First Round Async. Much work left to do, dont trust results of hash categorization presently.

2025-10-16 16:43:56 -04:00
parent fa0c18ee02
commit 6f2355fea9
21 changed files with 903 additions and 1647 deletions
@@ -0,0 +1,108 @@
+"""
+MAJOR WORK IN PROGRESS
+
+from flows.prepPolicy import (
+    buildPathsandPublishers,
+    buildPreflights,
+    selectAllowlists,
+    selectPolicies,
+    sortHashes,
+    )   
+
+
+
+#Pull History for last 24 hours, Make a list of unique policy names that had exectutions
+
+sortHashes(api,selected_policies, type=[1, 2, 6, 7], history_days=150)
+
+
+
+
+
+
+buildPathsandPublishers(False)
+
+buildPreflights()
+            else:
+                print("File not found. Please make sure it's saved correctly and try again.")
+
+
+
+                pathexclusions = pd.read_csv(f"{working_dir}\\Preflight\\approved_paths.csv")
+                hashes = pd.read_csv(f"{working_dir}\\Preflight\\approved_hashes.csv")
+
+                unique_combinations = pathexclusions[["longestcfp", "file_extension"]].drop_duplicates()
+
+                drive_letter_pattern = re.compile(r"^[a-zA-Z]:\\")
+                processed_paths = [
+                    (path if drive_letter_pattern.match(path) else f"\\\\{path}") + f"\\**{ext}"
+                    for path, ext in unique_combinations.itertuples(index=False, name=None)
+                ]
+
+                print(processed_paths)
+                print(colorText("These publishers would added", "yellow"))
+
+                if os.path.exists(f"{working_dir}\\Preflight\\approved_publishers.csv"):
+                    publishers = pd.read_csv(f"{working_dir}\\Preflight\\approved_hashes.csv")
+                    if publishers.empty:
+                        print(colorText("The publishers list is empty.", "red"))
+                    else:
+                        processed_publishers = (
+                            publishers[publishers["publisher_hash"] != "Not Signed"]
+                            ["publisher_hash"]
+                            .drop_duplicates()
+                            .tolist()
+                        )
+                        print(processed_publishers)
+
+                print(colorText("These hashes would be added to:", "yellow"))
+                print(destination_allowlist)
+
+                processed_hashes = hashes["sha256"].unique().tolist()
+                print(processed_hashes)
+
+                if processed_paths and processed_hashes:
+                    tested = True
+            else:
+                # Log which condition(s) failed
+                missing_items = []
+                if not os.path.exists(f"{working_dir}\\Preflight\\approved_paths.csv"):
+                    missing_items.append("approved_paths.csv not found")
+                if not os.path.exists(f"{working_dir}\\Preflight\\approved_hashes.csv"):
+                    missing_items.append("approved_hashes.csv not found")
+                if not destination_policy:
+                    missing_items.append("destination_policy is empty or None")
+                if not destination_allowlist:
+                    missing_items.append("destination_allowlist is empty or None")
+
+                logger.error("Preflight check failed due to the following:")
+                for item in missing_items:
+                    logger.error(f" - {item}")
+
+
+        elif choice == "7":
+            areYouSure()
+            confirmation = get_sanitized_input("Type 'I AGREE' to continue: ")
+            if (
+                tested
+                and destination_policy
+                and destination_allowlist
+                and confirmation.strip() == "I AGREE"
+            ):
+                print(colorText("Proceeding with the code...", "yellow"))
+                api.hash_add_to_allowlist(destination_allowlist[0].applicationid, processed_hashes)
+                api.policy_add_path_exclusions(destination_policy[0].groupid, processed_paths)
+                if processed_publishers:
+                    api.policy_add_publishers(destination_policy[0].groupid, processed_publishers)
+            else:
+                logger.error("Confirmation block failed. Reasons:")
+                if not tested:
+                    logger.error(" - Preflight checks were not completed successfully (`tested` is False).")
+                if not destination_policy:
+                    logger.error(" - `destination_policy` is missing or invalid.")
+                if not destination_allowlist:
+                    logger.error(" - `destination_allowlist` is missing or invalid.")
+                if confirmation.strip() != "I AGREE":
+                    logger.error(" - User did not confirm with 'I AGREE'. Received: '%s'", confirmation.strip())
+
+                    """