//-------------------------------------------------------------------------
//
// Copyright (c) Intel Corporation, 2011 - 2014  All Rights Reserved.
//
//  File:       SystemDefenseApi.cs
//
//  Contents:   Api code for Intel(R) Active Management Technology
//              (Intel® AMT) SystemDefense Sample.
//
//  Notes:      This sample demonstrates how to use various commands of
//              the SystemDefense and CBHeuristic services over WSMan.  
//
//-------------------------------------------------------------------------

using System;
using Intel.Management.Wsman;
using Connection;
using Common.Utils;

namespace SystemDefense
{
    public class SystemDefense_Api : Connection_setup
    {
        #region CONSTANTS

        private const int MAX_FILTER_HANDLES = 62;

        private const string STRING_NOT_APPLICABLE = "n/a";
        private const uint UINT_NOT_APPLICABLE = 0;
        private const uint DEFAULT_PRECEDENCE = 0;
        private const uint FAST_CONNECTIONS_THRESHOLD = 200; // milliseconds
        private const uint FAST_CONNECTIONS_CLEARTIME = 500; // milliseconds
        private const uint SLOW_CONNECTIONS_THRESHOLD = 200;
        private const uint SLOW_CONNECTIONS_CLEARTIME = 1000; // milliseconds
        private const ushort ENCOUNTER_TIMEOUT = 20; // seconds

        private const string CREATED_POLICY_NAME = "MyPolicy";
        private const string HDR8021_FILTER_NAME = "Sample8021Filter";
        private const string IP_HEADER_FILTER_NAME = "MyIPFilter";

        public enum TrafficDir
        {
            TRANSMIT = 0,
            RECEIVE
        }

        public enum EtherTypes
        {
            ETH_TYPE_PUP = 512,
            ETH_TYPE_IP = 2048,
            ETH_TYPE_ARP = 2054,
            ETH_TYPE_RARP = 32821,
            ETH_TYPE_8021Q = 33024,
            ETH_TYPE_IPV6 = 34525
        }

        public enum FilterProfile
        {
            STATISTICS_PASS = 0,
            STATISTICS_DROP,
            RATE,
            PASS,
            DROP
        }

        public enum IPProtocols
        {
            IP_IP = 0,      // Dummy for IP
            IP_ICMP = 1,    // Control message protocol
            IP_IGMP = 2,    // Internet group management protocol
            IP_TCP = 6,     // TCP
            IP_PUP = 12,    // PUP
            IP_UDP = 17,    // User datagram protocol
            IP_IPV6 = 41    // IPv6
        }

        public enum IPVer
        {
            IPV4 = 4,
            IPV6 = 6
        }

        public enum AntiSpoofSupport
        {
            OFF = 0,
            EVENT_ON_MATCH,
            COUNT,
            COUNTING_AND_EVENT_ON_MATCH
        }

        #endregion CONSTANTS

        #region DATA_MEMBERS

        private string NOT_EXIST_EXCEPTION =
            "No route can be determined to reach the destination role defined by the WSAddressing To.";

        #endregion

        #region CONSTRUCTORS
        //Inheriting Connection details from Connection_setup class.
        // Convert password to secure string to comply with wsman dll which supports passwords in SecureString
        // format only. 
        public SystemDefense_Api(string ip, string username, string pwd, bool krb, MpsManager proxy, bool acceptSelfSignedCertificate = false)
            : base(ip, username, pwd.ConvertToSecureString(), krb, proxy, acceptSelfSignedCertificate)
        {
        }

        // Convert password to secure string to comply with wsman dll which supports passwords in SecureString
        // format only.
        public SystemDefense_Api(string ip, string username, string pwd, string clientCert, bool krb, MpsManager proxy, bool acceptSelfSignedCertificate = false)
            : base(ip, username, pwd.ConvertToSecureString(), clientCert, krb, proxy, acceptSelfSignedCertificate)
        {
        }

        #endregion CONSTRUCTORS

        #region FLOWS

        /// <summary>
        /// Execute an API example. 
        /// 1. Prints the System Defense capabilities
        /// 2. Creates filters and policy and associates them.
        /// 3. Enables the policy on the wired LAN network interface and then updates the statistics.
        /// In case runHeuristicCommands is true:
        ///     4. Gets and sets the heuristic settings.
        ///     5. Adds a heuristic filter to the policy and then removes it.
        ///     6. Returns the heuristic settings to the original settings.
        /// 
        /// At the end: Delete all the created objects.
        /// 
        /// This function is performed by default in the wired interface.
        /// </summary>
        /// <param name="verbose">Use verbose mode</param>
        /// <param name="runHeuristicCommands">Execute Heuristic Commands</param>
        /// <param name="isWireless">true- for performing the operation in  the wireless. else- false</param>
        public void ApiFlow(bool verbose, bool runHeuristicCommands, bool isWireless)
        {
            Console.Write("\nQuerying Intel AMT System Defense Capabilities... ");
            QueryAMTSystemSdCapabilities(verbose);
            Console.WriteLine("Success");
            IManagedReference sdPolicyRef = EnableSystemDefencePolicy(CreatePolicy(verbose), isWireless);
            if (sdPolicyRef == null)
            {
                Console.WriteLine("\nFailed to enable System Defense policy. Exiting flow.");
                return; 
            }                
            Console.WriteLine("Success");
            Console.Write("\nUpdating Intel AMT System Defense Policy Statistics... ");            
            UpdadeStatistics(sdPolicyRef, verbose, isWireless);
            Console.WriteLine("Success");
            if (runHeuristicCommands)
            {
                IManagedReference ethernetPortRef = wsmanClient.NewReference("SELECT * FROM AMT_EthernetPortSettings WHERE InstanceID='Intel(r) AMT Ethernet Port Settings 0'");
                try
                {
                    ethernetPortRef.Get();
                }
                catch(NullReferenceException) 
                {                   
                    Console.WriteLine(
                        "\nCannot Get Heuristic Filter Statistics. " +
                        "\nNotes: \ta) This method was deprecated in CSME 12.0 \n\tb) This method is not supported in a LAN-less machine");  

                    // Delete the created policy.
                    DeletePolicy(verbose);
                    return;                    
                }
                Console.Write("\nGetting Heuristic Packet Filter Settings Policy... ");
                IManagedReference heuristicPacketFilterSettingsRef = GetHeurtisticPacketFilterSettings(verbose);
                if(heuristicPacketFilterSettingsRef == null)
                {
                    Console.Write("\nCannot get Heuristic Packet Filter settings. Note: This method was deprecated in CSME 12.0");

                    // Delete the created policy.
                    DeletePolicy(verbose);
                    return;
                }
                if (!verbose)
                    Console.WriteLine("Success");
                string enabled = heuristicPacketFilterSettingsRef.Get().GetProperty("Enabled").ToString();
                Console.Write("\nSetting Heuristic Packet Filter Settings Policy... ");
                SetHeuristicPacketFilterSettings(heuristicPacketFilterSettingsRef, false);
                Console.WriteLine("Success");
                Console.Write("\nGetting New Heuristic Packet Filter Settings Policy... ");
                GetHeurtisticFilterStatistics(verbose);
                if (!verbose)
                    Console.WriteLine("Success");
                bool exists = false;
                Console.Write("\nCreating Heuristic Packet System Defense Interface Policy... ");
                ConfigureHeuristicPacketPolicy(sdPolicyRef, out exists);
                if (!exists)
                {
                    Console.WriteLine("Success");
                    Console.Write("\nDeleting Heuristic Packet System Defense Interface Policy... ");
                    DeleteHeuristicPacketPolicy(sdPolicyRef);
                    Console.WriteLine("Success");
                }
                // Restore the original settings.
                Console.Write("\nSetting Original Heuristic Packet Filter Settings Policy... ");
                SetHeuristicPacketFilterSettings(heuristicPacketFilterSettingsRef, bool.Parse(enabled));
            }
            // Delete the created policy.
            DeletePolicy(verbose);
        }

        public void ApiFlow(bool verbose, bool runHeuristicCommands)
        {
            ApiFlow(verbose, runHeuristicCommands, false);
        }

