testing

utils/allowlist.py

@@ -3,7 +3,7 @@ import requests
 import json
 import os
 
-def allowlistexechistories(url): 
+def allowlistexechistories(url, outputjson: bool): 
     endpoint = url + '/v1/group'
     print("[+] Grabbing All Policies")
     payload = {}
@@ -23,11 +23,14 @@ def allowlistexechistories(url):
     endpoint = url + '/v1/logging/exechistories'
     payload_dict = {
         "type":[1,2,6,7],
+        "checkpoint":"000000000000000000000"
         "policy": [policiesnames[choice]]
     }
     payload = json.dumps(payload_dict)
     print(payload)
     response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
+    if outputjson == True:
+	    return response
     parse_text = json.loads(response.text)
     for item in parse_text['response']['exechistories']:
         print(item['checkpoint'])

utils/getdeviceevents.py

@@ -3,7 +3,7 @@ import requests
 import json
 import os
 
-def devicehistory(url):
+def devicehistory(url, outputjson: bool):
 	endpoint = url + '/v1/getexechistory'
 	print("\n")
 	print("1. Today")
@@ -43,7 +43,12 @@ def devicehistory(url):
 	}
 
 	response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
+	
+	if outputjson == True:
+		return response
+
 	parse_text = json.loads(response.text)
+
 	for block in parse_text['response']['exechistory']:
 		print(f"Command: {block['commandline']}")
 		print(f"Date: {block['datetime']}")

utils/hashfunctions.py

@@ -1,22 +1,45 @@
 import pandas as pd
 import requests
 import os
+import json
 
-def aggregateHashes(executions_json: dict) -> pd.DataFrame:
+
+def aggregateHashes(executions_json) -> pd.DataFrame:
     """
     Takes the executions,  aggregates all the data with sha256 as primary, then returns aggregated dataframe
     """
+    """
+   old version 
+   data = executions_json.json()
 
-    exechistories = executions_json.get("response", {}).get("exechistories", [])
-    df = pd.DataFrame(exechistories)
-    
+    df = pd.DataFrame(data["response"]["exechistories"])
+    print(df)
     if df.empty:
         return df 
     
-    # Aggregate by sha256 - keep all entries in lists
+    #Aggregate by sha256 - keep all entries in lists
     agg_df = df.groupby("sha256").agg(lambda x: list(x)).reset_index()
     
     return agg_df
+    """
+
+
+    data = executions_json.json()
+    df = pd.DataFrame(data["response"]["exechistories"])
+
+    if df.empty:
+         return df
+
+    # Aggregate by sha256, deduplicate lists, and preserve order
+    agg_df = df.groupby("sha256").agg(lambda x: list(dict.fromkeys(x))).reset_index()
+
+    # Add a column for the number of unique hostnames
+    agg_df["num_devices"] = agg_df["hostname"].apply(len)
+
+    # Sort by num_devices in descending order
+    agg_df = agg_df.sort_values("num_devices", ascending=False)
+
+    return agg_df
 
 def augmentAggregatedHashes(url, agg_df: pd.DataFrame) -> pd.DataFrame:
     """
@@ -66,7 +89,7 @@ def categorize_hashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_pub
         untrusted_publishers = []
 
     # Flatten threatlevel from nested reputation dict
-    df = df.copy()  
+    df = aug_df.copy()  
     df["threatlevel"] = df["reputation"].apply(lambda x: x.get("threatlevel") if pd.notnull(x) else None)
 
     # Masks for each category