Merge branch 'Zar-Branch' of https://git.racooncity.org/brotoskyj/AirlockTools into allowlistsearch

AirlockTools.py

@@ -30,7 +30,7 @@ dotenv.load_dotenv()
 
 url = "https://172.17.22.240:3129"
 badpublisherlist = ["Brave Software, Inc.",	"Zoom Video Communications, Inc."]
-path_exclusion_constant = 5
+path_exclusion_constant = 3
 treat_tolerance_constant = 4
 
 def apivalidation(): 
@@ -38,7 +38,7 @@ def apivalidation():
    _____  .__       .__                 __     ___________           .__          
   /  _  \ |__|______|  |   ____   ____ |  | __ \__    ___/___   ____ |  |   ______
  /  /_\  \|  \_  __ \  |  /  _ \_/ ___\|  |/ /   |    | /  _ \ /  _ \|  |  /  ___/
-/    |    \  ||  | \/  |_(  <_> )  \___|    <    |    |(  <_> |  <_> )  |__\___ \ 
+/    |    \  ||  | \/  |_(  <_> )  \___|    <    |    |(  <_> |  <_> )  |__\___ \ 4
 \____|__  /__||__|  |____/\____/ \___  >__|_ \   |____| \____/ \____/|____/____  >
         \/                           \/     \/                                 \/ 
 """)

utils/hashfunctions.py

@@ -82,34 +82,31 @@ def augmentAggregatedHashes(url, agg_df: pd.DataFrame) -> pd.DataFrame:
     aug_df = df[['sha256', 'filename_x', 'description', 'productname', 'productversion', 'publisher_y', 'publisher_x', 'netdomain', 'hostname', 'username', 'pprocess', 'gprocess', 'commandline', 'reputation_lastseen', 'reputation_scannercount', 'reputation_scannermatch', 'reputation_status', 'reputation_threatlevel', 'reputation_threatname', 'reputation_timestamp']]
     return aug_df
  
+
 def categorizeHashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_publishers: list):
     if untrusted_publishers is None:
         untrusted_publishers = []
 
     df = aug_df.copy()
 
-    def reputationtool(row, threat_tolerance):
+    def reputationtool(row):
-        if row["reputation_scannermatch"] == "N/A":
+        val = row["reputation_scannermatch"]
-            return True
+        if pd.isna(val) or val == "N/A":
+            return True if row["publisher_y"] == "Not Signed" else False
         try:
-            if int(row["reputation_scannermatch"]) > threat_tolerance:
+            return int(val) > threat_tolerance
-                return True
         except (ValueError, TypeError):
-            pass
+            return True if row["publisher_y"] == "Not Signed" else False
-        return False
 
-    mask_needsreview = (df["publisher_y"] == "Not Signed") & df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)
+    df["reputation_flag"] = df.apply(reputationtool, axis=1)
+
+    mask_needsreview = (df["publisher_y"] == "Not Signed") & df["reputation_flag"]
 
     mask_approved = (
-    ((df["publisher_y"] != "Not Signed") & (~df["publisher_y"].isin(untrusted_publishers))) &
+        ((df["publisher_y"] != "Not Signed") & ~df["publisher_y"].isin(untrusted_publishers)) |
-    (df["publisher_y"] != "Not Signed")  # explicitly signed
+        ((df["publisher_y"] == "Not Signed") & ~df["reputation_flag"] & ~df["publisher_y"].isin(untrusted_publishers))
-    ) | (
-    (df["publisher_y"] == "Not Signed") &
-    (~df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)) &
-    (~df["publisher_y"].isin(untrusted_publishers))  # exclude untrusted even if unsigned
     )
 
-
     needsreview_df = df[mask_needsreview]
     approved_df = df[mask_approved]
     remaining_df = df[~(mask_needsreview | mask_approved)]