        /// <summary>
        /// Deletes Heuristic Packet Policy from the given policy.
        /// </summary>
        /// <param name="systemDefensePolicyRef">The policy to delete heuristic from.</param>
        public void DeleteHeuristicPacketPolicy(IManagedReference systemDefensePolicyRef)
        {
            IManagedReference ethernetPortRef = wsmanClient.NewReference("SELECT * FROM AMT_EthernetPortSettings WHERE InstanceID='Intel(r) AMT Ethernet Port Settings 0'");
            try
            {
                ethernetPortRef.Get();
            }
            catch (NullReferenceException) 
            {
                
                Console.WriteLine(
                    "\nCannot delete Heuristic Packet Policy from the given policy. " +
                    "\nNotes: \ta) This method was deprecated in CSME 12.0 \n\tb) This method is not supported in a LAN-less machine");
                return;
                
            }
            // systemDefensePolicyRef is an EPR to the AMT_SystemDefensePolicy object created by the 'Create a System Defense Policy' use case.
            IManagedInstance systemDefensePolicyInstance = systemDefensePolicyRef.Get();

            IWsmanItem instanceID = systemDefensePolicyInstance.GetProperty("InstanceID");

            // Create a reference to the CIM_EthernetPort instance.

            ethernetPortRef =
                wsmanClient.NewReference(
                    "SELECT * FROM CIM_EthernetPort WHERE DeviceID='Intel(r) AMT Ethernet Port 0'");

            IManagedReference heuristicPacketFilterInterfacePolicyRef =
                wsmanClient.NewReference("AMT_HeuristicPacketFilterInterfacePolicy");

            heuristicPacketFilterInterfacePolicyRef.AddSelector("Antecedent", ethernetPortRef);

            // Traverse to the AMT_HeuristicPacketFilterInterfacePolicy instances that are connected to the CIM_EthernetPort instance.

            foreach (
                IWsmanItem heuristicPacketFilterInterfacePolicyItem in
                    heuristicPacketFilterInterfacePolicyRef.Enumerate(
                        "http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter", null))
            {

                //For each instance, check if it is associated to the AMT_SystemDefensePolicy instance.

                if (
                    heuristicPacketFilterInterfacePolicyItem.Object.GetProperty("Dependent").IsA(
                        "AMT_SystemDefensePolicy"))
                {
                    // Get the AMT_SystemDefensePolicy object using its EPR.

                    systemDefensePolicyInstance =
                        heuristicPacketFilterInterfacePolicyItem.Object.GetProperty("Dependent").Ref.Get();

                    if (systemDefensePolicyInstance.GetProperty("InstanceID").Equals(instanceID))
                    {
                        heuristicPacketFilterInterfacePolicyRef =
                            heuristicPacketFilterInterfacePolicyItem.Object.ToReference("Antecedent");
                        //, "Dependent");

                        heuristicPacketFilterInterfacePolicyRef.Delete();
                    }
                }
            }
        }

        /// <summary>
        /// Get Heuristic Filter Statistics.
        /// </summary>
        /// <param name="verbose">Use verbose mode</param>
        /// <returns>Heuristic Filter Statistics Instance</returns>
        public IManagedInstance GetHeurtisticFilterStatistics(bool verbose)
        {
            IManagedReference ethernetPortRef = wsmanClient.NewReference("SELECT * FROM AMT_EthernetPortSettings WHERE InstanceID='Intel(r) AMT Ethernet Port Settings 0'");
            try
            {
                ethernetPortRef.Get();
            }
            catch (NullReferenceException)
            {
                Console.WriteLine(
                    "\nCannot get Heuristic Filter Statistics. " +
                    "\nNotes: \ta) This method was deprecated in CSME 12.0 \n\tb) This method is not supported in a LAN-less machine");
                return null;                
            }
            // Create a reference to the CIM_EthernetPort instance.

            ethernetPortRef =
                wsmanClient.NewReference(
                    "SELECT * FROM CIM_EthernetPort WHERE DeviceID='Intel(r) AMT Ethernet Port 0'");

            IManagedReference elementStatisticalDataRef = wsmanClient.NewReference("CIM_ElementStatisticalData");

            elementStatisticalDataRef.AddSelector("ManagedElement", ethernetPortRef);

            // Traverse to the CIM_ElementStatisticalData instances that are connected to the CIM_EthernetPort instance.

            foreach (
                IWsmanItem elementStatisticalDataItem in
                    elementStatisticalDataRef.Enumerate(
                        "http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter", null))
            {
                // For each instance, check if it is associated to the AMT_HeuristicsPacketFilterStatiistics instance.

                if (elementStatisticalDataItem.Object.GetProperty("Stats").IsA("AMT_HeuristicPacketFilterStatistics"))
                {
                    //Get the AMT_HeuristicPacketFilterStatistics object using its EPR.

                    IManagedReference heuristicPacketFilterStatisticsRef =
                        elementStatisticalDataItem.Object.GetProperty("Stats").Ref;

                    IManagedInstance heuristicPacketFilterStatisticsInstance =
                        heuristicPacketFilterStatisticsRef.Get();

                    if (verbose)
                        DisplayHpFilterStatistics(heuristicPacketFilterStatisticsInstance);

                    return heuristicPacketFilterStatisticsInstance;
                }
            }
            return null;
        }

        /// <summary>
        /// Update Policy Statistics.
        /// This function is performed by default in the wired interface.
        /// </summary>
        /// <param name="systemDefensePolicyRef">The policy to update</param>
        /// <param name="verbose">Use verbose mode</param>
        /// <param name="isWireless">true- for performing the operation in  the wireless. else- false</param>
        public void UpdadeStatistics(IManagedReference systemDefensePolicyRef, bool verbose, bool isWireless)
        {
            IManagedReference ethernetPortRef = wsmanClient.NewReference("SELECT * FROM CIM_EthernetPort WHERE DeviceID='Intel(r) AMT Ethernet Port " + (isWireless ? "1'" : "0'"));

            IManagedInstance inputObject = systemDefensePolicyRef.CreateMethodInput("UpdateStatistics");

            inputObject.SetProperty("NetworkInterface", ethernetPortRef);

            inputObject.SetProperty("ResetOnRead", "true");

            IManagedInstance outputObject = systemDefensePolicyRef.InvokeMethod(inputObject);

            IWsmanItem returnValue = outputObject.GetProperty("ReturnValue");

            if (Int16.Parse(returnValue.ToString()) != 0)
                throw new Exception("Failed to Update Statistics. Return value = " + returnValue.ToString());
        }

        public void UpdadeStatistics(IManagedReference systemDefensePolicyRef, bool verbose)
        {
            UpdadeStatistics(systemDefensePolicyRef, verbose, false);
        }

        /// <summary>
        /// Outputs the Heuristic Packet Filter Statistics.
        /// </summary>
        /// <param name="hpFilterStatistics"></param>
        public static void DisplayHpFilterStatistics(IManagedInstance hpFilterStatistics)
        {
            Console.WriteLine("\n\nHeuristic Packet Filter Statistics:");
            Console.WriteLine("Instance ID:                         {0}", hpFilterStatistics.GetProperty("InstanceID"));
            Console.WriteLine("Blocked All:                         {0}", hpFilterStatistics.GetProperty("BlockedAllExist").IsNull == false ? hpFilterStatistics.GetProperty("BlockedAll").ToString() : "Not Specified");
            Console.WriteLine("Blocked Offensive Port:              {0}", hpFilterStatistics.GetProperty("BlockedOffensivePortExist").IsNull == false ? hpFilterStatistics.GetProperty("BlockedOffensivePort").ToString() : "Not Specified");
            Console.WriteLine("Blocked Offensive Port Protocol:     {0}", hpFilterStatistics.GetProperty("BlockedOffensivePortProtocolExist").IsNull == false ? hpFilterStatistics.GetProperty("BlockedOffensivePortProtocol").ToString() : "Not Specified");
            Console.WriteLine("Enabled SD Policy:                   {0}", hpFilterStatistics.GetProperty("EnabledPolicyExist").IsNull == false ? hpFilterStatistics.GetProperty("EnabledPolicy").ToString() : "Not Specified");
        }

