Skip to content

Commit 1420c31

Browse files
ffalorffalor
authored
set togglesettings to false by default (#30)
1 parent a47441e commit 1420c31

File tree

4 files changed

+128
-85
lines changed

4 files changed

+128
-85
lines changed

‎internal/prevention_policy/linux.go

+19-15
Original file line numberDiff line numberDiff line change
@@ -516,22 +516,26 @@ func (r *preventionPolicyLinuxResource) assignPreventionSettings(
516516
) {
517517
toggleSettings, mlSliderSettings, _ := mapPreventionSettings(categories)
518518

519-
//todo: check if value exists??
520-
521519
// toggle settings
522-
state.UnknownDetectionRelatedExecutables = toggleSettings["UnknownDetectionRelatedExecutables"]
523-
state.UnknownExecutables = toggleSettings["UnknownExecutables"]
524-
state.ScriptBasedExecutionMonitoring = toggleSettings["ScriptBasedExecutionMonitoring"]
525-
state.NextGenAV = toggleSettings["NextGenAV"]
526-
state.CustomBlacklisting = toggleSettings["CustomBlacklisting"]
527-
state.PreventSuspiciousProcesses = toggleSettings["PreventSuspiciousProcesses"]
528-
state.DriftPrevention = toggleSettings["DriftPrevention"]
529-
state.FilesystemVisibility = toggleSettings["FilesystemVisibility"]
530-
state.NetworkVisibility = toggleSettings["NetworkVisibility"]
531-
state.HTTPVisibility = toggleSettings["HTTPVisibility"]
532-
state.FTPVisibility = toggleSettings["FTPVisibility"]
533-
state.TLSVisibility = toggleSettings["TLSVisibility"]
534-
state.EmailProtocolVisibility = toggleSettings["EmailProtocolVisibility"]
520+
state.UnknownDetectionRelatedExecutables = defaultBoolFalse(
521+
toggleSettings["UnknownDetectionRelatedExecutables"],
522+
)
523+
state.UnknownExecutables = defaultBoolFalse(toggleSettings["UnknownExecutables"])
524+
state.ScriptBasedExecutionMonitoring = defaultBoolFalse(
525+
toggleSettings["ScriptBasedExecutionMonitoring"],
526+
)
527+
state.NextGenAV = defaultBoolFalse(toggleSettings["NextGenAV"])
528+
state.CustomBlacklisting = defaultBoolFalse(toggleSettings["CustomBlacklisting"])
529+
state.PreventSuspiciousProcesses = defaultBoolFalse(
530+
toggleSettings["PreventSuspiciousProcesses"],
531+
)
532+
state.DriftPrevention = defaultBoolFalse(toggleSettings["DriftPrevention"])
533+
state.FilesystemVisibility = defaultBoolFalse(toggleSettings["FilesystemVisibility"])
534+
state.NetworkVisibility = defaultBoolFalse(toggleSettings["NetworkVisibility"])
535+
state.HTTPVisibility = defaultBoolFalse(toggleSettings["HTTPVisibility"])
536+
state.FTPVisibility = defaultBoolFalse(toggleSettings["FTPVisibility"])
537+
state.TLSVisibility = defaultBoolFalse(toggleSettings["TLSVisibility"])
538+
state.EmailProtocolVisibility = defaultBoolFalse(toggleSettings["EmailProtocolVisibility"])
535539

536540
// mlslider settings
537541
state.CloudAntiMalware = mlSliderSettings["CloudAntiMalware"]

‎internal/prevention_policy/mac.go

+22-18
Original file line numberDiff line numberDiff line change
@@ -558,25 +558,29 @@ func (r *preventionPolicyMacResource) assignPreventionSettings(
558558
) {
559559
toggleSettings, mlSliderSettings, _ := mapPreventionSettings(categories)
560560

