3

Would like to use Python to search the DSaaS global rules to see if a certain HASH/SHA256 is in the global rule set.

Code below. How do I get the SHA256 value (hash256) in the search_filter object?

    hash256 = str(input("Pleas enter the hash that you would like to search: "))
    print(hash256)

    try:
        search_filter = deepsecurity.SearchFilter()

        api_response = api_instance.search_global_rules(api_version, search_filter=search_filter)
        pprint(api_response)
    except ApiException as e:
        print("An exception occurred when calling GlobalRulesApi.search_global_rules: %s\n" % e)

Not getting the search to work by HASH

tboyers
  • 65
  • 2

1 Answers1

2

In order to perform a search on the Application Control Global Rules you will need to first create a SearchCriteria as follows

# Create SearchCriteria
searchCriteria = deepsecurity.SearchCriteria(
    field_name='sha256',
    string_test='equal',
    string_value=hash256
)

and then add it to your SearchFilter object

search_filter = deepsecurity.SearchFilter(search_criteria=searchCriteria)

Overall your code will be as follows

hash256 = str(input("Please enter the hash that you would like to search: "))
print(hash256)

# Create SearchCriteria
searchCriteria = deepsecurity.SearchCriteria(
    field_name='sha256',
    string_test='equal',
    string_value=hash256
)

# Add SearchCriteria to SearchFilter
search_filter = deepsecurity.SearchFilter(search_criteria=searchCriteria)

try:
    api_response = api_instance.search_global_rules(api_version, search_filter=search_filter)
    pprint(api_response)
except ApiException as e:
    print("An exception occurred when calling GlobalRulesApi.search_global_rules: %s\n" % e)

Check out this guide for advanced searches, such as using wildcards and more.

P.S. I work for Trend Micro on the Deep Security team.

Rouzbeh
  • 71
  • 4
  • 1
    Thank you again...works great! I have python script that has these functions. Welcome to Deep Security Security Automation tool for Global Rule Hash Files Following below the actions allowed today from this tool: 1 - Add File Hash from Input File 2 - Add Single File Hash/Description 3 - Search for Single Hash 4 - Search for Single Description 5 - Delete File Hash by ID (use #5 first) 6 - List All File Hash to Screen 7 - Export All File Hash to File 8 - Close the session – tboyers Aug 16 '19 at 16:49