hachi 0.2.2 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: efe04e36b93c8278ea1c128e7aa38135d33468c904ad3434dbcc6c7dc7707478
-  data.tar.gz: caaa81f78a086e6dba10e54f977018fbc19f5485559a59d15047a152d1780d9b
+  metadata.gz: 3a64cb219a699afb02768ce856250ee2baa3eb77b51f8fc2bcb76b1ccc36b44a
+  data.tar.gz: 8de8ee38a60140d62e6740c874fddd679e91748cba187c6789b9afc3f3cfd09d
 SHA512:
-  metadata.gz: 75a96eb5ad3cea0bf65ec999ab14e27bbc081bc5e1315e231a9e1aac27c0db69caf1cc7820d1f782ba8cdcd25cc37606b6be0ea52abe8aa53b357781c1294217
-  data.tar.gz: 87d6925a83d4faf2d544648d47b6c0caa82641fa25fcf0a138d35c0061a5a421aba6491c7391e9211101ded22f7308b18f49da5d73adf86143068450107bcad7
+  metadata.gz: f66d6cf5bcb7c252a2ca4355e0409b28667dc7d9f55c356e482cab043bf6559f6d5eae49e08e83fa58cdf42493ab97fb481eb5c0907d0af5bcfd29b20aeb85bc
+  data.tar.gz: d00975cc9e11bfca85828a821f6d9915458f43d6adc22d957fc6dcc13a39b91e06bb315e290b0f5ca12cb87d79915e6611ea7b5542b695e661c13910e7d99f36

data/.travis.yml

@@ -3,5 +3,6 @@ sudo: false
 language: ruby
 cache: bundler
 rvm:
-  - 2.6.1
-before_install: gem install bundler -v 2.0.1
+  - 2.6
+  - 2.7
+before_install: gem install bundler -v 2.1

data/README.md

@@ -1,7 +1,7 @@
 # Hachi
 
 [![Gem Version](https://badge.fury.io/rb/hachi.svg)](https://badge.fury.io/rb/hachi)
-[![Build Status](https://travis-ci.org/ninoseki/hachi.svg?branch=master)](https://travis-ci.org/ninoseki/hachi)
+[![Build Status](https://travis-ci.com/ninoseki/hachi.svg?branch=master)](https://travis-ci.com/ninoseki/hachi)
 [![Coverage Status](https://coveralls.io/repos/github/ninoseki/hachi/badge.svg?branch=master)](https://coveralls.io/github/ninoseki/hachi?branch=master)
 [![CodeFactor](https://www.codefactor.io/repository/github/ninoseki/hachi/badge)](https://www.codefactor.io/repository/github/ninoseki/hachi)
 