561-
//todo: check if value exists??
562-
563561
// toggle settings
564-
state.EndUserNotifications = toggleSettings["EndUserNotifications"]
565-
state.UnknownDetectionRelatedExecutables = toggleSettings["UnknownDetectionRelatedExecutables"]
566-
state.UnknownExecutables = toggleSettings["UnknownExecutables"]
567-
state.SensorTamperingProtection = toggleSettings["SensorTamperingProtection"]
568-
state.ScriptBasedExecutionMonitoring = toggleSettings["ScriptBasedExecutionMonitoring"]
569-
state.DetectOnWrite = toggleSettings["DetectOnWrite"]
570-
state.QuarantineOnWrite = toggleSettings["QuarantineOnWrite"]
571-
state.NextGenAV = toggleSettings["NextGenAV"]
572-
state.CustomBlacklisting = toggleSettings["CustomBlacklisting"]
573-
state.PreventSuspiciousProcesses = toggleSettings["PreventSuspiciousProcesses"]
574-
state.IntelPrevention = toggleSettings["IntelPrevention"]
575-
state.ChopperWebshell = toggleSettings["ChopperWebshell"]
576-
state.XPCOMShell = toggleSettings["XPCOMShell"]
577-
state.EmpyreBackdoor = toggleSettings["EmpyreBackdoor"]
578-
state.KcPasswordDecoded = toggleSettings["KcPasswordDecoded"]
579-
state.HashCollector = toggleSettings["HashCollector"]
562+
state.EndUserNotifications = defaultBoolFalse(toggleSettings["EndUserNotifications"])
563+
state.UnknownDetectionRelatedExecutables = defaultBoolFalse(
564+
toggleSettings["UnknownDetectionRelatedExecutables"],
565+
)
566+
state.UnknownExecutables = defaultBoolFalse(toggleSettings["UnknownExecutables"])
567+
state.SensorTamperingProtection = defaultBoolFalse(toggleSettings["SensorTamperingProtection"])
568+
state.ScriptBasedExecutionMonitoring = defaultBoolFalse(
569+
toggleSettings["ScriptBasedExecutionMonitoring"],
570+
)
571+
state.DetectOnWrite = defaultBoolFalse(toggleSettings["DetectOnWrite"])
572+
state.QuarantineOnWrite = defaultBoolFalse(toggleSettings["QuarantineOnWrite"])
573+
state.NextGenAV = defaultBoolFalse(toggleSettings["NextGenAV"])
574+
state.CustomBlacklisting = defaultBoolFalse(toggleSettings["CustomBlacklisting"])
575+
state.PreventSuspiciousProcesses = defaultBoolFalse(
576+
toggleSettings["PreventSuspiciousProcesses"],
577+
)
578+
state.IntelPrevention = defaultBoolFalse(toggleSettings["IntelPrevention"])
579+
state.ChopperWebshell = defaultBoolFalse(toggleSettings["ChopperWebshell"])
580+
state.XPCOMShell = defaultBoolFalse(toggleSettings["XPCOMShell"])
581+
state.EmpyreBackdoor = defaultBoolFalse(toggleSettings["EmpyreBackdoor"])
582+
state.KcPasswordDecoded = defaultBoolFalse(toggleSettings["KcPasswordDecoded"])
583+
state.HashCollector = defaultBoolFalse(toggleSettings["HashCollector"])
580584

581585
// mlslider settings
582586
state.CloudAntiMalware = mlSliderSettings["CloudAntiMalware"]

‎internal/prevention_policy/shared.go

+9
Original file line numberDiff line numberDiff line change
@@ -674,3 +674,12 @@ func syncHostGroups(
674674

675675
return diags
676676
}
677+
678+
// defaultBoolFalse sets the default value of a bool to false if it is not set.
679+
func defaultBoolFalse(v types.Bool) types.Bool {
680+
if !v.ValueBool() {
681+
return types.BoolValue(false)
682+
}
683+
684+
return v
685+
}

‎internal/prevention_policy/windows.go

+78-52
Original file line numberDiff line numberDiff line change
@@ -851,59 +851,85 @@ func (r *preventionPolicyWindowsResource) assignPreventionSettings(
851851
) {
852852
toggleSettings, mlSliderSettings, detectionMlSliderSettings := mapPreventionSettings(categories)
853853

