VulnerabilityController.java

/*******************************************************************************
 * Copyright 2018 T Mobile, Inc. or its affiliates. All Rights Reserved.
 * 
 * Licensed under the Apache License, Version 2.0 (the "License"); you may not
 * use this file except in compliance with the License.  You may obtain a copy
 * of the License at
 * 
 *   http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
 * License for the specific language governing permissions and limitations under
 * the License.
 ******************************************************************************/
/*
 * 
 */
package com.tmobile.pacman.api.vulnerability.controller;

import java.time.Instant;
import java.time.LocalDate;
import java.time.ZoneId;
import java.time.ZonedDateTime;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Calendar;
import java.util.Date;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Optional;
import java.util.Set;
import java.util.TimeZone;
import java.util.stream.Collectors;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.cache.annotation.CacheConfig;
import org.springframework.cache.annotation.Cacheable;
import org.springframework.format.annotation.DateTimeFormat;
import org.springframework.http.ResponseEntity;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

import com.fasterxml.jackson.core.JsonProcessingException;
import com.google.common.base.Strings;
import com.tmobile.pacman.api.commons.Constants;
import com.tmobile.pacman.api.commons.exception.DataException;
import com.tmobile.pacman.api.commons.exception.ServiceException;
import com.tmobile.pacman.api.commons.utils.ResponseUtils;
import com.tmobile.pacman.api.vulnerability.domain.CompliantTrendRequest;
import com.tmobile.pacman.api.vulnerability.domain.DitributionDTO;
import com.tmobile.pacman.api.vulnerability.domain.OutputDTO;
import com.tmobile.pacman.api.vulnerability.domain.Request;
import com.tmobile.pacman.api.vulnerability.domain.ResponseData;
import com.tmobile.pacman.api.vulnerability.domain.ResponseWithCount;
import com.tmobile.pacman.api.vulnerability.domain.TrendNote;
import com.tmobile.pacman.api.vulnerability.domain.TrendRequest;
import com.tmobile.pacman.api.vulnerability.domain.VulnerabilityRequest;
import com.tmobile.pacman.api.vulnerability.service.VulnerabilityService;

import io.swagger.annotations.ApiOperation;

/**
 * The Class VulnerabilityController.
 */
/**
 * @author U95007
 *
 */

@RestController
@PreAuthorize("@securityService.hasPermission(authentication, 'ROLE_USER')")
@CacheConfig(cacheNames = { "trends", "trendsvuln" })
@ConditionalOnProperty(name = "features.vulnerability.enabled")
public class VulnerabilityController implements Constants {

	/** The Constant LOGGER. */
	private static final Logger LOGGER = LoggerFactory.getLogger(VulnerabilityController.class);

	/** The vulnerability service. */
	@Autowired
	private VulnerabilityService vulnerabilityService;

	/**
	 * Gets the vulnerabilities details.
	 *
	 * @param request
	 *            the request
	 * @return ResponseEntity<Object>
	 */

	@SuppressWarnings("unchecked")
	@PostMapping(value = "/v1/vulnerabilities/detail")
	public ResponseEntity<Object> getVulnerabilitiesDetails(@RequestBody(required = true) Request request) {

		ResponseWithCount response;
		String assetGroup = request.getAg();
		if (Strings.isNullOrEmpty(assetGroup)) {
			return ResponseUtils.buildFailureResponse(new Exception(ASSET_MANDATORY));
		}

		int from = request.getFrom();
		int size = request.getSize();
		if (from < 0) {
			return ResponseUtils.buildFailureResponse(new Exception("From should not be a negative number"));

		}

		String searchText = request.getSearchtext();

		Map<String, String> filter = request.getFilter();
		if (filter == null) {
			filter = new HashMap<>();
		}

		try {

			List<Map<String, Object>> masterDetailList = vulnerabilityService.getVulnerabilitiesDetails(assetGroup,
					filter);

			masterDetailList = (List<Map<String, Object>>) vulnerabilityService
					.filterMatchingCollectionElements(masterDetailList, searchText, true);
			if (masterDetailList.isEmpty()) {
				return ResponseUtils
						.buildSucessResponse(new ResponseWithCount(new ArrayList<Map<String, Object>>(), 0));
			}

			if (from >= masterDetailList.size()) {
				return ResponseUtils.buildFailureResponse(new Exception("From exceeds the size of list"));
			}

			int endIndex = 0;

			if ((from + size) > masterDetailList.size()) {
				endIndex = masterDetailList.size();
			} else {
				endIndex = from + size;
			}

			if (endIndex == 0) {
				endIndex = masterDetailList.size();
			}

			// from - inclusive, endIndex - exclusive
			List<Map<String, Object>> subDetailList = masterDetailList.subList(from, endIndex);

			response = new ResponseWithCount(subDetailList, masterDetailList.size());

