Added Pup Filter and Path Dedupe
This commit is contained in:
=
+43
-128
@@ -32,8 +32,9 @@ dotenv.load_dotenv()
|
||||
|
||||
#Constants
|
||||
url = os.getenv('url')
|
||||
badpublisherlist = ["Brave Software, Inc.", "Zoom Video Communications, Inc."]
|
||||
badpathparts = ["users", "inet\\wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata"]
|
||||
badpublisherlist = ["Brave Software, Inc.", "Zoom Video Communications, Inc.", "GlavSoft LLC"]
|
||||
pups = ["logmein", "invalid"]
|
||||
badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata"]
|
||||
path_exclusion_constant = 3
|
||||
min_files_for_path = 4
|
||||
threat_tolerance_constant = 4
|
||||
@@ -140,7 +141,6 @@ def menu_prepare_to_enforce():
|
||||
allowlist_parent_name = " "
|
||||
allowlist_child_name = " "
|
||||
destination_name = " "
|
||||
df_aggregated_combo = pd.DataFrame()
|
||||
|
||||
#If the directorys where we're going to store our output dont exist, make them.
|
||||
if not os.path.exists("parquet"): os.makedirs("parquet")
|
||||
@@ -149,119 +149,8 @@ def menu_prepare_to_enforce():
|
||||
if not os.path.exists("preflight"): os.makedirs("preflight")
|
||||
|
||||
while True:
|
||||
print(ct.colorText("\n --------------------------------------------------------------------", "cyan"))
|
||||
print(ct.colorText(" -------------------- Prepare to Enforce Policy ---------------------", "cyan"))
|
||||
print(ct.colorText(" --------------------------------------------------------------------", "cyan"))
|
||||
print(ct.colorText("\nSequentually follow these steps to prepare a policy for enforcement:", "white"))
|
||||
|
||||
|
||||
print(ct.colorText("\n1. Choose which originating policy or policies to move to enforcement", "cyan"))
|
||||
|
||||
if first_policy == " " and second_policy == " ":
|
||||
print(ct.colorText(f" [✗] No policies have been chosen","red"))
|
||||
elif first_policy != " " and second_policy is first_policy:
|
||||
print(ct.colorText(f" [✓] {first_policy} has been selected,", "green"))
|
||||
elif first_policy != " " and second_policy != " ":
|
||||
print(ct.colorText(f" [✓] {first_policy} has been selected as Policy 1","green"))
|
||||
print(ct.colorText(f" [✓] {second_policy} has been selected as Policy 2","green"))
|
||||
|
||||
|
||||
print(ct.colorText("2. Pull and stage event history, combine the histories, add hash info, then categorize the hashes", "cyan"))
|
||||
|
||||
if os.path.exists(f"parquet\\execution_history_{first_policy}.parquet"):
|
||||
print(ct.colorText(f" [✓] Execution history has been compiled for {first_policy}","green"))
|
||||
elif not os.path.exists(f"parquet\\execution_history_{first_policy}.parquet"):
|
||||
print(ct.colorText(f" [✗] Execution history has not been compiled for {first_policy}","red"))
|
||||
elif second_policy is not first_policy and os.path.exists(f"parquet\\execution_history_{second_policy}.parquet"):
|
||||
print(ct.colorText(f" [✓] Execution history has been compiled for {second_policy}","green"))
|
||||
elif second_policy is not first_policy and not os.path.exists(f"parquet\\execution_history_{second_policy}.parquet"):
|
||||
print(ct.colorText(f" [✗] Execution history has not been compiled for {second_policy}","red"))
|
||||
|
||||
if os.path.exists(f"parquet\\combined_hashlist_{first_policy}_{second_policy}.parquet"):
|
||||
print(ct.colorText(f" [✓] Hash Info has been added to the combined execution history", "green"))
|
||||
else:
|
||||
print(ct.colorText(f" [✗] Hash Info has not been added to the combined execution history", "red"))
|
||||
|
||||
if os.path.exists(f"parquet\\hashes_rep_unknown_{first_policy}_{second_policy}.parquet") and os.path.exists(f"parquet\\hashes_rep_good_{first_policy}_{second_policy}.parquet") and os.path.exists(f"parquet\\hashes_rep_bad_{first_policy}_{second_policy}.parquet"):
