hachi 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: a94e022e1b2936129782ed6b1fbe367da78f1b6438473f9f0caa0491eb717dcc
+  data.tar.gz: 5d676f455886a20254fdb8763be410dcd3dd66c618688a2b9c68d20840b67a1f
+SHA512:
+  metadata.gz: 872f23c2706dab7b0cd866ac36e7f6fd9fe6d9fbcaa2cb773c8c2391aeb354d09fb515056dc81aae47be0461dcc78832e4bf36efb704df0322753c63e4bda6e8
+  data.tar.gz: 00636aae8a8b8a1eb080bc804a85ffb5ee6584a0932e8508d696a5c46e8644a4193ce2b20bcad6bf1248f4cb1a891af13acf0ef69234ebaa81155d45c6f00fc5

data/.gitignore

@@ -0,0 +1,53 @@
+*.gem
+*.rbc
+/.config
+/coverage/
+/InstalledFiles
+/pkg/
+/spec/reports/
+/spec/examples.txt
+/test/tmp/
+/test/version_tmp/
+/tmp/
+
+# Used by dotenv library to load environment variables.
+# .env
+
+## Specific to RubyMotion:
+.dat*
+.repl_history
+build/
+*.bridgesupport
+build-iPhoneOS/
+build-iPhoneSimulator/
+
+## Specific to RubyMotion (use of CocoaPods):
+#
+# We recommend against adding the Pods directory to your .gitignore. However
+# you should judge for yourself, the pros and cons are mentioned at:
+# https://guides.cocoapods.org/using/using-cocoapods.html#should-i-check-the-pods-directory-into-source-control
+#
+# vendor/Pods/
+
+## Documentation cache and generated files:
+/.yardoc/
+/_yardoc/
+/doc/
+/rdoc/
+
+## Environment normalization:
+/.bundle/
+/vendor/bundle
+/lib/bundler/man/
+
+# for a library or gem, you might want to ignore these files since the code is
+# intended to run in multiple environments; otherwise, check them in:
+Gemfile.lock
+.ruby-version
+.ruby-gemset
+
+# unless supporting rvm < 1.11.0 or doing something fancy, ignore this:
+.rvmrc
+
+# RSpec
+.rspec_status

data/.rspec

@@ -0,0 +1,3 @@
+--format documentation
+--color
+--require spec_helper

data/.travis.yml

@@ -0,0 +1,7 @@
+---
+sudo: false
+language: ruby
+cache: bundler
+rvm:
+  - 2.6.1
+before_install: gem install bundler -v 2.0.1

data/Gemfile

@@ -0,0 +1,4 @@
+source "https://rubygems.org"
+
+# Specify your gem's dependencies in hachi.gemspec
+gemspec

