curl --request GET \
     --url "https://www.virustotal.com/api/v3/global_prevalence/summarize?entity_value=787e2c94e6d9ce5ec01f5cbe9ee2518431eca8523155526d6dc85934c9c5787c&entity_type=SHA256" \
     --header "accept: application/json" \
     --header "x-apikey: <YOUR_API_KEY>"

import time
import requests

def get_ioc_global_prevalence(entity_value: str, entity_type: str, api_key: str) -> dict:
    """Queries GTI Global Prevalence summary for an indicator."""
    url = "https://www.virustotal.com/api/v3/global_prevalence/summarize"
    headers = {"x-apikey": api_key, "Accept": "application/json"}
    params = {
        "entity_value": entity_value,
        "entity_type": entity_type  # e.g., "SHA256", "IP", "HOSTNAME"
    }
    response = requests.get(url, headers=headers, params=params)
    response.raise_for_status()
    return response.json().get("data", {}).get("attributes", {})

# Example SOAR Playbook Execution Logic
telemetry = get_ioc_global_prevalence(
    entity_value="203.0.113.55",
    entity_type="IP",
    api_key=SOAR_SECRETS["GTI_API_KEY"]
)

unique_orgs = telemetry.get("customer_count", 0)
raw_sightings = telemetry.get("observation_count", 0)
first_seen_ts = telemetry.get("first_seen_date", 0)
first_industry = telemetry.get("first_seen_industry", "")
last_industry = telemetry.get("last_seen_industry", "")

now = int(time.time())
days_since_first_seen = (now - first_seen_ts) // 86400 if first_seen_ts else 999

# Rule 1: Targeted Vertical Threat (Low org count + peer vertical impact)
if 0 < unique_orgs <= 5 and "FINANCE" in [first_industry, last_industry]:
    alert.add_tag("GTI:Targeted_Vertical_Threat")
    alert.set_severity("CRITICAL")
    alert.increase_risk_score(points=40)
    alert.assign_to("Tier-3 Incident Response")

# Rule 2: High-Volume Shared Infrastructure (Multi-tenant Cloud/CDN IP)
elif unique_orgs > 500 and entity_type == "IP":
    alert.add_tag("GTI:Shared_Infrastructure_Host")
    alert.add_task("Verify SNI / Domain header before applying IP block")

# Rule 3: Emerging In-The-Wild Threat (First observed in enterprise within last 48 hours)
elif unique_orgs > 0 and days_since_first_seen <= 2:
    alert.add_tag("GTI:Emerging_In_The_Wild")
    alert.increase_risk_score(points=25)