Major Refactor now allows multiple policies to be selected
This commit is contained in:
+143
-59
@@ -14,7 +14,10 @@
|
||||
# along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
|
||||
#Local Imports
|
||||
import utils.pretty as ct
|
||||
import utils.hashfunctions as hashf
|
||||
import utils.utils as ct
|
||||
import utils.pathfunctions as pathf
|
||||
import utils.policyfunctions as policyf
|
||||
|
||||
#Standard Libary Imports:
|
||||
import datetime
|
||||
@@ -27,7 +30,7 @@ import pandas as pd
|
||||
import requests
|
||||
|
||||
def findAgentID(url):
|
||||
|
||||
|
||||
print(ct.colorText("WARNING: Device Name is Case Sensitive", "red"))
|
||||
hostname = input(ct.colorText("Enter Device Name: ", "white"))
|
||||
|
||||
@@ -130,66 +133,67 @@ def getPolicyName(url, groupid):
|
||||
|
||||
|
||||
def devicehistory(url, outputjson: bool):
|
||||
endpoint = url + '/v1/getexechistory'
|
||||
print("\n")
|
||||
print(ct.colorText("1. Today", "yellow"))
|
||||
print(ct.colorText("2. Last 24 Hours", "yellow"))
|
||||
print(ct.colorText("3. Past 7 Days", "yellow"))
|
||||
print(ct.colorText("4. Past 30 Days", "yellow"))
|
||||
print(ct.colorText("5. Custom Date Range","yellow"))
|
||||
choice = input(ct.colorText("\nSelect Date Range: ", "white"))
|
||||
today = datetime.date.today()
|
||||
today = today.strftime("%Y-%m-%d")
|
||||
if choice == '1':
|
||||
date_selected = today
|
||||
elif choice == '2':
|
||||
date_selected = datetime.date.today() - datetime.timedelta(days=1)
|
||||
date_selected = date_selected.strftime('%Y-%m-%d')
|
||||
elif choice == '3':
|
||||
date_selected = datetime.date.today() - datetime.timedelta(days=7)
|
||||
date_selected = date_selected.strftime('%Y-%m-%d')
|
||||
elif choice == '4':
|
||||
date_selected = datetime.date.today() - datetime.timedelta(days=30)
|
||||
date_selected = date_selected.strftime('%Y-%m-%d')
|
||||
elif choice == "5":
|
||||
print(ct.colorText("Please Input Dates as YYYY-MM-DD", "cyan"))
|
||||
date_selected = input(ct.colorText("From: ", "white"))
|
||||
today = input(ct.colorText("Date To: ", "white"))
|
||||
print(ct.colorText("WARNING: Device Name is Case Sensitive", "red"))
|
||||
device = input(ct.colorText("Enter Device Name: ", "white"))
|
||||
payload_dict = {
|
||||
"datefrom": date_selected,
|
||||
"dateto": today,
|
||||
"hostname": device
|
||||
}
|
||||
payload = json.dumps(payload_dict)
|
||||
print(ct.colorText(payload, "green"))
|
||||
headers = {
|
||||
"X-APIKey": os.getenv('APIKEY')
|
||||
}
|
||||
endpoint = url + '/v1/getexechistory'
|
||||
print("\n")
|
||||
print(ct.colorText("1. Today", "yellow"))
|
||||
print(ct.colorText("2. Last 24 Hours", "yellow"))
|
||||
print(ct.colorText("3. Past 7 Days", "yellow"))
|
||||
print(ct.colorText("4. Past 30 Days", "yellow"))
|
||||
print(ct.colorText("5. Custom Date Range","yellow"))
|
||||
choice = input(ct.colorText("\nSelect Date Range: ", "white"))
|
||||
today = datetime.date.today()
|
||||
today = today.strftime("%Y-%m-%d")
|
||||
date_selected = " "
|
||||
if choice == '1':
|
||||
date_selected = today
|
||||
elif choice == '2':
|
||||
date_selected = datetime.date.today() - datetime.timedelta(days=1)
|
||||
date_selected = date_selected.strftime('%Y-%m-%d')
|
||||
elif choice == '3':
|
||||
date_selected = datetime.date.today() - datetime.timedelta(days=7)
|
||||
date_selected = date_selected.strftime('%Y-%m-%d')
|
||||
elif choice == '4':
|
||||
date_selected = datetime.date.today() - datetime.timedelta(days=30)
|
||||
date_selected = date_selected.strftime('%Y-%m-%d')
|
||||
elif choice == "5":
|
||||
print(ct.colorText("Please Input Dates as YYYY-MM-DD", "cyan"))
|
||||
date_selected = input(ct.colorText("From: ", "white"))
|
||||
today = input(ct.colorText("Date To: ", "white"))
|
||||
print(ct.colorText("WARNING: Device Name is Case Sensitive", "red"))
