-          import json
-          import boto3
-          import os
-          import requests
-          from datetime import datetime
-          
-          dynamodb = boto3.resource('dynamodb')
-          
-          def lambda_handler(event, context):
-              table = dynamodb.Table(os.environ['THREAT_INTEL_TABLE'])
-              feed = event.get('feed', {})
-              
-              # Fetch threat intelligence data
-              indicators = fetch_threat_feed(feed)
-              
-              # Update DynamoDB table
-              with table.batch_writer() as batch:
-                  for indicator in indicators:
-                      batch.put_item(Item={
-                          'indicator': indicator['value'],
-                          'indicator_type': indicator['type'],
-                          'severity': indicator.get('severity', 'medium'),
-                          'source': feed['name'],
-                          'last_seen': datetime.utcnow().isoformat(),
-                          'metadata': indicator.get('metadata', {})
-                      })
-              
-              return {
-                  'statusCode': 200,
-                  'body': json.dumps({
-                      'feed': feed['name'],
-                      'indicators_updated': len(indicators)
-                  })
-              }
-          
-          def fetch_threat_feed(feed):
-              indicators = []
-              
-              if feed['type'] == 'ip_reputation':
-                  indicators.extend(fetch_ip_reputation(feed))
-              elif feed['type'] == 'domain_reputation':
-                  indicators.extend(fetch_domain_reputation(feed))
-              elif feed['type'] == 'file_hash':
-                  indicators.extend(fetch_file_hashes(feed))
-              elif feed['type'] == 'indicators':
-                  indicators.extend(fetch_generic_indicators(feed))
-              
-              return indicators
-          
-          def fetch_ip_reputation(feed):
-              # Implement IP reputation feed fetching
-              # This is a placeholder - real implementation would fetch from actual feeds
-              return [
-                  {'value': '192.168.1.100', 'type': 'ip', 'severity': 'high'},
-                  {'value': '10.0.0.50', 'type': 'ip', 'severity': 'medium'}
-              ]
-          
-          def fetch_domain_reputation(feed):
-              # Implement domain reputation feed fetching
-              return [
-                  {'value': 'malicious.com', 'type': 'domain', 'severity': 'critical'},
-                  {'value': 'suspicious.net', 'type': 'domain', 'severity': 'high'}
-              ]
-          
-          def fetch_file_hashes(feed):
-              # Implement file hash feed fetching
-              return [
-                  {'value': 'd41d8cd98f00b204e9800998ecf8427e', 'type': 'md5', 'severity': 'high'},
-                  {'value': 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855', 'type': 'sha256', 'severity': 'critical'}
-              ]
-          
-          def fetch_generic_indicators(feed):
-              # Implement generic indicator fetching
-              if feed.get('source_url'):
-                  try:
-                      response = requests.get(feed['source_url'], timeout=30)
-                      if response.status_code == 200:
-                          # Parse response based on format
-                          return parse_indicators(response.text, feed)
-                  except Exception as e:
-                      print(f"Error fetching feed {feed['name']}: {str(e)}")
-              
-              return []
-          
-          def parse_indicators(data, feed):
-              # Parse indicators from raw data
-              indicators = []
-              
-              # Simple line-based parsing example
-              for line in data.split('\\n'):
-                  line = line.strip()
-                  if line and not line.startswith('#'):
-                      indicators.append({
-                          'value': line,
-                          'type': 'unknown',
-                          'severity': 'medium'
-                      })
-              
-              return indicators
-        PYTHON
-      end
-      
-      def create_incident_response(name, attrs, resources)
-        return unless attrs.incident_response[:enable_automated_response]
-        
-        # Create Step Functions for incident response workflows
-        state_machine_name = component_resource_name(name, :incident_response)
-        
-        resources[:step_functions][:incident_response] = aws_sfn_state_machine(state_machine_name, {
-          name: "siem-incident-response-#{name}",
-          role_arn: create_step_functions_role(name, "incident-response", attrs, resources),
-          
-          definition: JSON.pretty_generate({
-            Comment: "SIEM Incident Response Workflow",
-            StartAt: "ClassifyIncident",
-            States: {
-              ClassifyIncident: {
-                Type: "Task",
-                Resource: "arn:aws:states:::lambda:invoke",
-                Parameters: {
-                  FunctionName: create_incident_classifier(name, attrs, resources),
-                  Payload: {
-                    "incident.$" => "$"
-                  }
-                },
-                Next: "DetermineSeverity"
-              },
-              DetermineSeverity: {
-                Type: "Choice",
-                Choices: [
-                  {
-                    Variable: "$.severity",
-                    StringEquals: "critical",
-                    Next: "CriticalResponse"
-                  },
-                  {
-                    Variable: "$.severity",
-                    StringEquals: "high",
-                    Next: "HighResponse"
-                  },
-                  {
-                    Variable: "$.severity",
-                    StringEquals: "medium",
-                    Next: "MediumResponse"
-                  }
-                ],
-                Default: "LowResponse"
-              },
-              CriticalResponse: {
-                Type: "Parallel",
-                Branches: [
-                  {
-                    StartAt: "IsolateResource",
-                    States: {
-                      IsolateResource: {
-                        Type: "Task",
-                        Resource: "arn:aws:states:::lambda:invoke",
-                        Parameters: {
-                          FunctionName: create_isolation_lambda(name, attrs, resources),
-                          Payload: {
-                            "action" => "isolate",
-                            "resource.$" => "$.affected_resource"
-                          }
-                        },
-                        End: true
-                      }
-                    }
-                  },
-                  {
-                    StartAt: "NotifySOC",
-                    States: {
-                      NotifySOC: {
-                        Type: "Task",