|
||||
print(ct.colorText(f" [✓] Hashes have been cateogrized", "green"))
|
||||
else:
|
||||
print(ct.colorText(f" [✗] Hashes have not been cateogrized", "red"))
|
||||
|
||||
if os.path.exists(f"parquet\\condensed_executions_{first_policy}_{second_policy}.parquet"):
|
||||
print(ct.colorText(f" [✓] Execution history has been_combined_for {first_policy} and_{second_policy}", "green"))
|
||||
else:
|
||||
print(ct.colorText(f" [✗] Execution history has not been_combined_for {first_policy} and_{second_policy}", "red"))
|
||||
|
||||
|
||||
|
||||
print(ct.colorText(f"3. Manually review the files:","cyan"))
|
||||
print(ct.colorText(" 'needs_approved\\hashes_rep_good_{first_policy}_{second_policy}.csv' and 'needs_approved\\hashes_rep_unknown_{first_policy}_{second_policy}.csv'", "cyan"))
|
||||
print(ct.colorText(" Remove the rows containing hashes you do not approve of, and those you would not approve of without metarules.", "cyan"))
|
||||
print(ct.colorText(" If metarules need to be created, please make note of them, and remove the row from the csv.", "cyan"))
|
||||
print(ct.colorText(" When complete, save both csv files to the directory 'approved' and choose this option.","cyan"))
|
||||
print(ct.colorText(" This will combine these approved hashes with the automatically approved hashes and generate a list of paths to be reviewed", "cyan"))
|
||||
|
||||
if os.path.exists(f"approved\\hashes_rep_good_{first_policy}_{second_policy}.csv") and os.path.exists(f"approved\\hashes_rep_unknown_{first_policy}_{second_policy}.csv"):
|
||||
print(ct.colorText(" [✓] Reviewed hashes have been loaded","green"))
|
||||
else:
|
||||
print(ct.colorText(" [✗] Reviewed hashes have not been loaded","red"))
|
||||
|
||||
if os.path.exists(f"parquet\\all_approved_hashes_{first_policy}_{second_policy}.parquet"):
|
||||
print(ct.colorText(" [✓] The combined approved hashes list has been generated","green"))
|
||||
else:
|
||||
print(ct.colorText(" [✗] The combined approved hashes list has not been generated","red"))
|
||||
|
||||
if os.path.exists(f"parquet\\approved_hashes_with_paths_{first_policy}_{second_policy}.parquet"):
|
||||
print(ct.colorText(" [✓] Longest common filepaths have been generated and appended to hash info","green"))
|
||||
else:
|
||||
print(ct.colorText(" [✗] Longest common filepaths have not been generated","red"))
|
||||
|
||||
if os.path.exists(f"needs_approved\\path_needs_approved_{first_policy}_{second_policy}.csv"):
|
||||
print(ct.colorText(" [✓] Path review list created","green"))
|
||||
else:
|
||||
print(ct.colorText(" [✗] Path review list has not been created","red"))
|
||||
|
||||
|
||||
print(ct.colorText(f"4. Manually review the file 'needs_approved\\paths_needing_review_{first_policy}_{second_policy}.csv'", "cyan"))
|
||||
print(ct.colorText(" Remove the rows containing path exclusions you do not approve of" , "cyan"))
|
||||
print(ct.colorText(" When complete, save the csv file to the directory 'approved'", "cyan"))
|
||||
print(ct.colorText(" Preflight Lists will be generated", "cyan"))
|
||||
|
||||
if os.path.exists(f"approved\\path_needs_approved_{first_policy}_{second_policy}.csv"):
|
||||
print(ct.colorText(" [✓] Reviewed path list detected","green"))
|
||||
else:
|
||||
print(ct.colorText(" [✗] Path review list has not been detected","red"))
|
||||
|
||||
if os.path.exists(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.html"):
|
||||
print(ct.colorText(" [✓] Preflight Path Exclusion List has been generated","green"))
|
||||
else:
|
||||
print(ct.colorText(" [✗] Preflight Path Exclusion List has not been generated","red"))
|
||||
|
||||
if os.path.exists(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.html"):
|
||||
print(ct.colorText(" [✓] Preflight hash approval list has been generated","green"))