        /// <summary>
        /// Queries Intel AMT System Defense Capabilities.
        /// </summary>
        /// <param name="verbose">Use verbose mode</param>
        /// <returns>Intel AMT System Defense Capabilities Instance</returns>
        public IManagedInstance QueryAMTSystemSdCapabilities(bool verbose)
        {
            IManagedReference generalSystemDefenseCapabilitiesRef = wsmanClient.NewReference("SELECT * FROM  AMT_GeneralSystemDefenseCapabilities WHERE InstanceID='Intel(r) AMT:Handle:1'");

            IManagedInstance generalSystemDefenseCapabilitiesInstance = generalSystemDefenseCapabilitiesRef.Get();

            IWsmanItem globalMaxSupportedPolicies = generalSystemDefenseCapabilitiesInstance.GetProperty("GlobalMaxSupportedPolicies");

            IWsmanItem globalMaxSupportedFilters = generalSystemDefenseCapabilitiesInstance.GetProperty("GlobalMaxSupportedFilters");
            if (verbose)
            {
                Console.WriteLine("\n\tGlobal Max Supported Policies: {0}", globalMaxSupportedPolicies.ToString());
                Console.WriteLine("\tGlobal Max Supported Filters: {0}", globalMaxSupportedFilters.ToString());
            }
            return generalSystemDefenseCapabilitiesInstance;
        }

        /// <summary>
        /// Create a policy with a policyName CREATE_POLICY_NAME.
        /// </summary>
        /// <param name="verbose">Use verbose mode</param>
        public IManagedReference CreatePolicy(bool verbose)
        {
            Console.WriteLine("\n------------Creating a System Defense Blocking policy----------\n");

            if (verbose)
                Console.WriteLine("Creating SystemDefense Policy");

            IManagedInstance systemDefensePolicyInstance = wsmanClient.NewInstance("AMT_SystemDefensePolicy");
            systemDefensePolicyInstance.SetProperty("InstanceID", STRING_NOT_APPLICABLE);
            systemDefensePolicyInstance.SetProperty("PolicyName", CREATED_POLICY_NAME);
            systemDefensePolicyInstance.SetProperty("PolicyPrecedence", "30");
            systemDefensePolicyInstance.SetProperty("TxDefaultCount", "false");
            systemDefensePolicyInstance.SetProperty("TxDefaultDrop", "false");
            systemDefensePolicyInstance.SetProperty("TxDefaultMatchEvent", "false");
            systemDefensePolicyInstance.SetProperty("RxDefaultCount", "false");
            systemDefensePolicyInstance.SetProperty("RxDefaultDrop", "false");
            systemDefensePolicyInstance.SetProperty("RxDefaultMatchEvent", "false");

            //Create IP Filter.
            if (verbose)
                Console.WriteLine("Creating IPHeaderFilters");

            //Create the IpHeadersFilter Filter.
            IManagedInstance ipHeadersFilterInstance = wsmanClient.NewInstance("AMT_IPHeadersFilter");
            ipHeadersFilterInstance.SetProperty("InstanceID", "0");
            ipHeadersFilterInstance.SetProperty("Name", IP_HEADER_FILTER_NAME);
            ipHeadersFilterInstance.SetProperty("CreationClassName", STRING_NOT_APPLICABLE);
            ipHeadersFilterInstance.SetProperty("SystemName", STRING_NOT_APPLICABLE);
            ipHeadersFilterInstance.SetProperty("SystemCreationClassName", STRING_NOT_APPLICABLE);
            ipHeadersFilterInstance.SetProperty("FilterProfile", "1");
            ipHeadersFilterInstance.SetProperty("FilterDirection", "0");
            ipHeadersFilterInstance.SetProperty("ActionEventOnMatch", "true");
            ipHeadersFilterInstance.SetProperty("HdrIPVersion", "4");

            // The ipHeadersFilterRef is an EPR to the new AMT_IPHeadersFilter object.
            IManagedReference ipHeadersFilterRef = ipHeadersFilterInstance.Create();

            // ipHeadersFilterRef is an EPR to the AMT_IPHeadersFilter object created by the 'Create an IP Filter' use case. 
            ipHeadersFilterInstance = ipHeadersFilterRef.Get();
            IWsmanItem ipFilterInstanceID = ipHeadersFilterInstance.GetProperty("InstanceID");

            if (verbose)
                Console.WriteLine("Creating Hdr8021Filter");

            //Create Ethernet Filter.
            IManagedInstance hdr8021FilterInstance = wsmanClient.NewInstance("AMT_Hdr8021Filter");
            hdr8021FilterInstance.SetProperty("InstanceID", "0");
            hdr8021FilterInstance.SetProperty("Name", HDR8021_FILTER_NAME);
            hdr8021FilterInstance.SetProperty("CreationClassName", STRING_NOT_APPLICABLE);
            hdr8021FilterInstance.SetProperty("SystemName", STRING_NOT_APPLICABLE);
            hdr8021FilterInstance.SetProperty("SystemCreationClassName", STRING_NOT_APPLICABLE);
            hdr8021FilterInstance.SetProperty("HdrProtocolID8021", "33024");
            hdr8021FilterInstance.SetProperty("FilterProfile", "3");
            hdr8021FilterInstance.SetProperty("FilterDirection", "1");
            hdr8021FilterInstance.SetProperty("ActionEventOnMatch", "false");
            //The hdr8021FilterRef is an EPR to the new AMT_Hdr8021Filter object.
            IManagedReference hdr8021FilterRef = hdr8021FilterInstance.Create();

            //hdr8021FilterInstance is an EPR to the AMT_Hdr8021Filter object created by the 'Create an Ethernet Filter' use case.
            hdr8021FilterInstance = hdr8021FilterRef.Get();

            IWsmanItem ethernetFilterInstanceID = hdr8021FilterInstance.GetProperty("InstanceID");
            //UInt32 filterCreationHandles = @(ipFilterInstanceID.ToString(), ethernetFilterInstanceID.ToString()); //??

            systemDefensePolicyInstance.SetProperty("FilterCreationHandles", ipFilterInstanceID.ToString());
            systemDefensePolicyInstance.AddProperty("FilterCreationHandles", ethernetFilterInstanceID.ToString());

            // The systemDefensePolicyRef is an EPR to the new AMT_SystemDefensePolicy object.
            IManagedReference systemDefensePolicyRef = systemDefensePolicyInstance.Create();

            // Enable Policy
            if (verbose)
                Console.WriteLine("\nEnable the SystemDefensePolicy");
            Console.WriteLine("\nCreating System Defense Policy -- Done");

            return systemDefensePolicyRef;
        }

        /// <summary>
        /// Enables AMT_NetworkPortSystemDefensePolicy to the given policy.
        /// This function is performed by default in the wired interface.
        /// </summary>
        /// <param name="systemDefensePolicyRef">the policy to enable</param>
        /// <param name="isWireless">true- for performing the operation in  the wireless. else- false</param>
        public IManagedReference EnableSystemDefencePolicy(IManagedReference systemDefensePolicyRef, bool isWireless)
        {
            IManagedReference ethernetPortRef = wsmanClient.NewReference("SELECT * FROM AMT_EthernetPortSettings WHERE InstanceID=" +
                "'Intel(r) AMT Ethernet Port Settings " + (isWireless ? "1'" : "0'"));
            try
            {
                ethernetPortRef.Get();
            }
            catch (NullReferenceException)
            {
                if (!isWireless)                
                    Console.WriteLine($"\nCannot enable AMT_NetworkPortSystemDefensePolicy for the given policy (wired) in a LAN-less machine. " +
                        $"To run over wireless, please add the '-wireless' argument");
                else
                        Console.WriteLine("Failed to enable AMT_NetworkPortSystemDefensePolicy for the given policy");
                return null;                
            }
            // Select the wired interface.
            ethernetPortRef =
                wsmanClient.NewReference(
                    "SELECT * FROM CIM_EthernetPort WHERE DeviceID='Intel(r) AMT Ethernet Port " +
                    (isWireless ? "1'" : "0'"));
            IManagedInstance networkPortSystemDefensePolicyInstance =
                wsmanClient.NewInstance("AMT_NetworkPortSystemDefensePolicy");
            networkPortSystemDefensePolicyInstance.SetProperty("Antecedent", ethernetPortRef);

