Add machine-readable output fields for scripting (connections_analyzed, suspicious_connections, iocs, time_range, destination_summary)

c2sentinel.py

@@ -1438,11 +1438,34 @@ class AnalysisResult:
     # Raw features
     features: List[float] = field(default_factory=list)
 
+    # Connection-level details for scripting
+    connections_analyzed: int = 0
+    suspicious_connections: List[Dict] = field(default_factory=list)
+    iocs: Dict[str, Any] = field(default_factory=dict)
+    time_range: Dict[str, float] = field(default_factory=dict)
+    destination_summary: Dict[str, Any] = field(default_factory=dict)
+
     def to_dict(self) -> Dict[str, Any]:
         return asdict(self)
 
+    def to_json(self, indent: int = 2) -> str:
+        """Return JSON-formatted result for scripting."""
+        return json.dumps(self.to_dict(), indent=indent, default=str)
+
+    def to_ioc_format(self) -> Dict[str, Any]:
+        """Return IOCs in STIX-like format for threat intel platforms."""
+        return {
+            'type': 'indicator',
+            'spec_version': '2.1',
+            'pattern_type': 'c2-beacon',
+            'valid_from': self.time_range.get('start'),
+            'labels': ['malicious-activity', 'c2'] if self.is_c2 else ['benign'],
+            'confidence': int(self.confidence * 100),
+            'indicators': self.iocs
+        }
+
     def __repr__(self) -> str:
-        status = "🚨 C2 DETECTED" if self.is_c2 else "✅ Clean"
+        status = "C2 DETECTED" if self.is_c2 else "Clean"
         return f"<AnalysisResult: {status} | prob={self.c2_probability:.3f} | type={self.c2_type}>"
 
 
@@ -1760,6 +1783,72 @@ class C2Sentinel:
         if include_features:
             result.features = features.tolist()
 
+        # ================================================================
+        # PHASE 8: Populate machine-readable output fields
+        # ================================================================
+
+        result.connections_analyzed = len(connections)
+
+        # Time range
+        timestamps = [c.get('timestamp', 0) for c in connections if c.get('timestamp')]
+        if timestamps:
+            result.time_range = {
+                'start': min(timestamps),
+                'end': max(timestamps),
+                'duration': max(timestamps) - min(timestamps)
+            }
+
+        # Destination summary
+        dst_port_counts = {}
+        for conn in connections:
+            dst_ip = conn.get('dst_ip', '')
+            dst_port = conn.get('dst_port', 0)
+            key = f"{dst_ip}:{dst_port}"
+            dst_port_counts[key] = dst_port_counts.get(key, 0) + 1
+
+        result.destination_summary = {
+            'unique_ips': list(dst_ips),
+            'unique_ports': list(ports),
+            'destinations': dst_port_counts,
+            'total_bytes_sent': total_sent,
+            'total_bytes_recv': total_recv
+        }
+
+        # Suspicious connections - mark each with a score
+        if result.is_c2:
+            # All connections to a detected C2 destination are suspicious
+            for i, conn in enumerate(connections):
+                result.suspicious_connections.append({
+                    'index': i,
+                    'timestamp': conn.get('timestamp'),
+                    'src_ip': conn.get('src_ip', ''),
+                    'src_port': conn.get('src_port', 0),
+                    'dst_ip': conn.get('dst_ip', ''),
+                    'dst_port': conn.get('dst_port', 0),
+                    'bytes_sent': conn.get('bytes_sent', 0),
+                    'bytes_recv': conn.get('bytes_recv', 0),
+                    'score': result.c2_probability
+                })
+
+        # IOCs (Indicators of Compromise)
+        if result.is_c2:
+            result.iocs = {
+                'ip_addresses': list(dst_ips),
+                'ports': list(ports),
+                'c2_type': result.c2_type,
+                'timing_signature': {
+                    'mean_interval': float(np.mean(np.diff(sorted(timestamps)))) if len(timestamps) > 1 else 0,
+                    'interval_cv': float(np.std(np.diff(sorted(timestamps))) / (np.mean(np.diff(sorted(timestamps))) + 1e-6)) if len(timestamps) > 1 else 0
+                },
+                'size_signature': {
+                    'mean_bytes_sent': float(np.mean(bytes_sent)) if bytes_sent else 0,
+                    'mean_bytes_recv': float(np.mean(bytes_recv)) if bytes_recv else 0,
+                    'sent_cv': float(sent_cv),
+                    'recv_cv': float(recv_cv)
+                },
+                'behavioral_indicators': result.risk_factors
+            }
+
         return result
 
     def analyze_batch(