Took safeties and turned them into a preflight test so we no longer have to toggle

This commit is contained in:
=
2025-09-17 09:31:25 -04:00
parent 99b05c9cc7
commit bfd853fc76
3 changed files with 57 additions and 3 deletions
+38 -2
View File
@@ -35,7 +35,6 @@ def addHash(url, policy, hash):
pass
# print(p)
def addPath(url, policy, hash):
print(f"Adding the following Path Exclusions to {policy}:")
for p in hash:
@@ -137,6 +136,8 @@ def sendToPolicy(url, first_policy, second_policy, destination_name, destination
addPathReal(url, destination_id,processed_paths)
print(ct.colorText(f"Adding publishers to {destination_name}", "yellow"))
publisher_list = publishers['publisher'].tolist()
addPubReal(url, destination_id, publisher_list)
@@ -285,4 +286,39 @@ def skipback(days):
hex_timestamp = format(timestamp, '08x')
objectid_hex = hex_timestamp + '0000000000000000'
return ObjectId(objectid_hex)
def sendToPolicyTest(url, first_policy, second_policy, destination_name, destination_id, allowlist_parent_name, allowlist_parent_id, allowlist_child_name, allowlist_child_id):
pathexclusions = pd.read_parquet(f"parquet\\final_path_exclusions_{first_policy}_{second_policy}.parquet")
allowbyhash = pd.read_parquet(f"parquet\\final_hash_approvals_{first_policy}_{second_policy}.parquet")
publishers = pd.read_parquet(f"parquet\\publishers_{first_policy}_{second_policy}.parquet")
print(ct.colorText(f"These path exclusions would be added to {destination_name}", "yellow"))
# Get unique combinations of longestcfp and file_extension
unique_combinations = pathexclusions[["longestcfp", "file_extension"]].drop_duplicates()
# Regex to match a Windows drive letter at the start (e.g., C:\)
drive_letter_pattern = re.compile(r'^[a-zA-Z]:\\')
# Build processed paths like \\path\\**.exe or C:\path\**.jar
processed_paths = [
(path if drive_letter_pattern.match(path) else f"\\\\{path}") + f"\\**{ext}"
for path, ext in unique_combinations.itertuples(index=False, name=None)
]
addPath(url, destination_id,processed_paths)
print(ct.colorText(f"These publishers would added to {destination_name}", "yellow"))
publisher_list = publishers['publisher'].tolist()
addPub(url, destination_id, publisher_list)
print(ct.colorText(f"These hashes would be added to {allowlist_parent_name}", "yellow"))
allowlist_parenthashlist = allowbyhash[allowbyhash['reputation_status'] == 'KNOWN']['sha256'].unique().tolist()
addHash(url, allowlist_parent_id,allowlist_parenthashlist)
print(ct.colorText(f"These hashes would be added to {allowlist_child_name}", "yellow"))
allowlist_childhashlist = allowbyhash[allowbyhash['reputation_status'] == 'UNKNOWN']['sha256'].unique().tolist()
addHash(url, allowlist_child_id, allowlist_childhashlist)