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2019 Manabu Niseki
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,82 @@
+# Hachi
+
+[![Build Status](https://travis-ci.org/ninoseki/hachi.svg?branch=master)](https://travis-ci.org/ninoseki/hachi)
+[![Coverage Status](https://coveralls.io/repos/github/ninoseki/hachi/badge.svg?branch=master)](https://coveralls.io/github/ninoseki/hachi?branch=master)
+
+Hachi(`蜂`) is a dead simple [TheHive](https://github.com/TheHive-Project/TheHive) API wrapper for Ruby.
+
+## Installation
+
+```bash
+gem install hachi
+```
+
+## Usage
+
+```ruby
+require "hachi"
+
+# when given nothing, it tries to load your API key from ENV["THEHIVE_API_KEY"] & API endpoint from ENV["THEHIVE_API_ENDPOINT"]
+api = Hachi::API.new
+# or you can set them manually
+api = Hachi::API.new(api_endpoint: "http://your_api_endpoint", api_key: "yoru_api_key")
+
+# list alerts
+api.alert.list
+
+# search atrifacts
+api.artifact.search(data: "1.1.1.1", data_type: "ip")
+```
+
+## Implemented methods
+
+### Alert
+
+| HTTP Method | URI                               | Action                      | API method                                                                                                                                                          |
+|-------------|-----------------------------------|-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| GET         | /api/alert                        | List alerts                 | `#api.alert.list`                                                                                                                                                   |
+| POST        | /api/alert/_search                | Find alerts                 | N/A                                                                                                                                                                 |
+| PATCH       | /api/alert/_bulk                  | Update alerts in bulk       | N/A                                                                                                                                                                 |
+| POST        | /api/alert/_stats                 | Compute stats on alerts     | N/A                                                                                                                                                                 |
+| POST        | /api/alert                        | Create an alert             | `#api.alert.create(title:, description:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, type:, source:, source_ref: nil, artifacts: nil, follow: nil)` |
+| GET         | /api/alert/:alertId               | Get an alert                | `#api.alert.get_by_id(id)`                                                                                                                                          |
+| PATCH       | /api/alert/:alertId               | Update an alert             | N/A                                                                                                                                                                 |
+| DELETE      | /api/alert/:alertId               | Delete an alert             | `#api.alert.delete_by_id(id)`                                                                                                                                       |
+| POST        | /api/alert/:alertId/markAsRead    | Mark an alert as read       | N/A                                                                                                                                                                 |
+| POST        | /api/alert/:alertId/markAsUnread  | Mark an alert as unread     | N/A                                                                                                                                                                 |
+| POST        | /api/alert/:alertId/createCase    | Create a case from an alert | N/A                                                                                                                                                                 |
+| POST        | /api/alert/:alertId/follow        | Follow an alert             | N/A                                                                                                                                                                 |
+| POST        | /api/alert/:alertId/unfollow      | Unfollow an alert           | N/A                                                                                                                                                                 |
+| POST        | /api/alert/:alertId/merge/:caseId | Merge an alert in a case    | N/A                                                                                                                                                                 |
+
+### Artifact(Observable)
+
+| HTTP Method | URI                                    | Action                          | API method                                                                            |
+|-------------|----------------------------------------|---------------------------------|---------------------------------------------------------------------------------------|
+| POST        | /api/case/artifact/_search             | Find observables                | `#api.artifact.search(data:, date_type:)`                                             |
+| POST        | /api/case/artifact/_stats              | Compute stats on observables    | N/A                                                                                   |
+| POST        | /api/case/:caseId/artifact             | Create an observable            | `#api.artifact.create(case_id, data:, data_type:, message: nil, tlp: nil, tags: nil)` |
+| GET         | /api/case/artifact/:artifactId         | Get an observable               | `#api.artifact.get_by_id(id)`                                                         |
+| DELETE      | /api/case/artifact/:artifactId         | Remove an observable            | `#api.artifact.delete_by_id(id)`                                                      |
+| PATCH       | /api/case/artifact/:artifactId         | Update an observable            | N/A                                                                                   |
+| GET         | /api/case/artifact/:artifactId/similar | Get list of similar observables | N/A                                                                                   |
+| PATCH       | /api/case/artifact/_bulk               | Update observables in bulk      | N/A                                                                                   |
+
+### Case
+
+| HTTP Method | URI                                | Action                                | API method                                                                                                           |
+|-------------|------------------------------------|---------------------------------------|----------------------------------------------------------------------------------------------------------------------|
+| GET         | /api/case                          | List cases                            | `#api.case.list`                                                                                                     |
+| POST        | /api/case/_search                  | Find cases                            | `#api.case.search(query)`                                                                                            |
+| PATCH       | /api/case/_bulk                    | Update cases in bulk                  | N/A                                                                                                                  |
+| POST        | /api/case/_stats                   | Compute stats on cases                | N/A                                                                                                                  |
+| POST        | /api/case                          | Create a case                         | `#api.case.create(title:, description:, severity: nil, start_date: nil, owner: nil, flag: nil, tlp: nil, tags: nil)` |
+| GET         | /api/case/:caseId                  | Get a case                            | `#api.case.get_by_id(id)`                                                                                            |
+| PATCH       | /api/case/:caseId                  | Update a case                         | N/A                                                                                                                  |
+| DELETE      | /api/case/:caseId                  | Remove a case                         | `#api.case.delete_by_id(id)`                                                                                         |
+| GET         | /api/case/:caseId/links            | Get list of cases linked to this case | N/A                                                                                                                  |
+| POST        | /api/case/:caseId1/_merge/:caseId2 | Merge two cases                       | N/A                                                                                                                  |
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/Rakefile

