AirlockTools.py

@@ -34,7 +34,7 @@ url = os.getenv('url')
 bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"]
 pups = ["logmein", "invalid"]
 badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata"]
-path_exclusion_constant = 3
+path_exclusion_constant = 4
 min_files_for_path = 4
 threat_tolerance_constant = 4
 
@@ -235,6 +235,7 @@ def menu_prepare_to_enforce():
 		elif choice == "6":
 			if os.path.exists(f"preflight\\final_path_exclusions_{first_policy}_{second_policy}.html") and os.path.exists(f"preflight\\final_hash_approvals_{first_policy}_{second_policy}.html")	and allowlist_parent_name != " " and allowlist_child_name != " " and destination_name != " ":
 				utils.policyfunctions.sendToPolicy(
+					url,
 					first_policy,
 					second_policy,
 					destination_name,

utils/pathfunctions.py

@@ -22,7 +22,7 @@ import utils.pretty as ct
 from AirlockTools import tryToReadCSV
 
 
-def split_filepaths_grouped(df, col="filename", group_parts=3, min_parts=3):
+def split_filepaths_grouped(df, col="filename", group_parts=4, min_parts=4):
     def clean_split(path):
         parts = os.path.normpath(path).split(os.sep)
         # Remove leading empty strings caused by UNC paths

utils/policyfunctions.py

@@ -45,31 +45,27 @@ def addHashReal(url, allowlistID, hashlist):
     headers = {
         "X-APIKey": os.getenv('APIKEY')
     }
-    try:
+    payload = json.dumps(payload)
-        response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
+    response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
-        response.raise_for_status()  # Raise an error for bad status codes
+    response.raise_for_status()  # Raise an error for bad status codes
-        parse_text = json.loads(response.text)
+    parse_text = json.loads(response.text)
-        print(parse_text)
+    print(parse_text)
-    except requests.exceptions.RequestException as e:
+    
-        return {"error": str(e)}
 
 def addPathReal(url, grouplistID, pathlist): 
     endpoint = url + '/v1/group/path/add'
     print(ct.colorText("[+] Grabbing All Categories", "cyan"))
     payload = {
-            "applicationid" : grouplistID,
+            "groupid" : grouplistID,
-            "hashes" : pathlist
+            "path" : pathlist
         }
     headers = {
         "X-APIKey": os.getenv('APIKEY')
     }
-    try:
+    print(payload)
-        response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
+    payload = json.dumps(payload)
-        response.raise_for_status()  # Raise an error for bad status codes
+    response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
-        parse_text = json.loads(response.text)
+    print(response.text)
-        print(parse_text)
-    except requests.exceptions.RequestException as e:
-        return {"error": str(e)}
 
 def getPolicyInfo(url, policy, days):
     executionhist_policy = pd.DataFrame()
@@ -87,7 +83,7 @@ def getPolicyInfo(url, policy, days):
     gc.collect()
     return executionhist_policy
 
-def sendToPolicy(first_policy, second_policy, destination_name, destination_id, allowlist_parent_name, allowlist_parent_id, allowlist_child_name, allowlist_child_id):
+def sendToPolicy(url, first_policy, second_policy, destination_name, destination_id, allowlist_parent_name, allowlist_parent_id, allowlist_child_name, allowlist_child_id):
     pathexclusions = pd.read_parquet(f"parquet\\final_path_exclusions_{first_policy}_{second_policy}.parquet")
     allowbyhash =  pd.read_parquet(f"parquet\\final_hash_approvals_{first_policy}_{second_policy}.parquet")
 
@@ -107,16 +103,16 @@ def sendToPolicy(first_policy, second_policy, destination_name, destination_id,
             (path if drive_letter_pattern.match(path) else f"\\\\{path}") + "**"
             for path in pathexcludelist
 ]
-        addPath(destination_id,processed_paths)
+        addPath(url, destination_id,processed_paths)
         
         print(ct.colorText(f"Adding hashes to {allowlist_parent_name}", "yellow"))
                             
         allowlist_parenthashlist = allowbyhash[allowbyhash['reputation_status'] == 'KNOWN']['sha256'].unique().tolist()
-        addHash(allowlist_parent_id,allowlist_parenthashlist)
+        addHash(url, allowlist_parent_id,allowlist_parenthashlist)
         
         print(ct.colorText(f"Adding hashes to {allowlist_child_name}", "yellow"))
         allowlist_childhashlist = allowbyhash[allowbyhash['reputation_status'] == 'UNKNOWN']['sha256'].unique().tolist()
-        addHash(allowlist_child_id, allowlist_childhashlist)			
+        addHash(url, allowlist_child_id, allowlist_childhashlist)			
 
         ct.locked()