		} catch (Exception e) {
			LOGGER.error(EXE_VULN, e);
			return ResponseUtils.buildFailureResponse(e);
		}
		return ResponseUtils.buildSucessResponse(response);
	}


	

	/**
	 * Gets the vulnerabilities details by application.
	 *
	 * @param request
	 *            the request
	 * @return ResponseEntity<Object>
	 */

	@ApiOperation(httpMethod = "POST", value = "Get the cartesian product of vulnerability occureneces of asset and details of assets in an asset group. Filter can receive 'severitylevel' as comma seperated."
			+ "'searchtext' can be used to get  the sorted result based on the search text provided.Sample request: {\"ag\":\"pacman\",\"filter\":{\"severitylevel\":\"3,5\"},\"from\":0,\"searchtext\":\"\",\"size\":25}")
	@PostMapping(value = "/v1/vulnerabilities/occurrences")
	public ResponseEntity<Object> getVulnerabilitiesOccurrences(@RequestBody(required = true) Request request) {

		ResponseWithCount response = null;
		String assetGroup = request.getAg();
		if (Strings.isNullOrEmpty(assetGroup)) {
			return ResponseUtils.buildFailureResponse(new Exception(ASSET_MANDATORY));
		}
		String searchText = request.getSearchtext();
		int from = request.getFrom();
		int size = request.getSize();
		List<String> severitiesList = new ArrayList<>();
		List<String> severities = new ArrayList<>();
		boolean allMatch = false;
		severitiesList.add("3");
		severitiesList.add("4");
		severitiesList.add("5");

		if (from < 0) {
			return ResponseUtils.buildFailureResponse(new Exception("From should not be a negative number"));
		}
		Map<String, String> filter = request.getFilter();
		Map<String, String> severityfilter = new HashMap<>();
		String applicationFilter = null;
		String environmentFilter = null;
		for (Map.Entry<String, String> entry : filter.entrySet()) {
			if (entry.getKey().equals("severitylevel")) {
				severityfilter.put(entry.getKey(), entry.getValue());
			} else if (entry.getKey().equals("tags.Application.keyword")) {
				applicationFilter = entry.getValue();
			} else if (entry.getKey().equals("tags.Environment.keyword")) {
				environmentFilter = entry.getValue();
			}
		}

		if (severityfilter.size() > 0) {

			for (Map.Entry<String, String> entry : severityfilter.entrySet()) {
				severities = Arrays.asList(entry.getValue().split(","));
			}
			allMatch = severities.stream().allMatch(severitiesList::contains);
			if (allMatch != true) {
				return ResponseUtils.buildFailureResponse(new Exception("Severity level can only be 3,4 or 5"));
			}

		}
		if (!(Optional.ofNullable(size).isPresent()) && size != 0) {
			from = 0;
			size = 0;
		}

		try {
			int vulnerabilityOccuranceListCount = vulnerabilityService.vulnerabilityAssetCount(assetGroup,
					severityfilter, applicationFilter, environmentFilter, from, size);
			List<Map<String, Object>> vulnerabilityOccuranceList = vulnerabilityService
					.getAllVulnerabilitiesDetailsByAssetGroup(assetGroup, severityfilter,applicationFilter, environmentFilter, searchText, from, size);

			if (vulnerabilityOccuranceList.isEmpty()) {
				return ResponseUtils
						.buildSucessResponse(new ResponseWithCount(new ArrayList<Map<String, Object>>(), 0));
			}

			response = new ResponseWithCount(vulnerabilityOccuranceList, vulnerabilityOccuranceListCount);

		} catch (Exception e) {
			LOGGER.error(EXE_VULN, e);
			return ResponseUtils.buildFailureResponse(e);
		}

		return ResponseUtils.buildSucessResponse(response);
	}

	/**
	 * Gets the vulnerability summary.
	 *
	 * @param assetGroup
	 *            the asset group
	 * @param severity
	 *            the severity
	 * @return ResponseEntity<Object>
	 */