@@ -0,0 +1,6 @@
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+
+task :default => :spec

data/bin/console

@@ -0,0 +1,14 @@
+#!/usr/bin/env ruby
+
+require "bundler/setup"
+require "hachi"
+
+# You can add fixtures and/or initialization code here to make experimenting
+# with your gem easier. You can also use a different console, if you like.
+
+# (If you use this, don't forget to add pry to your Gemfile!)
+# require "pry"
+# Pry.start
+
+require "irb"
+IRB.start(__FILE__)

data/bin/setup

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+IFS=$'\n\t'
+set -vx
+
+bundle install
+
+# Do any other automated setup that you need to do here

data/hachi.gemspec

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+lib = File.expand_path('lib', __dir__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require "hachi/version"
+
+Gem::Specification.new do |spec|
+  spec.name          = "hachi"
+  spec.version       = Hachi::VERSION
+  spec.authors       = ["Manabu Niseki"]
+  spec.email         = ["manabu.niseki@gmail.com"]
+
+  spec.summary       = "A dead simple TheHive API wrapper."
+  spec.description   = "A dead simple TheHive API wrapper."
+  spec.homepage      = "https://github.com/ninoseki/hachi"
+  spec.license       = "MIT"
+
+  # Specify which files should be added to the gem when it is released.
+  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
+  spec.files = Dir.chdir(File.expand_path(__dir__)) do
+    `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+  end
+  spec.bindir        = "exe"
+  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
+  spec.require_paths = ["lib"]
+
+  spec.add_development_dependency "bundler", "~> 2.0"
+  spec.add_development_dependency "coveralls", "~> 0.8"
+  spec.add_development_dependency "rake", "~> 12.3"
+  spec.add_development_dependency "rspec", "~> 3.8"
+  spec.add_development_dependency "vcr", "~> 4.0"
+  spec.add_development_dependency "webmock", "~> 3.5"
+end

data/lib/hachi/api.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Hachi
+  class API
+    attr_reader :alert
+    attr_reader :artifact
+    attr_reader :case
+
+    def initialize(api_endpoint: ENV["THEHIVE_API_ENDPOINT"], api_key: ENV["THEHIVE_API_KEY"])
+      raise(ArgumentError, "api_endpoint argument is required") unless api_endpoint
+      raise(ArgumentError, "api_key argument is required") unless api_key
+
+      @alert = Clients::Alert.new(api_endpoint: api_endpoint, api_key: api_key)
+      @artifact = Clients::Artifact.new(api_endpoint: api_endpoint, api_key: api_key)
+      @case = Clients::Case.new(api_endpoint: api_endpoint, api_key: api_key)
+    end
+  end
+end

data/lib/hachi/clients/alert.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "date"
+require "securerandom"
+
+module Hachi
+  module Clients
+    class Alert < Base
+      def list
+        get("/api/alert") { |json| json }
+      end
+
+      def get_by_id(id)
+        get("/api/alert/#{id}") { |json| json }
+      end
+
+      def delete_by_id(id)
+        delete("/api/alert/#{id}") { |json| json }
+      end
+
+      def create(title:, description:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, type:, source:, source_ref: nil, artifacts: nil, follow: nil)
+        alert = Models::Alert.new(
+          title: title,
+          description: description,
+          severity: severity,
+          date: date,
+          tags: tags,
+          tlp: tlp,
+          status: status,
+          type: type,
+          source: source,
+          source_ref: source_ref,
+          artifacts: artifacts,
+          follow: follow
+        )
+        post("/api/alert", alert.payload) { |json| json }
+      end
+    end
+  end
+end