-                        Resource: "arn:aws:states:::sns:publish",
-                        Parameters: {
-                          TopicArn: resources[:sns_topics][:alerts].arn,
-                          Message: {
-                            "incident.$" => "$",
-                            "priority" => "CRITICAL"
-                          }
-                        },
-                        End: true
-                      }
-                    }
-                  },
-                  {
-                    StartAt: "CollectForensics",
-                    States: {
-                      CollectForensics: {
-                        Type: "Task",
-                        Resource: "arn:aws:states:::lambda:invoke",
-                        Parameters: {
-                          FunctionName: create_forensics_lambda(name, attrs, resources),
-                          Payload: {
-                            "action" => "collect",
-                            "incident.$" => "$"
-                          }
-                        },
-                        End: true
-                      }
-                    }
-                  }
-                ],
-                Next: "CreateIncidentTicket"
-              },
-              HighResponse: {
-                Type: "Task",
-                Resource: "arn:aws:states:::lambda:invoke",
-                Parameters: {
-                  FunctionName: create_response_lambda(name, attrs, resources),
-                  Payload: {
-                    "severity" => "high",
-                    "incident.$" => "$"
-                  }
-                },
-                Next: "CreateIncidentTicket"
-              },
-              MediumResponse: {
-                Type: "Task",
-                Resource: "arn:aws:states:::lambda:invoke",
-                Parameters: {
-                  FunctionName: create_response_lambda(name, attrs, resources),
-                  Payload: {
-                    "severity" => "medium",
-                    "incident.$" => "$"
-                  }
-                },
-                Next: "CreateIncidentTicket"
-              },
-              LowResponse: {
-                Type: "Task",
-                Resource: "arn:aws:states:::lambda:invoke",
-                Parameters: {
-                  FunctionName: create_response_lambda(name, attrs, resources),
-                  Payload: {
-                    "severity" => "low",
-                    "incident.$" => "$"
-                  }
-                },
-                Next: "CreateIncidentTicket"
-              },
-              CreateIncidentTicket: {
-                Type: "Task",
-                Resource: "arn:aws:states:::lambda:invoke",
-                Parameters: {
-                  FunctionName: create_ticketing_lambda(name, attrs, resources),
-                  Payload: {
-                    "action" => "create_ticket",
-                    "incident.$" => "$"
-                  }
-                },
-                End: true
-              }
-            }
-          }),
-          
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        # Create playbook executions for configured playbooks
-        attrs.incident_response[:playbooks].each do |playbook|
-          create_playbook_execution(name, playbook, attrs, resources)
-        end
-      end
-      
-      def create_incident_classifier(name, attrs, resources)
-        lambda_name = component_resource_name(name, :incident_classifier)
-        lambda = aws_lambda_function(lambda_name, {
-          function_name: "siem-incident-classifier-#{name}",
-          runtime: "python3.11",
-          handler: "index.lambda_handler",
-          role: create_lambda_execution_role(name, "incident-classifier", attrs, resources),
-          timeout: 60,
-          
-          code: {
-            zip_file: <<~PYTHON
-              import json
-              
-              def lambda_handler(event, context):
-                  incident = event.get('incident', {})
-                  
-                  # Classify incident based on rules
-                  severity = classify_severity(incident)
-                  category = classify_category(incident)
-                  
-                  return {
-                      'statusCode': 200,
-                      'severity': severity,
-                      'category': category,
-                      'incident': incident
-                  }
-              
-              def classify_severity(incident):
-                  # Implement severity classification logic
-                  indicators = incident.get('indicators', [])
-                  
-                  if any(ind.get('severity') == 'critical' for ind in indicators):
-                      return 'critical'
-                  elif any(ind.get('severity') == 'high' for ind in indicators):
-                      return 'high'
-                  elif len(indicators) > 10:
-                      return 'high'
-                  elif len(indicators) > 5:
-                      return 'medium'
-                  else:
-                      return 'low'
-              
-              def classify_category(incident):
-                  # Implement category classification
-                  event_types = incident.get('event_types', [])
-                  
-                  if 'malware' in event_types:
-                      return 'malware'
-                  elif 'unauthorized_access' in event_types:
-                      return 'unauthorized_access'
-                  elif 'data_exfiltration' in event_types:
-                      return 'data_breach'
-                  else:
-                      return 'unknown'
-            PYTHON
-          },
-          
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        resources[:lambda_functions][:incident_classifier] = lambda
-        lambda.arn
-      end
-      
-      def create_isolation_lambda(name, attrs, resources)
-        lambda_name = component_resource_name(name, :isolation_lambda)
-        lambda = aws_lambda_function(lambda_name, {
-          function_name: "siem-isolation-#{name}",
-          runtime: "python3.11",
-          handler: "index.lambda_handler",
-          role: create_isolation_role(name, attrs, resources),
-          timeout: 300,
-          
-          code: {
-            zip_file: <<~PYTHON
-              import json
-              import boto3
-              
-              ec2 = boto3.client('ec2')
-              
-              def lambda_handler(event, context):
-                  action = event.get('action')
-                  resource = event.get('resource', {})
-                  
-                  if action == 'isolate':
-                      result = isolate_resource(resource)
-                  elif action == 'restore':
-                      result = restore_resource(resource)
-                  else:
-                      result = {'error': 'Unknown action'}
-                  
-                  return {
-                      'statusCode': 200,
-                      'body': json.dumps(result)