|
||||
device = input(ct.colorText("Enter Device Name: ", "white"))
|
||||
payload_dict = {
|
||||
"datefrom": date_selected,
|
||||
"dateto": today,
|
||||
"hostname": device
|
||||
}
|
||||
payload = json.dumps(payload_dict)
|
||||
print(ct.colorText(payload, "green"))
|
||||
headers = {
|
||||
"X-APIKey": os.getenv('APIKEY')
|
||||
}
|
||||
|
||||
response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
|
||||
response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
|
||||
|
||||
if outputjson:
|
||||
return response
|
||||
if outputjson:
|
||||
return response
|
||||
|
||||
parse_text = json.loads(response.text)
|
||||
parse_text = json.loads(response.text)
|
||||
|
||||
# Safely get exechistory
|
||||
exechistory = parse_text.get('response', {}).get('exechistory')
|
||||
# Safely get exechistory
|
||||
exechistory = parse_text.get('response', {}).get('exechistory')
|
||||
|
||||
if isinstance(exechistory, list):
|
||||
for block in exechistory:
|
||||
print(ct.colorText(f"Command: {block.get('commandline', 'N/A')}", "green"))
|
||||
print(ct.colorText(f"Date: {block.get('datetime', 'N/A')}", "green"))
|
||||
print(ct.colorText(f"Filename: {block.get('filename', 'N/A')}", "green"))
|
||||
print(ct.colorText(f"Policy Name: {block.get('policyname', 'N/A')}", "green"))
|
||||
print(ct.colorText(f"Hostname: {block.get('hostname', 'N/A')}", "green"))
|
||||
print(ct.colorText(f"Hash: {block.get('sha256', 'N/A')}", "green"))
|
||||
print("\n")
|
||||
else:
|
||||
print(ct.colorText("No execution history found or data is not in expected format.", "red"))
|
||||
|
||||
if isinstance(exechistory, list):
|
||||
for block in exechistory:
|
||||
print(ct.colorText(f"Command: {block.get('commandline', 'N/A')}", "green"))
|
||||
print(ct.colorText(f"Date: {block.get('datetime', 'N/A')}", "green"))
|
||||
print(ct.colorText(f"Filename: {block.get('filename', 'N/A')}", "green"))
|
||||
print(ct.colorText(f"Policy Name: {block.get('policyname', 'N/A')}", "green"))
|
||||
print(ct.colorText(f"Hostname: {block.get('hostname', 'N/A')}", "green"))
|
||||
print(ct.colorText(f"Hash: {block.get('sha256', 'N/A')}", "green"))
|
||||
print("\n")
|
||||
else:
|
||||
print(ct.colorText("No execution history found or data is not in expected format.", "red"))
|
||||
|
||||
def findAllAgents(url):
|
||||
endpoint = url + '/v1/agent/find'
|
||||
payload = {}
|
||||
@@ -218,7 +222,7 @@ def findAllAgents(url):
|
||||
data['status'] = data['status'].map(status_map)
|
||||
return(data)
|
||||
|
||||
def findAgents(url, device_input_str):
|
||||
def findAgents(url, device_input_str, return_dataframe):
|
||||
|
||||
os.makedirs("device_search", exist_ok=True)
|
||||
df = findAllAgents(url)
|
||||
@@ -240,7 +244,8 @@ def findAgents(url, device_input_str):
|
||||
matched_df.to_csv(f"device_search\\{filename}", index=False)
|
||||
|
||||
print(ct.colorText(f"\n✅ Matched devices exported to: device_search\\{filename}","green"))
|
||||
|
||||
if return_dataframe : return matched_df
|
||||
|
||||
def promptForDevices():
|
||||
|
||||
print(ct.colorText("🔍 Device Search", "cyan"))
|
||||
@@ -266,3 +271,82 @@ def promptForDevices():
|
||||
|
||||
return device_input_str
|
||||
|
||||
|
||||
def returnToEnforcement(url, device_df, policy_relationship_map, bad_publisher_list, pups, badpathparts, threat_tolerance_constant, path_exclusion_constant, min_files_for_path):
|
||||
policylist = sorted(device_df['policy_name'].unique().tolist())
|
||||
type = [1, 2, 6, 7]
|
||||
|
||||
parq_base_dir = "prepare_policy\\parquet\\"
|
||||
appr_base_dir = "prepare_policy\\approved\\"
|
||||
needappr_base_dir = "prepare_policy\\needs_approved"
|
||||
pflight_base_dir = "prepare_policy\\preflight"
|
||||
|
||||
#If the directorys where we're going to store our output dont exist, make them.