@@ -41,19 +41,19 @@ See `samples` for more.
 | HTTP Method | URI                               | Action                      | API method                                                                                                                                                          |
 |-------------|-----------------------------------|-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | GET         | /api/alert                        | List alerts                 | `#api.alert.list`                                                                                                                                                   |
-| POST        | /api/alert/_search                | Find alerts                 | `#api.alert.search(attributes:, range: "all")`                                                                                                                      |
+| POST        | /api/alert/_search                | Find alerts                 | `#api.alert.search(attributes, range: "all")`                                                                                                                       |
 | PATCH       | /api/alert/_bulk                  | Update alerts in bulk       | N/A                                                                                                                                                                 |
 | POST        | /api/alert/_stats                 | Compute stats on alerts     | N/A                                                                                                                                                                 |
 | POST        | /api/alert                        | Create an alert             | `#api.alert.create(title:, description:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, type:, source:, source_ref: nil, artifacts: nil, follow: nil)` |
 | GET         | /api/alert/:alertId               | Get an alert                | `#api.alert.get_by_id(id)`                                                                                                                                          |
-| PATCH       | /api/alert/:alertId               | Update an alert             | N/A                                                                                                                                                                 |
+| PATCH       | /api/alert/:alertId               | Update an alert             | `#api.alert.update(id, title:, description:, severity: nil, tags: nil, tlp: nil, artifacts: nil)`                                                                   |
 | DELETE      | /api/alert/:alertId               | Delete an alert             | `#api.alert.delete_by_id(id)`                                                                                                                                       |
-| POST        | /api/alert/:alertId/markAsRead    | Mark an alert as read       | N/A                                                                                                                                                                 |
-| POST        | /api/alert/:alertId/markAsUnread  | Mark an alert as unread     | N/A                                                                                                                                                                 |
-| POST        | /api/alert/:alertId/createCase    | Create a case from an alert | N/A                                                                                                                                                                 |
+| POST        | /api/alert/:alertId/markAsRead    | Mark an alert as read       | `#api.alert.mark_as_read(id)`                                                                                                                                       |
+| POST        | /api/alert/:alertId/markAsUnread  | Mark an alert as unread     | `#api.alert.mark_as_unread(id)`                                                                                                                                     |
+| POST        | /api/alert/:alertId/createCase    | Create a case from an alert | `#api.alert.promote_to_case(id)`                                                                                                                                    |
 | POST        | /api/alert/:alertId/follow        | Follow an alert             | N/A                                                                                                                                                                 |
 | POST        | /api/alert/:alertId/unfollow      | Unfollow an alert           | N/A                                                                                                                                                                 |
-| POST        | /api/alert/:alertId/merge/:caseId | Merge an alert in a case    | N/A                                                                                                                                                                 |
+| POST        | /api/alert/:alertId/merge/:caseId | Merge an alert in a case    | `#api.alert.merge_into_case(*ids, case_id)`                                                                                                                         |
 
 ### Artifact(Observable)
 
@@ -81,7 +81,22 @@ See `samples` for more.
 | PATCH       | /api/case/:caseId                  | Update a case                         | N/A                                                                                                                  |
 | DELETE      | /api/case/:caseId                  | Remove a case                         | `#api.case.delete_by_id(id)`                                                                                         |
 | GET         | /api/case/:caseId/links            | Get list of cases linked to this case | `#api.case.links(id)`                                                                                                |
-| POST        | /api/case/:caseId1/_merge/:caseId2 | Merge two cases                       | N/A                                                                                                                  |
+| POST        | /api/case/:caseId1/_merge/:caseId2 | Merge two cases                       | `#api.case.merge(id1, id2)`                                                                                          |
+
+### User
+
+| HTTP Method | URI                               | Action              | API method                                           |
+|-------------|-----------------------------------|---------------------|------------------------------------------------------|
+| GET         | /api/logout                       | Logout              | N/A                                                  |
+| POST        | /api/login                        | User login          | N/A                                                  |
+| GET         | /api/user/current                 | Get current user    | `#api.user.current`                                  |
+| POST        | /api/user/_search                 | Find user           | N/A                                                  |
+| POST        | /api/user                         | Create a user       | `#api.user.create(login:, name:, roles:, password:)` |
+| GET         | /api/user/:userId                 | Get a user          | `#api.user.get_by_id(id)`                            |
+| DELETE      | /api/user/:userId                 | Delete a case       | `#api.user.delete_by_id(id)`                         |
+| PATCH       | /api/user/:userId                 | Update user details | N/A                                                  |
+| POST        | /api/user/:userId/password/set    | Set password        | N/A                                                  |
+| POST        | /api/user/:userId/password/change | Change password     | N/A                                                  |
 
