6$i_LdZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z ddlm Z ddl mZddlmZdd lmZmZmZmZmZdd lmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#dd l$m%Z%dd l&m'Z'dd l(m)Z)m*Z*ddl+m,Z,m-Z-m.Z.ddl/m0Z0m1Z1m2Z2m3Z3ddl4m5Z5ddl6m7Z7m8Z8m9Z9m:Z:m;Z;ddlm?Z?Gdde)Z@Gdde)ZAe dGddZBGdde)ZCGdde)ZDGd d!e)ZEGd"d#e)ZFdS)$u  This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program.  If not, see . Copyright © 2019 Cloud Linux Software Inc. This software is also available under ImunifyAV commercial license, see ) annotationsN) dataclass)reduce) attrgetter)Path)time)DictIterableListSetcast) SQL BooleanFieldCase CharFieldCheck Expression FloatFieldForeignKeyField IntegerField ModelSelectPrimaryKeyField TextFieldfn model_to_dict)UserType)Modelinstance) FilenameField ScanPathFieldapply_order_by)execute_iterable_expressionget_abspath_from_user_dirget_results_iterable_expressionsplit_for_chunk)RemoteRevertHitInfo)FAILED_TO_CLEANUPMalwareHitStatusMalwareScanResourceTypeMalwareScanTypeVulnerabilityHitStatus) get_crontab)MalwareDatabaseHitInfoc~eZdZdZGddZedZedZedZ ede d e j e je je je je je jfg Zedd Zedd Zedd Zedd Zede d ejjejjfg ZedZ edd Z!e" de j e je jfd ddZ#d S) MalwareScanzRepresents a batch of files scanned for malware Usually a single AI-BOLIT execution. See :class:`.MalwareScanType` for possible kinds of scans. c eZdZejZdZdS)MalwareScan.Meta malware_scansN__name__ __module__ __qualname__rdbdatabasedb_tableJ/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/model.pyMetar2Us;"r<r>T primary_keyFnullz type in {}rB constraintsrrBdefaultNresource_type in {}c8ttSNintrr;r<r=zMalwareScan.sTVVr<)typespathsc v||j|j|j|j|j|j|j|j d|j |j | |j|k |j|k}|r-| |j |}| |j|j|j|jtj||}|t'|||}|dt+|fS)N scan_typeT clear_limit)selecttotal_resourcespathscanidstarted completederrortotal_malicioustypealias resource_typewherein_group_byorder_byr0desclimitoffsetr"countlistdicts) clssincetordrerbrNrOquerys r= ondemand_listzMalwareScan.ondemand_listsd" JJ#    #{++!  U38<<&& ' ' U3;%' ( ( U3;"$ % % "  5KK U 3 344E NN#SXsz3;  Xk)..00 1 1 U5\\ VF^^   "8S%88E{{t{,,d5;;==.A.AAAr<rJ)$r5r6r7__doc__r>rrWrrXrYrformatr+ ON_DEMANDREALTIMEMALWARE_RESPONSE BACKGROUNDRESCANUSERRESCAN_OUTDATEDr\rUr!rVrrZr[r*DBvalueFILEr^ initiator timestamp classmethodrmr;r<r=r0r0Ns ######## Y4 ( ( (Fl&&&G $'''I 9  E##'1'0'8'2'.','7        D&#lq999O =dB / / /D I4 . . .E"lq999OI  E%,,/28/4:       M t$$$I %1D1DEEEI /B  %  &   /B/B/B/B[/B/B/Br<r0c eZdZdZGddZeZeedddZ e dZ e dZ e dZe