	@RequestMapping(path = "/v1/vulnerabilities/summary", method = RequestMethod.GET)
	public ResponseEntity<Object> getVulnerabilitysummary(@RequestParam(name = "ag", required = true) String assetGroup,
			@RequestParam(name = "severity", required = false) String severity) {

		if (Strings.isNullOrEmpty(assetGroup)) {
			return ResponseUtils.buildFailureResponse(new Exception(ASSET_MANDATORY));
		}
		if (Strings.isNullOrEmpty(severity)) {
			severity = SEVERITY_LEVELS;
		}
		DitributionDTO response;
		try {
			response = new DitributionDTO(vulnerabilityService.getVulnerabilitySummary(assetGroup, severity));
		} catch (Exception e) {
			LOGGER.error("Exception in getVulnerabilitysummary ", e);
			return ResponseUtils.buildFailureResponse(e);
		}
		return ResponseUtils.buildSucessResponse(response);
	}

	/**
	 * Gets the vulnerability by applications.
	 *
	 * @param assetGroup
	 *            the asset group
	 * @return ResponseEntity<Object>
	 */

	@RequestMapping(path = "/v1/vulnerabilities/summarybyapplication", method = RequestMethod.GET)
	public ResponseEntity<Object> getVulnerabilityByApplications(@RequestParam("ag") String assetGroup) {

		if (Strings.isNullOrEmpty(assetGroup)) {
			return ResponseUtils.buildFailureResponse(new Exception(ASSET_MANDATORY));
		}
		ResponseData response;
		try {
			response = new ResponseData(
					vulnerabilityService.getVulnerabilityByAppAndEnv(assetGroup, "tags.Application.keyword", ""));
		} catch (Exception e) {
			LOGGER.error("Exception in vulnerabilitybyapplications ", e);
			return ResponseUtils.buildFailureResponse(e);
		}
		return ResponseUtils.buildSucessResponse(response);
	}

	/**
	 * Gets the vulnerabilities trend.
	 *
	 * @param request
	 *            the request
	 * @return ResponseEntity<Object>
	 */

	@PostMapping(value = "/v1/vulnerabilities/trend")
	public ResponseEntity<Object> getVulnerabilitiesTrend(@RequestBody(required = true) TrendRequest request) {

		Map<String, Object> response = new HashMap<>();
		String assetGroup = request.getAg();
		if (Strings.isNullOrEmpty(assetGroup)) {
			return ResponseUtils.buildFailureResponse(new Exception(ASSET_MANDATORY));
		}
		Date from = request.getFrom();
		Date to = request.getTo();
		Map<String, String> filter = request.getFilter();
		try {
			if (from == null && to == null) {
				Calendar cal = Calendar.getInstance();
				cal.setTimeZone(TimeZone.getTimeZone("UTC"));
				to = cal.getTime();
				cal.add(Calendar.DATE, NEG_THIRTY);
				from = cal.getTime();
			}
			response.put("ag", assetGroup);
			List<Map<String, Object>> trendList = vulnerabilityService.getVulnerabilityTrend(assetGroup, filter, from,
					to);
			response.put("trend", trendList);
		} catch (Exception e) {
			LOGGER.error(EXE_VULN, e);
			return ResponseUtils.buildFailureResponse(e);
		}
		return ResponseUtils.buildSucessResponse(response);
	}

	/**
	 * Gets the vulnerability by environment.
	 *
	 * @param assetGroup
	 *            the asset group
	 * @param application
	 *            the application
	 * @return ResponseEntity<Object>
	 */

	@RequestMapping(path = "/v1/vulnerabilities/summarybyenvironment", method = RequestMethod.GET)
	public ResponseEntity<Object> getVulnerabilityByEnvironment(@RequestParam("ag") String assetGroup,
			@RequestParam(name = "application", required = false) String application) {

		if (Strings.isNullOrEmpty(assetGroup)) {
			return ResponseUtils.buildFailureResponse(new Exception(ASSET_MANDATORY));
		}
		ResponseData response;
		try {
			response = new ResponseData(vulnerabilityService.getVulnerabilityByAppAndEnv(assetGroup,
					"tags.Environment.keyword", application));
		} catch (Exception e) {
			LOGGER.error("Exception in vulnerabilitybyenvironment ", e);
			return ResponseUtils.buildFailureResponse(e);
		}
		return ResponseUtils.buildSucessResponse(response);
	}

	/**
	 * Gets the vulnerability distribution.
	 *
	 * @param assetGroup
	 *            the asset group
	 * @return ResponseEntity<Object>
	 */
	@RequestMapping(path = "/v1/vulnerabilities/distribution", method = RequestMethod.GET)
	public ResponseEntity<Object> getVulnerabilityDistribution(@RequestParam("ag") String assetGroup) {

		if (Strings.isNullOrEmpty(assetGroup)) {
			return ResponseUtils.buildFailureResponse(new Exception(ASSET_MANDATORY));
		}
		ResponseData response;
		try {
			response = new ResponseData(vulnerabilityService.getVulnerabilitiesDistribution(assetGroup));
		} catch (Exception e) {
			LOGGER.error("Exception in getVulnerabilityDistribution ", e);
			return ResponseUtils.buildFailureResponse(e);
		}
		return ResponseUtils.buildSucessResponse(response);
	}