 ## License
 

data/hachi.gemspec

@@ -24,10 +24,10 @@ Gem::Specification.new do |spec|
   spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "bundler", "~> 2.0"
+  spec.add_development_dependency "bundler", "~> 2.1"
   spec.add_development_dependency "coveralls", "~> 0.8"
-  spec.add_development_dependency "rake", "~> 12.3"
-  spec.add_development_dependency "rspec", "~> 3.8"
-  spec.add_development_dependency "vcr", "~> 5.0"
-  spec.add_development_dependency "webmock", "~> 3.6"
+  spec.add_development_dependency "rake", "~> 13.0"
+  spec.add_development_dependency "rspec", "~> 3.9"
+  spec.add_development_dependency "vcr", "~> 6.0"
+  spec.add_development_dependency "webmock", "~> 3.8"
 end

data/lib/hachi.rb

@@ -8,11 +8,13 @@ require "hachi/models/base"
 require "hachi/models/alert"
 require "hachi/models/artifact"
 require "hachi/models/case"
+require "hachi/models/user"
 
 require "hachi/clients/base"
 require "hachi/clients/alert"
 require "hachi/clients/artifact"
 require "hachi/clients/case"
+require "hachi/clients/user"
 
 module Hachi
   class Error < StandardError; end

data/lib/hachi/api.rb

@@ -2,17 +2,60 @@
 
 module Hachi
   class API
-    attr_reader :alert
-    attr_reader :artifact
-    attr_reader :case
+    # @return [String] TheHive API endpoint
+    attr_reader :api_endpoint
 
+    # @return [String] TheHive API key
+    attr_reader :api_key
+
+    #
+    # @param [String, nil] api_endpoint TheHive API endpoint
+    # @param [String, nil] api_key TheHive API key
+    #
+    # @raise [ArgumentError] When given or an empty endpoint or key
+    #
     def initialize(api_endpoint: ENV["THEHIVE_API_ENDPOINT"], api_key: ENV["THEHIVE_API_KEY"])
-      raise(ArgumentError, "api_endpoint argument is required") unless api_endpoint
-      raise(ArgumentError, "api_key argument is required") unless api_key
+      @api_endpoint = api_endpoint
+      raise ArgumentError, "api_endpoint argument is required" unless api_endpoint
+
+      @api_key = api_key
+      raise ArgumentError, "api_key argument is required" unless api_key
+    end
+
+    #
+    # Alert API endpoint client
+    #
+    # @return [Clients::Alert]
+    #
+    def alert
+      @alert ||= Clients::Alert.new(api_endpoint: api_endpoint, api_key: api_key)
+    end
+
+    #
+    # Artifact API endpoint client
+    #
+    # @return [Clients::Artifact]
+    #
+    def artifact
+      @artifact ||= Clients::Artifact.new(api_endpoint: api_endpoint, api_key: api_key)
+    end
+
+    #
+    # Case API endpoint client
+    #
+    # @return [Clients::Case]
+    #
+    def case
+      @case ||= Clients::Case.new(api_endpoint: api_endpoint, api_key: api_key)
+    end
 
-      @alert = Clients::Alert.new(api_endpoint: api_endpoint, api_key: api_key)
-      @artifact = Clients::Artifact.new(api_endpoint: api_endpoint, api_key: api_key)
-      @case = Clients::Case.new(api_endpoint: api_endpoint, api_key: api_key)
+    #
+    # User API endpoint client
+    #
+    # @return [Clients::User]
+    #
+    def user
+      @user ||= Clients::User.new(api_endpoint: api_endpoint, api_key: api_key)
     end
   end
 end

data/lib/hachi/clients/alert.rb

@@ -6,18 +6,55 @@ require "securerandom"
 module Hachi
   module Clients
     class Alert < Base
+      #
+      # List alerts
+      #
+      # @return [Array]
+      #
       def list
         get("/api/alert") { |json| json }
       end
 
+      #
+      # Get an alert
+      #
+      # @param [String] id Alert ID
+      #
+      # @return [Hash]
+      #
       def get_by_id(id)
         get("/api/alert/#{id}") { |json| json }
       end
 
+      #
+      # Delete an alert
+      #
+      # @param [String] id Alert ID
+      #
+      # @return [String]
+      #
       def delete_by_id(id)
         delete("/api/alert/#{id}") { |json| json }
       end
 
