First Draft

utils/clientfunctions.py

@@ -5,9 +5,9 @@ import pandas as pd
 import utils.pretty as ct
 
 
-def getDestAllowlistFromClientID(url, clientid="0dcddaf3-d017-4ced-9227-ceeca3117286"):
+def getDestAllowlistFromClientID(url, clientid):
 
-    #This is dependant on their being an allowlist in the policy with the same name as the policy 
+    #This is dependant on their being an allowlist in the policy containing the name "localapproval"
 
     endpoint = url + '/v1/agent/find'
     payload = {
@@ -22,13 +22,30 @@ def getDestAllowlistFromClientID(url, clientid="0dcddaf3-d017-4ced-9227-ceeca311
     result = json.loads(response.text)
     data = pd.DataFrame(result["response"]["agents"])
 
-    policyname = getPolicyName(url,data.loc[0, "groupid"])
     allowlists = getPolicyAllowlists(url,data.loc[0, "groupid"]) 
  
-    app_id = allowlists.loc[allowlists['name'] == f'{policyname}', 'applicationid'].values[0]
+    app_id = allowlists.loc[allowlists['name'].str.contains('localapproval', case=False, na=False), 'applicationid'].values[0]
     
     return app_id
 
+def getPolicyFromClientID(url, clientid):
+
+    endpoint = url + '/v1/agent/find'
+    payload = {
+            "agentid" : f"{clientid}"
+    }
+
+    headers = {"X-APIKey": os.getenv('APIKEY')}
+    payload = json.dumps(payload)
+
+
+    response = requests.post(endpoint, headers=headers, data=payload, verify=False)
+    result = json.loads(response.text)
+    data = pd.DataFrame(result["response"]["agents"])
+
+    policy = getPolicyName(url,data.loc[0, "groupid"]) 
+  
+    return policy
     
 def getPolicyAllowlists(url, groupid):
 

utils/otpfunctions.py

@@ -28,6 +28,10 @@ def getActiveOTP(url):
     response = requests.post(endpoint, headers=headers, data=payload, verify=False)
     result = json.loads(response.text)
     otp = pd.DataFrame(result["response"]["otpusage"])
+    if os.path.exists("OTP\\PARQ\\newest_active_OTP.parquet"):
+        previous_run = pd.read_parquet("OTP\\PARQ\\newest_active_OTP.parquet")
+        previous_run.to_parquet("OTP\\PARQ\\old_active_OTP.parquet", index=False)
+        os.remove("OTP\\PARQ\\newest_active_OTP.parquet")
     otp.to_parquet("OTP\\PARQ\\newest_active_OTP.parquet", index=False)
     if not otp.empty:
         ct.style_dataframe_dark(otp, f"newest_active_OTP.html")
@@ -90,20 +94,45 @@ def monitorOTP(url, pups):
         purpose = row ['purpose']
         pid = row['otpid']
         early = math.floor(duration * .9)
-
+        #If newly added to the list - schedule adding the majority of the executions prior to the expiration of OTP period.
         run_once_job(f"Add activity hashes for {pid}, for {hostname} for the purpose: {purpose}, early run", "addhash", time.time() + early, [url, clientid, pid, pups], None)
-        run_once_job(f"Add activity hashes for {pid}, for {hostname} for the purpose: {purpose}, duration complete run", "addhash", time.time() + duration, [url, clientid, pid, pups], None)
         print(f"Processing: {pid} with other data: {row}")
         
 
     for _, row in still_in_OTP.iterrows():
         pid = row['otpid']
+        #While still in OTP, continue to update activities list
         getOTPActivities(url,pid)
 
     for _, row in no_longer_OTP.iterrows():
+        clientid = row['clientid']
+        hostname = row['hostname']
+        purpose = row ['purpose']
         pid = row['otpid']
-        # Access other columns via row['column_name']
-        print(f"Processing PID: {pid} with other data: {row}")
+        allowlist = clientf.getDestAllowlistFromClientID(url,clientid)
+        policy = clientf.getPolicyFromClientID(url,clientid)
+        #When duration completes - 
+        
+        addOTPHashes(url, clientid,pid, pups)
+        
+        finalhashesadded = pd.read_parquet(f"OTP\\PARQ\\otp_activities_{pid}.parquet")
+        finalhashesadded['policy'] = policy
+        finalhashesadded['allowlist'] = allowlist
+        finalhashesadded['added_at'] = time.time()
+        
+        if not os.path.exists(f"OTP\\PARQ\\localapprovalhistory.parquet"): 
+            df = pd.DataFrame()
+            df.to_parquet(f"OTP\\PARQ\\localapprovalhistory.parquet")
+        else:
+            history = pd.read_parquet(f"OTP\\PARQ\\localapprovalhistory.parquet")
+            history = pd.concat([history, finalhashesadded], ignore_index=True)
+            history.to_parquet(f"OTP\\PARQ\\localapprovalhistory.parquet")
+        
+        os.remove(f"OTP\\PARQ\\otp_activities_{pid}.parquet")
+        del finalhashesadded
+
+
+        
 
 
 def addOTPHashes(url, clientid, otpid, pups):
@@ -111,7 +140,7 @@ def addOTPHashes(url, clientid, otpid, pups):
     activities = pd.read_parquet(path)
 
     pattern = pathf.regulator(pups)
-    policy = clientf.getDestAllowlistFromClientID(clientid)
+    allowlist = clientf.getDestAllowlistFromClientID(url, clientid)
 
     # Initialize or preserve 'hash_added' column
     if "hash_added" not in activities.columns: activities["hash_added"] = None
@@ -125,7 +154,7 @@ def addOTPHashes(url, clientid, otpid, pups):
 
     # Add hashes to policy
     if hashes_to_add:
-        policyf.addHash(url, policy, hashes_to_add)
+        policyf.addHash(url, allowlist, hashes_to_add)
 
     # Update 'hash_added' column
     activities["hash_added"] = activities.apply(