Took safeties and turned them into a preflight test so we no longer have to toggle
This commit is contained in:
@@ -35,7 +35,6 @@ def addHash(url, policy, hash):
|
||||
pass
|
||||
# print(p)
|
||||
|
||||
|
||||
def addPath(url, policy, hash):
|
||||
print(f"Adding the following Path Exclusions to {policy}:")
|
||||
for p in hash:
|
||||
@@ -137,6 +136,8 @@ def sendToPolicy(url, first_policy, second_policy, destination_name, destination
|
||||
|
||||
addPathReal(url, destination_id,processed_paths)
|
||||
|
||||
print(ct.colorText(f"Adding publishers to {destination_name}", "yellow"))
|
||||
|
||||
publisher_list = publishers['publisher'].tolist()
|
||||
addPubReal(url, destination_id, publisher_list)
|
||||
|
||||
@@ -285,4 +286,39 @@ def skipback(days):
|
||||
hex_timestamp = format(timestamp, '08x')
|
||||
objectid_hex = hex_timestamp + '0000000000000000'
|
||||
return ObjectId(objectid_hex)
|
||||
|
||||
|
||||
def sendToPolicyTest(url, first_policy, second_policy, destination_name, destination_id, allowlist_parent_name, allowlist_parent_id, allowlist_child_name, allowlist_child_id):
|
||||
pathexclusions = pd.read_parquet(f"parquet\\final_path_exclusions_{first_policy}_{second_policy}.parquet")
|
||||
allowbyhash = pd.read_parquet(f"parquet\\final_hash_approvals_{first_policy}_{second_policy}.parquet")
|
||||
publishers = pd.read_parquet(f"parquet\\publishers_{first_policy}_{second_policy}.parquet")
|
||||
|
||||
|
||||
print(ct.colorText(f"These path exclusions would be added to {destination_name}", "yellow"))
|
||||
|
||||
# Get unique combinations of longestcfp and file_extension
|
||||
unique_combinations = pathexclusions[["longestcfp", "file_extension"]].drop_duplicates()
|
||||
|
||||
# Regex to match a Windows drive letter at the start (e.g., C:\)
|
||||
drive_letter_pattern = re.compile(r'^[a-zA-Z]:\\')
|
||||
|
||||
# Build processed paths like \\path\\**.exe or C:\path\**.jar
|
||||
processed_paths = [
|
||||
(path if drive_letter_pattern.match(path) else f"\\\\{path}") + f"\\**{ext}"
|
||||
for path, ext in unique_combinations.itertuples(index=False, name=None)
|
||||
]
|
||||
|
||||
addPath(url, destination_id,processed_paths)
|
||||
|
||||
print(ct.colorText(f"These publishers would added to {destination_name}", "yellow"))
|
||||
|
||||
publisher_list = publishers['publisher'].tolist()
|
||||
addPub(url, destination_id, publisher_list)
|
||||
|
||||
print(ct.colorText(f"These hashes would be added to {allowlist_parent_name}", "yellow"))
|
||||
|
||||
allowlist_parenthashlist = allowbyhash[allowbyhash['reputation_status'] == 'KNOWN']['sha256'].unique().tolist()
|
||||
addHash(url, allowlist_parent_id,allowlist_parenthashlist)
|
||||
|
||||
print(ct.colorText(f"These hashes would be added to {allowlist_child_name}", "yellow"))
|
||||
allowlist_childhashlist = allowbyhash[allowbyhash['reputation_status'] == 'UNKNOWN']['sha256'].unique().tolist()
|
||||
addHash(url, allowlist_child_id, allowlist_childhashlist)
|
||||
Reference in New Issue
Block a user