+      #
+      # Create an alert
+      #
+      # @param [String] title
+      # @param [String] description
+      # @param [String, nil] severity
+      # @param [String, nil] date
+      # @param [String, nil] tags
+      # @param [String, nil] tlp
+      # @param [String, nil] status
+      # @param [String, nil] type
+      # @param [String, nil] source
+      # @param [String, nil] source_ref
+      # @param [String, nil] artifacts
+      # @param [String, nil] follow
+      #
+      # @return [Hash]
+      #
       def create(title:, description:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, type:, source:, source_ref: nil, artifacts: nil, follow: nil)
         alert = Models::Alert.new(
           title: title,
@@ -36,8 +73,91 @@ module Hachi
         post("/api/alert", alert.payload) { |json| json }
       end
 
-      def search(attributes, range: "all")
-        _search("/api/alert/_search", attributes: attributes, range: range) { |json| json }
+      #
+      # Find alerts
+      #
+      # @param [Hash] attributes
+      # @param [String] range
+      # @param [String, nil] sort
+      #
+      # @return [Array]
+      #
+      def search(attributes, range: "all", sort: nil)
+        _search("/api/alert/_search", attributes: attributes, range: range, sort: sort) { |json| json }
+      end
+
+      #
+      # Mark an alert as read
+      #
+      # @param [String] id Alert ID
+      #
+      # @return [Hash]
+      #
+      def mark_as_read(id)
+        post("/api/alert/#{id}/markAsRead") { |json| json }
+      end
+
+      #
+      # Mark an alert as unread
+      #
+      # @param [String] id Alert ID
+      #
+      # @return [Hash] hash
+      #
+      def mark_as_unread(id)
+        post("/api/alert/#{id}/markAsUnread") { |json| json }
+      end
+
+      #
+      # Create a case from an alert
+      #
+      # @param [String] id Alert ID
+      #
+      # @return [Hash]
+      #
+      def promote_to_case(id)
+        post("/api/alert/#{id}/createCase") { |json| json }
+      end
+
+      #
+      # Merge an alert / alerts in a case
+      #
+      # @param [String, Array] *ids Alert ID(s)
+      # @param [String] case_id Case ID
+      #
+      # @return [Hash]
+      #
+      def merge_into_case(*ids, case_id)
+        params = {
+          alertIds: ids.flatten,
+          caseId: case_id
+        }
+        post("/api/alert/merge/_bulk", params) { |json| json }
+      end
+
+      #
+      # Update an alert
+      #
+      # @param [String, nil] id
+      # @param [String, nil] title
+      # @param [String, nil] description
+      # @param [String, nil] severity
+      # @param [String, nil] tags
+      # @param [String, nil] tlp
+      # @param [String, nil] artifacts
+      #
+      # @return [Hash]
+      #
+      def update(id, title: nil, description: nil, severity: nil, tags: nil, tlp: nil, artifacts: nil)
+        attributes = {
+          title: title,
+          description: description,
+          severity: severity,
+          tags: tags,
+          tlp: tlp,
+          artifacts: artifacts,
+        }.compact
+        patch("/api/alert/#{id}", attributes) { |json| json }
       end
     end
   end

data/lib/hachi/clients/artifact.rb

@@ -3,6 +3,18 @@
 module Hachi
   module Clients
     class Artifact < Base
+      #
+      # Create an artifact
+      #
+      # @param [String] case_id Artifact ID
+      # @param [String] data
+      # @param [String] data_type
+      # @param [String, nil] message
+      # @param [Integer, nil] tlp
+      # @param [Array<String>, nil] tags
+      #
+      # @return [Hash]
+      #
       def create(case_id, data:, data_type:, message: nil, tlp: nil, tags: nil)
         artifact = Models::Artifact.new(
           data: data,
@@ -15,18 +27,47 @@ module Hachi
         post("/api/case/#{case_id}/artifact", artifact.payload) { |json| json }
       end
 