-                  }
-              
-              def isolate_resource(resource):
-                  resource_type = resource.get('type')
-                  resource_id = resource.get('id')
-                  
-                  if resource_type == 'ec2_instance':
-                      return isolate_ec2_instance(resource_id)
-                  elif resource_type == 'security_group':
-                      return isolate_security_group(resource_id)
-                  else:
-                      return {'error': 'Unsupported resource type'}
-              
-              def isolate_ec2_instance(instance_id):
-                  # Create isolation security group
-                  isolation_sg = ec2.create_security_group(
-                      GroupName=f'isolation-{instance_id}',
-                      Description='Isolation security group for incident response'
-                  )
-                  
-                  # Remove all ingress rules
-                  ec2.revoke_security_group_ingress(
-                      GroupId=isolation_sg['GroupId'],
-                      IpPermissions=[{
-                          'IpProtocol': '-1',
-                          'FromPort': -1,
-                          'ToPort': -1,
-                          'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
-                      }]
-                  )
-                  
-                  # Apply isolation security group
-                  ec2.modify_instance_attribute(
-                      InstanceId=instance_id,
-                      Groups=[isolation_sg['GroupId']]
-                  )
-                  
-                  return {
-                      'action': 'isolated',
-                      'instance_id': instance_id,
-                      'isolation_sg': isolation_sg['GroupId']
-                  }
-              
-              def restore_resource(resource):
-                  # Implement restoration logic
-                  return {'action': 'restored', 'resource': resource}
-              
-              def isolate_security_group(sg_id):
-                  # Implement security group isolation
-                  return {'action': 'isolated', 'security_group_id': sg_id}
-            PYTHON
-          },
-          
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        resources[:lambda_functions][:isolation] = lambda
-        lambda.arn
-      end
-      
-      def create_isolation_role(name, attrs, resources)
-        role_name = component_resource_name(name, :isolation_role)
-        role = aws_iam_role(role_name, {
-          name: role_name.to_s,
-          assume_role_policy: JSON.pretty_generate({
-            Version: "2012-10-17",
-            Statement: [{
-              Action: "sts:AssumeRole",
-              Effect: "Allow",
-              Principal: {
-                Service: "lambda.amazonaws.com"
-              }
-            }]
-          }),
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        # Attach policies
-        aws_iam_role_policy_attachment(:"#{role_name}_basic", {
-          role: role.name,
-          policy_arn: "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-        })
-        
-        # Custom policy for isolation actions
-        aws_iam_role_policy(:"#{role_name}_isolation", {
-          role: role.id,
-          policy: JSON.pretty_generate({
-            Version: "2012-10-17",
-            Statement: [
-              {
-                Effect: "Allow",
-                Action: [
-                  "ec2:CreateSecurityGroup",
-                  "ec2:AuthorizeSecurityGroupIngress",
-                  "ec2:AuthorizeSecurityGroupEgress",
-                  "ec2:RevokeSecurityGroupIngress",
-                  "ec2:RevokeSecurityGroupEgress",
-                  "ec2:ModifyInstanceAttribute",
-                  "ec2:DescribeInstances",
-                  "ec2:DescribeSecurityGroups",
-                  "ec2:CreateSnapshot",
-                  "ec2:CreateImage"
-                ],
-                Resource: "*"
-              }
-            ]
-          })
-        })
-        
-        role.arn
-      end
-      
-      def create_forensics_lambda(name, attrs, resources)
-        lambda_name = component_resource_name(name, :forensics_lambda)
-        lambda = aws_lambda_function(lambda_name, {
-          function_name: "siem-forensics-#{name}",
-          runtime: "python3.11",
-          handler: "index.lambda_handler",
-          role: create_forensics_role(name, attrs, resources),
-          timeout: 900,
-          memory_size: 3008,
-          
-          environment: {
-            variables: {
-              FORENSICS_BUCKET: create_forensics_bucket(name, attrs, resources)
-            }
-          },
-          
-          code: {
-            zip_file: <<~PYTHON
-              import json
-              import boto3
-              import os
-              from datetime import datetime
-              
-              ec2 = boto3.client('ec2')
-              s3 = boto3.client('s3')
-              ssm = boto3.client('ssm')
-              
-              def lambda_handler(event, context):
-                  action = event.get('action')
-                  incident = event.get('incident', {})
-                  
-                  if action == 'collect':
-                      result = collect_forensics(incident)
-                  else:
-                      result = {'error': 'Unknown action'}
-                  
-                  return {
-                      'statusCode': 200,
-                      'body': json.dumps(result)
-                  }
-              
-              def collect_forensics(incident):
-                  forensics_data = {
-                      'incident_id': incident.get('id'),
-                      'timestamp': datetime.utcnow().isoformat(),
-                      'affected_resources': []
-                  }
-                  
-                  for resource in incident.get('affected_resources', []):
-                      if resource['type'] == 'ec2_instance':
-                          forensics = collect_ec2_forensics(resource['id'])
-                          forensics_data['affected_resources'].append(forensics)
-                  
-                  # Store forensics data
-                  store_forensics_data(forensics_data)
-                  
-                  return forensics_data
-              
-              def collect_ec2_forensics(instance_id):
-                  forensics = {
-                      'instance_id': instance_id,
-                      'type': 'ec2_instance',
-                      'collected_at': datetime.utcnow().isoformat()
-                  }
-                  
-                  # Create memory dump
-                  memory_dump = create_memory_dump(instance_id)
-                  if memory_dump:
-                      forensics['memory_dump'] = memory_dump
-                  
-                  # Create disk snapshot
-                  snapshot = create_disk_snapshot(instance_id)
-                  if snapshot:
-                      forensics['disk_snapshot'] = snapshot