	/**
	 * Gets the vulnerabilitysummary by resource id.
	 *
	 * @param resourceId
	 *            the resource id
	 * @return ResponseEntity<Object>
	 */
	@RequestMapping(path = "/v1/vulnerabilities/summary/{resourceId}", method = RequestMethod.GET)
	public ResponseEntity<Object> getVulnerabilitysummaryByResourceId(
			@PathVariable(name = "resourceId", required = true) String resourceId) {

		DitributionDTO response;
		try {
			response = new DitributionDTO(vulnerabilityService.getVulnerabilitysummaryByResourceId(resourceId));
		} catch (Exception e) {
			LOGGER.error("Exception in getVulnerabilitysummary ", e);
			return ResponseUtils.buildFailureResponse(e);
		}
		return ResponseUtils.buildSucessResponse(response);
	}

	/**
	 * Gets the vulnerability details by resource id.
	 *
	 * @param resourceId
	 *            the resource id
	 * @param searchtext
	 *            the searchtext
	 * @param from
	 *            the from
	 * @param size
	 *            the size
	 * @return ResponseEntity<Object>
	 */
	@SuppressWarnings("unchecked")
	@RequestMapping(path = "/v1/vulnerabilities/detail/{resourceId}", method = RequestMethod.GET)
	public ResponseEntity<Object> getVulnerabilityDetailsByResourceId(
			@PathVariable(name = "resourceId", required = true) String resourceId,
			@RequestParam(name = "searchtext", required = false) String searchtext,
			@RequestParam(name = "from", required = false) Integer from,
			@RequestParam(name = "size", required = false) Integer size) {

		Integer iFrom = from == null ? 0 : from;
		Integer iSize = size == null ? 0 : size;

		ResponseWithCount response;
		try {
			List<Map<String, Object>> masterDetailList = vulnerabilityService
					.getVulnerabilityDetailsByResourceId(resourceId);
			masterDetailList = (List<Map<String, Object>>) vulnerabilityService
					.filterMatchingCollectionElements(masterDetailList, searchtext, true);
			if (masterDetailList.isEmpty()) {
				return ResponseUtils
						.buildSucessResponse(new ResponseWithCount(new ArrayList<Map<String, Object>>(), 0));
			}

			if (iFrom >= masterDetailList.size()) {
				return ResponseUtils.buildFailureResponse(new Exception("From exceeds the size of list"));
			}

			int endIndex = 0;

			if (iSize == 0) {
				iSize = masterDetailList.size();
			}

			if ((iFrom + iSize) > masterDetailList.size()) {
				endIndex = masterDetailList.size();
			} else {
				endIndex = iFrom + iSize;
			}

			List<Map<String, Object>> subDetailList = masterDetailList.subList(iFrom, endIndex);

			response = new ResponseWithCount(subDetailList, masterDetailList.size());

		} catch (Exception e) {
			LOGGER.error(EXE_VULN, e);
			return ResponseUtils.buildFailureResponse(e);
		}
		return ResponseUtils.buildSucessResponse(response);
	}

	/**
	 * Gets the aging summary.
	 *
	 * @param assetGroup
	 *            the asset group
	 * @return ResponseEntity<Object>
	 */
	@RequestMapping(path = "/v1/vulnerabilities/aging/summary", method = RequestMethod.GET)
	public ResponseEntity<Object> getAgingSummary(@RequestParam("ag") String assetGroup) {
		return ResponseUtils.buildSucessResponse(vulnerabilityService.getAgingSummary(assetGroup));
	}

	/**
	 * Gets the vulnerability by qid.
	 *
	 * @param qid
	 *            the qid
	 * @return ResponseEntity<Object>
	 */
	@RequestMapping(path = "/v1/vulnerabilities/qids", method = RequestMethod.GET)
	public ResponseEntity<Object> getVulnerabilityByQid(@RequestParam("qid") String qid) {
		return ResponseUtils.buildSucessResponse(vulnerabilityService.getVulnerabilityByQid(qid));
	}

	/**
	 * Gets the distribution summary by vuln type.
	 *
	 * @param assetGroup
	 *            the asset group
	 * @param severity
	 *            the severity
	 * @return the distribution summary by vuln type
	 */
	@RequestMapping(path = "/v1/vulnerabilities/distribution-vulntype", method = RequestMethod.GET)
	public ResponseEntity<Object> getDistributionSummaryByVulnType(@RequestParam("ag") String assetGroup,
			@RequestParam(name = "severity", required = false) String severity) {