|
||||
else:
|
||||
print(ct.colorText(" [✗] Preflight hash approval list has not been generated","red"))
|
||||
|
||||
|
||||
print(ct.colorText(f"5. Choose the destination policy and parent and child allow list", "cyan"))
|
||||
if allowlist_child_name == " " and allowlist_parent_name== " ":
|
||||
print(ct.colorText(f" [✗] No allowlists have been chosen","red"))
|
||||
elif allowlist_parent_name != " " and allowlist_child_name != " " and allowlist_parent_name is allowlist_child_name:
|
||||
print(ct.colorText(f" [✓] [✗] Only {allowlist_parent_name} has been selected this is unusual, but potentially valid case, double check before proceeding,", "yellow"))
|
||||
elif allowlist_parent_name != " " and allowlist_child_name != " " and allowlist_parent_name is not allowlist_child_name:
|
||||
print(ct.colorText(f" [✓] {allowlist_parent_name} has been selected as Parent Policy","green"))
|
||||
print(ct.colorText(f" [✓] {allowlist_child_name} has been selected as Child Policy","green"))
|
||||
if destination_name == " ":
|
||||
print(ct.colorText(f" [✗] No destination policy has been chosen","red"))
|
||||
else:
|
||||
print(ct.colorText(f" [✓] destination policy is {destination_name}","green"))
|
||||
|
||||
print(ct.colorText(f"6. Liftoff ------------------------------------------------------", "cyan"))
|
||||
print(ct.colorText(f" Apply path exclusions according to allowed and approved paths", "cyan"))
|
||||
print(ct.colorText(f" Apply signed or attested hashes to Parent Allow List", "cyan"))
|
||||
print(ct.colorText(f" Apply approved, but unsigned hashes to the Child Allow List", "cyan"))
|
||||
|
||||
print(ct.colorText("Q. Quit", "cyan"))
|
||||
ct.printEnforceChecklist(first_policy, second_policy, allowlist_child_name, allowlist_parent_name, destination_name)
|
||||
|
||||
choice = input(ct.colorText("\nEnter your choice: ", "white"))
|
||||
|
||||
@@ -388,7 +277,8 @@ def menu_prepare_to_enforce():
|
||||
categorized = utils.hashfunctions.categorizeHashes(
|
||||
pd.read_parquet(f"parquet\\combined_hashlist_{first_policy}_{second_policy}.parquet"),
|
||||
threat_tolerance_constant,
|
||||
badpublisherlist
|
||||
badpublisherlist,
|
||||
pups
|
||||
)
|
||||
|
||||
categorized[0].to_parquet(f"parquet\\hashes_rep_unknown_{first_policy}_{second_policy}.parquet", index=False)
|
||||
@@ -404,7 +294,7 @@ def menu_prepare_to_enforce():
|
||||
exe1 = pd.read_parquet(f"parquet\\execution_history_{first_policy}.parquet")
|
||||
utils.pathfunctions.inspect_parquet(f"parquet\\execution_history_{first_policy}.parquet")
|
||||
if not exe1.empty:
|
||||
condensed_exe1 = exe1.groupby('sha256').agg(lambda x: list(set(x))).reset_index()
|
||||
condensed_exe1 = exe1.groupby('sha256').agg(lambda x: list(set(x.tolist()))).reset_index()
|
||||
else:
|
||||
print("⚠️ First dataframe is empty.")
|
||||
except Exception as e:
|
||||
@@ -414,7 +304,8 @@ def menu_prepare_to_enforce():
|
||||
exe2 = pd.read_parquet(f"parquet\\execution_history_{second_policy}.parquet")
|
||||
utils.pathfunctions.inspect_parquet(f"parquet\\execution_history_{second_policy}.parquet")
|
||||
if not exe2.empty:
|
||||
condensed_exe2 = exe2.groupby('sha256').agg(lambda x: list(set(x))).reset_index()
|
||||
condensed_exe2 = exe2.groupby('sha256').agg(lambda x: list(set(x.tolist()))).reset_index()
|
||||
|
||||
else:
|
||||
print("⚠️ Second dataframe is empty.")
|
||||
except Exception as e:
|
||||
@@ -422,6 +313,8 @@ def menu_prepare_to_enforce():
|
||||
|
||||
if not exe1.empty and not exe2.empty:
|
||||
condensed_combo = pd.concat([condensed_exe1, condensed_exe2], ignore_index=True)
|
||||
condensed_combo = condensed_combo.drop_duplicates().reset_index(drop=True)
|
||||
|
||||
print(f"✅ Combined {len(condensed_combo)} hashes.")
