AirlockTools.py

@@ -34,8 +34,8 @@ dotenv.load_dotenv()
 #Constants
 url = os.getenv('url')
 bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"]
-pups = ["logmein", "invalid"]
-badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata"]
+pups = ["logmein", "invalid" , "nmap"]
+badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"]
 path_exclusion_constant = 4
 min_files_for_path = 4
 threat_tolerance_constant = 4
@@ -209,10 +209,10 @@ def menu_prepare_to_enforce():
 		elif choice == "2":
 
 			if not os.path.exists(f"parquet\\execution_history_{first_policy}.parquet"):
-				utils.policyfunctions.getPolicyInfo(url, first_policy, 60)
+				utils.policyfunctions.getPolicyInfo(url, first_policy, 150)
 
 			if not os.path.exists(f"parquet\\execution_history_{second_policy}.parquet"):
-				utils.policyfunctions.getPolicyInfo(url, second_policy, 60)
+				utils.policyfunctions.getPolicyInfo(url, second_policy, 150)
 
 			if not os.path.exists(f"parquet\\combined_hashlist_{first_policy}_{second_policy}.parquet"):
 				utils.hashfunctions.combineHashes(url, first_policy, second_policy)

utils/pathfunctions.py

@@ -69,7 +69,7 @@ def split_filepaths_grouped(df, col="filename", group_parts=4, min_parts=4):
             row["longestcfp"] = prefix_str
             row["middle"] = middle
             row["filename_only"] = filename
-            row["file_extension"] = os.path.splitext(filename)[1].tolower()
+            row["file_extension"] = os.path.splitext(filename)[1].lower()
             new_rows.append(row)
 
     return pd.DataFrame(new_rows).drop(columns=["group_key"])

utils/policyfunctions.py

@@ -113,16 +113,16 @@ def sendToPolicy(url, first_policy, second_policy, destination_name, destination
             for path, ext in unique_combinations.itertuples(index=False, name=None)
         ]
 
-        addPath(url, destination_id,processed_paths)
+        addPathReal(url, destination_id,processed_paths)
         
         print(ct.colorText(f"Adding hashes to {allowlist_parent_name}", "yellow"))
                             
         allowlist_parenthashlist = allowbyhash[allowbyhash['reputation_status'] == 'KNOWN']['sha256'].unique().tolist()
-        addHash(url, allowlist_parent_id,allowlist_parenthashlist)
+        addHashReal(url, allowlist_parent_id,allowlist_parenthashlist)
         
         print(ct.colorText(f"Adding hashes to {allowlist_child_name}", "yellow"))
         allowlist_childhashlist = allowbyhash[allowbyhash['reputation_status'] == 'UNKNOWN']['sha256'].unique().tolist()
-        addHash(url, allowlist_child_id, allowlist_childhashlist)			
+        addHashReal(url, allowlist_child_id, allowlist_childhashlist)			
 
         ct.locked()
         
@@ -136,7 +136,7 @@ def pullPolicyExechistories(url, policiesnames, days, outputjson: bool):
     if not os.path.exists(file_path):
         with open(file_path, 'w') as file:
             json.dump({'error': 'Success', 'response': {'exechistories': []}}, file)
-        print(f"File '{file_path}' has been crated.")
+        print(f"File '{file_path}' has been created.")
     else:
         print(f"File '{file_path}' already exists.")
     headers = {"X-APIKey": os.getenv('APIKEY')}