mysticmomba/AirlockTools
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

Fixed a breaking sort change, added some more logic to give insight on why functions arent running

Browse Source
This commit is contained in:
Zarithas
2025-10-07 16:14:25 -04:00
parent bec051b240
commit 6e4e35fa34
5 changed files with 103 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
models/execution.py
+35 -25
View File
@@ -126,7 +126,6 @@ class Hash:
@classmethod
def categorize_hashes(cls, hashes):
threat_tolerance = load_env("VT_THREAT_TOLERANCE", cast_type=int)
bad_publishers_pattern = regulator(load_env_json("BAD_PUBLISHERS", "[]"))
pups_pattern = regulator(load_env_json("PUPS", "[]"))
@@ -135,38 +134,48 @@ class Hash:
approved = []
unapproved = []
def reputationtool(hash_obj):
val = hash_obj.reputation.get("scannermatch") if isinstance(hash_obj.reputation, dict) else None
if val in [None, "N/A"]:
return hash_obj.publisher == "Not Signed"
try:
return int(val) > threat_tolerance
except (ValueError, TypeError):
return hash_obj.publisher == "Not Signed"
for hash_obj in hashes:
publisher = hash_obj.publisher or ""
description = hash_obj.description or ""
reputation = hash_obj.reputation if isinstance(hash_obj.reputation, dict) else {}
rep_status = reputation.get("status")
scannermatch = reputation.get("scannermatch")
rep_flag = reputationtool(hash_obj)
logger.debug(f"Evaluating hash: {hash_obj}")
logger.debug(f"Publisher: {publisher}, Description: {description}, Scannermatch: {scannermatch}")
is_signed = publisher != "Not Signed"
is_untrusted = re.search(bad_publishers_pattern, publisher, re.IGNORECASE) is not None
is_pup = re.search(pups_pattern, description, re.IGNORECASE) is not None
has_known_status = rep_status == "KNOWN"
if (not is_signed and rep_flag) or rep_status == "UNKNOWN":
needs_review.append(hash_obj)
elif (
(is_signed and not is_untrusted and has_known_status and not is_pup) or
(not is_signed and not rep_flag and not is_untrusted and has_known_status and not is_pup)
):
approved.append(hash_obj)
else:
# 1. Unapproved: bad publisher or PUP
if re.search(bad_publishers_pattern, publisher, re.IGNORECASE):
logger.debug("Unapproved: Publisher matches bad publisher pattern.")
unapproved.append(hash_obj)
continue
if re.search(pups_pattern, description, re.IGNORECASE):
logger.debug("Unapproved: Description matches PUP pattern.")
unapproved.append(hash_obj)
continue
# 2. Approved: signed
if publisher != "Not Signed":
logger.debug("Approved: File is signed and not flagged.")
approved.append(hash_obj)
continue
# 3. Approved or Unapproved based on threat level
try:
score = int(scannermatch)
logger.debug(f"Parsed scannermatch score: {score}")
if score > threat_tolerance:
logger.debug("Unapproved: Unsigned file with high threat score.")
unapproved.append(hash_obj)
else:
logger.debug("Approved: Unsigned file with low threat score.")
approved.append(hash_obj)
except (ValueError, TypeError):
logger.debug("Needs Review: Scannermatch score is missing or invalid.")
needs_review.append(hash_obj)
logger.debug(f"Final counts — Needs Review: {len(needs_review)}, Approved: {len(approved)}, Unapproved: {len(unapproved)}")
return needs_review, approved, unapproved
@@ -287,6 +296,7 @@ class ExecutionHistoryRecord:
how="left", # Preserve all executions, enrich where possible
suffixes=("_exec", "_hash")
)
merged_df.sort_values(by="filename_exec", inplace=True)
logger.info(f"Merged {len(merged_df)} rows. Non-null hash matches: {merged_df['sha256'].notna().sum()}")
filename = f"{label}_executions.csv"