-
Notifications
You must be signed in to change notification settings - Fork 0
/
deepinstinctagentless.py
96 lines (74 loc) · 3.88 KB
/
deepinstinctagentless.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
# Library file which defines methods for sending files to agentless for scanning
# and returns verdict.
#Import required libraries
import requests, base64, json, urllib3
#Disable SSL warnings
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
#Primary method which accepts file name and optional config data, submits scan, simplifies it, and returns result
def scan_file(file_name, scanner_ip, simplified=False, encoded=False, scanner_port=5000, protocol='https'):
# read file from disk (rb means opens the file in binary format for reading)
with open(file_name, 'rb') as f:
#read file
data = f.read()
#close file
f.close()
if encoded:
#encode data and set URL to match
data = base64.b64encode(data)
request_url = f'{protocol}://{scanner_ip}:{scanner_port}/scan/base64'
else:
#leave data as-is and set URL to match
request_url = f'{protocol}://{scanner_ip}:{scanner_port}/scan/binary'
# send scan request, capture response
response = requests.post(request_url, data=data, timeout=20, verify=False)
# validate response code and proceed if expected value 200
if response.status_code == 200:
#convert to Python dictionary
verdict = response.json()
if simplified:
#Call function to simplify the verdict
verdict = simplify_verdict(verdict)
#Return [simplified] verdict
return verdict
else:
print('ERROR: Unexpected return code', response.status_code, 'on POST to', request_url)
return None
#Wrapper which invokes scan_file with the parameter to use encoding
def scan_file_encoded(file_name, scanner_ip, simplified=False):
return scan_file(file_name=file_name, scanner_ip=scanner_ip, simplified=simplified, encoded=True)
# A method used to convert the raw verdict received from DI Agentless into a simplified/more user-friendly format
# --> Recommend to use this with an Agentless Policy where "prevention" is enabled at Threat Severity "Low" and above
# --> This method introduces the concept of a "Suspicious" verdict, which is for files that score Low or Moderate
def simplify_verdict(verdict):
if 'verdict' not in verdict.keys():
print('ERROR: The verdict passed to simplify_verdict is missing or corrupt:\n', verdict)
return None
else:
#remove the redundent text 'filetype' from the file type value, if present
if 'file_type' in verdict.keys():
verdict['file_type'] = verdict['file_type'].replace('FileType','')
if verdict['verdict'] == 'Malicious':
if verdict['severity'] in ['VERY_HIGH', 'HIGH']:
return {'verdict': 'Malicious',
'file_type': verdict['file_type'],
'threat_severity': verdict['severity'],
'file_hash': verdict['file_hash'],
'scan_guid': verdict['scan_guid']}
else:
return {'verdict': 'Suspicious',
'file_type': verdict['file_type'],
'threat_severity': verdict['severity'],
'file_hash': verdict['file_hash'],
'scan_guid': verdict['scan_guid']}
elif verdict['verdict'] == 'Benign':
return {'verdict': 'Benign',
'file_type': verdict['file_type'],
'file_hash': verdict['file_hash'],
'scan_guid': verdict['scan_guid']}
elif verdict['verdict'] == 'Not Classified':
return {'verdict': 'Unsupported',
'file_type': 'Other',
'scan_guid': verdict['scan_guid']}
else:
print('WARNING: Error in processing verfict passed to simplify_verdict:\n', verdict)
return None