ALL AT PATHS TOOL

utils/policyfunctions.py

@@ -93,16 +93,16 @@ def addPubReal(url, grouplistID, publist):
     print(response.text)
 
 
-def getPolicyInfo(url, policy, days):
+def getPolicyInfo(url, policy, type, days, parquet=True):
     executionhist_policy = pd.DataFrame()
-    exehist = pullPolicyExechistories(url, policy, days, True)
+    exehist = pullPolicyExechistories(url, policy, type, days, True)
     data = json.loads(exehist)
     executionhist_policy = pd.DataFrame(data["response"]["exechistories"])
     if not executionhist_policy.empty:
-        executionhist_policyxecutionhist_policy = executionhist_policy[['sha256', 'publisher', 'filename', 'hostname', 'username', 'pprocess', 'gprocess', 'commandline']]
+        executionhist_policy = executionhist_policy[['sha256', 'publisher', 'filename', 'hostname', 'username', 'pprocess', 'gprocess', 'commandline']]
         executionhist_policy = executionhist_policy.drop_duplicates(subset=['sha256', 'filename', 'hostname'])
         executionhist_policy = executionhist_policy.sort_values(by=['sha256', 'filename'])
-        executionhist_policy.to_parquet(f"parquet\\execution_history_{policy}.parquet", index=False)
+        if parquet: executionhist_policy.to_parquet(f"parquet\\execution_history_{policy}.parquet", index=False)
     print(ct.colorText(f"Staging of Execution history for policy: {policy} is complete", "green"))
     del data
     del exehist
@@ -157,7 +157,7 @@ def sendToPolicy(url, first_policy, second_policy, destination_name, destination
     else:
         print(ct.colorText("Operation aborted. You MUST EXPLICITLY AGREE to proceed.", "red"))
 
-def pullPolicyExechistories(url, policiesnames, days, outputjson: bool):
+def pullPolicyExechistories(url, policiesnames, type, days, outputjson: bool):
     file_path = 'chunkinator.json'
     if not os.path.exists(file_path):
         with open(file_path, 'w') as file:
@@ -171,7 +171,7 @@ def pullPolicyExechistories(url, policiesnames, days, outputjson: bool):
     with tqdm.tqdm(file=sys.stdout, leave=True, total=10000, desc=f"Checkpoint Progess: {checkpoint}", colour="blue", initial=1) as filebar:
         with tqdm.tqdm(file=sys.stdout, leave=True, total=100, desc=f"Total of {policiesnames} Complete: ") as pbar:
                 while True:
-                    json_response_data = checkpoint_stomper(checkpoint, url, policiesnames, headers)
+                    json_response_data = checkpoint_stomper(checkpoint, url, type, policiesnames, headers)
                     histories = json_response_data['response']['exechistories']
                     filebar.total=len(histories)
                     if not histories:
@@ -214,11 +214,11 @@ def pullPolicyExechistories(url, policiesnames, days, outputjson: bool):
     os.remove(file_path)
     return json.dumps(final_output) if outputjson else None
 
-def checkpoint_stomper(checkpoint, url, policy, headers):
+def checkpoint_stomper(checkpoint, url, type, policy, headers):
     json_output = {'error': 'Success', 'response': {'exechistories': []}}
     endpoint = url + '/v1/logging/exechistories'
     payload_dict = {
-        "type":[1,2,6,7],
+        "type":[type],
         "checkpoint": checkpoint,
         "policy": [policy]
     }
@@ -251,6 +251,37 @@ def listPolicies(url):
     choice = int(choice) - 1
     return choice, policiesnames, policyids
 
+def listATPolicies(url):
+    endpoint = url + '/v1/group'
+    print(ct.colorText("[+] Grabbing All Policies", "cyan"))
+    
+    headers = {
+        "X-APIKey": os.getenv('APIKEY')
+    }
+
+    try:
+        response = requests.post(endpoint, headers=headers, json={}, verify=False)
+        response.raise_for_status()
+        parse_text = response.json()
+
+        at_policies = {}
+
+        for index, group in enumerate(parse_text.get('response', {}).get('groups', []), start=1):
+            name = group.get('name', '')
+            if "AT" in name:
+                print(ct.colorText(f"{index}. {name}", "yellow"))
+                at_policies[name] = group.get('groupid')
+
+        return at_policies
+
+    except requests.exceptions.RequestException as e:
+        print(ct.colorText(f"[!] Request failed: {e}", "red"))
+        return {}
+    except (KeyError, json.JSONDecodeError) as e:
+        print(ct.colorText(f"[!] Failed to parse response: {e}", "red"))
+        return {}
+
+
 def listAllowlists(url): 
     endpoint = url + '/v1/application'
     print(ct.colorText("[+] Grabbing All Allowlists", "cyan"))