            //systemDefensePolicyRef is an EPR to the AMT_SystemDefensePolicy object created by the 'Create System Defense Policy' use case.
            networkPortSystemDefensePolicyInstance.SetProperty("Dependent", systemDefensePolicyRef);
            networkPortSystemDefensePolicyInstance.SetProperty("Enabled", "true");
            try
            {
                networkPortSystemDefensePolicyInstance.Create();
            }
            catch (NullReferenceException)
            {
                Console.WriteLine("\nCannot enable the given policy. Please check if you already have an identical policy, and delete it first");
                return null;
            }
            Console.WriteLine("\nEnabling System Defense Policy -- Done");
            return systemDefensePolicyRef;
        }

        public IManagedReference EnableSystemDefencePolicy(IManagedReference systemDefensePolicyRef)
        {
            return EnableSystemDefencePolicy(systemDefensePolicyRef, false);
        }

        /// <summary>
        /// Disable AMT_NetworkPortSystemDefensePolicy interface from the policy created using CreateAndEnablePolicy method.
        /// This function is performed by default in the wired interface.
        /// </summary>
        /// <param name="verbose">Use verbose mode</param>
        /// <param name="isWireless">true- for performing the operation in  the wireless. else- false</param>
        public void DisablePolicy(bool verbose, bool isWireless)
        {
            IManagedReference ethernetPortRef = wsmanClient.NewReference("SELECT * FROM AMT_EthernetPortSettings WHERE InstanceID=" +
                "'Intel(r) AMT Ethernet Port Settings " + (isWireless ? "1'" : "0'"));
            try
            {
                ethernetPortRef.Get();
            }
            catch (NullReferenceException)
            {
                if (!isWireless)
                    Console.WriteLine($"\nCannot disable the SystemDefence policy (wired) in a LAN-less machine. " +
                        $"To run over wireless, please add the '-wireless' argument");
                else
                    Console.WriteLine("Failed to disable the SystemDefence policy");
                return;                
            }

            Console.WriteLine("\nGet SystemDefensePolicy");

            //systemDefensePolicyRef is an EPR to the AMT_SystemDefensePolicy object created by the 'Create System Defense Policy' use case.
            IManagedReference systemDefensePolicyRef =
                wsmanClient.NewReference("SELECT * FROM AMT_SystemDefensePolicy");
            // WHERE InstanceID='Intel(r) AMT:Handle:x'
            //IManagedInstance systemDefensePolicyInstance = systemDefensePolicyRef.Get();
            IWsmanItem instanceID = null;
            IWsmanEnumeration systemDefensePolicyInstances = systemDefensePolicyRef.Enumerate(null, null);
            foreach (IWsmanItem systemDefensePolicyInstance in systemDefensePolicyInstances)
            {
                if (
                    systemDefensePolicyInstance.Object.GetProperty("PolicyName").ToString().CompareTo(
                        CREATED_POLICY_NAME) == 0)
                {
                    instanceID = systemDefensePolicyInstance.Object.GetProperty("InstanceID");
                    break;
                }
            }

            //Create a reference to the CIM_EthernetPort instance;
            ethernetPortRef =
                wsmanClient.NewReference("SELECT * FROM CIM_EthernetPort WHERE DeviceID='Intel(r) AMT Ethernet Port " + (isWireless ? "1'" : "0'"));
            IManagedReference networkPortSystemDefensePolicyRef =
                wsmanClient.NewReference("AMT_NetworkPortSystemDefensePolicy");
            networkPortSystemDefensePolicyRef.AddSelector("Antecedent", ethernetPortRef);

            //Traverse to the AMT_NetworkPortSystemDefensePolicy instances that are connected to the CIM_EthernetPort instance.
            var networkPortSystemDefensePolicies = networkPortSystemDefensePolicyRef.Enumerate(
                        "http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter", null);
            if(networkPortSystemDefensePolicies == null || networkPortSystemDefensePolicies.HasNext == false)
            {
                Console.WriteLine("\nNo AMT_NetworkPortSystemDefense Policies to disable");
                return;
            }
            foreach (IWsmanItem networkPortSystemDefensePolicyItem in networkPortSystemDefensePolicies)
            {
                //For each instance, check if it is associated to the AMT_SystemDefensePolicy instance.
                if (networkPortSystemDefensePolicyItem.Object.GetProperty("Dependent").IsA("AMT_SystemDefensePolicy"))
                {
                    // Get the AMT_SystemDefensePolicy object using its EPR.
                    IManagedInstance systemDefensePolicyInstance1 =
                        networkPortSystemDefensePolicyItem.Object.GetProperty("Dependent").Ref.Get();

                    if (
                        systemDefensePolicyInstance1.GetProperty("InstanceID").ToString().CompareTo(
                            instanceID?.ToString()) == 0)
                    {
                        IManagedReference networkPortSystemDefensePolicyRef1 =
                            networkPortSystemDefensePolicyItem.Object.ToReference("Dependent");
                        //"Antecedent", "Dependent")     
                        networkPortSystemDefensePolicyRef1.Delete();
                        Console.WriteLine($"\nPolicy: {systemDefensePolicyInstance1.GetProperty("PolicyName").ToString()} was disabled successfully");
                    }
                }
            }
        }

        public void DisablePolicy(bool verbose)
        {
            DisablePolicy(verbose, false);
        }

        /// <summary>
        /// Gets the Heuristic Packet Filter Settings.
        /// </summary>
        /// <param name="verbose">Use verbose mode</param>
        /// <returns>Heuristic Packet Filter Settings Reference</returns>
        public IManagedReference GetHeurtisticPacketFilterSettings(bool verbose)
        {
            IManagedReference ethernetPortRef = wsmanClient.NewReference("SELECT * FROM AMT_EthernetPortSettings WHERE InstanceID='Intel(r) AMT Ethernet Port Settings 0'");
            try
            {
                ethernetPortRef.Get();
            }
            catch (NullReferenceException)
            { Console.WriteLine("\nCannot get Heuristic Settings. " +
                "\nNotes: \ta) This method was deprecated in CSME 12.0 \n\tb) This method is not supported in a LAN-less machine");
                return null; 
            } 

            // Create a reference to the CIM_EthernetPort instance.
            ethernetPortRef =
                wsmanClient.NewReference(
                    "SELECT * FROM CIM_EthernetPort WHERE DeviceID='Intel(r) AMT Ethernet Port 0'");
            IManagedReference elementSettingDataRef = wsmanClient.NewReference("CIM_ElementSettingData");
            elementSettingDataRef.AddSelector("ManagedElement", ethernetPortRef);

            // Traverse to the CIM_ElementSettingData instances that are connected to the CIM_EthernetPort instance.
            foreach (
                IWsmanItem elementSettingDataItem in
                    elementSettingDataRef.Enumerate("http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter",
                                                    null))
            {
                // For each instance, check if it is associated to the AMT_HeuristicPacketFilterSettings instance.
                if (elementSettingDataItem.Object.GetProperty("SettingData").IsA("AMT_HeuristicPacketFilterSettings"))
                {
                    // Get the AMT_HeuristicPacketFilterSettings object using its EPR.
                    IManagedReference heuristicPacketFilterSettingsRef =
                        elementSettingDataItem.Object.GetProperty("SettingData").Ref;
                    IManagedInstance heuristicPacketFilterSettingsInstance = heuristicPacketFilterSettingsRef.Get();
                    if (verbose)
                        DisplayHpFilterSettings(heuristicPacketFilterSettingsInstance);
                    return heuristicPacketFilterSettingsRef;
                    //break;
                }
            }
            return null;
        }

