Enhanced Quiet Finder

utils/policyfunctions.py

@@ -100,7 +100,7 @@ def getPolicyInfo(url, policy, type, days, parquet=True):
         data = json.loads(exehist)
         executionhist_policy = pd.DataFrame(data["response"]["exechistories"])
         if not executionhist_policy.empty:
-            executionhist_policy = executionhist_policy[['sha256', 'publisher', 'filename', 'hostname', 'username', 'pprocess', 'gprocess', 'commandline']]
+            executionhist_policy = executionhist_policy[['datetime','sha256', 'publisher', 'filename', 'hostname', 'username', 'pprocess', 'gprocess', 'commandline']]
             executionhist_policy['policy'] = policy  # Add policy column here
             executionhist_policy = executionhist_policy.drop_duplicates(subset=['sha256', 'filename', 'hostname'])
             executionhist_policy = executionhist_policy.sort_values(by=['sha256', 'filename'])
@@ -316,7 +316,6 @@ def listAllowlists(url: str) -> tuple[int, list, list]:
 def skipback(days):
     """
     Generate a MongoDB ObjectId for a given number of days ago from today.
-    Adds 1 extra day to the input to look further back.
     """
     adjusted_days = days
     date_days_ago = datetime.datetime.now(datetime.UTC) - datetime.timedelta(days=adjusted_days)