diff --git a/AirlockTools.py b/AirlockTools.py index 5f9416c..543a446 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -39,6 +39,25 @@ urllib3.disable_warnings( urllib3.exceptions.InsecureRequestWarning ) +urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) +dotenv.load_dotenv() +#Constants +url = os.getenv('url') +bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] +pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] +badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 +path_exclusion_constant = 4 +min_files_for_path = 4 +threat_tolerance_constant = 4 + +policy_relationship_map ={ #Enforcement : Audit +"bf0b1f9b-bfea-4f44-97c0-80e27ff61712" : "538d3218-92f4-4943-a6ee-db9267ab62d8", #AT Servers General, AT Servers General Audit +"31ababac-65de-4c6a-86dd-6691d7e3ee3b" : "fc05b42a-b846-4e72-88ca-c35d416e699f", #AT Epic, #AT Epic Audit +"d1f58960-f866-49e0-848a-a5b09fffd4cd" : "d55c03a6-c376-4391-8626-4f843b882a7c", #AT DMZ Enforced, #AT DMZ Audit +"504dd011-86b6-489a-b78f-eff589cef8aa" : "88a1cfdc-3b30-448b-b309-be16fe437ca3", #AT Workstations BCA, #AT Workstations BCA Audit +"d126db36-72ed-4937-adc7-d88b7509a5b5" : "5aebf6a0-1d67-47b4-9c5f-2866ffca5671" #AT Testing, AT Testing +} + def main(): #Determine working directory, setup directory, configure logging, sent env, get API and URL if not already stored