        /// <summary>
        /// Outputs the Heuristic Packet Filter Settings.
        /// </summary>
        public static void DisplayHpFilterSettings(IManagedInstance hpFilterSettings)
        {
            //   Console.WriteLine("\n\n{0}", curHpFilter.ElementName);
            Console.WriteLine("\n\nFilter Settings:");
            Console.WriteLine("Instance ID:                   {0}", hpFilterSettings.GetProperty("InstanceID"));
            Console.WriteLine("Fast Connection Rate:");
            Console.WriteLine("\tThreshold Counter            = {0}", hpFilterSettings.GetProperty("FastConnectionRateThreshold").IsNull ? "Not Specified" : hpFilterSettings.GetProperty("FastConnectionRateThreshold").ToString());//.ToString() : "Not Specified");
            Console.WriteLine("\tClear Time (in milliseconds) = {0}", hpFilterSettings.GetProperty("FastConnectionRateClearTime").IsNull ? "Not Specified" : hpFilterSettings.GetProperty("FastConnectionRateClearTime").ToString());//.ToString() : "Not Specified");
            Console.WriteLine("Slow Connection Rate:");
            Console.WriteLine("\tThreshold Counter            = {0}", hpFilterSettings.GetProperty("SlowConnectionRateThreshold").IsNull ? "Not Specified" : hpFilterSettings.GetProperty("SlowConnectionRateThreshold").ToString());//.ToString() : "Not Specified");
            Console.WriteLine("\tClear Time (in milliseconds) = {0}", hpFilterSettings.GetProperty("SlowConnectionRateClearTime").IsNull ? "Not Specified" : hpFilterSettings.GetProperty("SlowConnectionRateClearTime").ToString());//.ToString() : "Not Specified");
            Console.WriteLine("Block All:                     {0}", hpFilterSettings.GetProperty("BlockAll").IsNull ? "Not Specified" : hpFilterSettings.GetProperty("BlockAll").ToString());//.ToString() : "Not Specified");
            Console.WriteLine("EncounterTimeout:              {0}", hpFilterSettings.GetProperty("EncounterTimeout"));
            Console.WriteLine("Block Offensive Port:          {0}", hpFilterSettings.GetProperty("BlockOffensivePort").IsNull ? "Not Specified" : hpFilterSettings.GetProperty("BlockOffensivePort").ToString());//.ToString() : "Not Specified");
            Console.WriteLine("Enabled:                       {0}", hpFilterSettings.GetProperty("Enabled"));
        }

        /// <summary>
        /// Configure AMT_HeuristicPacketFilterInterfacePolicy to the policy created using CreateAndEnablePolicy method.
        /// </summary>
        /// <param name="verbose">Use verbose mode</param> 
        public void ConfigureHeuristic(bool verbose)
        {
            IManagedReference ethernetPortRef = wsmanClient.NewReference("SELECT * FROM AMT_EthernetPortSettings WHERE InstanceID='Intel(r) AMT Ethernet Port Settings 0'");
            try
            {
                ethernetPortRef.Get();
            }
            catch (NullReferenceException) 
            { 
                Console.WriteLine("\nCannot configure heuristic packet policy. " +
                    "\nNotes: \ta) This method was deprecated in CSME 12.0 \n\tb) This method is not supported in a LAN-less machine");
                return; 
            }
            //Get Heuristic Packet Filter Settings.
            if (verbose)
                Console.WriteLine("\nGet Heuristic Packer Filter Settings");

            IManagedReference hpFilterSettings = GetHeurtisticPacketFilterSettings(verbose);
            if (hpFilterSettings == null)
            {
                Console.WriteLine("Error occurred in ConfigureHeuristic:");
                throw new Exception(
                    "Operation cannot be performed on the Intel(R) AMT system: \nThere is no instance of Heuristic Packet Filter. Note: This method was deprecated in CSME 12.0");
            }

            if (hpFilterSettings.Get().GetProperty("Enabled").Equals(false))
            {
                Console.WriteLine("Error occurred in ConfigureHeuristic");
                throw new Exception(
                    "\nAborting: Heuristic Packet Filter Settings is disabled while it must be enabled in order to configure Heuristic!" +
                    "\nNote that -enableheuristic option is available for enabling the Heuristic Packet Filter Settings");
            }

            // Get the created policy
            if (verbose)
                Console.WriteLine("\nGet created policy");

            //get a Reference of system Defense Policy thats been created.
            IManagedReference policy = GetPolicy();

            if (policy == null)
            {
                Console.WriteLine("Error occurred in ConfigureHeuristic");
                throw new Exception("\nAborting: System Defense Policy was not found!" +
                                    "\nNote that -createpolicy option should be called before this option");
            }
            // Must enable heuristic first
            EnableHeuristic(verbose);

            // Configure heuristic to policy
            if (verbose)
                Console.WriteLine("\nConfigure Heuristic Packet Policy");

            bool heuristicPolicyExist = false;

            ConfigureHeuristicPacketPolicy(policy, out heuristicPolicyExist);

            if (!heuristicPolicyExist)
                Console.WriteLine("\nConfigure Heuristic to System Defense Policy - Done");
        }

        /// <summary>
        /// Create an instance of the Heuristic Packet Filter Interface Policy in order to set a 
        /// Heuristic Packet Filter configuration that should be 'Enabled' in case of a threshold breach.
        /// (Create an instance which associates between Ethernet Port and the given System Defense policy.)
        /// </summary>
        /// <param name="sdPolicy">Instance of the System Defense Policy which will be used 
        ///                        for the HeuristicPacketPolicy configuration</param> 
        /// <param name="heuristicPolicyExist">An out parameter which indicates if the Heuristic Packet Policy
        ///                                    was configured by the function or if it already exists</param>
        /// <returns>Reference of the created AMT_HeuristicPacketFilterInterfacePolicy association class</returns>        
        public IManagedReference ConfigureHeuristicPacketPolicy(IManagedReference sdPolicy, out bool heuristicPolicyExist)
        {
            IManagedReference ethernetPortRef = wsmanClient.NewReference("SELECT * FROM AMT_EthernetPortSettings WHERE InstanceID='Intel(r) AMT Ethernet Port Settings 0'");
            try
            {
                ethernetPortRef.Get();
            }
            catch (NullReferenceException) 
            { 
                Console.WriteLine("\nCannot configure heuristic packet policy. " +
                    "\nNotes: \ta) This method was deprecated in CSME 12.0 \n\tb) This method is not supported in a LAN-less machine");
                heuristicPolicyExist = false; return null; 
            }
            ethernetPortRef =
                wsmanClient.NewReference(
                    "SELECT * FROM CIM_EthernetPort WHERE DeviceID='Intel(r) AMT Ethernet Port 0'");
            IManagedReference heuristicPacketFilterInterfacePolicyRef =
                wsmanClient.NewReference("SELECT * FROM AMT_HeuristicPacketFilterInterfacePolicy");
            IWsmanEnumeration heuristicPacketFilterInterfacePolicies =
                heuristicPacketFilterInterfacePolicyRef.Enumerate(null, null);
            foreach (IWsmanItem heuristicPacketFilterInterfacePolicy in heuristicPacketFilterInterfacePolicies)
            {
                Console.WriteLine("\nWarning:");
                Console.WriteLine("There is already an instance of Heuristic Packet System Defense Interface");
                Console.WriteLine("Policy on the Intel(R) AMT platform; skipping the configuration.");
                heuristicPolicyExist = true;
                return null;
            }

            IManagedInstance heuristicPacketFilterInterfacePolicyInstance =
                wsmanClient.NewInstance("AMT_HeuristicPacketFilterInterfacePolicy");
            // heuristicPacketFilterInterfacePolicyInstance.SetProperty("Antecedent", ethernetPortRef);

            //if(ethernetPortRef.count >0)
            //{
            heuristicPacketFilterInterfacePolicyInstance.SetProperty("Antecedent", ethernetPortRef);

            // systemDefensePolicyRef is an EPR to the AMT_SystemDefensePolicy object created by the 'Create a System Defense Policy' use case.
            heuristicPacketFilterInterfacePolicyInstance.SetProperty("Dependent", sdPolicy);

            heuristicPacketFilterInterfacePolicyRef = heuristicPacketFilterInterfacePolicyInstance.Create();

            heuristicPolicyExist = false;

            // heuristicsSdPolicy.Antecedent = portsList[0].Reference;
            // heuristicsSdPolicy.Dependent = sdPolicy.Reference;

            return heuristicPacketFilterInterfacePolicyRef;
            //}

            /*else
            {
                Console.WriteLine("Failed - there is no CIM_EthernetPort to enable on the policy");
                return null;
            } */
        }