854-
//todo: check if value exists??
855-
856854
// toggle settings
857-
state.AdditionalUserModeData = toggleSettings["AdditionalUserModeData"]
858-
state.EndUserNotifications = toggleSettings["EndUserNotifications"]
859-
state.UnknownDetectionRelatedExecutables = toggleSettings["UnknownDetectionRelatedExecutables"]
860-
state.UnknownExecutables = toggleSettings["UnknownExecutables"]
861-
state.SensorTamperingProtection = toggleSettings["SensorTamperingProtection"]
862-
state.InterpreterProtection = toggleSettings["InterpreterProtection"]
863-
state.EngineProtectionV2 = toggleSettings["EngineProtectionV2"]
864-
state.ScriptBasedExecutionMonitoring = toggleSettings["ScriptBasedExecutionMonitoring"]
865-
state.HTTPDetections = toggleSettings["HTTPDetections"]
866-
state.RedactHTTPDetectionDetails = toggleSettings["RedactHTTPDetectionDetails"]
867-
state.HardwareEnhancedExploitDetection = toggleSettings["HardwareEnhancedExploitDetection"]
868-
state.EnhancedExploitationVisibility = toggleSettings["EnhancedExploitationVisibility"]
869-
state.MemoryScan = toggleSettings["MemoryScan"]
870-
state.CPUMemoryScan = toggleSettings["CPUMemoryScan"]
871-
state.FirmwareAnalysisExtraction = toggleSettings["FirmwareAnalysisExtraction"]
872-
state.MLLargeFileHandling = toggleSettings["ML Large File Handling"]
873-
state.USBInsertionTriggeredScan = toggleSettings["USBInsertionTriggeredScan"]
874-
state.DetectOnWrite = toggleSettings["DetectOnWrite"]
875-
state.QuarantineOnWrite = toggleSettings["QuarantineOnWrite"]
876-
state.OnWriteScriptFileVisibility = toggleSettings["OnWriteScriptFileVisibility"]
877-
state.NextGenAV = toggleSettings["NextGenAV"]
878-
state.NextGenAVQuarantineOnRemovableMedia = toggleSettings["NextGenAVQuarantineOnRemovableMedia"]
879-
state.MicrosoftOfficeFileSuspiciousMacroRemoval = toggleSettings["MicrosoftOfficeFileSuspiciousMacroRemoval"]
880-
state.CustomBlacklisting = toggleSettings["CustomBlacklisting"]
881-
state.PreventSuspiciousProcesses = toggleSettings["PreventSuspiciousProcesses"]
882-
state.SuspiciousRegistryOperations = toggleSettings["SuspiciousRegistryOperations"]
883-
state.MaliciousPowershell = toggleSettings["MaliciousPowershell"]
884-
state.IntelPrevention = toggleSettings["IntelPrevention"]
885-
state.SuspiciousKernelDrivers = toggleSettings["SuspiciousKernelDrivers"]
886-
state.VulnerableDriverProtection = toggleSettings["VulnerableDriverProtection"]
887-
state.ForceASLR = toggleSettings["ForceASLR"]
888-
state.ForceDEP = toggleSettings["ForceDEP"]
889-
state.HeapSprayPreallocation = toggleSettings["HeapSprayPreallocation"]
890-
state.NullPageAllocation = toggleSettings["NullPageAllocation"]
891-
state.SEHOverwriteProtection = toggleSettings["SEHOverwriteProtection"]
892-
state.BackupDeletion = toggleSettings["BackupDeletion"]
893-
state.Cryptowall = toggleSettings["Cryptowall"]
894-
state.FileEncryption = toggleSettings["FileEncryption"]
895-
state.Locky = toggleSettings["Locky"]
896-
state.FileSystemAccess = toggleSettings["FileSystemAccess"]
897-
state.VolumeShadowCopyAudit = toggleSettings["VolumeShadowCopyAudit"]
898-
state.VolumeShadowCopyProtect = toggleSettings["VolumeShadowCopyProtect"]
899-
state.ApplicationExploitationActivity = toggleSettings["ApplicationExploitationActivity"]
900-
state.ChopperWebshell = toggleSettings["ChopperWebshell"]
901-
state.DriveByDownload = toggleSettings["DriveByDownload"]
902-
state.ProcessHollowing = toggleSettings["ProcessHollowing"]
903-
state.JavaScriptViaRundll32 = toggleSettings["JavaScriptViaRundll32"]
904-
state.WindowsLogonBypassStickyKeys = toggleSettings["WindowsLogonBypassStickyKeys"]
905-
state.CredentialDumping = toggleSettings["CredentialDumping"]
906-
state.AutomatedRemediation = toggleSettings["AutomatedRemediation"]
855+
state.AdditionalUserModeData = defaultBoolFalse(toggleSettings["AdditionalUserModeData"])
856+
state.EndUserNotifications = defaultBoolFalse(toggleSettings["EndUserNotifications"])
857+
state.UnknownDetectionRelatedExecutables = defaultBoolFalse(
858+
toggleSettings["UnknownDetectionRelatedExecutables"],
859+
)
860+
state.UnknownExecutables = defaultBoolFalse(toggleSettings["UnknownExecutables"])
861+
state.SensorTamperingProtection = defaultBoolFalse(toggleSettings["SensorTamperingProtection"])
862+
state.InterpreterProtection = defaultBoolFalse(toggleSettings["InterpreterProtection"])
