Updated functions... need to be able to pull groupid and applicationid out of the list functions, else make new ones to do that
This commit is contained in:
=
+35
-19
@@ -132,8 +132,9 @@ def menu_prepare_to_enforce():
|
||||
|
||||
first_policy = " "
|
||||
second_policy = " "
|
||||
allowlist_parent = " "
|
||||
allowlist_child = " "
|
||||
allowlist_parent_name = " "
|
||||
allowlist_child_name = " "
|
||||
destination_policy = " "
|
||||
df_aggregated_combo = pd.DataFrame()
|
||||
|
||||
#If the directorys where we're going to store our output dont exist, make them.
|
||||
@@ -230,14 +231,18 @@ def menu_prepare_to_enforce():
|
||||
else:
|
||||
print(ct.colorText(" [✗] Preflight hash approval list has not been generated","red"))
|
||||
|
||||
print(ct.colorText(f"5. Choose the destination parent and child policy allow list", "cyan"))
|
||||
if allowlist_child == " " and allowlist_parent== " ":
|
||||
print(ct.colorText(f" [✗] No policies have been chosen","red"))
|
||||
elif allowlist_parent != " " and allowlist_child != " " and allowlist_parent is allowlist_child:
|
||||
print(ct.colorText(f" [✓] [✗] Only {allowlist_parent} has been selected this is unusual, but potentially valid case, double check before proceeding,", "yellow"))
|
||||
elif allowlist_parent != " " and allowlist_child != " " and allowlist_parent is not allowlist_child:
|
||||
print(ct.colorText(f" [✓] {allowlist_parent} has been selected as Parent Policy","green"))
|
||||
print(ct.colorText(f" [✓] {allowlist_child} has been selected as Child Policy","green"))
|
||||
print(ct.colorText(f"5. Choose the destination_name policy and parent and child allow list", "cyan"))
|
||||
if allowlist_child_name == " " and allowlist_parent_name== " ":
|
||||
print(ct.colorText(f" [✗] No allowlists have been chosen","red"))
|
||||
elif allowlist_parent_name != " " and allowlist_child_name != " " and allowlist_parent_name is allowlist_child_name:
|
||||
print(ct.colorText(f" [✓] [✗] Only {allowlist_parent_name} has been selected this is unusual, but potentially valid case, double check before proceeding,", "yellow"))
|
||||
elif allowlist_parent_name != " " and allowlist_child_name != " " and allowlist_parent_name is not allowlist_child_name:
|
||||
print(ct.colorText(f" [✓] {allowlist_parent_name} has been selected as Parent Policy","green"))
|
||||
print(ct.colorText(f" [✓] {allowlist_child_name} has been selected as Child Policy","green"))
|
||||
if destination_policy == " ":
|
||||
print(ct.colorText(f" [✗] No destination_name policy has been chosen","red"))
|
||||
else:
|
||||
print(ct.colorText(f" [✓] destination_name policy is {destination_policy}","green"))
|
||||
|
||||
print(ct.colorText(f"6. Liftoff ------------------------------------------------------", "cyan"))
|
||||
print(ct.colorText(f" Apply path exclusions according to allowed and approved paths", "cyan"))
|
||||
@@ -369,19 +374,27 @@ def menu_prepare_to_enforce():
|
||||
|
||||
elif choice == "5":
|
||||
|
||||
print(ct.colorText(f"Please choose Parent Allowlist","white"))
|
||||
print(ct.colorText(f"Please choose destination_name Policy for Path Exclusions","white"))
|
||||
destination_tuple = utils.allowlist.listPolicies(url)
|
||||
#print(allowlist_parent_tuple)
|
||||
destination_name = destination_tuple[1][destination_tuple[0]]
|
||||
destination_id = destination_tuple[0][destination_tuple[0]]
|
||||
|
||||
print(ct.colorText(f"Please choose Parent Allowlist for Known Hashes","white"))
|
||||
allowlist_parent_tuple = utils.allowlist.listAllowlists(url)
|
||||
#print(allowlist_parent_tuple)
|
||||
