diff --git a/AirlockTools.py b/AirlockTools.py index ab02082..d86dcb2 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -32,8 +32,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata"] +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 diff --git a/utils/pathfunctions.py b/utils/pathfunctions.py index e3899dc..e1ddfbb 100644 --- a/utils/pathfunctions.py +++ b/utils/pathfunctions.py @@ -181,4 +181,10 @@ def generatePathReview(first_policy, second_policy, badpathparts, min_files_for_ lcp_not_forbidden_review = lcp_not_forbidden_review[lcp_not_forbidden_review['unique_sha256_count'] >= min_files_for_path] lcp_not_forbidden_review.to_parquet(f"parquet\\path_needs_approved_{first_policy}_{second_policy}.parquet",index=False) - lcp_not_forbidden_review.to_csv(f"needs_approved\\path_needs_approved_{first_policy}_{second_policy}.csv",index=False) \ No newline at end of file + lcp_not_forbidden_review.to_csv(f"needs_approved\\path_needs_approved_{first_policy}_{second_policy}.csv",index=False) + ct.style_dataframe_dark(lcp_not_forbidden_review,f"needs_approved\\path_needs_approved_{first_policy}_{second_policy}.html", True) + + del lcp_not_forbidden + del unique_sha_counts + del lcp_not_forbidden_review +