hachi 0.2.3 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 293861a0525887a1d226fe9c8673de534787fc243b6fa8c0feddc61e3cf7ff48
-  data.tar.gz: 4f2aecbe26c66918b393921e4f0666b34c62f2b8fc13d2c337d89789b86a22a3
+  metadata.gz: d03f917e4b7693f16612d130fb9808df41a4f66f962d757ec8e2dbedd6f039e1
+  data.tar.gz: 76ee4ec9ba69e732b17c7bff865fa5aaa5a251339b39b7daacc4e104000f99a3
 SHA512:
-  metadata.gz: dd3136e1b68d371109ea98957d9a09b18459f3086d14ec94d9f023cda5b81ae06ae477d180535014d1a3ba9d33541d215e62283b87c9e101ad3a85c115bde9cf
-  data.tar.gz: 4e866aed081ac5a526db9460c4b2ef148d0ee7ce17f5ffe758ef81cbbef6acb2970a7ec710ea4cc457825cb775c3a07bc7fdc46d1adc4ed0c04becd9e61a85c8
+  metadata.gz: 9281deed1829c4efe3ea82ed2ecafa616535cb4038867ab9ef480e28a328b39ad66c270503b5ef40d80b18c99dce849231aaa31e6c59a24ec5073dfebf9c103b
+  data.tar.gz: 637a3945b65862633bdfeeb1723f4179bd7a61ae989cc725b4427d94257dc5aa71c972100110afdadd61717294b7001957349ffb90a1978dcce70060186f82e6

data/.github/workflows/test.yml

@@ -0,0 +1,26 @@
+name: Ruby CI
+
+on: [pull_request]
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: [2.7, '3.0']
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby }}
+        bundler-cache: true
+    - name: Build and test with Rake
+      run: |
+        gem install bundler
+        bundle install
+        bundle exec rake

data/README.md

@@ -1,12 +1,14 @@
 # Hachi
 
 [![Gem Version](https://badge.fury.io/rb/hachi.svg)](https://badge.fury.io/rb/hachi)
-[![Build Status](https://travis-ci.org/ninoseki/hachi.svg?branch=master)](https://travis-ci.org/ninoseki/hachi)
+[![Ruby CI](https://github.com/ninoseki/hachi/actions/workflows/test.yml/badge.svg)](https://github.com/ninoseki/hachi/actions/workflows/test.yml)
 [![Coverage Status](https://coveralls.io/repos/github/ninoseki/hachi/badge.svg?branch=master)](https://coveralls.io/github/ninoseki/hachi?branch=master)
 [![CodeFactor](https://www.codefactor.io/repository/github/ninoseki/hachi/badge)](https://www.codefactor.io/repository/github/ninoseki/hachi)
 
 Hachi(`蜂`) is a dead simple [TheHive](https://github.com/TheHive-Project/TheHive) API wrapper for Ruby.
 
+**Note**: This library supports TheHive v4.
+
 ## Installation
 
 ```bash
@@ -26,10 +28,9 @@ api = Hachi::API.new(api_endpoint: "http://your_api_endpoint", api_key: "yoru_ap
 # list alerts
 api.alert.list
 
-# search atrifacts
-api.artifact.search(data: "1.1.1.1", data_type: "ip")
-# you can do a bulk search by giving an array as an input
-api.artifact.search(data: %w(1.1.1.1 8.8.8.8 github.com))
+# search artifacts
+query = { "_and": [{ "_or": [{ "_field": "data", "_value": "1.1.1.1" }, { "_field": "data", "_value": "example.com" }] }] }
+api.artifact.search(query)
 ```
 
 See `samples` for more.
@@ -41,25 +42,25 @@ See `samples` for more.
 | HTTP Method | URI                               | Action                      | API method                                                                                                                                                          |
 |-------------|-----------------------------------|-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | GET         | /api/alert                        | List alerts                 | `#api.alert.list`                                                                                                                                                   |
-| POST        | /api/alert/_search                | Find alerts                 | `#api.alert.search(attributes:, range: "all")`                                                                                                                      |
+| POST        | /api/alert/_search                | Find alerts                 | `#api.alert.search(query, range: "all")`                                                                                                                            |
 | PATCH       | /api/alert/_bulk                  | Update alerts in bulk       | N/A                                                                                                                                                                 |
 | POST        | /api/alert/_stats                 | Compute stats on alerts     | N/A                                                                                                                                                                 |
 | POST        | /api/alert                        | Create an alert             | `#api.alert.create(title:, description:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, type:, source:, source_ref: nil, artifacts: nil, follow: nil)` |
 | GET         | /api/alert/:alertId               | Get an alert                | `#api.alert.get_by_id(id)`                                                                                                                                          |
-| PATCH       | /api/alert/:alertId               | Update an alert             | N/A                                                                                                                                                                 |
+| PATCH       | /api/alert/:alertId               | Update an alert             | `#api.alert.update(id, title:, description:, severity: nil, tags: nil, tlp: nil, artifacts: nil)`                                                                   |
 | DELETE      | /api/alert/:alertId               | Delete an alert             | `#api.alert.delete_by_id(id)`                                                                                                                                       |
-| POST        | /api/alert/:alertId/markAsRead    | Mark an alert as read       | N/A                                                                                                                                                                 |
-| POST        | /api/alert/:alertId/markAsUnread  | Mark an alert as unread     | N/A                                                                                                                                                                 |
-| POST        | /api/alert/:alertId/createCase    | Create a case from an alert | N/A                                                                                                                                                                 |
+| POST        | /api/alert/:alertId/markAsRead    | Mark an alert as read       | `#api.alert.mark_as_read(id)`                                                                                                                                       |
+| POST        | /api/alert/:alertId/markAsUnread  | Mark an alert as unread     | `#api.alert.mark_as_unread(id)`                                                                                                                                     |
+| POST        | /api/alert/:alertId/createCase    | Create a case from an alert | `#api.alert.promote_to_case(id)`                                                                                                                                    |
 | POST        | /api/alert/:alertId/follow        | Follow an alert             | N/A                                                                                                                                                                 |
 | POST        | /api/alert/:alertId/unfollow      | Unfollow an alert           | N/A                                                                                                                                                                 |
-| POST        | /api/alert/:alertId/merge/:caseId | Merge an alert in a case    | N/A                                                                                                                                                                 |
+| POST        | /api/alert/:alertId/merge/:caseId | Merge an alert in a case    | `#api.alert.merge_into_case(*ids, case_id)`                                                                                                                         |
 
