diff --git a/AirlockTools.py b/AirlockTools.py index 3f3131d..180d624 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -34,8 +34,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata"] +pups = ["logmein", "invalid" , "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 @@ -209,10 +209,10 @@ def menu_prepare_to_enforce(): elif choice == "2": if not os.path.exists(f"parquet\\execution_history_{first_policy}.parquet"): - utils.policyfunctions.getPolicyInfo(url, first_policy, 60) + utils.policyfunctions.getPolicyInfo(url, first_policy, 150) if not os.path.exists(f"parquet\\execution_history_{second_policy}.parquet"): - utils.policyfunctions.getPolicyInfo(url, second_policy, 60) + utils.policyfunctions.getPolicyInfo(url, second_policy, 150) if not os.path.exists(f"parquet\\combined_hashlist_{first_policy}_{second_policy}.parquet"): utils.hashfunctions.combineHashes(url, first_policy, second_policy) diff --git a/utils/pathfunctions.py b/utils/pathfunctions.py index b2a9121..747472b 100644 --- a/utils/pathfunctions.py +++ b/utils/pathfunctions.py @@ -69,7 +69,7 @@ def split_filepaths_grouped(df, col="filename", group_parts=4, min_parts=4): row["longestcfp"] = prefix_str row["middle"] = middle row["filename_only"] = filename - row["file_extension"] = os.path.splitext(filename)[1].tolower() + row["file_extension"] = os.path.splitext(filename)[1].lower() new_rows.append(row) return pd.DataFrame(new_rows).drop(columns=["group_key"]) diff --git a/utils/policyfunctions.py b/utils/policyfunctions.py index 2a7d3d8..815d868 100644 --- a/utils/policyfunctions.py +++ b/utils/policyfunctions.py @@ -113,16 +113,16 @@ def sendToPolicy(url, first_policy, second_policy, destination_name, destination for path, ext in unique_combinations.itertuples(index=False, name=None) ] - addPath(url, destination_id,processed_paths) + addPathReal(url, destination_id,processed_paths) print(ct.colorText(f"Adding hashes to {allowlist_parent_name}", "yellow")) allowlist_parenthashlist = allowbyhash[allowbyhash['reputation_status'] == 'KNOWN']['sha256'].unique().tolist() - addHash(url, allowlist_parent_id,allowlist_parenthashlist) + addHashReal(url, allowlist_parent_id,allowlist_parenthashlist) print(ct.colorText(f"Adding hashes to {allowlist_child_name}", "yellow")) allowlist_childhashlist = allowbyhash[allowbyhash['reputation_status'] == 'UNKNOWN']['sha256'].unique().tolist() - addHash(url, allowlist_child_id, allowlist_childhashlist) + addHashReal(url, allowlist_child_id, allowlist_childhashlist) ct.locked() @@ -136,7 +136,7 @@ def pullPolicyExechistories(url, policiesnames, days, outputjson: bool): if not os.path.exists(file_path): with open(file_path, 'w') as file: json.dump({'error': 'Success', 'response': {'exechistories': []}}, file) - print(f"File '{file_path}' has been crated.") + print(f"File '{file_path}' has been created.") else: print(f"File '{file_path}' already exists.") headers = {"X-APIKey": os.getenv('APIKEY')}