+      #
+      # Get an artifact
+      #
+      # @param [String] id Artifact ID
+      #
+      # @return [Hash]
+      #
       def get_by_id(id)
         get("/api/case/artifact/#{id}") { |json| json }
       end
 
+      #
+      # Delete an artifact
+      #
+      # @param [String] id Artifact ID
+      #
+      # @return [String]
+      #
       def delete_by_id(id)
         delete("/api/case/artifact/#{id}") { |json| json }
       end
 
-      def search(attributes, range: "all")
+      #
+      # Find artifacts
+      #
+      # @param [Hash] attributes
+      # @param [String] range
+      #
+      # @return [Array]
+      #
+      def search( range: "all", **attributes)
         _search("/api/case/artifact/_search", attributes: attributes, range: range) { |json| json }
       end
 
+      #
+      # Get list of similar observables
+      #
+      # @param [String] id Artifact ID
+      #
+      # @return [Array]
+      #
       def similar(id)
         get("/api/case/artifact/#{id}/similar") { |json| json }
       end

data/lib/hachi/clients/base.rb

@@ -2,6 +2,7 @@
 
 require "json"
 require "net/https"
+require "uri"
 
 module Hachi
   module Clients
@@ -103,6 +104,18 @@ module Hachi
         request(delete, &block)
       end
 
+      def patch(path, params = {}, &block)
+        url = url_for(path)
+
+        patch = Net::HTTP::Patch.new(url)
+        patch.body = params.is_a?(Hash) ? params.to_json : params.to_s
+
+        patch.add_field "Content-Type", "application/json"
+        patch.add_field "Authorization", "Bearer #{api_key}"
+
+        request(patch, &block)
+      end
+
       def validate_range(range)
         return true if range == "all"
         raise ArgumentError, "range should be 'all' or `from-to`" unless range.match?(/(\d+)-(\d+)/)
@@ -113,14 +126,15 @@ module Hachi
         raise ArgumentError, "from should be smaller than to"
       end
 
-      def _search(path, attributes:, range: "all")
+      def _search(path, attributes:, range: "all", sort: nil)
         validate_range range
 
+        attributes = normalize_attributes(attributes)
         conditions = attributes.map do |key, value|
           if key == :data && value.is_a?(Array)
             { _or: decompose_data(value) }
           else
-            { _string: "#{key}:#{value}" }
+            { _string: "#{key}:\"#{value}\"" }
           end
         end
 
@@ -135,7 +149,9 @@ module Hachi
           _and: [conditions, default_conditions].flatten,
         }
 
-        post("#{path}?range=#{range}", query: query) { |json| json }
+        query_string = build_query_string(range: range, sort: sort)
+
+        post("#{path}?#{query_string}", query: query) { |json| json }
       end
 
       def decompose_data(data)
@@ -143,6 +159,23 @@ module Hachi
           { _field: "data", _value: elem }
         end
       end
+
+      def normalize_attributes(attributes)
+        h = {}
+        attributes.each do |key, value|
+          h[camelize(key).to_sym] = value
+        end
+        h
+      end
+
+      def camelize(string)
+        head, *others = string.to_s.split("_")
+        [head, others.map(&:capitalize)].flatten.join
+      end
+
+      def build_query_string(params)
+        URI.encode_www_form(params.reject { |_k, v| v.nil? })
+      end
     end
   end
 end

data/lib/hachi/clients/case.rb

@@ -3,18 +3,51 @@
 module Hachi
   module Clients
     class Case < Base
+      #
+      # List cases
+      #
+      # @return [Array]
+      #
       def list
         get("/api/case") { |json| json }
       end
 
+      #
+      # Get a case
+      #
+      # @param [String] id Case ID
+      #
+      # @return [Hash]
+      #
       def get_by_id(id)
         get("/api/case/#{id}") { |json| json }
       end
 
