AirlockTools.py

@@ -16,8 +16,10 @@ import argparse
 import dotenv
 import os
 import pandas as pd
+
 import urllib3
 import utils.allowlist
+import utils.clientfunctions
 import utils.getdeviceevents
 import utils.hashfunctions
 import utils.otpfunctions
@@ -26,6 +28,7 @@ import utils.policyfunctions
 import utils.pretty as ct
 
 
+
 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
 
 dotenv.load_dotenv()
@@ -48,14 +51,14 @@ def main():
 	args = parser.parse_args()
 
 	if args.monitorOTP:
+        
+		
 		# Non-interactive logic
+			if not os.path.exists("parquet"): os.makedirs("parquet")
 			apivalidation()
 			print(f"Running non-interactively to start monitoring OTP")
 
-			utils.otpfunctions.getOTPHistory(url, 0)
+			utils.clientfunctions.getClientsPolicy(url)
-			utils.otpfunctions.getOTPHistory(url, 1)
-			utils.otpfunctions.getOTPHistory(url, 2)
-			utils.otpfunctions.getOTPHistory(url, 3)
 		
             # Process input here
 	else:

utils/clientfunctions.py

@@ -0,0 +1,60 @@
+import json
+import requests
+import os
+import pandas as pd
+import utils.pretty as ct
+
+
+def getClientsPolicy(url, clientid="0dcddaf3-d017-4ced-9227-ceeca3117286"):
+
+    endpoint = url + '/v1/agent/find'
+    payload = {
+            "agentid" : f"{clientid}"
+    }
+
+    headers = {"X-APIKey": os.getenv('APIKEY')}
+    payload = json.dumps(payload)
+
+
+    response = requests.post(endpoint, headers=headers, data=payload, verify=False)
+    result = json.loads(response.text)
+    data = pd.DataFrame(result["response"]["agents"])
+
+    policyname = getPolicyName(url,data.loc[0, "groupid"])
+    allowlists = getPolicyAllowlists(url,data.loc[0, "groupid"]) 
+    allowlists = allowlists['name'].tolist()
+    print(policyname)
+    print(allowlists)      
+    
+
+
+def getPolicyAllowlists(url, groupid):
+
+    endpoint = url + '/v1/group/policies'
+    payload = {
+            "groupid" : f"{groupid}"
+    }
+
+    headers = {"X-APIKey": os.getenv('APIKEY')}
+    payload = json.dumps(payload)
+
+    response = requests.post(endpoint, headers=headers, data=payload, verify=False)
+    result = json.loads(response.text)
+    data = pd.DataFrame(result["response"]["applications"])
+    return data
+
+def getPolicyName(url, groupid):
+
+    endpoint = url + '/v1/group/'
+    payload = {
+            
+    }
+
+    headers = {"X-APIKey": os.getenv('APIKEY')}
+    payload = json.dumps(payload)
+
+    response = requests.post(endpoint, headers=headers, data=payload, verify=False)
+    result = json.loads(response.text)
+    data = pd.DataFrame(result["response"]["groups"])
+    name = data.loc[data['groupid'] == f"{groupid}", 'name'].values[0]
+    return name

utils/otpfunctions.py

@@ -1,21 +1,63 @@
 import json
 import requests
 import os
+import pandas as pd
+import utils.pretty as ct
+import shutil
 
 
+def getActiveOTP(url):
 
-def getOTPHistory(url, type):
+    endpoint = url + f'/v1/otp/usage'
-
-    endpoint = url + '/v1/otp/usage'
     payload = {
-            "status" : type
+            "status" : "0"
     }
 
     headers = {"X-APIKey": os.getenv('APIKEY')}
     payload = json.dumps(payload)
 
     response = requests.post(endpoint, headers=headers, data=payload, verify=False)
-    data = response.json()
+    result = json.loads(response.text)
-    results = data.get("response", {}).get("otpusage", [])
+    otp = pd.DataFrame(result["response"]["otpusage"])
+    otp.to_parquet("parquet\\newest_active_OTP.parquet", index=False)
+    if not otp.empty:
+        ct.style_dataframe_dark(otp, f"newest_active_OTP.html")
    
-    print(results)
+
+
+def getOTPActivities(url, otpid):
+
+    endpoint = url + f'/v1/otp/activities'
+    payload = {
+            "otpid" : f"{otpid}"
+    }
+
+    headers = {"X-APIKey": os.getenv('APIKEY')}
+    payload = json.dumps(payload)
+
+    response = requests.post(endpoint, headers=headers, data=payload, verify=False)
+    result = json.loads(response.text)
+    otp = pd.DataFrame(result["response"]["otpactivities"])
+    otp.to_parquet("parquet/otp_activities.parquet", index=False)
+    if not otp.empty:
+        ct.style_dataframe_dark(otp, f"OTP_activities_{otpid}.html")
+
+
+def compareOTPHistory():
+
+    if not os.path.exists("parquet\\old_active_OTP"): 
+        shutil.copy2("parquet\\newest_active_OTP.parquet", "parquet\\old_active_OTP.parquet")
+
+    old_active_OTP = pd.read_parquet("parquet\\old_active_OTP.parquet")
+    current_active_OTP = pd.read_parquet("parquet\\newest_active_OTP.parquet")
+
+    newly_added = current_active_OTP[~current_active_OTP['otpid'].isin(old_active_OTP['otpid'])]
+    still_in_OTP = old_active_OTP[old_active_OTP['otpid'].isin(current_active_OTP['otpid'])]
+    no_longer_OTP = old_active_OTP[~old_active_OTP['otpid'].isin(current_active_OTP['otpid'])]
+
+    
+  
+    for _, row in newly_added.iterrows():
+        pid = row['otpid']
+        # Access other columns via row['column_name']
+        print(f"Processing PID: {pid} with other data: {row}")