dZedd Ze d Ze d Zed Ze ej Zed Ze ded ejjejjfg Z e d Z!e d Z"e d Z#e d Z$e d Z%e&dBdZ'e&dZ(GddZ)e* dCdZ+e* dDdZ,e*dEdZ-e*dddZ.e*dEdZ/e*dFdZ0e*dGd Z1e*dHd"Z2e*d#Z3e* dId$Z4e*dd%d&Z5e*dJd)Z6e*dKd+Z7e*d,Z8d-Z9e*dLdMd/Z:e*dNd2Z;e*dOd4Ze*dOd7Z?e*d8Z@e*d9ZAe*d:ZBeCdPd?ZDd@ZEdAZFdS)Q MalwareHitz*Represents a malicious or suspicious file.c eZdZejZdZdS)MalwareHit.Meta malware_hitsNr4r;r<r=r>rs;!r<r>FhitsCASCADErB related_name on_deleterArETrFrHrCreturnstrc6tt|jSrJ)r rr\selfs r= signature_idzMalwareHit.signature_idsC###r<cTtt|j}t|SrJr r orig_filerrrs r=orig_file_pathzMalwareHit.orig_file_pathdn-- Ir<c$eZdZedZdS)MalwareHit.OrderByc ttjtjdftjdftjdftjdftjdffdfS)Nrd) rr~statusr)CLEANUP_PENDINGCLEANUP_STARTEDFOUND CLEANUP_DONECLEANUP_REMOVEDr;r<r=rzMalwareHit.OrderBy.status sb%)91=)91=)/3)6:)91=     r<N)r5r6r7 staticmethodrr;r<r=OrderByr s-       r<rrNc , ||tt}|p t}|tj|ktj|kzg}|5d|d}|t d|f|j|zz|#|tj|k|#|tj |k| "|tj | z| rω r||j dk||j  fd| D}|rrg}g}|D]/}|d||d0d|}|t d|d|ttj|}|}| "|tj| z}||||}| t-| t|}||}d |D}||fS) N%CAST(orig_file AS TEXT) LIKE ?filec~g|]9}t|tk"|7|:Sr;)len startswith).0p site_searchs r= z)MalwareHit._hits_list..LsMq66C ,,,,k1J1J,,,,r<zorig_file NOT LIKE ?z AND ()c6g|]}|Sr;as_dictrrows r=rz)MalwareHit._hits_list..s 333C#++--333r<)rTr0joinrrXappendruserr~rWrr^rrroperatorand_idr`r_rdrer" _hits_num)riclausesrjrkrdresearch by_scan_idrrb by_statusidsr user_siteskwargsrwhere_conditionspattern longer_paths sql_chunks sql_paramsrVcombined_sql_string full_clausesmax_count_clausesordered max_countresults ` r= _hits_listzMalwareHit._hits_lists$zz#{++00== \466   E )k.AR.G H   #&mmmG  # #4wjAA8W$&       # #JOt$; < < <  !  # #K$6*$D E E E   # #J$5$B C C C  +   # #C$5$? @ @ @  # #CM$<$<[$I$I J J J#L    (22D%%&<===%%jjj1111&-ll:&>&># ''2/222J?? hm-=>> ) ? JM--c22 2L**\**0077>>vFF  $Xz7CCGMM"344 337333&  r<cx|r&|r$|tj|ktj|kzz}|||j|kz}|t j|jt|}|t|t|}| SrJ) r0rXrrTrCOUNTrrr_r"r~scalar)rirrjrkrrbqs r=rzMalwareHit._hits_numws  R   +u4#r) G   sx4' 'G JJrx'' ( ( - -k : : @ @ I I  xQ77Axxzzr<c||jtj|jz|||SrJ)rrnot_inr)CLEANUP malicious)rirjrkrs r= malicious_numzMalwareHit.malicious_nums?