+      #
+      # Delete a case
+      #
+      # @param [String] id Case ID
+      #
+      # @return [String]
+      #
       def delete_by_id(id)
         delete("/api/case/#{id}") { |json| json }
       end
 
+      #
+      # Create a case
+      #
+      # @param [String, nil] title
+      # @param [String, nil] description
+      # @param [Integer, nil] severity
+      # @param [String, nil] start_date
+      # @param [String, nil] owner
+      # @param [Boolean, nil] flag
+      # @param [Intege, nil] tlp
+      # @param [String, nil] tags
+      #
+      # @return [Hash]
+      #
       def create(title:, description:, severity: nil, start_date: nil, owner: nil, flag: nil, tlp: nil, tags: nil)
         kase = Models::Case.new(
           title: title,
@@ -30,13 +63,83 @@ module Hachi
         post("/api/case", kase.payload) { |json| json }
       end
 
-      def search(attributes, range: "all")
+      #
+      # Find cases
+      #
+      # @param [Hash] attributes
+      # @param [String] range
+      #
+      # @return [Hash]
+      #
+      def search(range: "all", **attributes)
         _search("/api/case/_search", attributes: attributes, range: range) { |json| json }
       end
 
+      #
+      # Get list of cases linked to this case
+      #
+      # @param [String] id Case ID
+      #
+      # @return [Array]
+      #
       def links(id)
         get("/api/case/#{id}/links") { |json| json }
       end
+
+      #
+      # Merge two cases
+      #
+      # @param [String] id1 Case ID
+      # @param [String] id2 Case ID
+      #
+      # @return [Hash]
+      #
+      def merge(id1, id2)
+        post("/api/case/#{id1}/_merge/#{id2}") { |json| json }
+      end
+
+      #
+      # Update a case
+      #
+      # @param [String, nil] id
+      # @param [String, nil] title
+      # @param [String, nil] description
+      # @param [String, nil] severity
+      # @param [String, nil] start_date
+      # @param [String, nil] owner
+      # @param [Boolean, nil] flag
+      # @param [Integer, nil] tlp
+      # @param [String, nil] tags
+      # @param [String, nil] status
+      # @param [String, nil] resolution_status
+      # @param [String, nil] impact_status
+      # @param [String, nil] summary
+      # @param [String, nil] end_date
+      # @param [String, nil] metrics
+      # @param [String, nil] custom_fields
+      #
+      # @return [Hash]
+      #
+      def update(id, title: nil, description: nil, severity: nil, start_date: nil, owner: nil, flag: nil, tlp: nil, tags: nil, status: nil, resolution_status: nil, impact_status: nil, summary: nil, end_date: nil, metrics: nil, custom_fields: nil )
+        attributes = {
+          title: title,
+          description: description,
+          severity: severity,
+          startDate: start_date,
+          owner: owner,
+          flag: flag,
+          tlp: tlp,
+          tags: tags,
+          status: status,
+          resolutionStatus: resolution_status,
+          impactStatus: impact_status,
+          summary: summary,
+          endDate: end_date,
+          metrics: metrics,
+          customFields: custom_fields
+        }.compact
+        patch("/api/case/#{id}", attributes) { |json| json }
+      end
     end
   end
 end

data/lib/hachi/clients/user.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Hachi
+  module Clients
+    class User < Base
+      #
+      # Get current user
+      #
+      # @return [Hash]
+      #
+      def current
+        get("/api/user/current") { |json| json }
+      end
+
+      #
+      # Get a user
+      #
+      # @param [String] id User ID
+      #
+      # @return [Hash]
+      #
+      def get_by_id(id)
+        get("/api/user/#{id}") { |json| json }
+      end
+
+      #
+      # Delete a user
+      #
+      # @param [String] id User ID
+      #
+      # @return [String]
+      #
+      def delete_by_id(id)
+        delete("/api/user/#{id}") { |json| json }
+      end
+
+      #
+      # Create a user
+      #
+      # @param [String] login
+      # @param [String] name
+      # @param [Array<String>] roles
+      # @param [String] password
+      #
+      # @return [Hash]
+      #
+      def create(login:, name:, roles:, password:)
+        user = Models::User.new(
+          login: login,
+          name: name,
+          roles: roles,
+          password: password
+        )
+
+        post("/api/user", user.payload) { |json| json }
+      end
+    end
+  end
+end

