brotoskyj
123 lines
4.9 KiB
Python
123 lines
4.9 KiB
Python
# Copyright (C) 2025 James Brotosky, Brandon Wickline
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU Affero General Public License as published
|
|
# by the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU Affero General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
import gc
|
|
import json
|
|
import os
|
|
import pandas as pd
|
|
import re
|
|
import requests
|
|
import utils.pretty as ct
|
|
import utils.allowlist
|
|
|
|
|
|
|
|
|
|
def addHash(policy, hash):
|
|
print(f"Adding the following hashes to {policy}:")
|
|
for p in hash:
|
|
print(p)
|
|
|
|
|
|
def addPath(policy, hash):
|
|
print(f"Adding the following Path Exclusions to {policy}:")
|
|
for p in hash:
|
|
print(p)
|
|
|
|
def addHashReal(url, allowlistID, hashlist):
|
|
endpoint = url + '/v1/hash/application/add'
|
|
print(ct.colorText("[+] Grabbing All Categories", "cyan"))
|
|
payload = {
|
|
"applicationid" : allowlistID,
|
|
"hashes" : hashlist
|
|
}
|
|
headers = {
|
|
"X-APIKey": os.getenv('APIKEY')
|
|
}
|
|
payload = json.dumps(payload)
|
|
response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
|
|
response.raise_for_status() # Raise an error for bad status codes
|
|
parse_text = json.loads(response.text)
|
|
print(parse_text)
|
|
|
|
|
|
def addPathReal(url, grouplistID, pathlist):
|
|
endpoint = url + '/v1/group/path/add'
|
|
print(ct.colorText("[+] Grabbing All Categories", "cyan"))
|
|
payload = {
|
|
"groupid" : grouplistID,
|
|
"path" : pathlist
|
|
}
|
|
headers = {
|
|
"X-APIKey": os.getenv('APIKEY')
|
|
}
|
|
print(payload)
|
|
payload = json.dumps(payload)
|
|
response = requests.request("POST", endpoint, headers=headers, data=payload, verify=False)
|
|
print(response.text)
|
|
|
|
def getPolicyInfo(url, policy, days):
|
|
executionhist_policy = pd.DataFrame()
|
|
exehist = utils.allowlist.pullPolicyExechistories(url, policy, days, True)
|
|
data = json.loads(exehist)
|
|
executionhist_policy = pd.DataFrame(data["response"]["exechistories"])
|
|
if not executionhist_policy.empty:
|
|
executionhist_policyxecutionhist_policy = executionhist_policy[['sha256', 'publisher', 'filename', 'hostname', 'username', 'pprocess', 'gprocess', 'commandline']]
|
|
executionhist_policy = executionhist_policy.drop_duplicates(subset=['sha256', 'filename', 'hostname'])
|
|
executionhist_policy = executionhist_policy.sort_values(by=['sha256', 'filename'])
|
|
executionhist_policy.to_parquet(f"parquet\\execution_history_{policy}.parquet", index=False)
|
|
print(ct.colorText(f"Staging of Execution history for policy: {policy} is complete", "green"))
|
|
del data
|
|
del exehist
|
|
gc.collect()
|
|
return executionhist_policy
|
|
|
|
def sendToPolicy(url, first_policy, second_policy, destination_name, destination_id, allowlist_parent_name, allowlist_parent_id, allowlist_child_name, allowlist_child_id):
|
|
pathexclusions = pd.read_parquet(f"parquet\\final_path_exclusions_{first_policy}_{second_policy}.parquet")
|
|
allowbyhash = pd.read_parquet(f"parquet\\final_hash_approvals_{first_policy}_{second_policy}.parquet")
|
|
|
|
ct.areYouSure()
|
|
confirmation = input(ct.colorText("Type 'I AGREE' to continue: ","white"))
|
|
|
|
if confirmation.strip().upper() == "I AGREE":
|
|
print(ct.colorText("Proceeding with the code...", "yellow"))
|
|
print(ct.colorText(f"Adding path exclusions to {destination_name}", "yellow"))
|
|
pathexcludelist = pathexclusions['longestcfp'].unique().tolist()
|
|
|
|
# Regex to match a Windows drive letter at the start (e.g., C:\)
|
|
drive_letter_pattern = re.compile(r'^[a-zA-Z]:\\')
|
|
|
|
# Processed list
|
|
processed_paths = [
|
|
(path if drive_letter_pattern.match(path) else f"\\\\{path}") + "**"
|
|
for path in pathexcludelist
|
|
]
|
|
addPath(url, destination_id,processed_paths)
|
|
|
|
print(ct.colorText(f"Adding hashes to {allowlist_parent_name}", "yellow"))
|
|
|
|
allowlist_parenthashlist = allowbyhash[allowbyhash['reputation_status'] == 'KNOWN']['sha256'].unique().tolist()
|
|
addHash(url, allowlist_parent_id,allowlist_parenthashlist)
|
|
|
|
print(ct.colorText(f"Adding hashes to {allowlist_child_name}", "yellow"))
|
|
allowlist_childhashlist = allowbyhash[allowbyhash['reputation_status'] == 'UNKNOWN']['sha256'].unique().tolist()
|
|
addHash(url, allowlist_child_id, allowlist_childhashlist)
|
|
|
|
ct.locked()
|
|
|
|
exit()
|
|
|
|
else:
|
|
print(ct.colorText("Operation aborted. You MUST EXPLICITLY AGREE to proceed.", "red"))
|
|
|