-                  
-                  # Collect system information
-                  system_info = collect_system_info(instance_id)
-                  if system_info:
-                      forensics['system_info'] = system_info
-                  
-                  # Collect network connections
-                  network_info = collect_network_info(instance_id)
-                  if network_info:
-                      forensics['network_info'] = network_info
-                  
-                  return forensics
-              
-              def create_memory_dump(instance_id):
-                  # Use SSM to run memory dump command
-                  try:
-                      response = ssm.send_command(
-                          InstanceIds=[instance_id],
-                          DocumentName='AWS-RunShellScript',
-                          Parameters={
-                              'commands': [
-                                  'sudo dd if=/dev/mem of=/tmp/memory.dump',
-                                  'aws s3 cp /tmp/memory.dump s3://{}/forensics/{}/memory.dump'.format(
-                                      os.environ['FORENSICS_BUCKET'],
-                                      instance_id
-                                  )
-                              ]
-                          }
-                      )
-                      return {
-                          'command_id': response['Command']['CommandId'],
-                          's3_location': 's3://{}/forensics/{}/memory.dump'.format(
-                              os.environ['FORENSICS_BUCKET'],
-                              instance_id
-                          )
-                      }
-                  except Exception as e:
-                      print(f"Error creating memory dump: {str(e)}")
-                      return None
-              
-              def create_disk_snapshot(instance_id):
-                  try:
-                      # Get instance volumes
-                      instance = ec2.describe_instances(InstanceIds=[instance_id])
-                      volumes = []
-                      
-                      for reservation in instance['Reservations']:
-                          for instance in reservation['Instances']:
-                              for bdm in instance.get('BlockDeviceMappings', []):
-                                  if 'Ebs' in bdm:
-                                      volume_id = bdm['Ebs']['VolumeId']
-                                      
-                                      # Create snapshot
-                                      snapshot = ec2.create_snapshot(
-                                          VolumeId=volume_id,
-                                          Description=f'Forensics snapshot for incident - {instance_id}'
-                                      )
-                                      
-                                      volumes.append({
-                                          'volume_id': volume_id,
-                                          'snapshot_id': snapshot['SnapshotId']
-                                      })
-                      
-                      return volumes
-                  except Exception as e:
-                      print(f"Error creating snapshot: {str(e)}")
-                      return None
-              
-              def collect_system_info(instance_id):
-                  # Collect system information via SSM
-                  commands = [
-                      'uname -a',
-                      'ps aux',
-                      'netstat -tulpn',
-                      'last -50',
-                      'w',
-                      'history'
-                  ]
-                  
-                  try:
-                      response = ssm.send_command(
-                          InstanceIds=[instance_id],
-                          DocumentName='AWS-RunShellScript',
-                          Parameters={'commands': commands}
-                      )
-                      return {'command_id': response['Command']['CommandId']}
-                  except Exception as e:
-                      print(f"Error collecting system info: {str(e)}")
-                      return None
-              
-              def collect_network_info(instance_id):
-                  # Collect network flow information
-                  try:
-                      # Get VPC Flow Logs
-                      # This is simplified - real implementation would query flow logs
-                      return {
-                          'flow_logs': 'collected',
-                          'connections': 'analyzed'
-                      }
-                  except Exception as e:
-                      print(f"Error collecting network info: {str(e)}")
-                      return None
-              
-              def store_forensics_data(data):
-                  # Store forensics data in S3
-                  key = 'forensics/{}/data.json'.format(data['incident_id'])
-                  
-                  s3.put_object(
-                      Bucket=os.environ['FORENSICS_BUCKET'],
-                      Key=key,
-                      Body=json.dumps(data, indent=2),
-                      ServerSideEncryption='aws:kms'
-                  )
-            PYTHON
-          },
-          
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        resources[:lambda_functions][:forensics] = lambda
-        lambda.arn
-      end
-      
-      def create_forensics_role(name, attrs, resources)
-        role_name = component_resource_name(name, :forensics_role)
-        role = aws_iam_role(role_name, {
-          name: role_name.to_s,
-          assume_role_policy: JSON.pretty_generate({
-            Version: "2012-10-17",
-            Statement: [{
-              Action: "sts:AssumeRole",
-              Effect: "Allow",
-              Principal: {
-                Service: "lambda.amazonaws.com"
-              }
-            }]
-          }),
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        # Attach policies
-        aws_iam_role_policy_attachment(:"#{role_name}_basic", {
-          role: role.name,
-          policy_arn: "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-        })
-        
-        # Custom policy for forensics collection
-        aws_iam_role_policy(:"#{role_name}_forensics", {
-          role: role.id,
-          policy: JSON.pretty_generate({
-            Version: "2012-10-17",
-            Statement: [
-              {
-                Effect: "Allow",
-                Action: [
-                  "ec2:CreateSnapshot",
-                  "ec2:DescribeInstances",
-                  "ec2:DescribeVolumes",
-                  "ec2:DescribeSnapshots",
-                  "ssm:SendCommand",
-                  "ssm:GetCommandInvocation",
-                  "s3:PutObject",
-                  "s3:GetObject",
-                  "kms:Decrypt",
-                  "kms:GenerateDataKey"
-                ],
-                Resource: "*"
-              }
-            ]
-          })
-        })
