Reverting Back to Working Branch

utils/allowlist.py

@@ -27,6 +27,7 @@ import utils.colortext as ct
 
 >>>>>>> b187d8c (Added colors)
 
+
 def pullPolicyExechistories(url, choice, policiesnames, outputjson: bool): 
    
     headers = {
@@ -81,9 +82,12 @@ def listPolicies(url):
         policyids.append(list['groupid'])
     choice = input(ct.colorText("Select Policy Group: ", "white"))
     choice = int(choice) - 1
+<<<<<<< HEAD
 <<<<<<< HEAD
     return choice, policiesnames
 =======
+=======
+>>>>>>> b187d8cd79c04d364185a4e366d0432841a3372a
     checkpoint = '000000000000000000000000'
     json_output = {'error': 'Success', 'response': {'exechistories': []}}
     while True:
@@ -152,4 +156,7 @@ def checkpoint_stomper(checkpoint, url, policy, headers):
 
 
     print("Finished")
+<<<<<<< HEAD
 >>>>>>> ccbf716 (Zar-Branch (#6))
+=======
+>>>>>>> b187d8cd79c04d364185a4e366d0432841a3372a

utils/hashfunctions.py

@@ -90,6 +90,7 @@ def categorizeHashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_publ
 
     df = aug_df.copy()
 
+<<<<<<< HEAD
 <<<<<<< HEAD
     def reputationtool(row):
         val = row["reputation_scannermatch"]
@@ -100,11 +101,17 @@ def categorizeHashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_publ
         if row["reputation_scannermatch"] == "N/A":
             return True
 >>>>>>> ccbf716 (Zar-Branch (#6))
+=======
+    def reputationtool(row, threat_tolerance):
+        if row["reputation_scannermatch"] == "N/A":
+            return True
+>>>>>>> b187d8cd79c04d364185a4e366d0432841a3372a
         try:
             return int(val) > threat_tolerance
         except (ValueError, TypeError):
             return row["publisher_y"] == "Not Signed"
 
+<<<<<<< HEAD
 <<<<<<< HEAD
     df["reputation_flag"] = df.apply(reputationtool, axis=1)
 
@@ -112,25 +119,25 @@ def categorizeHashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_publ
         ((df["publisher_y"] == "Not Signed") & df["reputation_flag"]) |
         (df["reputation_status"] == "UNKNOWN")
     )
+=======
+    mask_needsreview = (df["publisher_y"] == "Not Signed") & df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)
+>>>>>>> b187d8cd79c04d364185a4e366d0432841a3372a
 
     mask_approved = (
-        (
-            (df["publisher_y"] != "Not Signed") &
-            ~df["publisher_y"].isin(untrusted_publishers) &
-            ~df["reputation_status"].isna()
-        ) |
-        (
-            (df["publisher_y"] == "Not Signed") &
-            ~df["reputation_flag"] &
-            ~df["publisher_y"].isin(untrusted_publishers) &
-            ~df["reputation_status"].isna()
-        )
+    ((df["publisher_y"] != "Not Signed") & (~df["publisher_y"].isin(untrusted_publishers))) &
+    (df["publisher_y"] != "Not Signed")  # explicitly signed
+    ) | (
+    (df["publisher_y"] == "Not Signed") &
+    (~df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)) &
+    (~df["publisher_y"].isin(untrusted_publishers))  # exclude untrusted even if unsigned
     )
 
+
     needsreview_df = df[mask_needsreview]
     approved_df = df[mask_approved]
-    unapproved_df = df[~(mask_needsreview | mask_approved)]
+    remaining_df = df[~(mask_needsreview | mask_approved)]
 
+<<<<<<< HEAD
     return needsreview_df, approved_df, unapproved_df
 =======
     mask_needsreview = (df["publisher_y"] == "Not Signed") & df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)
@@ -151,3 +158,6 @@ def categorizeHashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_publ
 
     return needsreview_df, approved_df, remaining_df
 >>>>>>> ccbf716 (Zar-Branch (#6))
+=======
+    return needsreview_df, approved_df, remaining_df
+>>>>>>> b187d8cd79c04d364185a4e366d0432841a3372a

utils/pathfunctions.py

@@ -57,9 +57,12 @@ def filepathInitialGroup(df: pd.DataFrame):
                 break
         return join_parts(prefix)
 
+<<<<<<< HEAD
 <<<<<<< HEAD
     # Step 6: Group directories by shared prefix
 =======
+=======
+>>>>>>> b187d8cd79c04d364185a4e366d0432841a3372a
     # Step 6: Group directories by shared prefix using custom logic
     """
     Loop through each directory path
@@ -67,7 +70,10 @@ def filepathInitialGroup(df: pd.DataFrame):
     groups: will hold lists of grouped directories.
     used: tracks which directories have already been grouped.
     """
+<<<<<<< HEAD
 >>>>>>> ccbf716 (Zar-Branch (#6))
+=======
+>>>>>>> b187d8cd79c04d364185a4e366d0432841a3372a
     directories = df["directory"].tolist()
     groups = []
     used = set()
@@ -85,6 +91,7 @@ def filepathInitialGroup(df: pd.DataFrame):
         group = [path]
         parts_i = get_parts(path)
 
+<<<<<<< HEAD
 <<<<<<< HEAD
         for j in range(i + 1, len(directories)):
             parts_j = get_parts(directories[j])
@@ -107,6 +114,23 @@ def filepathInitialGroup(df: pd.DataFrame):
             common = os.path.commonprefix([parts_i, parts_j])
         #Apply grouping rules
 >>>>>>> ccbf716 (Zar-Branch (#6))
+=======
+    #Compare with all other directories: For each other directory, split it into parts and find the common prefix (shared folder structure).
+        """
+        Logic:
+        If the directory is deep (>3 parts) and shares at least 3 parts → group it.
+        If it's exactly 3 parts long and shares at least 2 → group it.
+        Or, if it shares all but one part and is deep → group it.
+        These rules are designed to:
+        Group directories that are closely related in structure.
+        Avoid grouping unrelated paths that just happen to start similarly.
+        """  
+
+        for j in range(i + 1, len(directories)):
+            parts_j = get_parts(directories[j])
+            common = os.path.commonprefix([parts_i, parts_j])
+        #Apply grouping rules
+>>>>>>> b187d8cd79c04d364185a4e366d0432841a3372a
             if (len(parts_i) > 3 and len(common) >= 3) or (len(parts_i) == 3 and len(common) >= 2):
                 group.append(directories[j])
                 used.add(directories[j])
@@ -134,11 +158,15 @@ def filepathInitialGroup(df: pd.DataFrame):
     path_eligible = grouped_df[grouped_df["depth"] > 2].drop(columns=["depth"])
     path_ineligible = grouped_df[grouped_df["depth"] <= 2].drop(columns=["depth"])
 
+<<<<<<< HEAD
 <<<<<<< HEAD
     # Step 10: Move entries from eligible to ineligible if grouped_directory contains excluded directories
 =======
     # Step 10: Move entries from eligible to ineligible if grouped_directory contains 'C:\Users' or 'c$\Users'
 >>>>>>> ccbf716 (Zar-Branch (#6))
+=======
+    # Step 10: Move entries from eligible to ineligible if grouped_directory contains 'C:\Users' or 'c$\Users'
+>>>>>>> b187d8cd79c04d364185a4e366d0432841a3372a
     mask = path_eligible["grouped_directory"].str.contains(r"(?i)(?:\\Users|\\c\$\\Users|inetpub\\wwwroot|windows\\temp)", na=False)
     move_to_ineligible = path_eligible[mask]
     path_eligible = path_eligible[~mask]