}} Z  /7 8 83= H       r<)ignore_cleanedc|j}|r'||jtjz}|j|g|Ri|SrJ)rrrr)rr)rirargsrrs r=malicious_listzMalwareHit.malicious_listsR-  C sz(()9)ABB BGs~g7777777r<cFd|D}d}t|||||S)Ncg|] }|j Sr;rrs r=rz)MalwareHit.set_status..'''3'''r<cd|i}|||d<|jdi||j|S)Nr cleaned_atr;updater_rr`)rrirrfields_to_updates r= expressionz)MalwareHit.set_status..expressionU&  %1; .3:11 01177 3HH Hr<r#)rirrrrs r= set_statuszMalwareHit.set_statusF''$''' I I I+ c6:   r< to_deletergcFd|D}fd}t||S)Ncg|] }|j Sr;rrs r=rz/MalwareHit.delete_instances..s111SV111r<cj|SrJ)deleter_rr`)rris r=rz/MalwareHit.delete_instances..expressions+::<<%%cfjjoo66 6r<r)rirrs` r=delete_instanceszMalwareHit.delete_instancessA11y111  7 7 7 7 7+:yAAAr< to_updatec|D][}|D]D\}}|D]\}}t||||E\dSrJ)itemssetattrsave)rirdata _instancenew_fields_datafieldrxs r=update_instanceszMalwareHit.update_instancess ! !D.2jjll ! !* ?$3$9$9$;$;55LE5Iue4444     ! ! !r<rc`|jtjg|jz}|SrJ)rr`r)rr)rirs r= is_infectedzMalwareHit.is_infecteds: JNN$*   m   r<c|jSrJ)rris r= is_suspiciouszMalwareHit.is_suspiciouss  ~r<c Tfd}tt||||dS)Nc|j}|||j|z}nSr(||jt jz}n)r'||jt jz}|5t|tr|g}||j |z}| |SrJ) rrr`rrr)r RESTORABLE isinstancerrrTr_) chunk_of_idsrirrcleanuprestores r=rz/MalwareHit.malicious_select..expressionsmG'36::l333 G3:,,-=-EFFF G3:>>*:*EFFFdC((" 6D38<<---::<<%%g.. .r<T)exec_expr_with_empty_iterrgr%)rirrrrrrs `` r=malicious_selectzMalwareHit.malicious_selectsS / / / / / / +Cdd      r<statusesc2fd}t||S)Ncj|}r|jz}|SrJrr`rrTr_filesrrir s r=rz'MalwareHit.get_hits..expressionTm''..G 43:>>(333::<<%%g.. .r<r%rirr rs` ` r=get_hitszMalwareHit.get_hits4 / / / / / / /z5AAAr< hits_infoSet[MalwareDatabaseHitInfo]cxd|D}d|D}d|Dtttj|tj|}fd|D}|S)Ncg|] }|j Sr;rVrentrys r=rz*MalwareHit.get_db_hits..s333333r<cg|] }|j Sr;app_namers r=rz*MalwareHit.get_db_hits..6665666r<c*g|]}|j|jfSr;rVr rs r=rz*MalwareHit.get_db_hits..s!JJJuuz5>2JJJr<c4g|]}|j|jfv|Sr;rr rhit paths_appss r=rz*MalwareHit.get_db_hits..s3   CM3<#@J#N#NC#N#N#Nr<)rgr~rTr_rr`r )rirrOappsrr(s @r= get_db_hitszMalwareHit.get_db_hitss3333366I666JJ JJJ       U:'++E22 3 3 U:&**400 1 1           r<list[RemoteRevertHitInfo]cdd|D}d|D}d|D}d|Dtttj|tj|tj|tjtj }fd|D}|S)Ncg|] }|j Sr;) app_root_pathrs r=rz.s<<<$<<.r!r<cg|] }|j Sr;)sig_idrs r=rz.s:::uel:::r<c6g|]}|j|j|jfSr;)r.r r1rs r=rz.s6    %.%, ?   r<c@g|]}|j|j|jfv|Sr;)rr rr&s r=rz. s<    s|S-=>*LL LLLr<) rgr~db_hitsr_rr`r r\rr)r)rirrOr) signaturesrr(s @r=get_db_hits_for_remote_revertz(MalwareHit.get_db_hits_for_remote_reverts&=<)<<<66I666:: :::   "   "&    U:'++E22 3 3 U:&**400 1 1 U:?