|
||||
os.makedirs(parq_base_dir, exist_ok=True)
|
||||
os.makedirs(needappr_base_dir, exist_ok=True)
|
||||
os.makedirs(appr_base_dir, exist_ok=True)
|
||||
os.makedirs(pflight_base_dir, exist_ok=True)
|
||||
|
||||
while True:
|
||||
|
||||
#ct.printDeviceEnforceChecklist()
|
||||
|
||||
choice = input(ct.colorText("\nEnter your choice: ", "white"))
|
||||
|
||||
if choice == "1":
|
||||
|
||||
policyf.buildExecHistory(url,
|
||||
policylist,
|
||||
parq_base_dir,
|
||||
needappr_base_dir,
|
||||
type,
|
||||
threat_tolerance_constant,
|
||||
bad_publisher_list,
|
||||
pups,
|
||||
)
|
||||
|
||||
elif choice == "2":
|
||||
|
||||
pathf.generateApprovables(needappr_base_dir, appr_base_dir, parq_base_dir, badpathparts, bad_publisher_list, path_exclusion_constant, min_files_for_path, True)
|
||||
|
||||
elif choice == "3":
|
||||
policyf.savePreFlights(appr_base_dir, parq_base_dir, pflight_base_dir)
|
||||
|
||||
"""
|
||||
|
||||
elif choice == "4":
|
||||
if os.path.exists(f"preflight\\final_path_exclusions.html") and os.path.exists(f"preflight\\final_hash_approvals.html") and allowlist_parent_name != " " and allowlist_child_name != " " and destination_name != " ":
|
||||
sendToPolicyTest(
|
||||
url,
|
||||
first_policy,
|
||||
second_policy,
|
||||
destination_name,
|
||||
destination_id,
|
||||
allowlist_parent_name,
|
||||
allowlist_parent_id,
|
||||
allowlist_child_name,
|
||||
allowlist_child_id
|
||||
)
|
||||
|
||||
elif choice == "5":
|
||||
if os.path.exists(f"preflight\\final_path_exclusions.html") and os.path.exists(f"preflight\\final_hash_approvals.html") and allowlist_parent_name != " " and allowlist_child_name != " " and destination_name != " ":
|
||||
sendToPolicy(
|
||||
url,
|
||||
first_policy,
|
||||
second_policy,
|
||||
destination_name,
|
||||
destination_id,
|
||||
allowlist_parent_name,
|
||||
allowlist_parent_id,
|
||||
allowlist_child_name,
|
||||
allowlist_child_id
|
||||
)
|
||||
elif choice == "R":
|
||||
|
||||
pathf.clean_folders(enforcement_prep)
|
||||
|
||||
elif choice == "Q":
|
||||
break
|
||||
else:
|
||||
print(ct.colorText("Invalid choice. Please try again.", "red"))
|
||||
"""
|
||||
Reference in New Issue
Block a user