        /// <summary>
        /// Disable AMT_HeuristicPacketFilterInterfacePolicy interface from the policy created 
        /// using CreateAndEnablePolicy method.
        /// </summary>
        /// <param name="verbose">Use verbose mode</param>
        public void RemoveHeuristic(bool verbose)
        {
            IManagedReference ethernetPortRef = wsmanClient.NewReference("SELECT * FROM AMT_EthernetPortSettings WHERE InstanceID='Intel(r) AMT Ethernet Port Settings 0'");
            try
            {
                ethernetPortRef.Get();
            }
            catch (NullReferenceException) 
            { 
                Console.WriteLine("\nCannot remove Heuristic. " +
                    "\nNotes: \ta) This method was deprecated in CSME 12.0 \n\tb) This method is not supported in a LAN-less machine"); return; 
            }
            // Get the created policy.
            if (verbose)
            {
                Console.WriteLine("\nGet SystemDefensePolicy");
            }
            //Get reference to the system Defense Policy.
            IManagedReference policy = GetPolicy();

            if (null == policy)
            {
                Console.WriteLine("\nAborting: System Defense Policy was not found!" +
                                  "\nNote that -createpolicy option should be called before this option");
                return;
            }

            //Remove heuristic from policy.
            if (verbose)
            {
                Console.WriteLine("\nRemove Heuristic Filter From Policy");
            }
            RemoveHeuristicFromPolicy(policy);            
        }

        /// <summary>
        /// Disable Heuristic Packet Filter.
        /// </summary>
        /// <param name="verbose">Use verbose mode</param>
        public void DisableHeuristic(bool verbose)
        {
            IManagedReference ethernetPortRef = wsmanClient.NewReference("SELECT * FROM AMT_EthernetPortSettings WHERE InstanceID='Intel(r) AMT Ethernet Port Settings 0'");
            try
            {
                ethernetPortRef.Get();
            }
            catch (NullReferenceException) 
            { 
                Console.WriteLine("\nCannot disable Heuristic Packet Filter. " +
                    "\nNotes: \ta) This method was deprecated in CSME 12.0 \n\tb) This method is not supported in a LAN-less machine"); return; 
            }
            // Get Heuristic Packet Filter Settings
            if (verbose)
                Console.WriteLine("\nGet Heuristic Packet Filter Settings");

            IManagedReference hpFilterSettings = GetHeurtisticPacketFilterSettings(verbose);
            if(hpFilterSettings == null)
            {
                Console.WriteLine("\nCannot get Heuristic Packet Filter Settings." +
                    "\nNote: This method was deprecated in CSME 12.0 ");
                return;
            }

            // Set the Heuristic Packet Filter Settings
            if (verbose)
                Console.WriteLine("\nSet Heuristic Packet Filter Settings");

            SetHeuristicPacketFilterSettings(hpFilterSettings, false);
            // hpFilterSettings.Get().GetProperty("InstanceID"), hpFilterSettings.Get().GetProperty("ElementName"), false);

            Console.WriteLine("\nDisable heuristic packet filter settings - Done");
        }

        /// <summary>
        /// Enable Heuristic Packet Filter.
        /// </summary>
        /// <param name="verbose">Use verbose mode</param>
        public void EnableHeuristic(bool verbose)
        {
            IManagedReference ethernetPortRef = wsmanClient.NewReference("SELECT * FROM AMT_EthernetPortSettings WHERE InstanceID='Intel(r) AMT Ethernet Port Settings 0'");
            try
            {
                ethernetPortRef.Get();
            }
            catch (NullReferenceException) 
            { 
                Console.WriteLine("\nCannot enable Heuristic Packet Filter. " +
                    "\nNotes: \ta) This method was deprecated in CSME 12.0 \n\tb) This method is not supported in a LAN-less machine"); return; 
            }
            // Get Heuristic Packet Filter Settings.
            if (verbose)
                Console.WriteLine("\nGet Heuristic Packet Filter Settings");

            IManagedReference hpFilterSettings = GetHeurtisticPacketFilterSettings(verbose);

            if (hpFilterSettings != null)
            {
                // Set the Heuristic Packet Filter Settings.
                if (verbose)
                    Console.WriteLine("\nSet Heuristic Packet Filter Settings");

                if (hpFilterSettings.Get().GetProperty("Enabled").ToString().CompareTo("false") == 0)
                    SetHeuristicPacketFilterSettings(hpFilterSettings, true);

                Console.WriteLine("\nEnable heuristic packet filter settings - Done");
            }
            else
                Console.WriteLine("\nCannot enable Heuristic Packet Filter. " +
                    "\nNote: This method was deprecated in CSME 12.0");
        }

        /// <summary>
        /// Delete the created policy and the filters connected to it.
        /// 
        /// Important Note: This function deletes the policy, 8021 filters and IP filters if
        ///                 their names matches CREATED_POLICY_NAME, HDR8021_FILTER_NAME and 
        ///                 IP_HEADER_FILTER_NAME (accordingly). Creating policy, 8021 filters
        ///                 or IP filters with the same names not using the sample will cause
        ///                 this function to try and delete them and could fail the function 
        ///                 execution.
        ///                 In order to delete a specific policy or filter, one should use the
        ///                 handle of the policy/filter to uniquely identify it.
        /// </summary>
        /// <param name="verbose">Use verbose mode</param>
        public void DeletePolicy(bool verbose)
        {
            IManagedReference systemDefensePolicyRef = wsmanClient.NewReference("SELECT * FROM AMT_SystemDefensePolicy");// WHERE InstanceID='Intel(r) AMT:Handle:x'
            IWsmanEnumeration systemDefensePolicyInstances = systemDefensePolicyRef.Enumerate(null, null);
            if (systemDefensePolicyInstances == null || systemDefensePolicyInstances.HasNext == false)
            {
                Console.WriteLine("\nNo policies to delete"); 
                return;
            }
            foreach (IWsmanItem systemDefensePolicyItem in systemDefensePolicyInstances)
            {
                systemDefensePolicyRef = systemDefensePolicyItem.Object.ToReference("InstanceID");
                IManagedInstance systemDefensePolicyInstance = systemDefensePolicyRef.Get();
                if (systemDefensePolicyInstance.GetProperty("PolicyName").ToString().CompareTo(CREATED_POLICY_NAME) == 0)
                {
                    systemDefensePolicyRef.Delete();
                    Console.WriteLine($"\nThe System-Defense Policy Name: {systemDefensePolicyInstance.GetProperty("PolicyName").ToString()} was deleted successfully.");
                }
            }              
        }

        /// <summary>
        /// Enumerate and Print all available policies.
        /// This function is performed by default in the wired interface.
        /// </summary>
        /// <param name="isWireless">true- for performing the operation in  the wireless. else- false</param>
        public void PrintAvailablePolicies(bool isWireless)
        {
            // Retrieve the enabled policies triggered by System Defense.
            // Create a reference to the CIM_EthernetPort instance;
            IManagedReference ethernetPortRef = wsmanClient.NewReference("SELECT * FROM CIM_EthernetPort WHERE DeviceID='Intel(r) AMT Ethernet Port " + (isWireless ? "1'" : "0'"));
            IManagedReference networkPortSystemDefensePolicyRef = wsmanClient.NewReference("AMT_NetworkPortSystemDefensePolicy");
            networkPortSystemDefensePolicyRef.AddSelector("Antecedent", ethernetPortRef);
            // Traverse to the AMT_NetworkPortSystemDefensePolicy instances that are connected to the CIM_EthernetPort instance.
            var networkPortSystemDefensePolicies = networkPortSystemDefensePolicyRef.Enumerate("http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter", null);
            if (networkPortSystemDefensePolicies == null || networkPortSystemDefensePolicies.HasNext == false)     
                Console.WriteLine($"\nNo policies to display for: 'Enabled policies triggered by System Defense'");
            else
            {
                Console.WriteLine("\nEnabled policies triggered by System Defense:");
                foreach (IWsmanItem networkPortSystemDefensePolicyItem in networkPortSystemDefensePolicies)
                {
                    // For each instance, check if it is associated to the AMT_SystemDefensePolicy instance. 
                    if (networkPortSystemDefensePolicyItem.Object.GetProperty("Dependent").IsA("AMT_SystemDefensePolicy"))
                    {
                        if ((networkPortSystemDefensePolicyItem.Object.GetProperty("Active").ToString() == "true") || (networkPortSystemDefensePolicyItem.Object.GetProperty("Enabled").ToString() == "true"))
                        {
                            //Get the AMT_SystemDefensePolicy object using its EPR.
                            IManagedInstance systemDefensePolicyInstance = networkPortSystemDefensePolicyItem.Object.GetProperty("Dependent").Ref.Get();
                            DisplaySdPolicy(systemDefensePolicyInstance);
                        }
                    }
                }
            }

