testing

utils/hashfunctions.py

@@ -1,22 +1,45 @@
 import pandas as pd
 import requests
 import os
+import json
 
-def aggregateHashes(executions_json: dict) -> pd.DataFrame:
+
+def aggregateHashes(executions_json) -> pd.DataFrame:
     """
     Takes the executions,  aggregates all the data with sha256 as primary, then returns aggregated dataframe
     """
+    """
+   old version 
+   data = executions_json.json()
 
-    exechistories = executions_json.get("response", {}).get("exechistories", [])
-    df = pd.DataFrame(exechistories)
-    
+    df = pd.DataFrame(data["response"]["exechistories"])
+    print(df)
     if df.empty:
         return df 
     
-    # Aggregate by sha256 - keep all entries in lists
+    #Aggregate by sha256 - keep all entries in lists
     agg_df = df.groupby("sha256").agg(lambda x: list(x)).reset_index()
     
     return agg_df
+    """
+
+
+    data = executions_json.json()
+    df = pd.DataFrame(data["response"]["exechistories"])
+
+    if df.empty:
+         return df
+
+    # Aggregate by sha256, deduplicate lists, and preserve order
+    agg_df = df.groupby("sha256").agg(lambda x: list(dict.fromkeys(x))).reset_index()
+
+    # Add a column for the number of unique hostnames
+    agg_df["num_devices"] = agg_df["hostname"].apply(len)
+
+    # Sort by num_devices in descending order
+    agg_df = agg_df.sort_values("num_devices", ascending=False)
+
+    return agg_df
 
 def augmentAggregatedHashes(url, agg_df: pd.DataFrame) -> pd.DataFrame:
     """
@@ -66,7 +89,7 @@ def categorize_hashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_pub
         untrusted_publishers = []
 
     # Flatten threatlevel from nested reputation dict
-    df = df.copy()  
+    df = aug_df.copy()  
     df["threatlevel"] = df["reputation"].apply(lambda x: x.get("threatlevel") if pd.notnull(x) else None)
 
     # Masks for each category