|
||||
elif exe1.empty:
|
||||
condensed_combo = condensed_exe2
|
||||
@@ -454,11 +347,7 @@ def menu_prepare_to_enforce():
|
||||
needsapproval['filename_key'] = needsapproval['filename'].apply(lambda x: x[0] if isinstance(x, list) and x else '')
|
||||
needsapproval = needsapproval.sort_values(by='filename_key').drop(columns=['filename_key'])
|
||||
|
||||
|
||||
needsapproval.to_csv(f"needs_approved\\hashes_rep_unknown_{first_policy}_{second_policy}.csv",index=False)
|
||||
needsapproval.to_parquet(f"parquet\\hashes_rep_unknown_{first_policy}_{second_policy}.parquet",index=False)
|
||||
ct.style_dataframe_dark(needsapproval, f"needs_approved\\hashes_rep_unknown_{first_policy}_{second_policy}.html")
|
||||
|
||||
|
||||
del needsapproval
|
||||
del condensed_combo
|
||||
@@ -484,11 +373,7 @@ def menu_prepare_to_enforce():
|
||||
needsapproval['filename_key'] = needsapproval['filename'].apply(lambda x: x[0] if isinstance(x, list) and x else '')
|
||||
needsapproval = needsapproval.sort_values(by='filename_key').drop(columns=['filename_key'])
|
||||
|
||||
|
||||
needsapproval.to_csv(f"needs_approved\\hashes_rep_good_{first_policy}_{second_policy}.csv",index=False)
|
||||
needsapproval.to_parquet(f"parquet\\hashes_rep_good_{first_policy}_{second_policy}.parquet", index=False)
|
||||
ct.style_dataframe_dark(needsapproval, f"needs_approved\\hashes_rep_good_{first_policy}_{second_policy}.html")
|
||||
|
||||
|
||||
del needsapproval
|
||||
del condensed_combo
|
||||
@@ -514,14 +399,41 @@ def menu_prepare_to_enforce():
|
||||
needsapproval['filename_key'] = needsapproval['filename'].apply(lambda x: x[0] if isinstance(x, list) and x else '')
|
||||
needsapproval = needsapproval.sort_values(by='filename_key').drop(columns=['filename_key'])
|
||||
|
||||
|
||||
needsapproval.to_parquet(f"parquet\\hashes_rep_bad_{first_policy}_{second_policy}.parquet", index=False)
|
||||
ct.style_dataframe_dark(needsapproval, f"needs_approved\\hashes_rep_bad_{first_policy}_{second_policy}.html")
|
||||
|
||||
del needsapproval
|
||||
del condensed_combo
|
||||
gc.collect()
|
||||
|
||||
if os.path.exists(f"parquet\\hashes_rep_unknown_{first_policy}_{second_policy}.parquet") & os.path.exists(f"parquet\\hashes_rep_good_{first_policy}_{second_policy}.parquet") & os.path.exists(f"parquet\\hashes_rep_bad_{first_policy}_{second_policy}.parquet"):
|
||||
|
||||
unknown = pd.read_parquet(f"parquet\\hashes_rep_unknown_{first_policy}_{second_policy}.parquet")
|
||||
good = pd.read_parquet(f"parquet\\hashes_rep_good_{first_policy}_{second_policy}.parquet")
|
||||
bad = pd.read_parquet(f"parquet\\hashes_rep_bad_{first_policy}_{second_policy}.parquet")
|
||||
|
||||
# Build regex pattern once
|
||||
pattern = utils.pathfunctions.regulator(pups)
|
||||
|
||||
# Move matching rows from unknown and good to bad
|
||||
bad = pd.concat([
|
||||
bad,
|
||||
unknown[unknown["filename"].str.contains(pattern, na=False)],
|
||||
good[good["filename"].str.contains(pattern, na=False)]
|
||||
], ignore_index=True)
|
||||
|
||||
# Remove matching rows from unknown and good
|
||||
unknown = unknown[~unknown["filename"].str.contains(pattern, na=False)]
|
||||
good = good[~good["filename"].str.contains(pattern, na=False)]
|
||||
|
||||
|
||||
unknown.to_csv(f"needs_approved\\hashes_rep_unknown_{first_policy}_{second_policy}.csv",index=False)
|
||||
good.to_csv(f"needs_approved\\hashes_rep_good_{first_policy}_{second_policy}.csv",index=False)
|
||||
|
||||
ct.style_dataframe_dark(unknown, f"needs_approved\\hashes_rep_unknown_{first_policy}_{second_policy}.html")
|
||||
ct.style_dataframe_dark(good, f"needs_approved\\hashes_rep_good_{first_policy}_{second_policy}.html")
|
||||
ct.style_dataframe_dark(bad, f"needs_approved\\hashes_rep_bad_{first_policy}_{second_policy}.html")
|
||||
|
||||
|
||||
elif choice == "3":
|