&&z22 3 3 U:$(()9)DEE F F " "          r<c.fd}t||S)Ncj|SrJrr_rr`rris r=rz*MalwareHit.delete_hits..expression/::<<%%cm&7&7&>&>?? ?r<rrirrs` r= delete_hitszMalwareHit.delete_hits3 @ @ @ @ @+:u===r<cjt||SrJ)r\get_pk_exprrs r=refreshzMalwareHit.refreshs"Dzz~~dmmoo...r<Iterable[MalwareHit]cLfd}tt||S)Nc}r3tt}|jd|DS)Ncg|] }|j Sr;rrr's r=rz?MalwareHit.refresh_hits..expression.."s*B*B*Bc36*B*B*Br<)rTr0rr_rr`)rrlriinclude_scan_infos r=rz+MalwareHit.refresh_hits..expressionsiJJLLE  G 3 4499+FF;;svzz*B*BT*B*B*BCCDD Dr<r )rirrHrs` ` r= refresh_hitszMalwareHit.refresh_hitssC E E E E E E 3JEEFFFr<r{rLc||j|k|jt jz|jdzS)NF)rTr_rrr`r)CLEANEDis_null)rir{s r= cleaned_sincezMalwareHit.cleaned_since&s^zz||!! ^y (z~~.677 9~%%e,, .   r<rc||jtjjkSrJ)rTr_r^r*rwrxrs r=r4zMalwareHit.db_hits.s4zz||!!  !8!;!A A   r<cv||jtjkS)z,Return db hits that are in queue for cleanup)r4r_rr)rrs r=db_hits_pending_cleanupz"MalwareHit.db_hits_pending_cleanup42{{}}"" J*: :   r<cv||jtjkS)z3Return db hits for which the cleanup is in progress)r4r_rr)rrs r=db_hits_under_cleanupz MalwareHit.db_hits_under_cleanup;rQr<cv||jtjkS)z3Return db hits for which the restore is in progressr4r_rr)CLEANUP_RESTORE_STARTEDrs r=db_hits_under_restorationz$MalwareHit.db_hits_under_restorationBs2{{}}"" J*B B   r<c<d|D}d|D}d|D||j||j|}fd|DS)z Return db hits for which the cleanup is in progress specified by the provided set of MalwareDatabaseHitInfo ch|] }|j Sr;rrhit_infos r= z6MalwareHit.db_hits_under_cleanup_in..Qs???hHM???r<ch|] }|j Sr;rrZs r=r\z6MalwareHit.db_hits_under_cleanup_in..RsGGGh)GGGr<c*h|]}|j|jfSr;r#rZs r=r\z6MalwareHit.db_hits_under_cleanup_in..Ss/   3;X]H- .   r<c4g|]}|j|jfv|Sr;r%)rr'path_app_name_sets r=rz7MalwareHit.db_hits_under_cleanup_in..[s8    s|,0AAA AAAr<)rSr_rr`r )ri hit_info_setpath_set app_name_setrlr`s @r=db_hits_under_cleanup_inz#MalwareHit.db_hits_under_cleanup_inIs@?,???GG,GGG   ?K     % % ' ' U3=$$X.. / / U3<##L11 2 2          r<c||jtjtjgSrJ)r4r_rr`r)CLEANUP_RESTORE_PENDINGCLEANUP_REMOTE_RESTORE_PENDINGrs r=db_hits_pending_cleanup_restorez*MalwareHit.db_hits_pending_cleanup_restoreasF{{}}"" JNN$<$C     r<cv||jtjkSrJrUrs r=db_hits_under_cleanup_restorez(MalwareHit.db_hits_under_cleanup_restorels0{{}}"" J*B B   r< hit_list_listList['MalwareHit'] attributeDict[str, List['MalwareHit']]ctdtj|Dt |}dtj|t |DS)Nc3K|]}|VdSrJr;rGs r= z0MalwareHit.group_by_attribute..w" I ISS I I I I I Ir<keyc4i|]\}}|t|Sr;rgr attr_valuers r= z1MalwareHit.group_by_attribute..z4    D T    r<sorted itertoolschain from_iterablergroupbyrmrkhit_lists r=group_by_attributezMalwareHit.group_by_attributer I IIO99-HH I I I9%%     $-$5y))%%%    r<c@id|jd|jd|jd|jjd|jd|jjd|jd|jd |jd |j d |j d |j d |j did|j d|jd|j|j|j|jt$jjkret+t,t,jt,jt,jt,j|jkt,j|jkt,j|jkt,j |j kt,j|jkt,j|jkt,j|jkt,j|jkt,jdt,jdt,jd ngdS)Nrusernamercreatedscan_idrQr^r\hashsizerrr extra_datadb_namer db_hostF)db_portsnippet table_fields)!rrrrWrX scanid_idr\r^rrrrrrr rrrr*rwrxrgMalwareHistoryrT table_name table_field table_row_infr_rVrrrLrhrs r=rzMalwareHit.as_dicts-- $'-  -  DN-  t{* - t~ - ) -  T/-  DI-  DI-  DI-  -  dk-  $/-  "-  t|-  !