Audit Policy Update Mechs added, both interactive & non

AirlockTools.py

@@ -41,28 +41,12 @@ path_exclusion_constant = 4
 min_files_for_path = 4
 threat_tolerance_constant = 4
 
-"""
-Execution Types
- 0 = "Trusted Execution",
- 1 = "Blocked Execution", 
- 2 = "Untrusted Execution [Audit]", 
- 3 = "Untrusted Execution [OTP]", 
- 4 = "Trusted Path Execution", 
- 5 = "Trusted Publisher Execution", 
- 6 = "Blocklist Execution", 
- 7 = "Blocklist Execution [Audit]", 
- 8 = "Trusted Process Execution", 
- 9 = "Constrained Execution", 
- 10 = "Trusted Metadata Execution",
- 11 = "Trusted Browser Execution", 
- 12 = "Blocked Browser Execution", 
- 13 = "Untrusted Browser Execution [Audit]", 
- 14 = "Untrusted Browser Execution [OTP]", 
- 15 = "Blocklist Browser Execution [Audit]", 
- 16 = "Blocklist Browser Execution", 
- 17 = "Trusted Installer Execution", 
- 18 = "Trusted Browser Metadata Execution"
-"""
+policy_relationship_map ={ #Enforcement : Audit
+#"bf0b1f9b-bfea-4f44-97c0-80e27ff61712" : "538d3218-92f4-4943-a6ee-db9267ab62d8", #AT Servers General, AT Servers General Audit
+#"31ababac-65de-4c6a-86dd-6691d7e3ee3b" : "fc05b42a-b846-4e72-88ca-c35d416e699f" #AT Epic, #AT Epic Audit
+"bf0b1f9b-bfea-4f44-97c0-80e27ff61712" : "d126db36-72ed-4937-adc7-d88b7509a5b5" #AT Servers General, AT Testing
+}
+
 
 
 def main():
@@ -83,8 +67,11 @@ def main():
 			apivalidation()
 					
 			register_function("monitorOTP", utils.otpfunctions.monitorOTP)
+			register_function("updateAudit", utils.policyfunctions.updateAuditPoliciesFromEnforcementPolices)
 			
-			if not os.path.exists("scheduling\\jobs.json"): recurring_job("monitor", "monitorOTP", interval=60, unit="seconds", args=[url, pups])
+			if not os.path.exists("scheduling\\jobs.json"): 
+				recurring_job("monitorOTP", "monitorOTP", interval=60, unit="seconds", args=[url, pups])
+				recurring_job("updateAudit", "updateAudit", interval=10, unit="minutes", args=[url, policy_relationship_map])
 			else:
 				reload_jobs()
 			start_scheduler()
@@ -136,6 +123,7 @@ def menu_main():
 		print(ct.colorText("2. OTP", "yellow"))
 		print(ct.colorText("3. Divide by Exclusion", "yellow"))
 		print(ct.colorText("4. Prepare Policy For Enforcement", "yellow"))
+		print(ct.colorText("5. Update Audit Policies from Enforcement Policies", "yellow"))
 		print(ct.colorText("Q. Quit", "yellow"))
 
 		choice = input(ct.colorText("\nEnter Menu Item: ", "white"))
@@ -147,6 +135,8 @@ def menu_main():
 			menu_feature2()
 		elif choice == "4":
 			menu_prepare_to_enforce()
+		elif choice == "5":
+			utils.policyfunctions.updateAuditPoliciesFromEnforcementPolices(url, policy_relationship_map)
 		elif choice == "Q":
 			break
 		else:

utils/policyfunctions.py

@@ -354,3 +354,71 @@ def sendToPolicyTest(url, first_policy, second_policy, destination_name, destina
     allowlist_childhashlist = allowbyhash[allowbyhash['reputation_status'] == 'UNKNOWN']['sha256'].unique().tolist()
     addHash(url, allowlist_child_id, allowlist_childhashlist)	
 
+def getMetaRules(url,appid): 
+    endpoint = url + '/v1/application/export'
+    payload = {
+        "applicationid" : {appid}
+    }
+    headers = {
+        "X-APIKey": os.getenv('APIKEY')
+    }
+    response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
+    parse_text = json.loads(response.text)
+    policiesnames = []
+    policyids = []
+    for index, list in enumerate(parse_text['response']['groups'], start=1):
+        print(ct.colorText(f"{index}. {list['name']}", "yellow"))
+        policiesnames.append(list['name'])
+        policyids.append(list['groupid'])
+    choice = input(ct.colorText("Select Policy Group: ", "white"))
+    choice = int(choice) - 1
+    return choice, policiesnames, policyids
+
+def updateAuditPoliciesFromEnforcementPolices(url, policy_relationship_map):
+    for enforcement_policy, audit_policy in policy_relationship_map.items():
+        assignPoliciesfromGroup(url, enforcement_policy, audit_policy)
+        turnOnAudit(url, audit_policy)
+
+def assignPoliciesfromGroup(url, source_policy_id, target_policy_id):
+
+    endpoint = url + '/v1/group/assign'
+
+    payload = {
+        "groupid" : {source_policy_id},
+        "targetgroupid" : {target_policy_id}
+        }
+    headers = {
+        "X-APIKey": os.getenv('APIKEY')
+    }
+    response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
+    parse_text = json.loads(response.text)
+    print(parse_text)
+
+
+def turnOnAudit(url, policyid):
+    
+    endpoint = url + '/v1/group/settings/auditmode'
+
+    payload = {
+        "groupid" : {policyid},
+        "auditmode" : "1"
+        }
+    headers = {
+        "X-APIKey": os.getenv('APIKEY')
+    }
+    response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
+    parse_text = json.loads(response.text)
+    print(parse_text)
+
+def agentsInPolicy(url, policyid):
+    endpoint = url + '/v1/group/agents'
+
+    payload = {
+        "groupid" : {policyid}
+        }
+    headers = {
+        "X-APIKey": os.getenv('APIKEY')
+    }
+    response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
+    parse_text = json.loads(response.text)
+    print(parse_text)