diff --git a/AirlockTools.py b/AirlockTools.py index f5c39c5..4abfed9 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -35,7 +35,7 @@ dotenv.load_dotenv() url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] +badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 @@ -253,7 +253,7 @@ def menu_prepare_to_enforce(): elif choice == "3": if os.path.exists(f"approved\\hashes_rep_unknown_{first_policy}_{second_policy}.csv") and os.path.exists(f"approved\\hashes_rep_good_{first_policy}_{second_policy}.csv"): - utils.pathfunctions.generatePathReview(first_policy, second_policy, badpathparts, min_files_for_path) + utils.pathfunctions.generatePathReview(first_policy, second_policy, badpathparts,path_exclusion_constant, min_files_for_path) utils.hashfunctions.generatePublist(first_policy,second_policy,bad_publisher_list) else: print(ct.colorText(f"Please manually approve hashes prior to this step","red")) diff --git a/utils/pathfunctions.py b/utils/pathfunctions.py index 747472b..01c54ff 100644 --- a/utils/pathfunctions.py +++ b/utils/pathfunctions.py @@ -142,7 +142,8 @@ def regulator(paths, case_insensitive=True): print(f"Regulator is providing: {pattern}") return pattern -def generatePathReview(first_policy, second_policy, badpathparts, min_files_for_path): + +def generatePathReview(first_policy, second_policy, badpathparts, path_exclusion_constant, min_files_for_path): if not os.path.exists(f"parquet\\all_approved_hashes_{first_policy}_{second_policy}.parquet"): @@ -151,8 +152,6 @@ def generatePathReview(first_policy, second_policy, badpathparts, min_files_for_ all_approved_hashes = pd.concat([df1 , df2], ignore_index=True).sort_values(by=['filename']) - - print(ct.colorText(f"Approved hash lists have been combined","green")) all_approved_hashes.to_parquet(f"parquet\\all_approved_hashes_{first_policy}_{second_policy}.parquet", index=False) @@ -162,8 +161,8 @@ def generatePathReview(first_policy, second_policy, badpathparts, min_files_for_ if not os.path.exists(f"parquet\\path_needs_approved_{first_policy}_{second_policy}.parquet"): all_approved_hashes = pd.read_parquet(f"parquet\\all_approved_hashes_{first_policy}_{second_policy}.parquet") print(ct.colorText(f"Beginning calculating longest common filepaths for path exceptions","green")) - - haslcp = pathf.split_filepaths_grouped(all_approved_hashes) + + haslcp = pathf.split_filepaths_grouped(all_approved_hashes,"filename",path_exclusion_constant, min_files_for_path) haslcp.drop_duplicates() forbidden = pathf.regulator(badpathparts, True)