- " t|#- $||.%)@)C)III+"))&1&2&4 U&/4=@&.$,>&.$,>&.$,>&+t~=&48JJ&.$+=&3ty@&199%@@&2::5AA&4<rrrr0rWrownerrr rr\rrrrrr{r)rrrrror*rwrxryr^r rrrrpropertyrrrr|rrrrrrrrrr rr*r6r=rBrIrMr4rPrSrWrdrhrjrrrrr;r<r=r~r~s44""""""""   B _%f F I5 ! ! !E 9% D 5)))I 9% D  %777I 9$   D 9$   D %%%IY/5 6 6 6F&&&JI  E%,,/28/4:       Myd###HiT"""GiT"""GiT"""GiT"""G $$$X$X"   X!X!X![X!tDH   [    [ 278888[8    [ BBB[B!!![!   [ [9>   [ .)-BBBB[B   [ [0>>[> ///GGGG[G   [    [    [    [    [   [ .  [   [     \  . . . `NNNNNr<r~T)frozenceZdZUdZded<ded<ded<ded<ded<d ed <ded <ded <d ed <ded<edZedZdS)MalwareHitAlternatezA Used as a replacement for MalwareHit for file hits only rrWrNoner rrrLrrr\r{boolrc |||d|d|d|d|d|ddd|ddd|ddd  S) Nrrrrrrmatchesr{ suspicious) rWrr rrrrr\r{rr;)rirWfilenamers r=createzMalwareHitAlternate.createsssw-ffffa+6l1ok2v,q/,77    r<cNttj|jSrJ)rosfsdecoderrs r=rz"MalwareHitAlternate.orig_file_pathsBK//000r<N) r5r6r7rn__annotations__r|rrrr;r<r=rrsKKKNNNNNNJJJ III III III IIINNNOOO   [  11X111r<rcJeZdZdZGddZdZeZeZ ede dgZ e dd Z ed Zefd Zefd Ze dddZeddZedZxZS)MalwareIgnorePathz+A path that must be excluded from all scansc$eZdZejZdZdZdS)MalwareIgnorePath.Metamalware_ignore_path)))rVr^TN)r5r6r7rr8r9r:indexesr;r<r=r>rs;(6r<r>NFzresource_type in ('file','db')rCc8ttSrJrKr;r<r=rMzMalwareIgnorePath.s#dff++r<rEct||j}||_dSrJ)rgrTrbrVrhCACHE)rirs r= _update_cachezMalwareIgnorePath._update_caches>SZZ\\**3844::<<== r<c Rd|_tt|jdi|S)Nr;)rsuperrr)rirrs r=rzMalwareIgnorePath.creates. 3u&,,3==f===r<c`d|_tt|SrJ)rrrr)rirs r=rzMalwareIgnorePath.deletes' &,,33555r<r^ str | Nonec \||j} || |j|k} || |j|k} |-| |j|} || |j|k} || |} || |} |t||| } |t|} | |j t| dz|jt| kz|jtt|kz} | d} | d| DfS)N/TrRc,g|]}t|Sr;rrs r=rz:MalwareIgnorePath.paths_count_and_list..*s - - -C]3   - - -r<)rTrbrVr_ added_datecontainsr^rerdr"r$rrr-rf) rirdrerr^rrjrkrbr user_homers r=paths_count_and_listz&MalwareIgnorePath.paths_count_and_lists JJLL ! !