data/lib/hachi/clients/artifact.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module Hachi
+  module Clients
+    class Artifact < Base
+      def create(case_id, data:, data_type:, message: nil, tlp: nil, tags: nil)
+        artifact = Models::Artifact.new(
+          data: data,
+          data_type: data_type,
+          message: message,
+          tlp: tlp,
+          tags: tags
+        )
+
+        post("/api/case/#{case_id}/artifact", artifact.payload) { |json| json }
+      end
+
+      def get_by_id(id)
+        get("/api/case/artifact/#{id}") { |json| json }
+      end
+
+      def delete_by_id(id)
+        delete("/api/case/artifact/#{id}") { |json| json }
+      end
+
+      def search(data:, data_type:)
+        artifact = Models::Artifact.new(data: data, data_type: data_type)
+        payload = {
+          query: {
+            _and:
+              [
+                { _field: "data", _value: artifact.data },
+                { _field: "dataType", _value: artifact.data_type },
+                { _and:
+                  [
+                    { _not: { status: "Deleted" } },
+                    { _not:
+                      { _in: { _field: "_type", _values: ["dashboard", "data", "user", "analyzer", "caseTemplate", "reportTemplate", "action"] } } }
+                  ] }
+              ]
+          }
+        }
+
+        post("/api/case/artifact/_search?range=all", payload) { |json| json }
+      end
+    end
+  end
+end

data/lib/hachi/clients/base.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require "json"
+require "net/https"
+
+module Hachi
+  module Clients
+    class Base
+      attr_reader :api_endpoint
+      attr_reader :api_key
+
+      def initialize(api_endpoint:, api_key:)
+        @api_endpoint = URI(api_endpoint)
+        @api_key = api_key
+      end
+
+      private
+
+      def base_url
+        "#{api_endpoint.scheme}://#{api_endpoint.hostname}:#{api_endpoint.port}"
+      end
+
+      def url_for(path)
+        URI(base_url + path)
+      end
+
+      def https_options
+        return nil if api_endpoint.scheme != "https"
+
+        if proxy = ENV["HTTPS_PROXY"] || ENV["https_proxy"]
+          uri = URI(proxy)
+          {
+            proxy_address: uri.hostname,
+            proxy_port: uri.port,
+            proxy_from_env: false,
+            use_ssl: true
+          }
+        else
+          { use_ssl: true }
+        end
+      end
+
+      def http_options
+        if proxy = ENV["HTTP_PROXY"] || ENV["http_proxy"]
+          uri = URI(proxy)
+          {
+            proxy_address: uri.hostname,
+            proxy_port: uri.port,
+            proxy_from_env: false,
+          }
+        else
+          {}
+        end
+      end
+
+      def parse_body(body)
+        JSON.parse body.to_s
+      rescue JSON::ParserError => _
+        body.to_s
+      end
+
+      def request(req)
+        Net::HTTP.start(api_endpoint.hostname, api_endpoint.port, https_options || http_options) do |http|
+          response = http.request(req)
+          json = parse_body(response.body)
+
+          raise(Error, "Unsupported response code returned: #{response.code} (#{json&.dig('message')})" ) unless response.code.start_with? "20"
+
+          yield json
+        end
+      end
+
+      def get(path, params = {}, &block)
+        url = url_for(path)
+        url.query = URI.encode_www_form(params) unless params.empty?
+
+        get = Net::HTTP::Get.new(url)
+        get.add_field "Authorization", "Bearer #{api_key}"
+        request(get, &block)
+      end
+
+      def post(path, params = {}, &block)
+        url = url_for(path)
+
+        post = Net::HTTP::Post.new(url)
+        post.body = params.is_a?(Hash) ? params.to_json : params.to_s
+
+        post.add_field "Content-Type", "application/json"
+        post.add_field "Authorization", "Bearer #{api_key}"
+
+        request(post, &block)
+      end
+
+      def delete(path, params = {}, &block)
+        url = url_for(path)
+        url.query = URI.encode_www_form(params) unless params.empty?
+
+        delete = Net::HTTP::Delete.new(url)
+        delete.add_field "Authorization", "Bearer #{api_key}"
+        request(delete, &block)
+      end
+    end
+  end
+end