-        
-        role.arn
-      end
-      
-      def create_forensics_bucket(name, attrs, resources)
-        bucket_name = component_resource_name(name, :forensics_bucket)
-        bucket = create_secure_bucket(
-          bucket_name,
-          "siem-forensics-#{name}",
-          attrs,
-          resources
-        )
-        
-        resources[:s3_buckets][:forensics] = bucket
-        bucket.id
-      end
-      
-      def create_response_lambda(name, attrs, resources)
-        lambda_name = component_resource_name(name, :response_lambda)
-        lambda = aws_lambda_function(lambda_name, {
-          function_name: "siem-response-#{name}",
-          runtime: "python3.11",
-          handler: "index.lambda_handler",
-          role: create_lambda_execution_role(name, "response", attrs, resources),
-          timeout: 300,
-          
-          code: {
-            zip_file: <<~PYTHON
-              import json
-              
-              def lambda_handler(event, context):
-                  severity = event.get('severity')
-                  incident = event.get('incident', {})
-                  
-                  # Execute response based on severity
-                  if severity == 'high':
-                      response = execute_high_severity_response(incident)
-                  elif severity == 'medium':
-                      response = execute_medium_severity_response(incident)
-                  else:
-                      response = execute_low_severity_response(incident)
-                  
-                  return {
-                      'statusCode': 200,
-                      'body': json.dumps(response)
-                  }
-              
-              def execute_high_severity_response(incident):
-                  # Implement high severity response
-                  return {
-                      'actions_taken': [
-                          'blocked_suspicious_ips',
-                          'disabled_compromised_accounts',
-                          'initiated_forensics_collection'
-                      ]
-                  }
-              
-              def execute_medium_severity_response(incident):
-                  # Implement medium severity response
-                  return {
-                      'actions_taken': [
-                          'increased_monitoring',
-                          'notified_security_team'
-                      ]
-                  }
-              
-              def execute_low_severity_response(incident):
-                  # Implement low severity response
-                  return {
-                      'actions_taken': [
-                          'logged_incident',
-                          'updated_metrics'
-                      ]
-                  }
-            PYTHON
-          },
-          
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        resources[:lambda_functions][:response] = lambda
-        lambda.arn
-      end
-      
-      def create_ticketing_lambda(name, attrs, resources)
-        lambda_name = component_resource_name(name, :ticketing_lambda)
-        lambda = aws_lambda_function(lambda_name, {
-          function_name: "siem-ticketing-#{name}",
-          runtime: "python3.11",
-          handler: "index.lambda_handler",
-          role: create_lambda_execution_role(name, "ticketing", attrs, resources),
-          timeout: 60,
-          
-          environment: {
-            variables: {
-              INTEGRATIONS: JSON.generate(attrs.integrations.select { |i| i[:type] == 'ticketing' })
-            }
-          },
-          
-          code: {
-            zip_file: <<~PYTHON
-              import json
-              import os
-              import requests
-              from datetime import datetime
-              
-              def lambda_handler(event, context):
-                  action = event.get('action')
-                  incident = event.get('incident', {})
-                  
-                  if action == 'create_ticket':
-                      ticket = create_incident_ticket(incident)
-                  else:
-                      ticket = {'error': 'Unknown action'}
-                  
-                  return {
-                      'statusCode': 200,
-                      'body': json.dumps(ticket)
-                  }
-              
-              def create_incident_ticket(incident):
-                  integrations = json.loads(os.environ.get('INTEGRATIONS', '[]'))
-                  
-                  ticket = {
-                      'title': f"Security Incident: {incident.get('name', 'Unknown')}",
-                      'description': format_incident_description(incident),
-                      'severity': incident.get('severity', 'medium'),
-                      'created_at': datetime.utcnow().isoformat(),
-                      'incident_id': incident.get('id')
-                  }
-                  
-                  # Send to configured ticketing systems
-                  for integration in integrations:
-                      if integration.get('enabled', True):
-                          send_to_ticketing_system(ticket, integration)
-                  
-                  return ticket
-              
-              def format_incident_description(incident):
-                  description = f"""
-                  Incident ID: {incident.get('id')}
-                  Severity: {incident.get('severity', 'unknown').upper()}
-                  Time: {incident.get('timestamp')}
-                  
-                  Description: {incident.get('description', 'No description provided')}
-                  
-                  Affected Resources:
-                  """
-                  
-                  for resource in incident.get('affected_resources', []):
-                      description += f"\\n- {resource.get('type')}: {resource.get('id')}"
-                  
-                  description += f"\\n\\nIndicators: {len(incident.get('indicators', []))}"
-                  description += f"\\nActions Taken: {', '.join(incident.get('actions_taken', []))}"
-                  
-                  return description
-              
-              def send_to_ticketing_system(ticket, integration):
-                  # Implement integration with ticketing systems
-                  # This is a placeholder - real implementation would use actual APIs
-                  endpoint = integration.get('endpoint')
-                  
-                  if endpoint:
-                      try:
-                          response = requests.post(
-                              endpoint,
-                              json=ticket,
-                              headers={'Authorization': f"Bearer {get_api_key(integration)}"},
-                              timeout=30
-                          )
-                          return response.json()
-                      except Exception as e:
-                          print(f"Error sending to ticketing system: {str(e)}")
-                  
-                  return None
-              
-              def get_api_key(integration):