		Map<String, Object> response = new HashMap<>();

		List<Map<String, Object>> distributionList = new ArrayList<>();
		try {
			distributionList = vulnerabilityService.getDistributionSummaryByVulnType(assetGroup, severity);
		} catch (DataException e) {
			LOGGER.error("Error in getDistributionSummaryByVulnType", e);
			return ResponseUtils.buildFailureResponse(e);
		}

		response.put(DISTRIBUTION, distributionList);
		return ResponseUtils.buildSucessResponse(response);

	}

	/**
	 * Gets the distribution summary by infra type.
	 *
	 * @param assetGroup
	 *            the asset group
	 * @param severity
	 *            the severity
	 * @return the distribution summary by infra type
	 */
	@RequestMapping(path = "/v1/vulnerabilities/distribution-infra", method = RequestMethod.GET)
	public ResponseEntity<Object> getDistributionSummaryByInfraType(@RequestParam("ag") String assetGroup,
			@RequestParam(name = "severity", required = false) String severity) {
		Map<String, Object> response = new HashMap<>();

		List<Map<String, Object>> distributionList = new ArrayList<>();
		try {
			distributionList = vulnerabilityService.getDistributionSummaryByInfraType(assetGroup, severity);
		} catch (ServiceException e) {
			LOGGER.error("Error in getDistributionSummaryByInfraType", e);
			return ResponseUtils.buildFailureResponse(e);
		}
		response.put(DISTRIBUTION, distributionList);
		return ResponseUtils.buildSucessResponse(response);
	}

	/**
	 * Gets the distribution summary by env.
	 *
	 * @param assetGroup
	 *            the asset group
	 * @param severity
	 *            the severity
	 * @return the distribution summary by env
	 */
	@RequestMapping(path = "/v1/vulnerabilities/distribution-env", method = RequestMethod.GET)
	public ResponseEntity<Object> getDistributionSummaryByEnv(@RequestParam("ag") String assetGroup,
			@RequestParam(name = "severity", required = false) String severity) {
		Map<String, Object> response = new HashMap<>();

		List<Map<String, Object>> distributionList = new ArrayList<>();
		try {
			distributionList = vulnerabilityService.getDistributionSummaryByEnv(assetGroup, severity);
		} catch (ServiceException e) {
			LOGGER.error("Error in getDistributionSummaryByEnv", e);
			return ResponseUtils.buildFailureResponse(e);
		}
		response.put(DISTRIBUTION, distributionList);
		return ResponseUtils.buildSucessResponse(response);
	}

	/**
	 * Gets the remediation actions summary.
	 *
	 * @param assetGroup
	 *            the asset group
	 * @param severity
	 *            the severity
	 * @return the remediation actions summary
	 */
	@RequestMapping(path = "/v1/vulnerabilities/remediations/summary", method = RequestMethod.GET)
	public ResponseEntity<Object> getRemediationActionsSummary(@RequestParam("ag") String assetGroup,
			@RequestParam(name = "severity", required = false) String severity) {
		Map<String, Object> response = new HashMap<>();

		List<Map<String, Object>> remediationList = new ArrayList<>();
		try {
			remediationList = vulnerabilityService.getRemediationActionsSummary(assetGroup, severity);
		} catch (DataException e) {
			LOGGER.error("Error in getRemediationActionsSummary", e);
			return ResponseUtils.buildFailureResponse(e);
		}

		response.put("actions", remediationList);
		return ResponseUtils.buildSucessResponse(response);
	}

	/**
	 * Gets the highest lowest performers.
	 *
	 * @param assetGroup
	 *            the asset group
	 * @param severity
	 *            the severity
	 * @return the highest lowest performers
	 */
	@RequestMapping(path = "/v1/vulnerabilities/performers", method = RequestMethod.GET)
	public ResponseEntity<Object> getHighestLowestPerformers(@RequestParam("ag") String assetGroup,
			@RequestParam(name = "severity", required = false) String severity) {
		Map<String, Object> response = new HashMap<>();