            //Retrieve the enabled policies triggered by Agent Presence.
            //Create a reference to the CIM_EthernetPort instance.
            ethernetPortRef = wsmanClient.NewReference("SELECT * FROM CIM_EthernetPort WHERE DeviceID='Intel(r) AMT Ethernet Port " + (isWireless ? "1'" : "0'"));

            IManagedReference agentPresenceInterfacePolicyRef = wsmanClient.NewReference("AMT_AgentPresenceInterfacePolicy");
            agentPresenceInterfacePolicyRef.AddSelector("Antecedent", ethernetPortRef);

            //Traverse to the AMT_AgentPresenceInterfacePolicy instances that are connected to the CIM_EthernetPort instance.
            var agentPresenceInterfacePolicies = agentPresenceInterfacePolicyRef.Enumerate("http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter", null);
            if (agentPresenceInterfacePolicies == null || agentPresenceInterfacePolicies.HasNext == false)
                Console.WriteLine($"\nNo policies to display for: 'Enabled policies triggered by Agent Presence'");
            else
            {
                Console.WriteLine("\nEnabled policies triggered by Agent Presence:");
                foreach (IWsmanItem agentPresenceInterfacePolicyItem in agentPresenceInterfacePolicies)
                {

                    // For each instance, check if it is associated to the AMT_SystemDefensePolicy instance.
                    if (agentPresenceInterfacePolicyItem.Object.GetProperty("Dependent").IsA("AMT_SystemDefensePolicy"))
                    {
                        if ((agentPresenceInterfacePolicyItem.Object.GetProperty("Enabled").Equals(true)) || (agentPresenceInterfacePolicyItem.Object.GetProperty("Active").Equals(true)))
                        {
                            // Get the AMT_SystemDefensePolicy object using its EPR.
                            IManagedInstance systemDefensePolicyInstance = agentPresenceInterfacePolicyItem.Object.GetProperty("Dependent").Ref.Get();
                            DisplaySdPolicy(systemDefensePolicyInstance);
                        }
                    }

                }
            }

            // Retrieve the enabled policies triggered by Environment Detection.
            //Create a reference to the CIM_EthernetPort instance;
            IManagedReference environmentDetectionInterfacePolicyRef = wsmanClient.NewReference("AMT_EnvironmentDetectionInterfacePolicy");
            environmentDetectionInterfacePolicyRef.AddSelector("Antecedent", ethernetPortRef);

            // Traverse to the AMT_EnvironmentDetectionInterfacePolicy instances that are connected to the CIM_EthernetPort instance.
            var environmentDetectionInterfacePolicies = environmentDetectionInterfacePolicyRef.Enumerate("http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter", null);
            if (environmentDetectionInterfacePolicies == null || environmentDetectionInterfacePolicies.HasNext == false)
                Console.WriteLine($"\nNo policies to display for: 'Enabled policies triggered by Environment Detection'");
            else
            {
                Console.WriteLine("\nEnabled policies triggered by Environment Detection:");
                foreach (IWsmanItem environmentDetectionInterfacePolicyItem in environmentDetectionInterfacePolicies)
                {
                    // For each instance, check if it is associated to the AMT_SystemDefensePolicy instance.
                    if (environmentDetectionInterfacePolicyItem.Object.GetProperty("Dependent").IsA("AMT_SystemDefensePolicy"))
                    {
                        if ((environmentDetectionInterfacePolicyItem.Object.GetProperty("Enabled").Equals(true)) || (environmentDetectionInterfacePolicyItem.Object.GetProperty("Active").Equals(true)))
                        {
                            // Get the AMT_SystemDefensePolicy object using its EPR.
                            IManagedInstance systemDefensePolicyInstance = environmentDetectionInterfacePolicyItem.Object.GetProperty("Dependent").Ref.Get();
                            DisplaySdPolicy(systemDefensePolicyInstance);
                        }
                    }
                }
            }
            try
            {
                // Retrieve the enabled policies triggered by Heuristic System Defense.
                //Create a reference to the CIM_EthernetPort instance; select the wired interface.
                IManagedReference heuristicPacketFilterInterfacePolicyRef = wsmanClient.NewReference("AMT_HeuristicPacketFilterInterfacePolicy");
                heuristicPacketFilterInterfacePolicyRef.AddSelector("Antecedent", ethernetPortRef);
                // Traverse to the AMT_HeuristicsPacketFilterInterfacePolicy instances that are connected to the CIM_EthernetPort instance.
                var heuristicPacketFilterInterfacePolicies = heuristicPacketFilterInterfacePolicyRef.Enumerate("http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter", null);
                if (heuristicPacketFilterInterfacePolicies == null || heuristicPacketFilterInterfacePolicies.HasNext == false)
                    Console.WriteLine($"\nNo policies to display for: 'Enabled policies triggered by Heuristic System Defense'");
                else
                {
                    Console.WriteLine("\nEnabled policies triggered by Heuristic System Defense:");
                    foreach (IWsmanItem heuristicPacketFilterInterfacePolicyItem in heuristicPacketFilterInterfacePolicies)
                    {
                        // For each instance, check if it is associated to the AMT_SystemDefensePolicy instance.
                        if (heuristicPacketFilterInterfacePolicyItem.Object.GetProperty("Dependent").IsA("AMT_SystemDefensePolicy"))
                        {
                            if ((heuristicPacketFilterInterfacePolicyItem.Object.GetProperty("Enabled").Equals(true)) || (heuristicPacketFilterInterfacePolicyItem.Object.GetProperty("Active").Equals(true)))
                            {
                                // Get the AMT_SystemDefensePolicy object using its EPR.
                                IManagedInstance systemDefensePolicyInstance = heuristicPacketFilterInterfacePolicyItem.Object.GetProperty("Dependent").Ref.Get();
                                DisplaySdPolicy(systemDefensePolicyInstance);
                                break;
                            }
                        }

                    }
                }
            }
            catch(NullReferenceException)
            {
                Console.WriteLine($"\nCannot retrieve the 'Enabled policies triggered by Heuristic System-Defense'. " +
                    "\nNotes: \ta) This method was deprecated in CSME 12.0 \n\tb) This method is not supported in a LAN-less machine");
            }
        }

        public void PrintAvailablePolicies()
        {
            PrintAvailablePolicies(false);
        }

        #endregion FLOWS

        #region FUNCTIONS

        /// <summary>
        /// Outputs the SystemDefense Policy.
        /// </summary>
        /// <param name="sdPolicy">>Instance of the SystemDefense Policy</param>
        public void DisplaySdPolicy(IManagedInstance sdPolicy)
        {
            Console.WriteLine("\n{0}", sdPolicy.GetProperty("ElementName"));
            Console.WriteLine("Instance ID:                 {0}", sdPolicy.GetProperty("InstanceID"));
            Console.WriteLine("Policy Precedence:           {0}", sdPolicy.GetProperty("PolicyPrecedence"));
            Console.WriteLine("AntiSpoofing Support:        {0}", sdPolicy.GetProperty("AntiSpoofingSupport"));
            Console.WriteLine("Policy Name:                 {0}", sdPolicy.GetProperty("PolicyName"));

