Merge branch 'Zar-Branch' of https://git.racooncity.org/brotoskyj/AirlockTools into allowlistsearch

utils/hashfunctions.py

@@ -82,34 +82,31 @@ def augmentAggregatedHashes(url, agg_df: pd.DataFrame) -> pd.DataFrame:
     aug_df = df[['sha256', 'filename_x', 'description', 'productname', 'productversion', 'publisher_y', 'publisher_x', 'netdomain', 'hostname', 'username', 'pprocess', 'gprocess', 'commandline', 'reputation_lastseen', 'reputation_scannercount', 'reputation_scannermatch', 'reputation_status', 'reputation_threatlevel', 'reputation_threatname', 'reputation_timestamp']]
     return aug_df
  
+
 def categorizeHashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_publishers: list):
     if untrusted_publishers is None:
         untrusted_publishers = []
 
     df = aug_df.copy()
 
-    def reputationtool(row, threat_tolerance):
-        if row["reputation_scannermatch"] == "N/A":
-            return True
+    def reputationtool(row):
+        val = row["reputation_scannermatch"]
+        if pd.isna(val) or val == "N/A":
+            return True if row["publisher_y"] == "Not Signed" else False
         try:
-            if int(row["reputation_scannermatch"]) > threat_tolerance:
-                return True
+            return int(val) > threat_tolerance
         except (ValueError, TypeError):
-            pass
-        return False
+            return True if row["publisher_y"] == "Not Signed" else False
 
-    mask_needsreview = (df["publisher_y"] == "Not Signed") & df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)
+    df["reputation_flag"] = df.apply(reputationtool, axis=1)
+
+    mask_needsreview = (df["publisher_y"] == "Not Signed") & df["reputation_flag"]
 
     mask_approved = (
-    ((df["publisher_y"] != "Not Signed") & (~df["publisher_y"].isin(untrusted_publishers))) &
-    (df["publisher_y"] != "Not Signed")  # explicitly signed
-    ) | (
-    (df["publisher_y"] == "Not Signed") &
-    (~df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)) &
-    (~df["publisher_y"].isin(untrusted_publishers))  # exclude untrusted even if unsigned
+        ((df["publisher_y"] != "Not Signed") & ~df["publisher_y"].isin(untrusted_publishers)) |
+        ((df["publisher_y"] == "Not Signed") & ~df["reputation_flag"] & ~df["publisher_y"].isin(untrusted_publishers))
     )
 
-
     needsreview_df = df[mask_needsreview]
     approved_df = df[mask_approved]
     remaining_df = df[~(mask_needsreview | mask_approved)]