#( + +  %/00A >",--A  ))&1122A  $)]:;;A    A  A  xa00A  1$77I$$S^^c%9::8s9~~-/8s;t#4#45557A GGG--  - -1 - - -  r<r List[str]c:|j|i|\}}d|DS)Ncg|] }|d Srr;rs r=rz/MalwareIgnorePath.path_list..0s111F 111r<)r)rirr_ path_lists r=rzMalwareIgnorePath.path_list-s1/s/@@@ 911y1111r<cK|j|t|}|jrK|jD]C}tjdd{Vt|d}||ks ||jvrdSDdS)zChecks whether path stored in MalwareIgnorePath cache or if it's belongs to path from cache or if it matches patters from cache :param str check_path: path to check :return: bool: is ignored according MalwareIgnorePath NrrVTF)rrrasynciosleepparents)ri check_pathrVr ignored_paths r=is_path_ignoredz!MalwareIgnorePath.is_path_ignored2s 9       J 9 Y  mA&&&&&&&&&#AfI L((ldl.J.J44/Kur<)NNNNNNNN)r^r)rr)r5r6r7rnr>rrrrrVrr^rrr|rrrrrr __classcell__)rs@r=rrs5577777777 E   B 9;;DI 'G!H!H IM52E2EFFFJ[>>>>[>6666[6$(  & & & & [& P222[2[r<rc eZdZdZGddZedZedZede d e j j e jj fge jj ZedZedZedZedZedZedd ZedZedZedZedZedZedZedZedZe dd Z ed Z!eddZ"eddZ#d S)rz:Records every event related to :class:`MalwareHit` recordsc eZdZejZdZdS)MalwareHistory.Metamalware_historyNr4r;r<r=r>rIs;$r<r>FrATrH)rBrDrFc8ttSrJrKr;r<r=rMzMalwareHistory.jsS[[r<rENc|j|k|j|kz}|r/||j|td|fzz}|r||j|kz}|||| } |t|t| } t| } | d| fS)Nz(INSTR(path, ?))TrR)ctimeeventrr file_userrTr_rdrerhr"rrgrf) rirjrkrdrerrrbrrl list_results r= get_historyzMalwareHistory.get_history|s9%#)r/:    **622& 22 G  - s}, ,G ""7++11%88??GGMMOO  "8^UCCE5kk {{t{,,k99r<c |jd|ddp tj|ddp tj|ddpt jjd| dS)Nrzcauser^)rzrr^r;) insertpoprROOTr+MANUALr*ryrxexecute)rirs r= save_eventzMalwareHistory.save_events  jjd33Dx}**Wd++E/E **_d;;2&+1      ')))))r<r List[dict]c tj5t|dt |jjzD])}||* ddddS#1swxYwYdS)Ni) chunk_size) rr8atomicr&r_metacolumns insert_manyr)rir hits_chunks r= save_eventszMalwareHistory.save_eventss [   ! ! 6 6 .CI,=(>(>!> 6 6  ++335555 6  6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6sABB BrOrgrjrLc>||jtj|j||jtkz|j|kz |j SrJ) rTrVrrr_r`rr(rratuples)rirOrjs r=get_failed_cleanup_events_countz.MalwareHistory.get_failed_cleanup_events_counts{ JJsx , , U U##9 1139%' Xch   VXX r<)NNN)rr)rOrgrjrL)$r5r6r7rnr>r rVrr rror*rwrxryr^rrrz file_ownerrrrrrrrrrrrr|rrrrr;r<r=rrFsLDD%%%%%%%% =e $ $ $Dyd###HI  E%,,/28/4:    (,2   M I5 ! ! !E I5 ! ! !E u%%%I&&&J u%%%I Le-@-@ A A AEiT"""GiT"""GiT"""G%%%J)&&&K Ld+++MiT"""G9$'''LHL:::[:&[ 6 6 6[ 6    [    r<rcHeZdZdZGddZeZeedddZ e dZ e dZ e dZe dZe d Ze d Zed Ze ej Zed Zed Zed$dZed%dZedddZedZe d&dZedZ e!d'dZ"ed(d!Z#ed)d"Z$d#Z%dS)*VulnerabilityHitzRepresents a vulnerable file.c eZdZejZdZdS)VulnerabilityHit.Metavulnerability_hitsNr4r;r<r=r>rs;'r<r>FvulnerabilitiesrrrATrcTtt|j}t|SrJrrs r=rzVulnerabilityHit.orig_file_pathrr< signaturerrrc,|dS)Nz VULN-ESUS-)r)rirs r=matchzVulnerabilityHit.matchs##L111r<rgctjd|x}r-|ddSgS)NzVULN-ESUS-([\d,]+)r,)rergroupssplit)rirrs r=get_vulnerability_idsz&VulnerabilityHit.get_vulnerability_idssBI3Y?? ?5 0<<>>!