data/lib/hachi/clients/case.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module Hachi
+  module Clients
+    class Case < Base
+      def list
+        get("/api/case") { |json| json }
+      end
+
+      def get_by_id(id)
+        get("/api/case/#{id}") { |json| json }
+      end
+
+      def delete_by_id(id)
+        delete("/api/case/#{id}") { |json| json }
+      end
+
+      def create(title:, description:, severity: nil, start_date: nil, owner: nil, flag: nil, tlp: nil, tags: nil)
+        kase = Models::Case.new(
+          title: title,
+          description: description,
+          severity: severity,
+          start_date: start_date,
+          owner: owner,
+          flag: flag,
+          tlp: tlp,
+          tags: tags
+        )
+
+        post("/api/case", kase.payload) { |json| json }
+      end
+
+      def search(query)
+        payload = {
+          query: {
+            _and:
+              [
+                { string: query },
+                { _and:
+                  [
+                    { _not: { status: "Deleted" } },
+                    { _not:
+                      { _in: { _field: "_type", _values: ["dashboard", "data", "user", "analyzer", "caseTemplate", "reportTemplate", "action"] } } }
+                  ] }
+              ]
+          }
+        }
+        post("/api/case/_search?range=all", payload) { |json| json }
+      end
+    end
+  end
+end

data/lib/hachi/models/alert.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require "date"
+require "securerandom"
+
+module Hachi
+  module Models
+    class Alert
+      attr_reader :title
+      attr_reader :description
+      attr_reader :severity
+      attr_reader :date
+      attr_reader :tags
+      attr_reader :tlp
+      attr_reader :status
+      attr_reader :type
+      attr_reader :source
+      attr_reader :source_ref
+      attr_reader :artifacts
+      attr_reader :follow
+
+      def initialize(title:, description:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, type:, source:, source_ref: nil, artifacts: nil, follow: nil)
+        @title = title
+        @description = description
+        @severity = severity
+        @date = date
+        @tags = tags
+        @tlp = tlp
+        @status = status
+        @type = type
+        @source = source
+        @source_ref = source_ref || SecureRandom.hex(10)
+        @artifacts = artifacts
+        @follow = follow
+
+        validate_date if date
+        validate_severity if severity
+        validate_status if status
+        validate_tlp if tlp
+      end
+
+      def payload
+        {
+          title: title,
+          description: description,
+          severity: severity,
+          date: date,
+          tags: tags,
+          tlp: tlp,
+          status: status,
+          type: type,
+          source: source,
+          sourceRef: source_ref,
+          artifacts: artifacts,
+          follow: follow
+        }.compact
+      end
+
+      private
+
+      def validate_severity
+        return true if severity >= 1 && severity <= 3
+
+        raise ArgumentError, "severity should be 1 - 3 (1: low; 2: medium; 3: high)."
+      end
+
+      def validate_date
+        DateTime.parse(date)
+        true
+      rescue ArgumentError => _
+        raise ArgumentError, "date should be Date format."
+      end
+
+      def validate_tlp
+        return true if tlp >= 0 && severity <= 3
+
+        raise ArgumentError, "tlp should be 0 - 3 (0: white; 1: green; 2: amber; 3: red)."
+      end
+
+      def validate_status
+        return true if %w(New Updated Ignored Imported).include?(status)
+
+        raise ArgumentError, "status should be New, Updated, Ignored or Imported"
+      end
+    end
+  end
+end