863+
state.EngineProtectionV2 = defaultBoolFalse(toggleSettings["EngineProtectionV2"])
864+
state.ScriptBasedExecutionMonitoring = defaultBoolFalse(
865+
toggleSettings["ScriptBasedExecutionMonitoring"],
866+
)
867+
state.HTTPDetections = defaultBoolFalse(toggleSettings["HTTPDetections"])
868+
state.RedactHTTPDetectionDetails = defaultBoolFalse(
869+
toggleSettings["RedactHTTPDetectionDetails"],
870+
)
871+
state.HardwareEnhancedExploitDetection = defaultBoolFalse(
872+
toggleSettings["HardwareEnhancedExploitDetection"],
873+
)
874+
state.EnhancedExploitationVisibility = defaultBoolFalse(
875+
toggleSettings["EnhancedExploitationVisibility"],
876+
)
877+
state.MemoryScan = defaultBoolFalse(toggleSettings["MemoryScan"])
878+
state.CPUMemoryScan = defaultBoolFalse(toggleSettings["CPUMemoryScan"])
879+
state.FirmwareAnalysisExtraction = defaultBoolFalse(
880+
toggleSettings["FirmwareAnalysisExtraction"],
881+
)
882+
state.MLLargeFileHandling = defaultBoolFalse(toggleSettings["ML Large File Handling"])
883+
state.USBInsertionTriggeredScan = defaultBoolFalse(toggleSettings["USBInsertionTriggeredScan"])
884+
state.DetectOnWrite = defaultBoolFalse(toggleSettings["DetectOnWrite"])
885+
state.QuarantineOnWrite = defaultBoolFalse(toggleSettings["QuarantineOnWrite"])
886+
state.OnWriteScriptFileVisibility = defaultBoolFalse(
887+
toggleSettings["OnWriteScriptFileVisibility"],
888+
)
889+
state.NextGenAV = defaultBoolFalse(toggleSettings["NextGenAV"])
890+
state.NextGenAVQuarantineOnRemovableMedia = defaultBoolFalse(
891+
toggleSettings["NextGenAVQuarantineOnRemovableMedia"],
892+
)
893+
state.MicrosoftOfficeFileSuspiciousMacroRemoval = defaultBoolFalse(
894+
toggleSettings["MicrosoftOfficeFileSuspiciousMacroRemoval"],
895+
)
896+
state.CustomBlacklisting = defaultBoolFalse(toggleSettings["CustomBlacklisting"])
897+
state.PreventSuspiciousProcesses = defaultBoolFalse(
898+
toggleSettings["PreventSuspiciousProcesses"],
899+
)
900+
state.SuspiciousRegistryOperations = defaultBoolFalse(
901+
toggleSettings["SuspiciousRegistryOperations"],
902+
)
903+
state.MaliciousPowershell = defaultBoolFalse(toggleSettings["MaliciousPowershell"])
904+
state.IntelPrevention = defaultBoolFalse(toggleSettings["IntelPrevention"])
905+
state.SuspiciousKernelDrivers = defaultBoolFalse(toggleSettings["SuspiciousKernelDrivers"])
906+
state.VulnerableDriverProtection = defaultBoolFalse(
907+
toggleSettings["VulnerableDriverProtection"],
908+
)
909+
state.ForceASLR = defaultBoolFalse(toggleSettings["ForceASLR"])
910+
state.ForceDEP = defaultBoolFalse(toggleSettings["ForceDEP"])
911+
state.HeapSprayPreallocation = defaultBoolFalse(toggleSettings["HeapSprayPreallocation"])
912+
state.NullPageAllocation = defaultBoolFalse(toggleSettings["NullPageAllocation"])
913+
state.SEHOverwriteProtection = defaultBoolFalse(toggleSettings["SEHOverwriteProtection"])
914+
state.BackupDeletion = defaultBoolFalse(toggleSettings["BackupDeletion"])
915+
state.Cryptowall = defaultBoolFalse(toggleSettings["Cryptowall"])
916+
state.FileEncryption = defaultBoolFalse(toggleSettings["FileEncryption"])
917+
state.Locky = defaultBoolFalse(toggleSettings["Locky"])
918+
state.FileSystemAccess = defaultBoolFalse(toggleSettings["FileSystemAccess"])
919+
state.VolumeShadowCopyAudit = defaultBoolFalse(toggleSettings["VolumeShadowCopyAudit"])
920+
state.VolumeShadowCopyProtect = defaultBoolFalse(toggleSettings["VolumeShadowCopyProtect"])
921+
state.ApplicationExploitationActivity = defaultBoolFalse(
922+
toggleSettings["ApplicationExploitationActivity"],
923+
)
924+
state.ChopperWebshell = defaultBoolFalse(toggleSettings["ChopperWebshell"])
925+
state.DriveByDownload = defaultBoolFalse(toggleSettings["DriveByDownload"])
926+
state.ProcessHollowing = defaultBoolFalse(toggleSettings["ProcessHollowing"])
927+
state.JavaScriptViaRundll32 = defaultBoolFalse(toggleSettings["JavaScriptViaRundll32"])
928+
state.WindowsLogonBypassStickyKeys = defaultBoolFalse(
929+
toggleSettings["WindowsLogonBypassStickyKeys"],
930+
)
931+
state.CredentialDumping = defaultBoolFalse(toggleSettings["CredentialDumping"])
932+
state.AutomatedRemediation = defaultBoolFalse(toggleSettings["AutomatedRemediation"])
907933

908934
// mlslider settings
909935
state.ExtendedUserModeDataSlider = detectionMlSliderSettings["ExtendedUserModeDataSlider"]

0 commit comments

Comments
 (0)