||||
|
||||
if os.path.exists(f"approved\\hashes_rep_unknown_{first_policy}_{second_policy}.csv") and os.path.exists(f"approved\\hashes_rep_good_{first_policy}_{second_policy}.csv"):
|
||||
@@ -532,6 +444,9 @@ def menu_prepare_to_enforce():
|
||||
df2 = tryToReadCSV(f"approved\\hashes_rep_good_{first_policy}_{second_policy}.csv")
|
||||
|
||||
all_approved_hashes = pd.concat([df1 , df2], ignore_index=True).sort_values(by=['filename'])
|
||||
|
||||
|
||||
|
||||
print(ct.colorText(f"Approved hash lists have been combined","green"))
|
||||
|
||||
all_approved_hashes.to_parquet(f"parquet\\all_approved_hashes_{first_policy}_{second_policy}.parquet", index=False)
|
||||
|
||||
+11
-7
@@ -17,8 +17,10 @@ import pandas as pd
|
||||
import requests
|
||||
import os
|
||||
import json
|
||||
import utils.pathfunctions as pathf
|
||||
import utils.pretty as ct
|
||||
|
||||
|
||||
def aggregateHashes(executions_json) -> pd.DataFrame:
|
||||
"""
|
||||
Takes the executions, aggregates all the data with sha256 as primary, then returns aggregated dataframe
|
||||
@@ -101,11 +103,9 @@ def augmentAggregatedHashes(url, agg_df: pd.DataFrame) -> pd.DataFrame:
|
||||
|
||||
return aug_df
|
||||
|
||||
def categorizeHashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_publishers: list):
|
||||
if untrusted_publishers is None:
|
||||
untrusted_publishers = []
|
||||
|
||||
df = aug_df.copy()
|
||||
def categorizeHashes(df: pd.DataFrame, threat_tolerance: int, untrusted_publishers: list, pups: list):
|
||||
if untrusted_publishers is None: untrusted_publishers = []
|
||||
if pups is None: pups = []
|
||||
|
||||
def reputationtool(row):
|
||||
val = row["reputation_scannermatch"]
|
||||
@@ -127,13 +127,15 @@ def categorizeHashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_publ
|
||||
(
|
||||
(df["publisher"] != "Not Signed") &
|
||||
~df["publisher"].isin(untrusted_publishers) &
|
||||
~df["reputation_status"].isna()
|
||||
~df["reputation_status"].isna() &
|
||||
~df["description"].str.contains(pathf.regulator(pups), case=False, na=False)
|
||||
) |
|
||||
(
|
||||
(df["publisher"] == "Not Signed") &
|
||||
~df["reputation_flag"] &
|
||||
~df["publisher"].isin(untrusted_publishers) &
|
||||
~df["reputation_status"].isna()
|
||||
~df["reputation_status"].isna() &
|
||||
~df["description"].str.contains(pathf.regulator(pups), case=False, na=False)
|
||||
)
|
||||
)
|
||||
|
||||
@@ -143,6 +145,8 @@ def categorizeHashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_publ
|
||||
|
||||
return needsreview_df, approved_df, unapproved_df
|
||||
|
||||
|
||||
|
||||
def explode_and_deduplicate(df):
|
||||
df['sha256'] = df['sha256'].str.split(',')
|
||||
df = df.explode('sha256')
|
||||
|
||||
+118
@@ -1,3 +1,5 @@
|
||||
import os
|
||||
|
||||
|
||||
def colorText(text: str, color: str) -> str:
|
||||
colors = {
|
||||
@@ -176,6 +178,122 @@ def displayIntro():
|
||||
print(colorText("======================== Welcome to the Airlock API Tool ========================", "cyan"))
|
||||
print(colorText("=================================================================================", "cyan"))
|
||||
|
||||
def printEnforceChecklist(first_policy, second_policy, allowlist_child_name, allowlist_parent_name, destination_name):
|
||||
|
||||
print(colorText("\n --------------------------------------------------------------------", "cyan"))
|
||||
print(colorText(" -------------------- Prepare to Enforce Policy ---------------------", "cyan"))
|
||||
print(colorText(" --------------------------------------------------------------------", "cyan"))
|
||||
print(colorText("\nSequentually follow these steps to prepare a policy for enforcement:", "white"))
|
||||
|
||||
print(colorText("\n1. Choose which originating policy or policies to move to enforcement", "cyan"))
|
||||