data/lib/hachi/models/artifact.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Hachi
+  module Models
+    class Artifact
+      DATA_TYPES = %w(filename file fqdn hash uri_path ip domain mail autonomous-system registry mail_subject regexp user-agent other url).freeze
+
+      attr_reader :data
+      attr_reader :data_type
+      attr_reader :message
+      attr_reader :tlp
+      attr_reader :tags
+
+      def initialize(data:, data_type:, message: nil, tlp: nil, tags: nil)
+        @data = data
+        @data_type = data_type
+        @message = message
+        @tlp = tlp
+        @tags = tags
+
+        raise(ArgumentError, "data is required") unless data
+        raise(ArgumentError, "data_type is required") unless data_type
+        raise(ArgumentError, "invalid data type") unless DATA_TYPES.include?(data_type)
+        raise(ArgumentError, "tags should be an array") unless tags.nil? || tags.is_a?(Array)
+      end
+
+      def payload
+        {
+          data: data,
+          dataType: data_type,
+          message: message,
+          tlp: tlp,
+          tags: tags
+        }.compact
+      end
+    end
+  end
+end

data/lib/hachi/models/case.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module Hachi
+  module Models
+    class Case
+      attr_reader :title
+      attr_reader :description
+      attr_reader :severity
+      attr_reader :start_date
+      attr_reader :owner
+      attr_reader :flag
+      attr_reader :tlp
+      attr_reader :tags
+
+      def initialize(title:, description:, severity: nil, start_date: nil, owner: nil, flag: nil, tlp: nil, tags: nil)
+        @title = title
+        @description = description
+        @severity = severity
+        @start_date = start_date
+        @owner = owner
+        @flag = flag
+        @tlp = tlp
+        @tags = tags
+
+        validate_flag if flag
+        validate_severity if severity
+        validate_start_date if start_date
+        validate_tlp if tlp
+      end
+
+      def payload
+        {
+          title: title,
+          description: description,
+          severity: severity,
+          startDate: start_date,
+          owner: owner,
+          flag: flag,
+          tlp: tlp,
+          tags: tags
+        }.compact
+      end
+
+      private
+
+      def validate_severity
+        return true if severity >= 1 && severity <= 3
+
+        raise ArgumentError, "severity should be 1 - 3 (1: low; 2: medium; 3: high)."
+      end
+
+      def validate_start_date
+        DateTime.parse(start_date)
+        true
+      rescue ArgumentError => _
+        raise ArgumentError, "date should be Date format."
+      end
+
+      def validate_tlp
+        return true if tlp >= 0 && severity <= 3
+
+        raise ArgumentError, "tlp should be 0 - 3 (0: white; 1: green; 2: amber; 3: red)."
+      end
+
+      def validate_flag
+        return true if [true, false].include?(flag)
+
+        raise ArgumentError, "flag should be true or false."
+      end
+    end
+  end
+end

data/lib/hachi/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Hachi
+  VERSION = "0.1.0"
+end

data/lib/hachi.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require "hachi/version"
+
+require "hachi/api"
+
+require "hachi/models/alert"
+require "hachi/models/artifact"
+require "hachi/models/case"
+
+require "hachi/clients/base"
+require "hachi/clients/alert"
+require "hachi/clients/artifact"
+require "hachi/clients/case"
+
+module Hachi
+  class Error < StandardError; end
+end

metadata

@@ -0,0 +1,147 @@
+--- !ruby/object:Gem::Specification
+name: hachi
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Manabu Niseki
+autorequire: 
+bindir: exe
+cert_chain: []
+date: 2019-04-14 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: coveralls
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.8'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.8'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.8'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.8'
+- !ruby/object:Gem::Dependency
+  name: vcr
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.5'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.5'
+description: A dead simple TheHive API wrapper.
+email:
+- manabu.niseki@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- ".rspec"
+- ".travis.yml"
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- bin/console
+- bin/setup
+- hachi.gemspec
+- lib/hachi.rb
+- lib/hachi/api.rb
+- lib/hachi/clients/alert.rb
+- lib/hachi/clients/artifact.rb
+- lib/hachi/clients/base.rb
+- lib/hachi/clients/case.rb
+- lib/hachi/models/alert.rb
+- lib/hachi/models/artifact.rb
+- lib/hachi/models/case.rb
+- lib/hachi/version.rb
+homepage: https://github.com/ninoseki/hachi
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.0.2
+signing_key: 
+specification_version: 4
+summary: A dead simple TheHive API wrapper.
+test_files: []