		List<Map<String, Object>> responseList = new ArrayList<>();
		Map<String, Integer> directorData = vulnerabilityService.getHighestLowestPerformers(assetGroup, severity,
				"org");
		Set<String> keys = directorData.keySet();
		String[] keysArray = keys.toArray(new String[keys.size()]);

		if (keysArray.length >= 10) {

			Map<String, Object> info = new HashMap<>();
			info.put(CATEGORY, HIGHEST);
			List<Map<String, Integer>> directorList = new ArrayList<>();

			for (int i = 0; i < keysArray.length && i < Constants.FIVE; i++) {
				Map<String, Integer> director = new HashMap<>();
				director.put(keysArray[i], directorData.get(keysArray[i]));
				directorList.add(director);
			}
			info.put(DIRECTORS, directorList);
			responseList.add(info);

			info = new HashMap<>();
			info.put(CATEGORY, "Lowest");
			directorList = new ArrayList<>();

			for (int i = keysArray.length - Constants.ONE; i > keysArray.length - Constants.SIX && i >= 0; i--) {
				Map<String, Integer> director = new HashMap<>();
				director.put(keysArray[i], directorData.get(keysArray[i]));
				directorList.add(director);
			}
			info.put(DIRECTORS, directorList);
			responseList.add(info);
		} else {

			if (keysArray.length % 2 == 0) {
				Map<String, Object> info = new HashMap<>();
				info.put(CATEGORY, HIGHEST);
				List<Map<String, Integer>> directorList = new ArrayList<>();

				for (int i = 0; i < keysArray.length / 2; i++) {
					Map<String, Integer> director = new HashMap<>();
					director.put(keysArray[i], directorData.get(keysArray[i]));
					directorList.add(director);
				}
				info.put(DIRECTORS, directorList);
				responseList.add(info);

			} else {

				Map<String, Object> info = new HashMap<>();
				info.put(CATEGORY, HIGHEST);
				List<Map<String, Integer>> directorList = new ArrayList<>();

				for (int i = 0; i < (keysArray.length / 2) + 1; i++) {
					Map<String, Integer> director = new HashMap<>();
					director.put(keysArray[i], directorData.get(keysArray[i]));
					directorList.add(director);
				}
				info.put(DIRECTORS, directorList);
				responseList.add(info);
			}

			Map<String, Object> info = new HashMap<>();
			info.put(CATEGORY, "Lowest");
			List<Map<String, Integer>> directorList = new ArrayList<>();

			for (int i = keysArray.length - Constants.ONE; i > keysArray.length / 2 && i >= 0; i--) {
				Map<String, Integer> director = new HashMap<>();
				director.put(keysArray[i], directorData.get(keysArray[i]));
				directorList.add(director);
			}
			info.put(DIRECTORS, directorList);
			responseList.add(info);
		}
		response.put("response", responseList);
		return ResponseUtils.buildSucessResponse(response);
	}

	/**
	 * Gets the highest lowest performers.
	 *
	 * @param assetGroup
	 *            the asset group
	 * @param severity
	 *            the severity
	 * @param type
	 *            the type
	 * @return the highest lowest performers
	 */
	@RequestMapping(path = "/v2/vulnerabilities/performers", method = RequestMethod.GET)
	public ResponseEntity<Object> getHighestLowestPerformers(@RequestParam("ag") String assetGroup,
			@RequestParam(name = "severity", required = false) String severity,
			@RequestParam(name = "type") PerfType type) {
		Map<String, Object> response = new HashMap<>();

		Map<String, Integer> perfData = vulnerabilityService.getHighestLowestPerformers(assetGroup, severity,
				type.name());
		List<Map<String, Integer>> perfList = new ArrayList<>();
		Map<String, Object> info = new HashMap<>();
		String typeName = type.name();
		switch (typeName) {
		case "org":
			info.put(CATEGORY, "Director");
			break;
		case "application":
			info.put(CATEGORY, "Application");
			break;
		case "environment":
			info.put(CATEGORY, "Environment");
			break;
		}

		if (perfData.size() > 1) {
			Set<String> keys = perfData.keySet();
			String[] keysArray = keys.toArray(new String[keys.size()]);

			for (int i = 0; i < keysArray.length; i++) {
				Map<String, Integer> director = new HashMap<>();
				director.put(keysArray[i], perfData.get(keysArray[i]));
				perfList.add(director);
			}
		}
		info.put("data", perfList);

		response.put("response", info);
		return ResponseUtils.buildSucessResponse(response);
	}

	/**
	 * Gets the vulnerability trend.
	 *
	 * @param header
	 *            the header
	 * @param request
	 *            the request
	 * @return the vulnerability trend
	 */
	@Cacheable(cacheNames = "trends", key = "#request.vulnCacheKey", unless = "#result.statusCodeValue!=200")
	@RequestMapping(path = "/v1/vulnerabilities/trend/open-new", method = RequestMethod.POST)
	public ResponseEntity<Object> getVulnerabilityTrend(@RequestBody(required = true) TrendRequest request) {