if first_policy == " " and second_policy == " ":
|
||||
print(colorText(f" [✗] No policies have been chosen","red"))
|
||||
elif first_policy != " " and second_policy is first_policy:
|
||||
print(colorText(f" [✓] {first_policy} has been selected,", "green"))
|
||||
elif first_policy != " " and second_policy != " ":
|
||||
print(colorText(f" [✓] {first_policy} has been selected as Policy 1","green"))
|
||||
print(colorText(f" [✓] {second_policy} has been selected as Policy 2","green"))
|
||||
|
||||
|
||||
|
||||
print(colorText("2. Pull and stage event history, combine the histories, add hash info, then categorize the hashes", "cyan"))
|
||||
|
||||
if os.path.exists(f"parquet\\execution_history_{first_policy}.parquet"):
|
||||
print(colorText(f" [✓] Execution history has been compiled for {first_policy}","green"))
|
||||
elif not os.path.exists(f"parquet\\execution_history_{first_policy}.parquet"):
|
||||
print(colorText(f" [✗] Execution history has not been compiled for {first_policy}","red"))
|
||||
elif second_policy is not first_policy and os.path.exists(f"parquet\\execution_history_{second_policy}.parquet"):
|
||||
print(colorText(f" [✓] Execution history has been compiled for {second_policy}","green"))
|
||||
elif second_policy is not first_policy and not os.path.exists(f"parquet\\execution_history_{second_policy}.parquet"):
|
||||
print(colorText(f" [✗] Execution history has not been compiled for {second_policy}","red"))
|
||||
|
||||
if os.path.exists(f"parquet\\combined_hashlist_{first_policy}_{second_policy}.parquet"):
|
||||
print(colorText(f" [✓] Hash Info has been added to the combined execution history", "green"))
|
||||
else:
|
||||
print(colorText(f" [✗] Hash Info has not been added to the combined execution history", "red"))
|
||||
|
||||
if os.path.exists(f"parquet\\hashes_rep_unknown_{first_policy}_{second_policy}.parquet") and os.path.exists(f"parquet\\hashes_rep_good_{first_policy}_{second_policy}.parquet") and os.path.exists(f"parquet\\hashes_rep_bad_{first_policy}_{second_policy}.parquet"):
|
||||
print(colorText(f" [✓] Hashes have been cateogrized", "green"))
|
||||
else:
|
||||
print(colorText(f" [✗] Hashes have not been cateogrized", "red"))
|
||||
|
||||
if os.path.exists(f"parquet\\condensed_executions_{first_policy}_{second_policy}.parquet"):
|
||||
print(colorText(f" [✓] Execution history has been_combined_for {first_policy} and_{second_policy}", "green"))
|
||||
else:
|
||||
print(colorText(f" [✗] Execution history has not been_combined_for {first_policy} and_{second_policy}", "red"))
|
||||
|
||||
|
||||
print(colorText(f"3. Manually review the files:","cyan"))
|
||||
print(colorText(" 'needs_approved\\hashes_rep_good_{first_policy}_{second_policy}.csv' and 'needs_approved\\hashes_rep_unknown_{first_policy}_{second_policy}.csv'", "cyan"))
|
||||
print(colorText(" Remove the rows containing hashes you do not approve of, and those you would not approve of without metarules.", "cyan"))
|
||||
print(colorText(" If metarules need to be created, please make note of them, and remove the row from the csv.", "cyan"))
|
||||
print(colorText(" When complete, save both csv files to the directory 'approved' and choose this option.","cyan"))
|
||||
print(colorText(" This will combine these approved hashes with the automatically approved hashes and generate a list of paths to be reviewed", "cyan"))
|
||||
|
||||
if os.path.exists(f"approved\\hashes_rep_good_{first_policy}_{second_policy}.csv") and os.path.exists(f"approved\\hashes_rep_unknown_{first_policy}_{second_policy}.csv"):
|
||||
print(colorText(" [✓] Reviewed hashes have been loaded","green"))
|
||||
else:
|
||||
print(colorText(" [✗] Reviewed hashes have not been loaded","red"))
|
||||
|
||||
if os.path.exists(f"parquet\\all_approved_hashes_{first_policy}_{second_policy}.parquet"):
|
||||
