diff --git a/utils/clientfunctions.py b/utils/clientfunctions.py index 69feafd..323c7a9 100644 --- a/utils/clientfunctions.py +++ b/utils/clientfunctions.py @@ -5,9 +5,9 @@ import pandas as pd import utils.pretty as ct -def getDestAllowlistFromClientID(url, clientid="0dcddaf3-d017-4ced-9227-ceeca3117286"): +def getDestAllowlistFromClientID(url, clientid): - #This is dependant on their being an allowlist in the policy with the same name as the policy + #This is dependant on their being an allowlist in the policy containing the name "localapproval" endpoint = url + '/v1/agent/find' payload = { @@ -22,13 +22,30 @@ def getDestAllowlistFromClientID(url, clientid="0dcddaf3-d017-4ced-9227-ceeca311 result = json.loads(response.text) data = pd.DataFrame(result["response"]["agents"]) - policyname = getPolicyName(url,data.loc[0, "groupid"]) allowlists = getPolicyAllowlists(url,data.loc[0, "groupid"]) - app_id = allowlists.loc[allowlists['name'] == f'{policyname}', 'applicationid'].values[0] + app_id = allowlists.loc[allowlists['name'].str.contains('localapproval', case=False, na=False), 'applicationid'].values[0] return app_id +def getPolicyFromClientID(url, clientid): + + endpoint = url + '/v1/agent/find' + payload = { + "agentid" : f"{clientid}" + } + + headers = {"X-APIKey": os.getenv('APIKEY')} + payload = json.dumps(payload) + + + response = requests.post(endpoint, headers=headers, data=payload, verify=False) + result = json.loads(response.text) + data = pd.DataFrame(result["response"]["agents"]) + + policy = getPolicyName(url,data.loc[0, "groupid"]) + + return policy def getPolicyAllowlists(url, groupid): diff --git a/utils/otpfunctions.py b/utils/otpfunctions.py index bf3006f..efb96e9 100644 --- a/utils/otpfunctions.py +++ b/utils/otpfunctions.py @@ -28,6 +28,10 @@ def getActiveOTP(url): response = requests.post(endpoint, headers=headers, data=payload, verify=False) result = json.loads(response.text) otp = pd.DataFrame(result["response"]["otpusage"]) + if os.path.exists("OTP\\PARQ\\newest_active_OTP.parquet"): + previous_run = pd.read_parquet("OTP\\PARQ\\newest_active_OTP.parquet") + previous_run.to_parquet("OTP\\PARQ\\old_active_OTP.parquet", index=False) + os.remove("OTP\\PARQ\\newest_active_OTP.parquet") otp.to_parquet("OTP\\PARQ\\newest_active_OTP.parquet", index=False) if not otp.empty: ct.style_dataframe_dark(otp, f"newest_active_OTP.html") @@ -90,20 +94,45 @@ def monitorOTP(url, pups): purpose = row ['purpose'] pid = row['otpid'] early = math.floor(duration * .9) - + #If newly added to the list - schedule adding the majority of the executions prior to the expiration of OTP period. run_once_job(f"Add activity hashes for {pid}, for {hostname} for the purpose: {purpose}, early run", "addhash", time.time() + early, [url, clientid, pid, pups], None) - run_once_job(f"Add activity hashes for {pid}, for {hostname} for the purpose: {purpose}, duration complete run", "addhash", time.time() + duration, [url, clientid, pid, pups], None) print(f"Processing: {pid} with other data: {row}") for _, row in still_in_OTP.iterrows(): pid = row['otpid'] + #While still in OTP, continue to update activities list getOTPActivities(url,pid) for _, row in no_longer_OTP.iterrows(): + clientid = row['clientid'] + hostname = row['hostname'] + purpose = row ['purpose'] pid = row['otpid'] - # Access other columns via row['column_name'] - print(f"Processing PID: {pid} with other data: {row}") + allowlist = clientf.getDestAllowlistFromClientID(url,clientid) + policy = clientf.getPolicyFromClientID(url,clientid) + #When duration completes - + + addOTPHashes(url, clientid,pid, pups) + + finalhashesadded = pd.read_parquet(f"OTP\\PARQ\\otp_activities_{pid}.parquet") + finalhashesadded['policy'] = policy + finalhashesadded['allowlist'] = allowlist + finalhashesadded['added_at'] = time.time() + + if not os.path.exists(f"OTP\\PARQ\\localapprovalhistory.parquet"): + df = pd.DataFrame() + df.to_parquet(f"OTP\\PARQ\\localapprovalhistory.parquet") + else: + history = pd.read_parquet(f"OTP\\PARQ\\localapprovalhistory.parquet") + history = pd.concat([history, finalhashesadded], ignore_index=True) + history.to_parquet(f"OTP\\PARQ\\localapprovalhistory.parquet") + + os.remove(f"OTP\\PARQ\\otp_activities_{pid}.parquet") + del finalhashesadded + + + def addOTPHashes(url, clientid, otpid, pups): @@ -111,7 +140,7 @@ def addOTPHashes(url, clientid, otpid, pups): activities = pd.read_parquet(path) pattern = pathf.regulator(pups) - policy = clientf.getDestAllowlistFromClientID(clientid) + allowlist = clientf.getDestAllowlistFromClientID(url, clientid) # Initialize or preserve 'hash_added' column if "hash_added" not in activities.columns: activities["hash_added"] = None @@ -125,7 +154,7 @@ def addOTPHashes(url, clientid, otpid, pups): # Add hashes to policy if hashes_to_add: - policyf.addHash(url, policy, hashes_to_add) + policyf.addHash(url, allowlist, hashes_to_add) # Update 'hash_added' column activities["hash_added"] = activities.apply(