		String ag = request.getAg();
		if (Strings.isNullOrEmpty(ag)) {
			return ResponseUtils.buildFailureResponse(new Exception(ASSET_MANDATORY));
		}
		Date from = request.getFrom();
		if (from == null) {
			Calendar cal = Calendar.getInstance();
			cal.setTimeZone(TimeZone.getTimeZone("UTC"));
			cal.add(Calendar.DATE, NEG_THIRTY);
			from = cal.getTime();
		}

		Map<String, String> filter = request.getFilter();
		String severity = SEVERITY_LEVELS;
		if (filter != null) {
			severity = filter.get("severity");
			if (severity == null) {
				severity = SEVERITY_LEVELS;
			}
		}

		Map<String, Object> response = new HashMap<>();
		try {
			List<Map<String, Object>> trendList = vulnerabilityService.getVulnerabilityNewOpenTrend(ag, severity, from);
			response.put("trend", trendList);
			return ResponseUtils.buildSucessResponse(response);
		} catch (Exception e) {
			return ResponseUtils.buildFailureResponse(e);
		}

	}

	/**
	 * Creates the trend annotation.
	 *
	 * @param request
	 *            the request
	 * @return the response entity
	 */
	@RequestMapping(path = "/v1/vulnerabilities/trend/notes", method = RequestMethod.POST)
	public ResponseEntity<Object> createTrendAnnotation(@RequestBody(required = true) TrendNote request) {

		try {
			if (vulnerabilityService.createTrendAnnotation(request)) {
				return ResponseUtils.buildSucessResponse("Annotation created");
			} else {
				return ResponseUtils.buildFailureResponse(new Exception("Annotation creation failed"));
			}
		} catch (JsonProcessingException e) {
			LOGGER.error("Error in createTrendAnnotation ", e);
			return ResponseUtils.buildFailureResponse(e);
		}
	}

	/**
	 * Gets the trend annotations.
	 *
	 * @param assetGroup
	 *            the asset group
	 * @param from
	 *            the from
	 * @return the trend annotations
	 */
	@RequestMapping(path = "/v1/vulnerabilities/trend/notes", method = RequestMethod.GET)
	public ResponseEntity<Object> getTrendAnnotations(@RequestParam("ag") String assetGroup,
			@RequestParam(name = "from", required = false) @DateTimeFormat(pattern = "yyyy-MM-dd") Date from) {

		if (from == null) {
			Calendar cal = Calendar.getInstance();
			cal.setTimeZone(TimeZone.getTimeZone("UTC"));
			cal.add(Calendar.DATE, NEG_THIRTY);
			from = cal.getTime();
		}
		Map<String, Object> notes = new HashMap<>();
		try {
			notes.put("notes", vulnerabilityService.getTrendAnnotations(assetGroup, from));
		} catch (DataException e) {
			LOGGER.error("Error in getTrendAnnotations ", e);
			return ResponseUtils.buildFailureResponse(e);
		}
		return ResponseUtils.buildSucessResponse(notes);

	}

	/**
	 * Delete trend annotation.
	 *
	 * @param noteId
	 *            the note id
	 * @return the response entity
	 */
	@RequestMapping(path = "/v1/vulnerabilities/trend/notes/{noteId}", method = RequestMethod.DELETE)
	public ResponseEntity<Object> deleteTrendAnnotation(@PathVariable(name = "noteId", required = true) String noteId) {

		if (vulnerabilityService.deleteTrendAnnotation(noteId)) {
			return ResponseUtils.buildSucessResponse("Annotation Deleted");
		} else {
			return ResponseUtils.buildFailureResponse(new Exception("Annotation deletion failed"));
		}
	}

	/**
	 * Gets the vulnerability assets trend.
	 *
	 * @param request
	 *            the request
	 * @return the vulnerability assets trend
	 */
	@Cacheable(cacheNames = "trendsvuln", key = "#request.vulnCacheKey", unless = "#result.statusCodeValue!=200")
	@RequestMapping(path = "/v1/vulnerabilities/trend/total-affected", method = RequestMethod.POST)
	public ResponseEntity<Object> getVulnerabilityAssetsTrend(@RequestBody(required = true) TrendRequest request) {

		String ag = request.getAg();
		if (Strings.isNullOrEmpty(ag)) {
			return ResponseUtils.buildFailureResponse(new Exception(ASSET_MANDATORY));
		}
		Date from = request.getFrom();
		if (from == null) {
			Calendar cal = Calendar.getInstance();
			cal.setTimeZone(TimeZone.getTimeZone("UTC"));
			cal.add(Calendar.DATE, NEG_THIRTY);
			from = cal.getTime();
		}

