from keepersdk.plugins.pedm import admin_plugin, admin_types
from keepersdk import utils
plugin = admin_plugin.PedmPlugin(enterprise_loader)
controls = ['policy controls']
policy_name = 'policy name'
policy_type = 'LeastPrivilege' ## or 'FileAccess', 'PrivilegeElevation'
policy_uid = utils.generate_uid()
policy_data: Dict[str, Any] = {
'PolicyName': policy_name,
'PolicyType': policy_type,
'PolicyId': policy_uid,
'Status': 'off',
'Actions': {
'OnSuccess': {'Controls': controls or []},
'OnFailure': {'Command': ''}
},
"NotificationMessage": "A policy has been set to monitor mode. When this policy is enabled, [mfa, justification, request] will be required to run this process as an administrator.",
"NotificationRequiresAcknowledge": False,
"RiskLevel": 50,
'Operator': 'And',
'Rules': [
{
'RuleName': 'UserCheck',
'ErrorMessage': 'This user is not included in this policy',
'RuleExpressionType': 'BuiltInAction',
'Expression': 'CheckUser()'
},
{
'RuleName': 'MachineCheck',
'ErrorMessage': 'This Machine is not included in this policy',
'RuleExpressionType': 'BuiltInAction',
'Expression': 'CheckMachine()'
},
{
'RuleName': 'ApplicationCheck',
'ErrorMessage': 'This application is not included in this policy',
'RuleExpressionType': 'BuiltInAction',
'Expression': 'CheckFile(false)'
},
{
"RuleName": "DateCheck",
"ErrorMessage": "Current date is not covered by this policy",
"RuleExpressionType": "BuiltInAction",
"Expression": "CheckDate()"
},
{
'RuleName': 'TimeCheck',
'ErrorMessage': 'Current time is not covered by this policy',
'RuleExpressionType': 'BuiltInAction',
'Expression': 'CheckTime()'
},
{
'RuleName': 'DayCheck',
'ErrorMessage': 'Today is not included in this policy',
'RuleExpressionType': 'BuiltInAction',
'Expression': 'CheckDay()'
}
]
}
disabled: bool = False
policy_key = utils.generate_aes_key()
add_policy = admin_types.PedmPolicy(
policy_uid=policy_uid, policy_key=policy_key, data=policy_data, admin_data={}, disabled=disabled)
response = plugin.modify_policies(add_policies=[add_policy])