allowlist_parent = allowlist_parent_tuple[1][allowlist_parent_tuple[0]]
|
||||
allowlist_parent_name = allowlist_parent_tuple[1][allowlist_parent_tuple[0]]
|
||||
allowlist_parent_id = allowlist_parent_tuple[1][allowlist_parent_tuple[1]]
|
||||
|
||||
|
||||
print(ct.colorText(f"Please choose Child Allowlist","white"))
|
||||
print(ct.colorText(f"Please choose Child Allowlist for Less-Known Hashes","white"))
|
||||
allowlist_child_tuple = utils.allowlist.listAllowlists(url)
|
||||
#print(allowlist_child_tuple)
|
||||
allowlist_child = allowlist_child_tuple[1][allowlist_child_tuple[0]]
|
||||
allowlist_child_name = allowlist_child_tuple[1][allowlist_child_tuple[0]]
|
||||
allowlist_child_id = allowlist_child_tuple[0][allowlist_child_tuple[0]]
|
||||
|
||||
elif choice == "6":
|
||||
if os.path.exists(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.csv") and os.path.exists(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.csv") and allowlist_parent != " " and allowlist_child != " ":
|
||||
if os.path.exists(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.csv") and os.path.exists(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.csv") and allowlist_parent_name != " " and allowlist_child_name != " ":
|
||||
|
||||
pathexclusions = tryToReadCSV(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.csv")
|
||||
allowbyhash = tryToReadCSV(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.csv")
|
||||
@@ -397,15 +410,18 @@ def menu_prepare_to_enforce():
|
||||
|
||||
if confirmation.strip().upper() == "I AGREE":
|
||||
print(ct.colorText("Proceeding with the code...", "yellow"))
|
||||
|
||||
print(ct.colorText(f"Adding path exclusions to {destination_name}", "yellow"))
|
||||
pathexcludelist = pathexclusions['longestcfp'].unique().tolist()
|
||||
utils.policyfunctions.addPath(allowlist_child,pathexcludelist)
|
||||
utils.policyfunctions.addPath(destination_id,pathexcludelist)
|
||||
|
||||
print(ct.colorText(f"Adding hashes to {allowlist_parent_name}", "yellow"))
|
||||
allowlist_parenthashlist = allowbyhash[allowbyhash['reputation_status'] == 'KNOWN']['sha256'].tolist()
|
||||
utils.policyfunctions.addHash(allowlist_parent,allowlist_parenthashlist)
|
||||
utils.policyfunctions.addHash(allowlist_parent_id,allowlist_parenthashlist)
|
||||
|
||||
|
||||
print(ct.colorText(f"Adding hashes to {allowlist_child_name}", "yellow"))
|
||||
allowlist_childhashlist = allowbyhash[allowbyhash['reputation_status'] == 'UNKNOWN']['sha256'].tolist()
|
||||
utils.policyfunctions.addHash(allowlist_child, allowlist_childhashlist)
|
||||
utils.policyfunctions.addHash(allowlist_child_id, allowlist_childhashlist)
|
||||
|
||||
else:
|
||||
print(ct.colorText("Operation aborted. You MUST EXPLICITLY AGREE to proceed.", "red"))
|
||||
|
||||
@@ -15,6 +15,7 @@
|
||||
|
||||
import requests
|
||||
import json
|
||||
import os
|
||||
import utils.pretty as ct
|
||||
|
||||
def addHash(policy, hash):
|
||||
@@ -32,7 +33,7 @@ def addHashReal(url, allowlistID, hashlist):
|
||||
endpoint = url + '/v1/hash/application/add'
|
||||
print(ct.colorText("[+] Grabbing All Categories", "cyan"))
|
||||
payload = {
|
||||
"applicationid" : allowlistID
|
||||
"applicationid" : allowlistID,
|
||||
"hashes" : hashlist
|
||||
}
|
||||
headers = {
|
||||
@@ -50,7 +51,7 @@ def addPathReal(url, grouplistID, pathlist):
|
||||
endpoint = url + '/v1/group/path/add'
|
||||
print(ct.colorText("[+] Grabbing All Categories", "cyan"))
|
||||
payload = {
|
||||
"applicationid" : grouplistID
|
||||
"applicationid" : grouplistID,
|
||||
"hashes" : pathlist
|
||||
}
|
||||
headers = {
|
||||
|
||||
Reference in New Issue
Block a user