print(colorText(" [✓] The combined approved hashes list has been generated","green"))
|
||||
else:
|
||||
print(colorText(" [✗] The combined approved hashes list has not been generated","red"))
|
||||
|
||||
if os.path.exists(f"parquet\\approved_hashes_with_paths_{first_policy}_{second_policy}.parquet"):
|
||||
print(colorText(" [✓] Longest common filepaths have been generated and appended to hash info","green"))
|
||||
else:
|
||||
print(colorText(" [✗] Longest common filepaths have not been generated","red"))
|
||||
|
||||
if os.path.exists(f"needs_approved\\path_needs_approved_{first_policy}_{second_policy}.csv"):
|
||||
print(colorText(" [✓] Path review list created","green"))
|
||||
else:
|
||||
print(colorText(" [✗] Path review list has not been created","red"))
|
||||
|
||||
|
||||
print(colorText(f"4. Manually review the file 'needs_approved\\paths_needing_review_{first_policy}_{second_policy}.csv'", "cyan"))
|
||||
print(colorText(" Remove the rows containing path exclusions you do not approve of" , "cyan"))
|
||||
print(colorText(" When complete, save the csv file to the directory 'approved'", "cyan"))
|
||||
print(colorText(" Preflight Lists will be generated", "cyan"))
|
||||
|
||||
if os.path.exists(f"approved\\path_needs_approved_{first_policy}_{second_policy}.csv"):
|
||||
print(colorText(" [✓] Reviewed path list detected","green"))
|
||||
else:
|
||||
print(colorText(" [✗] Path review list has not been detected","red"))
|
||||
|
||||
if os.path.exists(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.html"):
|
||||
print(colorText(" [✓] Preflight Path Exclusion List has been generated","green"))
|
||||
else:
|
||||
print(colorText(" [✗] Preflight Path Exclusion List has not been generated","red"))
|
||||
|
||||
if os.path.exists(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.html"):
|
||||
print(colorText(" [✓] Preflight hash approval list has been generated","green"))
|
||||
else:
|
||||
print(colorText(" [✗] Preflight hash approval list has not been generated","red"))
|
||||
|
||||
|
||||
print(colorText(f"5. Choose the destination policy and parent and child allow list", "cyan"))
|
||||
if allowlist_child_name == " " and allowlist_parent_name== " ":
|
||||
print(colorText(f" [✗] No allowlists have been chosen","red"))
|
||||
elif allowlist_parent_name != " " and allowlist_child_name != " " and allowlist_parent_name is allowlist_child_name:
|
||||
print(colorText(f" [✓] [✗] Only {allowlist_parent_name} has been selected this is unusual, but potentially valid case, double check before proceeding,", "yellow"))
|
||||
elif allowlist_parent_name != " " and allowlist_child_name != " " and allowlist_parent_name is not allowlist_child_name:
|
||||
print(colorText(f" [✓] {allowlist_parent_name} has been selected as Parent Policy","green"))
|
||||
print(colorText(f" [✓] {allowlist_child_name} has been selected as Child Policy","green"))
|
||||
if destination_name == " ":
|
||||
print(colorText(f" [✗] No destination policy has been chosen","red"))
|
||||
else:
|
||||
print(colorText(f" [✓] destination policy is {destination_name}","green"))
|
||||
|
||||
print(colorText(f"6. Liftoff ------------------------------------------------------", "cyan"))
|
||||
print(colorText(f" Apply path exclusions according to allowed and approved paths", "cyan"))
|
||||
print(colorText(f" Apply signed or attested hashes to Parent Allow List", "cyan"))
|
||||
print(colorText(f" Apply approved, but unsigned hashes to the Child Allow List", "cyan"))
|
||||
|
||||
print(colorText("Q. Quit", "cyan"))
|
||||
|
||||
|
||||
|
||||
|
||||
def areYouSure():
|
||||
print(colorText(f"*******************************************************************************************************************************************","red"))
|
||||
|
||||
Reference in New Issue
Block a user