data/lib/hachi/models/alert.rb

@@ -30,7 +30,7 @@ module Hachi
         @type = type
         @source = source
         @source_ref = source_ref || SecureRandom.hex(10)
-        @artifacts = artifacts.nil? ? nil : artifacts.map { |a| Artifact.new a }
+        @artifacts = artifacts.nil? ? nil : artifacts.map { |a| Artifact.new(**a) }
         @follow = follow
 
         validate_date if date

data/lib/hachi/models/user.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Hachi
+  module Models
+    class User < Base
+      attr_reader :login
+      attr_reader :name
+      attr_reader :roles
+      attr_reader :password
+
+      ROLES = %w(read write admin).freeze
+
+      def initialize(login:, name:, roles:, password:)
+        @login = login
+        @name = name
+        @roles = roles
+        @password = password
+
+        validate_roles
+      end
+
+      def payload
+        {
+          login: login,
+          name: name,
+          roles: roles,
+          password: password
+        }.compact
+      end
+
+      private
+
+      def validate_roles
+        raise ArgumentError, "roles should be an array" unless roles.is_a?(Array)
+        raise ArgumentError, "role should be one of #{ROLES.join('.')}" unless roles.all? { |role| ROLES.include? role }
+      end
+    end
+  end
+end

data/lib/hachi/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Hachi
-  VERSION = "0.2.2"
+  VERSION = "0.3.2"
 end

data/samples/04_merge_alerts.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+$LOAD_PATH.unshift("#{__dir__}/../lib")
+
+require "hachi"
+
+def api
+  @api ||= Hachi::API.new
+end
+
+description = ARGV[0].to_s
+case_id = ARGV[1].to_s
+
+alerts = api.alert.search(description: description)
+alert_ids = alerts.map { |alert| alert.dig "id" }
+
+api.alert.merge_into_case(alert_ids, case_id)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hachi
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.3.2
 platform: ruby
 authors:
 - Manabu Niseki
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2019-08-11 00:00:00.000000000 Z
+date: 2020-07-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.1'
 - !ruby/object:Gem::Dependency
   name: coveralls
   requirement: !ruby/object:Gem::Requirement
@@ -44,56 +44,56 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12.3'
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12.3'
+        version: '13.0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.8'
+        version: '3.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.8'
+        version: '3.9'
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.6'
+        version: '3.8'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.6'
+        version: '3.8'
 description: A dead simple TheHive API wrapper.
 email:
 - manabu.niseki@gmail.com
@@ -117,19 +117,22 @@ files:
 - lib/hachi/clients/artifact.rb
 - lib/hachi/clients/base.rb
 - lib/hachi/clients/case.rb
+- lib/hachi/clients/user.rb
 - lib/hachi/models/alert.rb
 - lib/hachi/models/artifact.rb
 - lib/hachi/models/base.rb
 - lib/hachi/models/case.rb
+- lib/hachi/models/user.rb
 - lib/hachi/version.rb
 - samples/01_create_an_alert.rb
 - samples/02_search_artifacts.rb
 - samples/03_list_cases.rb
+- samples/04_merge_alerts.rb
 homepage: https://github.com/ninoseki/hachi
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -144,8 +147,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.4
-signing_key: 
+rubygems_version: 3.1.2
+signing_key:
 specification_version: 4
 summary: A dead simple TheHive API wrapper.
 test_files: []