-                  # Retrieve API key from Secrets Manager
-                  # This is simplified - real implementation would use boto3
-                  return "placeholder-api-key"
-            PYTHON
-          },
-          
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        resources[:lambda_functions][:ticketing] = lambda
-        lambda.arn
-      end
-      
-      def create_playbook_execution(name, playbook, attrs, resources)
-        # Create Lambda for playbook execution
-        playbook_lambda_name = component_resource_name(name, :playbook, playbook[:name])
-        
-        resources[:lambda_functions][:"playbook_#{playbook[:name]}"] = aws_lambda_function(playbook_lambda_name, {
-          function_name: "siem-playbook-#{name}-#{playbook[:name]}",
-          runtime: "python3.11",
-          handler: "index.lambda_handler",
-          role: create_lambda_execution_role(name, "playbook-#{playbook[:name]}", attrs, resources),
-          timeout: 900,
-          
-          environment: {
-            variables: {
-              PLAYBOOK_NAME: playbook[:name],
-              PLAYBOOK_STEPS: JSON.generate(playbook[:steps])
-            }
-          },
-          
-          code: {
-            zip_file: generate_playbook_code(playbook)
-          },
-          
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-      end
-      
-      def generate_playbook_code(playbook)
-        <<~PYTHON
-          import json
-          import os
-          import boto3
-          
-          def lambda_handler(event, context):
-              playbook_name = os.environ['PLAYBOOK_NAME']
-              steps = json.loads(os.environ['PLAYBOOK_STEPS'])
-              
-              results = []
-              for step in steps:
-                  result = execute_step(step, event)
-                  results.append(result)
-                  
-                  # Stop if step fails and is marked as critical
-                  if not result['success'] and step.get('critical', False):
-                      break
-              
-              return {
-                  'statusCode': 200,
-                  'body': json.dumps({
-                      'playbook': playbook_name,
-                      'results': results
-                  })
-              }
-          
-          def execute_step(step, context):
-              step_type = step.get('type')
-              
-              if step_type == 'notify':
-                  return notify_step(step, context)
-              elif step_type == 'isolate':
-                  return isolate_step(step, context)
-              elif step_type == 'block':
-                  return block_step(step, context)
-              elif step_type == 'collect':
-                  return collect_step(step, context)
-              elif step_type == 'analyze':
-                  return analyze_step(step, context)
-              else:
-                  return {'success': False, 'error': 'Unknown step type'}
-          
-          def notify_step(step, context):
-              # Implement notification logic
-              return {'success': True, 'action': 'notified', 'details': step}
-          
-          def isolate_step(step, context):
-              # Implement isolation logic
-              return {'success': True, 'action': 'isolated', 'details': step}
-          
-          def block_step(step, context):
-              # Implement blocking logic
-              return {'success': True, 'action': 'blocked', 'details': step}
-          
-          def collect_step(step, context):
-              # Implement collection logic
-              return {'success': True, 'action': 'collected', 'details': step}
-          
-          def analyze_step(step, context):
-              # Implement analysis logic
-              return {'success': True, 'action': 'analyzed', 'details': step}
-        PYTHON
-      end
-      
-      def create_monitoring(name, attrs, resources)
-        # Create CloudWatch dashboard
-        dashboard_name = component_resource_name(name, :dashboard)
-        
-        dashboard_body = {
-          widgets: [
-            {
-              type: "metric",
-              properties: {
-                metrics: [
-                  ["AWS/ES", "ClusterUsedSpace", { stat: "Average" }],
-                  [".", "ClusterIndexWritesBlocked", { stat: "Sum" }],
-                  [".", "ClusterStatus.green", { stat: "Average" }]
-                ],
-                period: 300,
-                stat: "Average",
-                region: aws_region,
-                title: "OpenSearch Cluster Health"
-              }
-            },
-            {
-              type: "metric",
-              properties: {
-                metrics: [
-                  ["AWS/Kinesis/Firehose", "IncomingRecords", { stat: "Sum" }],
-                  [".", "DeliveryToElasticsearch.Success", { stat: "Sum" }],
-                  [".", "DeliveryToElasticsearch.DataFreshness", { stat: "Average" }]
-                ],
-                period: 300,
-                stat: "Sum",
-                region: aws_region,
-                title: "Data Ingestion Metrics"
-              }
-            }
-          ]
-        }
-        
-        aws_cloudwatch_dashboard(dashboard_name, {
-          dashboard_name: "siem-#{name}",
-          dashboard_body: JSON.pretty_generate(dashboard_body)
-        })
-        
-        # Create alarms for critical metrics
-        create_siem_alarms(name, attrs, resources)
-      end
-      
-      def create_siem_alarms(name, attrs, resources)
-        # OpenSearch cluster health alarm
-        cluster_health_alarm = component_resource_name(name, :cluster_health_alarm)
-        resources[:alarms][:cluster_health] = aws_cloudwatch_metric_alarm(cluster_health_alarm, {
-          alarm_name: "siem-cluster-health-#{name}",
-          alarm_description: "Alert when OpenSearch cluster is not green",
-          metric_name: "ClusterStatus.green",
-          namespace: "AWS/ES",
-          statistic: "Average",
-          period: 300,
-          evaluation_periods: 2,
-          threshold: 1,
-          comparison_operator: "LessThanThreshold",
-          dimensions: {
-            DomainName: resources[:opensearch_domain].domain_name
-          },
-          alarm_actions: [resources[:sns_topics][:alerts].arn],
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        # Data freshness alarm
-        data_freshness_alarm = component_resource_name(name, :data_freshness_alarm)
-        resources[:alarms][:data_freshness] = aws_cloudwatch_metric_alarm(data_freshness_alarm, {
-          alarm_name: "siem-data-freshness-#{name}",
-          alarm_description: "Alert when data ingestion is delayed",
-          metric_name: "DeliveryToElasticsearch.DataFreshness",
-          namespace: "AWS/Kinesis/Firehose",
-          statistic: "Average",
-          period: 300,
-          evaluation_periods: 2,
-          threshold: 900,  # 15 minutes
-          comparison_operator: "GreaterThanThreshold",
-          alarm_actions: [resources[:sns_topics][:alerts].arn],