$**3// / r<Nr c2fd}t||S)Ncj|}r|jz}|SrJrrs r=rz-VulnerabilityHit.get_hits..expressionrr<rrs` ` r=rzVulnerabilityHit.get_hitsrr<c.fd}t||S)Ncj|SrJr9r:s r=rz0VulnerabilityHit.delete_hits..expressionr;r<rr<s` r=r=zVulnerabilityHit.delete_hitsr>r<rc  d||tt} |p t}d|} tj|ktj|kz}||t d| f|j| zzz}|||j|kz}|||j|kz}| ||j | zz}|}| ||j | z}| | ||}|t|||}|t!j|j t |}d|D}||fS)Nz%{}%rc6g|]}|Sr;rrs r=rz/VulnerabilityHit._hits_list..(rr<)rTr0rrrorXrrrWrrr`r_rdrer"rrr)rirjrkrdrerrrrbrrrrrrrrrrs r=rzVulnerabilityHit._hits_listszz#{++00== \466--''#+u4  2 %    C07*7"$ $L   CH, ,L  ! CJ*4 4L  CJ)3 3L( ? CFJJsOO +L**\**0077>>vFF  $XsG<.5rrr<rsc4i|]\}}|t|Sr;rvrws r=ryz7VulnerabilityHit.group_by_attribute..8rzr<r{rs r=rz#VulnerabilityHit.group_by_attribute0rr<r list[int]ct}|D]2}|tt|dz}3t|S)Nr\)setrrrg)rirvuln_idsr's r=get_vulnerabilities_idsz(VulnerabilityHit.get_vulnerabilities_ids@sU55  C  66s6{CC HHH~~r<cFd|D}d}t|||||S)Ncg|] }|j Sr;rrs r=rz/VulnerabilityHit.set_status..Krr<cd|i}|||d<|jdi||j|S)Nr patched_atr;r)rrirrrs r=rz/VulnerabilityHit.set_status..expressionMrr<r)rirrrrs r=rzVulnerabilityHit.set_statusIrr<c |j|j|j|jj|j|jj|j|j|j|j |j d S)N) rr file_pathrrrQr\rrrr) rrrrWrXrr\rrrrrs r=rzVulnerabilityHit.as_dictZsN' {*~)IIIk/   r<)rrrr)rrrrg) rNNNNNNNNN)rkrrmrrr)rrgrrrJ)&r5r6r7rnr>rrrr0rWrrrr rr\rrrr{r, VULNERABLErrrrr|rrrr=rrgrrr rrr;r<r=rrs''((((((((   B _ & F I5 ! ! !E 9% D 5)))I 9% D 9$   D 9$   D %%%IY5@ A A AF&&&J X222[2[ )-BBBB[B>>[>    1!1!1![1!f//[/    \  [   [      r<rcDeZdZdZGddZedZdS)ImunifyPatchSubscriptionz(Stores Imunify Patch user subscriptions.c eZdZejZdZdS)ImunifyPatchSubscription.Metaimunify_patch_subscriptionsN)r5r6r7rr8r9rr;r<r=r>rms;2 r<r>Tr?N)r5r6r7rnr>ruser_idr;r<r=rrjsP2233333333iD)))GGGr<r)Grn __future__rrr}rrr dataclassesr functoolsrrpathlibrrtypingr r r r r peeweerrrrrrrrrrrrrplayhouse.shortcutsr defence360agent.contracts.configrdefence360agent.modelrr$defence360agent.model.simplificationr r!r"defence360agent.utilsr#r$r%r&imav.api.cleanup_revertr'imav.malwarelib.configr(r)r*r+r,imav.malwarelib.scan.crontabr-imav.malwarelib.scan.mds.reportr.r0r~rrrrrr;r<r=r(s*#""""" !!!!!!22222222222222.-----55555511111111  877777544444BBBBBBrBrBrBrBrB%rBrBrBjvNvNvNvNvNvNvNvNr $"1"1"1"1"1"1"1"1JaaaaaaaaHk k k k k Uk k k \s s s s s us s s l*****u*****r<