            //List<string> filterCreationHandles = GetFilterHandlesOfPolicy(sdPolicy);
            IWsmanItem filterCreationHandles = sdPolicy.GetProperty("FilterCreationHandles");

            if (filterCreationHandles.Count != 0)
            {
                Console.Write("Filter Creation Handles:     ");
                int i = 0;
                foreach (IWsmanItem handle in filterCreationHandles)
                {
                    Console.Write("{0}", handle.ToString());
                    if ((i + 1) != filterCreationHandles.Count)
                    {
                        Console.Write(", ");
                    }
                    i++;
                }
                Console.WriteLine();
            }           
            Console.WriteLine("Rx Default Count:            {0}", sdPolicy.GetProperty("RxDefaultCount"));
            Console.WriteLine("Rx Default Drop:             {0}", sdPolicy.GetProperty("RxDefaultDrop"));
            Console.WriteLine("Rx Default Match Event:      {0}", sdPolicy.GetProperty("RxDefaultMatchEvent"));
            Console.WriteLine("Tx Default Count:            {0}", sdPolicy.GetProperty("TxDefaultCount"));
            Console.WriteLine("Tx Default Drop:             {0}", sdPolicy.GetProperty("TxDefaultDrop"));
            Console.WriteLine("Tx Default Match Event:      {0}", sdPolicy.GetProperty("TxDefaultMatchEvent"));
        }

        /// <summary>
        /// Set the Heuristic Packet Filter Settings using the InstanceID, ElementName and Enabled properties.
        /// <param name="instanceID">Instance ID of the HeuristicPacketFilterSettings</param>
        /// <param name="elementName">Element Name of the HeuristicPacketFilterSettings</param>
        /// <param name="enable">Enabled state of the HeuristicPacketFilterSettings</param>
        /// </summary>
        public void SetHeuristicPacketFilterSettings(IManagedReference heuristicPacketFilterSettingsRef, bool enable)// string instanceID, string elementName, bool enable)
        {
            //heuristicPacketFilterSettingsRef is an EPR to the AMT_HeuristicPacketFilterSettings object returned by the 'Get Heuristics Settings' use case.
            IManagedInstance heuristicPacketFilterSettingsInstance = heuristicPacketFilterSettingsRef.Get();
            heuristicPacketFilterSettingsInstance.SetProperty("Enabled", enable.ToString().ToLower()); //true or false
            heuristicPacketFilterSettingsInstance.SetProperty("FastConnectionRateThreshold", "100");
            heuristicPacketFilterSettingsInstance.SetProperty("FastConnectionRateClearTime", "100");
            heuristicPacketFilterSettingsInstance.SetProperty("BlockOffensivePort", "true");
            heuristicPacketFilterSettingsInstance.SetProperty("EncounterTimeout", "0");
            heuristicPacketFilterSettingsRef.Put(heuristicPacketFilterSettingsInstance);
        }

        /// <summary>
        ///  Remove heuristic from policy.
        /// </summary>
        /// <param name="systemDefensePolicyRef">the policy to remove</param>
        public void RemoveHeuristicFromPolicy(IManagedReference systemDefensePolicyRef)
        {
            IManagedReference ethernetPortRef = wsmanClient.NewReference("SELECT * FROM AMT_EthernetPortSettings WHERE InstanceID='Intel(r) AMT Ethernet Port Settings 0'");
            try
            {
                ethernetPortRef.Get();
            }
            catch (NullReferenceException) 
            { 
                Console.WriteLine("\nCannot remove Heuristic from policy. " +
                      "\nNotes: \ta) This method was deprecated in CSME 12.0 \n\tb) This method is not supported in a LAN-less machine"); return; 
            }
            // systemDefensePolicyRef is an EPR to the AMT_SystemDefensePolicy object created by the 'Create a System Defense Policy' use case.
            IManagedInstance systemDefensePolicyInstance = systemDefensePolicyRef.Get();
            IWsmanItem instanceID = systemDefensePolicyInstance.GetProperty("InstanceID");

            // Create a reference to the CIM_EthernetPort instance.
            ethernetPortRef =
                wsmanClient.NewReference(
                    "SELECT * FROM CIM_EthernetPort WHERE DeviceID='Intel(r) AMT Ethernet Port 0'");
            IManagedReference heuristicPacketFilterInterfacePolicyRef =
                wsmanClient.NewReference("AMT_HeuristicPacketFilterInterfacePolicy");
            heuristicPacketFilterInterfacePolicyRef.AddSelector("Antecedent", ethernetPortRef);

            // Traverse to the AMT_HeuristicPacketFilterInterfacePolicy instances that are connected to the CIM_EthernetPort instance.
            try
            {
                var heuristicPacketFilterInterfacePolicies = heuristicPacketFilterInterfacePolicyRef.Enumerate(
                            "http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter", null);
                foreach (IWsmanItem heuristicPacketFilterInterfacePolicyItem in heuristicPacketFilterInterfacePolicies)
                {
                    // For each instance, check if it is associated to the AMT_SystemDefensePolicy instance.
                    if (
                    heuristicPacketFilterInterfacePolicyItem.Object.GetProperty("Dependent").IsA(
                        "AMT_SystemDefensePolicy"))
                    {
                        // Get the AMT_SystemDefensePolicy object using its EPR.
                        systemDefensePolicyInstance =
                            heuristicPacketFilterInterfacePolicyItem.Object.GetProperty("Dependent").Ref.Get();
                        if (
                            systemDefensePolicyInstance.GetProperty("InstanceID").ToString().CompareTo(
                                instanceID.ToString()) == 0)
                        {
                            heuristicPacketFilterInterfacePolicyRef =
                                heuristicPacketFilterInterfacePolicyItem.Object.ToReference("Dependent");
                            //"Antecedent", "Dependent");
                            heuristicPacketFilterInterfacePolicyRef.Delete();
                        }
                    }
                }

                Console.WriteLine("\nRemove Heuristic From Policy - Done");
            }
            catch(NullReferenceException)           
            {
                Console.WriteLine("\nCannot remove Heuristic from policy. " +
                    "\nNote: This method was deprecated in CSME 12.0 ");
                return;
            }
         
        }

        /// <summary>
        /// Enumerate machine's SystemDefense policies.
        /// </summary>
        /// <param name="isWireless">use the wireless interface</param>
        /// <returns>Instance of System defense Policy</returns>
        public IManagedReference GetPolicy(bool isWireless)
        {
            // Create a reference to the CIM_EthernetPort instance; select the wired interface.
            IManagedReference ethernetPortRef =
                wsmanClient.NewReference("SELECT * FROM CIM_EthernetPort WHERE DeviceID='Intel(r) AMT Ethernet Port " +
                                         (isWireless ? "1'" : "0'"));
            IManagedReference networkPortSystemDefensePolicyRef = wsmanClient.NewReference("AMT_NetworkPortSystemDefensePolicy");
            networkPortSystemDefensePolicyRef.AddSelector("Antecedent", ethernetPortRef);

            // Traverse to the AMT_NetworkPortSystemDefensePolicy instances that are connected to the CIM_EthernetPort instance.
            foreach (IWsmanItem networkPortSystemDefensePolicyItem in networkPortSystemDefensePolicyRef.Enumerate("http://schemas.dmtf.org/wbem/wsman/1/wsman/SelectorFilter", null))
            {
                // For each instance, check if it is associated to the AMT_SystemDefensePolicy instance.
                if (networkPortSystemDefensePolicyItem.Object.GetProperty("Dependent").IsA("AMT_SystemDefensePolicy"))
                {
                    if ((networkPortSystemDefensePolicyItem.Object.GetProperty("Active").ToString().Equals("true")) || (networkPortSystemDefensePolicyItem.Object.GetProperty("Enabled").ToString().Equals("true")))
                    {
                        // Get the AMT_SystemDefensePolicy object using its EPR.
                        IManagedInstance systemDefensePolicyInstance = networkPortSystemDefensePolicyItem.Object.GetProperty("Dependent").Ref.Get();
                        IManagedReference systemDefensePolicyRef = networkPortSystemDefensePolicyItem.Object.GetProperty("Dependent").Ref;
                        return systemDefensePolicyRef;

                    }
                }
            }
            return null;
        }

        public IManagedReference GetPolicy()
        {
            return GetPolicy(false);
        }

        #endregion
    }
}