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        # High severity incident alarm
-        if attrs.monitoring_config[:create_alarms]
-          incident_alarm = component_resource_name(name, :high_severity_alarm)
-          resources[:alarms][:high_severity] = aws_cloudwatch_metric_alarm(incident_alarm, {
-            alarm_name: "siem-high-severity-incidents-#{name}",
-            alarm_description: "Alert on high severity security incidents",
-            metric_name: "HighSeverityIncidents",
-            namespace: "Custom/SIEM",
-            statistic: "Sum",
-            period: 300,
-            evaluation_periods: 1,
-            threshold: 1,
-            comparison_operator: "GreaterThanOrEqualToThreshold",
-            alarm_actions: [resources[:sns_topics][:alerts].arn],
-            tags: component_tags('siem_security_platform', name, attrs.tags)
-          })
-        end
-      end
-      
-      def create_dashboards(name, attrs, resources)
-        # Create OpenSearch dashboards via API
-        # This would typically be done after OpenSearch is deployed
-        # For now, we'll create a Lambda to configure dashboards
-        
-        dashboard_config_lambda = component_resource_name(name, :dashboard_config)
-        resources[:lambda_functions][:dashboard_config] = aws_lambda_function(dashboard_config_lambda, {
-          function_name: "siem-dashboard-config-#{name}",
-          runtime: "python3.11",
-          handler: "index.lambda_handler",
-          role: create_lambda_execution_role(name, "dashboard-config", attrs, resources),
-          timeout: 300,
-          
-          environment: {
-            variables: {
-              OPENSEARCH_ENDPOINT: resources[:opensearch_domain].endpoint,
-              DASHBOARDS: JSON.generate(attrs.dashboards)
-            }
-          },
-          
-          code: {
-            zip_file: generate_dashboard_config_code()
-          },
-          
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        # Invoke Lambda to configure dashboards
-        aws_lambda_invocation(:"#{dashboard_config_lambda}_invoke", {
-          function_name: resources[:lambda_functions][:dashboard_config].function_name,
-          input: JSON.generate({ action: "configure_dashboards" })
-        })
-      end
-      
-      def generate_dashboard_config_code
-        <<~PYTHON
-          import json
-          import os
-          from opensearchpy import OpenSearch
-          
-          def lambda_handler(event, context):
-              es = OpenSearch(
-                  hosts=[{'host': os.environ['OPENSEARCH_ENDPOINT'], 'port': 443}],
-                  http_auth=get_auth(),
-                  use_ssl=True,
-                  verify_certs=True
-              )
-              
-              dashboards = json.loads(os.environ['DASHBOARDS'])
-              
-              for dashboard in dashboards:
-                  create_dashboard(es, dashboard)
-              
-              return {
-                  'statusCode': 200,
-                  'body': json.dumps({
-                      'dashboards_created': len(dashboards)
-                  })
-              }
-          
-          def create_dashboard(es, dashboard):
-              dashboard_type = dashboard['type']
-              
-              if dashboard_type == 'security_overview':
-                  create_security_overview_dashboard(es, dashboard)
-              elif dashboard_type == 'threat_hunting':
-                  create_threat_hunting_dashboard(es, dashboard)
-              elif dashboard_type == 'compliance':
-                  create_compliance_dashboard(es, dashboard)
-              elif dashboard_type == 'incident_response':
-                  create_incident_response_dashboard(es, dashboard)
-          
-          def create_security_overview_dashboard(es, config):
-              # Create security overview visualizations and dashboard
-              visualizations = [
-                  create_events_timeline(es),
-                  create_severity_distribution(es),
-                  create_top_threats(es),
-                  create_geographic_map(es)
-              ]
-              
-              # Create dashboard with visualizations
-              dashboard_body = {
-                  'title': config['name'],
-                  'panels': format_panels(visualizations),
-                  'refresh_interval': config.get('refresh_interval', 300)
-              }
-              
-              # Save dashboard
-              es.index(
-                  index='.kibana',
-                  doc_type='dashboard',
-                  id=f"dashboard-{config['name'].replace(' ', '-').lower()}",
-                  body=dashboard_body
-              )
-          
-          def create_threat_hunting_dashboard(es, config):
-              # Implement threat hunting dashboard
-              pass
-          
-          def create_compliance_dashboard(es, config):
-              # Implement compliance dashboard
-              pass
-          
-          def create_incident_response_dashboard(es, config):
-              # Implement incident response dashboard
-              pass
-          
-          def create_events_timeline(es):
-              # Create timeline visualization
-              return {
-                  'title': 'Security Events Timeline',
-                  'type': 'line',
-                  'query': {
-                      'match_all': {}
-                  }
-              }
-          
-          def create_severity_distribution(es):
-              # Create severity distribution visualization
-              return {
-                  'title': 'Severity Distribution',
-                  'type': 'pie',
-                  'query': {
-                      'terms': {
-                          'field': 'severity.keyword'
-                      }
-                  }
-              }
-          
-          def create_top_threats(es):
-              # Create top threats visualization
-              return {
-                  'title': 'Top Threats',
-                  'type': 'horizontal_bar',
-                  'query': {
-                      'terms': {
-                          'field': 'threat_name.keyword',
-                          'size': 10
-                      }
-                  }
-              }
-          
-          def create_geographic_map(es):
-              # Create geographic threat map
-              return {
-                  'title': 'Threat Geographic Distribution',
-                  'type': 'map',
-                  'query': {
-                      'exists': {
-                          'field': 'source_geo.location'
-                      }
-                  }
-              }
-          
-          def format_panels(visualizations):
-              # Format visualizations as dashboard panels
-              panels = []
-              for i, viz in enumerate(visualizations):
-                  panels.append({
-                      'visualization': viz,
-                      'gridData': {
-                          'x': (i % 2) * 24,
