diff --git a/AirlockTools.py b/AirlockTools.py index 3e51ced..a183683 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -132,8 +132,9 @@ def menu_prepare_to_enforce(): first_policy = " " second_policy = " " - allowlist_parent = " " - allowlist_child = " " + allowlist_parent_name = " " + allowlist_child_name = " " + destination_policy = " " df_aggregated_combo = pd.DataFrame() #If the directorys where we're going to store our output dont exist, make them. @@ -230,14 +231,18 @@ def menu_prepare_to_enforce(): else: print(ct.colorText(" [✗] Preflight hash approval list has not been generated","red")) - print(ct.colorText(f"5. Choose the destination parent and child policy allow list", "cyan")) - if allowlist_child == " " and allowlist_parent== " ": - print(ct.colorText(f" [✗] No policies have been chosen","red")) - elif allowlist_parent != " " and allowlist_child != " " and allowlist_parent is allowlist_child: - print(ct.colorText(f" [✓] [✗] Only {allowlist_parent} has been selected this is unusual, but potentially valid case, double check before proceeding,", "yellow")) - elif allowlist_parent != " " and allowlist_child != " " and allowlist_parent is not allowlist_child: - print(ct.colorText(f" [✓] {allowlist_parent} has been selected as Parent Policy","green")) - print(ct.colorText(f" [✓] {allowlist_child} has been selected as Child Policy","green")) + print(ct.colorText(f"5. Choose the destination_name policy and parent and child allow list", "cyan")) + if allowlist_child_name == " " and allowlist_parent_name== " ": + print(ct.colorText(f" [✗] No allowlists have been chosen","red")) + elif allowlist_parent_name != " " and allowlist_child_name != " " and allowlist_parent_name is allowlist_child_name: + print(ct.colorText(f" [✓] [✗] Only {allowlist_parent_name} has been selected this is unusual, but potentially valid case, double check before proceeding,", "yellow")) + elif allowlist_parent_name != " " and allowlist_child_name != " " and allowlist_parent_name is not allowlist_child_name: + print(ct.colorText(f" [✓] {allowlist_parent_name} has been selected as Parent Policy","green")) + print(ct.colorText(f" [✓] {allowlist_child_name} has been selected as Child Policy","green")) + if destination_policy == " ": + print(ct.colorText(f" [✗] No destination_name policy has been chosen","red")) + else: + print(ct.colorText(f" [✓] destination_name policy is {destination_policy}","green")) print(ct.colorText(f"6. Liftoff ------------------------------------------------------", "cyan")) print(ct.colorText(f" Apply path exclusions according to allowed and approved paths", "cyan")) @@ -369,19 +374,27 @@ def menu_prepare_to_enforce(): elif choice == "5": - print(ct.colorText(f"Please choose Parent Allowlist","white")) + print(ct.colorText(f"Please choose destination_name Policy for Path Exclusions","white")) + destination_tuple = utils.allowlist.listPolicies(url) + #print(allowlist_parent_tuple) + destination_name = destination_tuple[1][destination_tuple[0]] + destination_id = destination_tuple[0][destination_tuple[0]] + + print(ct.colorText(f"Please choose Parent Allowlist for Known Hashes","white")) allowlist_parent_tuple = utils.allowlist.listAllowlists(url) #print(allowlist_parent_tuple) - allowlist_parent = allowlist_parent_tuple[1][allowlist_parent_tuple[0]] + allowlist_parent_name = allowlist_parent_tuple[1][allowlist_parent_tuple[0]] + allowlist_parent_id = allowlist_parent_tuple[1][allowlist_parent_tuple[1]] - print(ct.colorText(f"Please choose Child Allowlist","white")) + print(ct.colorText(f"Please choose Child Allowlist for Less-Known Hashes","white")) allowlist_child_tuple = utils.allowlist.listAllowlists(url) #print(allowlist_child_tuple) - allowlist_child = allowlist_child_tuple[1][allowlist_child_tuple[0]] + allowlist_child_name = allowlist_child_tuple[1][allowlist_child_tuple[0]] + allowlist_child_id = allowlist_child_tuple[0][allowlist_child_tuple[0]] elif choice == "6": - if os.path.exists(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.csv") and os.path.exists(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.csv") and allowlist_parent != " " and allowlist_child != " ": + if os.path.exists(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.csv") and os.path.exists(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.csv") and allowlist_parent_name != " " and allowlist_child_name != " ": pathexclusions = tryToReadCSV(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.csv") allowbyhash = tryToReadCSV(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.csv") @@ -397,15 +410,18 @@ def menu_prepare_to_enforce(): if confirmation.strip().upper() == "I AGREE": print(ct.colorText("Proceeding with the code...", "yellow")) - + print(ct.colorText(f"Adding path exclusions to {destination_name}", "yellow")) pathexcludelist = pathexclusions['longestcfp'].unique().tolist() - utils.policyfunctions.addPath(allowlist_child,pathexcludelist) - + utils.policyfunctions.addPath(destination_id,pathexcludelist) + + print(ct.colorText(f"Adding hashes to {allowlist_parent_name}", "yellow")) allowlist_parenthashlist = allowbyhash[allowbyhash['reputation_status'] == 'KNOWN']['sha256'].tolist() - utils.policyfunctions.addHash(allowlist_parent,allowlist_parenthashlist) + utils.policyfunctions.addHash(allowlist_parent_id,allowlist_parenthashlist) + + print(ct.colorText(f"Adding hashes to {allowlist_child_name}", "yellow")) allowlist_childhashlist = allowbyhash[allowbyhash['reputation_status'] == 'UNKNOWN']['sha256'].tolist() - utils.policyfunctions.addHash(allowlist_child, allowlist_childhashlist) + utils.policyfunctions.addHash(allowlist_child_id, allowlist_childhashlist) else: print(ct.colorText("Operation aborted. You MUST EXPLICITLY AGREE to proceed.", "red")) diff --git a/utils/policyfunctions.py b/utils/policyfunctions.py index 287fa5b..aafff35 100644 --- a/utils/policyfunctions.py +++ b/utils/policyfunctions.py @@ -15,6 +15,7 @@ import requests import json +import os import utils.pretty as ct def addHash(policy, hash): @@ -32,7 +33,7 @@ def addHashReal(url, allowlistID, hashlist): endpoint = url + '/v1/hash/application/add' print(ct.colorText("[+] Grabbing All Categories", "cyan")) payload = { - "applicationid" : allowlistID + "applicationid" : allowlistID, "hashes" : hashlist } headers = { @@ -50,7 +51,7 @@ def addPathReal(url, grouplistID, pathlist): endpoint = url + '/v1/group/path/add' print(ct.colorText("[+] Grabbing All Categories", "cyan")) payload = { - "applicationid" : grouplistID + "applicationid" : grouplistID, "hashes" : pathlist } headers = {