		Map<String, String> filter = request.getFilter();
		String severity = SEVERITY_LEVELS;
		if (filter != null) {
			severity = filter.get("severity");
			if (severity == null) {
				severity = SEVERITY_LEVELS;
			}
		}

		Map<String, Object> response = new HashMap<>();
		try {
			response.put("trend", vulnerabilityService.getVulnerabilityAssetsTrend(ag, severity, from));
		} catch (DataException e) {
			LOGGER.error("Error in getVulnerabilityAssetsTrend ", e);
			return ResponseUtils.buildFailureResponse(e);
		}

		return ResponseUtils.buildSucessResponse(response);

	}

	/**
	 * Gets the vulnerability summary by assets.
	 *
	 * @param assetGroup
	 *            the asset group
	 * @return the vulnerability summary by assets
	 */
	@RequestMapping(path = "/v1/vulnerabilities/summarybyassets", method = RequestMethod.GET)
	public ResponseEntity<Object> getVulnerabilitySummaryByAssets(
			@RequestParam(name = "ag", required = true) String assetGroup) {
		try {
			return ResponseUtils.buildSucessResponse(vulnerabilityService.getVulnerabilitySummaryByAssets(assetGroup));
		} catch (ServiceException | DataException e) {
			LOGGER.error("Error in getVulnerabilitySummaryByAssets ", e);
			return ResponseUtils.buildFailureResponse(e);
		}
	}

	/**
	 * Gets the vulnerabilities.asssetGroup is mandatory. API returns count of
	 * totalVulnerabilities/totalAssets/totalVulnerabilites Assets
	 *
	 * @param assetGroup
	 *            name of the asset group
	 * @return ResponseEntity
	 */
	// @Cacheable("trends")
	@RequestMapping(path = "/v1/vulnerabilites", method = RequestMethod.GET)
	public ResponseEntity<Object> getVulnerabilities(@RequestParam("ag") String assetGroup) {
		if (Strings.isNullOrEmpty(assetGroup)) {
			return ResponseUtils.buildFailureResponse(new Exception(ASSET_MANDATORY));
		}
		OutputDTO output = null;
		try {
			Map<String, Long> vulnerabilities = new HashMap<>();
			Map<String, Object> vulnSummary = vulnerabilityService.getVulnerabilitySummary(assetGroup, SEVERITY_LEVELS);
			vulnerabilities.put("vulnerabilities", Long.valueOf(vulnSummary.get("vulnerabilities").toString()));
			vulnerabilities.put("hosts", Long.valueOf(vulnSummary.get("hosts").toString()));
			vulnerabilities.put("totalVulnerableAssets",
					Long.valueOf(vulnSummary.get("totalVulnerableAssets").toString()));
			vulnSummary.remove("compliantpercent");
			output = new OutputDTO(vulnerabilities);
		} catch (ServiceException e) {
			return vulnerabilityService.formatException(e);
		}
		return ResponseUtils.buildSucessResponse(output);
	}

	@RequestMapping(path = "/v1/trend/compliance/vulnerabilities", method = RequestMethod.POST)
	public ResponseEntity<Object> getVulnTrend(@RequestBody(required = true) CompliantTrendRequest request) {

		Map<String, Object> response = new HashMap<>();
		String assetGroup = request.getAg();

		Date input = request.getFrom();

		if (input == null) {
			Calendar cal = Calendar.getInstance();
			cal.setTimeZone(TimeZone.getTimeZone("UTC"));
			cal.add(Calendar.DATE, NEG_THIRTY);
			input = cal.getTime();
		}

		Instant instant = input.toInstant();
		ZonedDateTime zdt = instant.atZone(ZoneId.systemDefault());
		LocalDate fromDate = zdt.toLocalDate();
		LocalDate toDate = LocalDate.now();

		if (Strings.isNullOrEmpty(assetGroup)) {
			return ResponseUtils.buildFailureResponse(new Exception(ASSET_MANDATORY));
		}

		try {
			Map<String, Object> ruleTrendProgressList = vulnerabilityService.getTrendProgress(assetGroup, null,
					fromDate, toDate, "vulncompliance");
			response.put(RESPONSE, ruleTrendProgressList);
		} catch (ServiceException e) {
			LOGGER.error("Exception in getVulnTrend", e.getMessage());
			return ResponseUtils.buildFailureResponse(e);
		}
		return ResponseUtils.buildSucessResponse(response);
	}

}

enum PerfType {
	org, application, environment
}