-                          'y': (i // 2) * 12,
-                          'w': 24,
-                          'h': 12
-                      }
-                  })
-              return panels
-          
-          def get_auth():
-              # Implement authentication
-              return None
-        PYTHON
-      end
-      
-      def create_integration(name, integration, attrs, resources)
-        # Create integration based on type
-        case integration[:type]
-        when 'soar'
-          create_soar_integration(name, integration, attrs, resources)
-        when 'threat_intel'
-          create_threat_intel_integration(name, integration, attrs, resources)
-        when 'notification'
-          create_notification_integration(name, integration, attrs, resources)
-        end
-      end
-      
-      def create_soar_integration(name, integration, attrs, resources)
-        # Create Lambda for SOAR integration
-        lambda_name = component_resource_name(name, :soar_integration, integration[:name])
-        
-        resources[:lambda_functions][:"soar_#{integration[:name]}"] = aws_lambda_function(lambda_name, {
-          function_name: "siem-soar-#{name}-#{integration[:name]}",
-          runtime: "python3.11",
-          handler: "index.lambda_handler",
-          role: create_lambda_execution_role(name, "soar-#{integration[:name]}", attrs, resources),
-          timeout: 300,
-          
-          environment: {
-            variables: {
-              SOAR_ENDPOINT: integration[:endpoint] || "",
-              SOAR_API_KEY_SECRET: integration[:api_key_secret_arn] || ""
-            }
-          },
-          
-          code: {
-            zip_file: <<~PYTHON
-              import json
-              import boto3
-              import os
-              import requests
-              
-              def lambda_handler(event, context):
-                  # Send incident to SOAR platform
-                  incident = event.get('incident', {})
-                  
-                  soar_payload = {
-                      'name': incident.get('name'),
-                      'severity': incident.get('severity'),
-                      'description': incident.get('description'),
-                      'artifacts': incident.get('indicators', []),
-                      'actions': incident.get('recommended_actions', [])
-                  }
-                  
-                  # Send to SOAR
-                  response = send_to_soar(soar_payload)
-                  
-                  return {
-                      'statusCode': 200,
-                      'body': json.dumps(response)
-                  }
-              
-              def send_to_soar(payload):
-                  endpoint = os.environ.get('SOAR_ENDPOINT')
-                  api_key = get_api_key()
-                  
-                  if endpoint and api_key:
-                      try:
-                          response = requests.post(
-                              f"{endpoint}/api/incidents",
-                              json=payload,
-                              headers={'Authorization': f'Bearer {api_key}'},
-                              timeout=30
-                          )
-                          return response.json()
-                      except Exception as e:
-                          return {'error': str(e)}
-                  
-                  return {'error': 'Missing configuration'}
-              
-              def get_api_key():
-                  secret_arn = os.environ.get('SOAR_API_KEY_SECRET')
-                  if secret_arn:
-                      client = boto3.client('secretsmanager')
-                      response = client.get_secret_value(SecretId=secret_arn)
-                      return json.loads(response['SecretString']).get('api_key')
-                  return None
-            PYTHON
-          },
-          
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-      end
-      
-      def create_threat_intel_integration(name, integration, attrs, resources)
-        # Already handled in create_threat_detection
-      end
-      
-      def create_notification_integration(name, integration, attrs, resources)
-        # Create SNS topic for notifications if not exists
-        topic_name = component_resource_name(name, :notification, integration[:name])
-        resources[:sns_topics][integration[:name].to_sym] = aws_sns_topic(topic_name, {
-          name: "siem-notify-#{name}-#{integration[:name]}",
-          kms_master_key_id: resources[:kms_keys][:main].id,
-          tags: component_tags('siem_security_platform', name, attrs.tags)
-        })
-        
-        # Subscribe endpoint if provided
-        if integration[:endpoint]
-          aws_sns_topic_subscription(:"#{topic_name}_subscription", {
-            topic_arn: resources[:sns_topics][integration[:name].to_sym].arn,
-            protocol: integration[:endpoint].start_with?('http') ? 'https' : 'email',
-            endpoint: integration[:endpoint]
-          })
-        end
-      end
-      
-      def calculate_siem_security_score(attrs)
-        score = 100
-        
-        # Deduct points for missing features
-        score -= 5 unless attrs.threat_detection[:enable_ml_detection]
-        score -= 5 unless attrs.threat_detection[:enable_behavior_analytics]
-        score -= 5 unless attrs.incident_response[:enable_automated_response]
-        score -= 5 unless attrs.compliance_config[:enable_compliance_reporting]
-        score -= 5 unless attrs.security_config[:enable_encryption_at_rest]
-        score -= 5 unless attrs.security_config[:enable_fine_grained_access]
-        score -= 10 unless attrs.threat_detection[:threat_intel_feeds].any?
-        
-        # Add points for advanced features
-        score += 5 if attrs.analytics_config[:enable_ueba]
-        score += 5 if attrs.incident_response[:enable_forensics_collection]
-        score += 5 if attrs.scaling_config[:enable_auto_scaling]
-        
-        [score, 100].min
-      end
-      
-      def generate_siem_compliance_status(attrs)
-        status = {}
-        
-        attrs.compliance_config[:frameworks].each do |framework|
-          status[framework] = {
-            compliant: true,
-            last_assessment: Time.now.iso8601,
-            evidence_collected: attrs.compliance_config[:evidence_collection],
-            report_available: attrs.compliance_config[:enable_compliance_reporting],
-            next_report: calculate_next_report_date(attrs.compliance_config[:report_schedule])
-          }
-        end
-        
-        status
-      end
-      
-      def calculate_next_report_date(schedule)
-        case schedule
-        when 'daily'
-          (Time.now + 86400).iso8601
-        when 'weekly'
-          (Time.now + 604800).iso8601
-        when 'monthly'
-          (Time.now + 2592000).iso8601
-        else
-          nil
-        end
-      end
-      
-      def aws_region
-        'us-east-1'
-      end
-      
-      def aws_account_id
-        '123456789012'
-      end
-      
-      include Base
-    end
-  end
-end