Major refactor: security enhancements, modularization, config integration, reduced Parquet reliance

- Migrated codebase to class-based architecture for better modularity and maintainability - Introduced system_config.json for centralized configuration (required for runtime) - Added structured working directories for improved file organization - Significantly reduced reliance on Parquet; replaced with alternative data handling - Implemented security improvements across modules - Several TODOs remain in the main script for future enhancements - Linter formatting affected readability in some files (e.g., utils); cleanup is on the agenda
2025-10-05 22:20:42 -04:00
parent b1e6af01c6
commit 89db386ffe
26 changed files with 3530 additions and 2389 deletions
@@ -0,0 +1,123 @@
+#    Copyright (C) 2025 James Brotosky, Brandon Wickline
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU Affero General Public License as published
+#    by the Free Software Foundation, either version 3 of the License, or
+#    (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU Affero General Public License for more details.
+#
+#    You should have received a copy of the GNU Affero General Public License
+#    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+import datetime
+import logging
+
+import pandas as pd
+
+from flows.prepPolicy import selectPolicies
+from services.API import AirlockAPIWrapper
+from services.policyhandler import getPolicyInfo
+from services.selector import Selector
+from utils.utils import colorText, load_env
+
+logger = logging.getLogger(__name__)
+import dotenv
+
+dotenv.load_dotenv()
+
+
+def findQuietAgents(api: AirlockAPIWrapper):
+    working_dir = load_env("WORKING_DIR")
+    # Get policy selection and agent list
+    selected_policy = selectPolicies(api, False)
+    if selected_policy:
+        agents = api.agents_find_by_group(selected_policy[0].groupid)
+
+        # Prompt user for history range
+        history_days = Selector.select_value(
+            prompt="Enter how many days of history to pull (1–150): ",
+            value_type=int,
+            valid_range=(1, 150),
+        )
+        required_quiet = Selector.select_value(
+            prompt="Enter how many days without an untrusted execution before these are considered ready for enforcement? (1–365): ",
+            value_type=int,
+            valid_range=(1, 365),
+        )
+
+        # Get execution history as a DataFrame
+        policy_exec_history = getPolicyInfo(
+            api, selected_policy[0], [1, 2, 6, 7], history_days
+        )
+        
+       
+        if policy_exec_history.empty:
+            logging.info("No execution history found for the selected policy and time range.")
+            return
+
+
+        # Convert 'datetime' column to timezone-aware datetime objects
+        policy_exec_history["datetime"] = pd.to_datetime(
+            policy_exec_history["datetime"], format="%Y-%m-%dT%H:%M:%SZ", utc=True
+        )
+
+        # Get current UTC time
+        now = datetime.datetime.now(datetime.timezone.utc)
+
+        # Calculate days ago
+        policy_exec_history["days_ago"] = policy_exec_history["datetime"].apply(
+            lambda dt: (now - dt).days
+        )
+
+        # Count total executions per hostname
+        hostname_counts = policy_exec_history["hostname"].value_counts()
+
+        # Map execution counts to agents
+        agents["execution_count"] = agents["hostname"].map(hostname_counts).fillna(0).astype(int)
+
+        # Find most recent execution per hostname
+        most_recent_exec = policy_exec_history.sort_values(by="days_ago").drop_duplicates(
+            subset="hostname", keep="first"
+        )
+
+        # Map most recent execution age to agents
+        agents["days_since"] = agents["hostname"].map(
+            most_recent_exec.set_index("hostname")["days_ago"]
+        )
+
+        # Check for enforcement readiness
+        agents["required_quiet"] = required_quiet
+        agents["enforce_ready"] = agents["days_since"].apply(
+            lambda x: True if pd.isna(x) or x > required_quiet else False
+        )
+
+        # Sort agents by execution count and hostname
+        agents = agents.sort_values(by=["execution_count", "hostname"], ascending=[True, True])
+
+        # Save to CSV
+        filename = f"{working_dir}\\{selected_policy[0].name}_agents_last_{history_days}_days.csv"
+        logging.debug(f"Saving CSV to {filename}")
+        print(colorText(f"Saving CSV to {filename}", "green"))
+        agents.to_csv(filename, index=False)
+
+        # Summary statistics
+        total_agents = len(agents)
+        ready_agents = agents["enforce_ready"].sum()
+        not_ready_agents = total_agents - ready_agents
+        ready_percentage = (ready_agents / total_agents) * 100
+
+        # Print results
+        
+    
+        message = (
+            f"Total agents: {total_agents}\n"
+            f"Agents marked as 'enforce_ready': {ready_agents}\n"
+            f"Agents not ready: {not_ready_agents}\n"
+            f"Percentage ready for enforcement: {ready_percentage:.2f}%"
+        )
+        logger.debug(message)
+        colorText(message,"green")