-
Notifications
You must be signed in to change notification settings - Fork 0
/
premature_prevention_recovery_step2_remove_allow_list_entries_for_restored_files.py
51 lines (42 loc) · 1.74 KB
/
premature_prevention_recovery_step2_remove_allow_list_entries_for_restored_files.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
# Part 2 of a pair of scripts showing an example of how to handle a break/fix
# scenario where some (or many) devices were prematurely moved to a more
# restrictive policy.
#import API Wrapper (Python bindings) and additional libraries
import deepinstinct3 as di
import pandas, datetime
from dateutil import parser
#define server config
di.key = 'BAR'
di.fqdn = 'FOO.customers.deepinstinctweb.com'
#read hash list from Excel file on disk
file_name = 'premature_prevention_recovery.xlsx'
folder_name = di.create_export_folder()
hash_list_df = pandas.read_excel(f'{folder_name}/{file_name}', sheet_name='hash_list')
hash_list_df.columns=['hashes']
hash_list = hash_list_df['hashes'].values.tolist()
#get events from server
search_parameters = {}
search_parameters['type'] = ['STATIC_ANALYSIS']
search_parameters['action'] = ['PREVENTED']
search_parameters['last_action'] = ['QUARANTINE_SUCCESS']
events = di.get_events(search=search_parameters)
#calculate list of hashes for files still in quarantine
hash_list_still_in_quarantine = []
for event in events:
if event['file_hash'] not in hash_list_still_in_quarantine:
hash_list_still_in_quarantine.append(event['file_hash'])
#calculate hashes safe to remove from allow list
hashes_to_remove = []
for hash in hash_list:
if hash not in hash_list_still_in_quarantine:
hashes_to_remove.append(hash)
#get policies
all_policies = di.get_policies()
#filter policy list
windows_policies = []
for policy in all_policies:
if policy['os'] == 'WINDOWS':
windows_policies.append(policy)
#iterate through Windows policies and remove the allow lists from each
for policy in windows_policies:
di.remove_allow_list_hashes(hashes_to_remove, policy['id'])