 ### Artifact(Observable)
 
 | HTTP Method | URI                                    | Action                          | API method                                                                            |
 |-------------|----------------------------------------|---------------------------------|---------------------------------------------------------------------------------------|
-| POST        | /api/case/artifact/_search             | Find observables                | `#api.artifact.search(attributes, range: "all")`                                      |
+| POST        | /api/case/artifact/_search             | Find observables                | `#api.artifact.search(query, range: "all")`                                           |
 | POST        | /api/case/artifact/_stats              | Compute stats on observables    | N/A                                                                                   |
 | POST        | /api/case/:caseId/artifact             | Create an observable            | `#api.artifact.create(case_id, data:, data_type:, message: nil, tlp: nil, tags: nil)` |
 | GET         | /api/case/artifact/:artifactId         | Get an observable               | `#api.artifact.get_by_id(id)`                                                         |
@@ -73,7 +74,7 @@ See `samples` for more.
 | HTTP Method | URI                                | Action                                | API method                                                                                                           |
 |-------------|------------------------------------|---------------------------------------|----------------------------------------------------------------------------------------------------------------------|
 | GET         | /api/case                          | List cases                            | `#api.case.list`                                                                                                     |
-| POST        | /api/case/_search                  | Find cases                            | `#api.case.search(attributes, range: "all")`                                                                         |
+| POST        | /api/case/_search                  | Find cases                            | `#api.case.search(query, range: "all")`                                                                              |
 | PATCH       | /api/case/_bulk                    | Update cases in bulk                  | N/A                                                                                                                  |
 | POST        | /api/case/_stats                   | Compute stats on cases                | N/A                                                                                                                  |
 | POST        | /api/case                          | Create a case                         | `#api.case.create(title:, description:, severity: nil, start_date: nil, owner: nil, flag: nil, tlp: nil, tags: nil)` |
@@ -81,7 +82,31 @@ See `samples` for more.
 | PATCH       | /api/case/:caseId                  | Update a case                         | N/A                                                                                                                  |
 | DELETE      | /api/case/:caseId                  | Remove a case                         | `#api.case.delete_by_id(id)`                                                                                         |
 | GET         | /api/case/:caseId/links            | Get list of cases linked to this case | `#api.case.links(id)`                                                                                                |
-| POST        | /api/case/:caseId1/_merge/:caseId2 | Merge two cases                       | N/A                                                                                                                  |
+| POST        | /api/case/:caseId1/_merge/:caseId2 | Merge two cases                       | `#api.case.merge(id1, id2)`                                                                                          |
+
+### User
+
+| HTTP Method | URI                               | Action              | API method                                           |
+|-------------|-----------------------------------|---------------------|------------------------------------------------------|
+| GET         | /api/logout                       | Logout              | N/A                                                  |
+| POST        | /api/login                        | User login          | N/A                                                  |
+| GET         | /api/user/current                 | Get current user    | `#api.user.current`                                  |
+| POST        | /api/user/_search                 | Find user           | N/A                                                  |
+| POST        | /api/user                         | Create a user       | `#api.user.create(login:, name:, roles:, password:)` |
+| GET         | /api/user/:userId                 | Get a user          | `#api.user.get_by_id(id)`                            |
+| DELETE      | /api/user/:userId                 | Delete a case       | `#api.user.delete_by_id(id)`                         |
+| PATCH       | /api/user/:userId                 | Update user details | N/A                                                  |
+| POST        | /api/user/:userId/password/set    | Set password        | N/A                                                  |
+| POST        | /api/user/:userId/password/change | Change password     | N/A                                                  |
+
+
+## How to interact with unimplemented API endpoints
+
+`Hachi::API` exposes `get`, `post`, `delete` and `patch` methods. You can interact with the API endpoints via the methods.
+
+```ruby
+alerts = api.get("/api/alert" ) { |json| json }
+```
 
 ## License
 

data/Rakefile

@@ -3,4 +3,4 @@ require "rspec/core/rake_task"
 
 RSpec::Core::RakeTask.new(:spec)
 
-task :default => :spec
+task default: :spec

data/hachi.gemspec

@@ -24,10 +24,10 @@ Gem::Specification.new do |spec|
   spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "bundler", "~> 2.0"
+  spec.add_development_dependency "bundler", "~> 2.2"
   spec.add_development_dependency "coveralls", "~> 0.8"
-  spec.add_development_dependency "rake", "~> 12.3"
-  spec.add_development_dependency "rspec", "~> 3.8"
-  spec.add_development_dependency "vcr", "~> 5.0"
-  spec.add_development_dependency "webmock", "~> 3.6"
+  spec.add_development_dependency "rake", "~> 13.0"
+  spec.add_development_dependency "rspec", "~> 3.10"
+  spec.add_development_dependency "vcr", "~> 6.0"
+  spec.add_development_dependency "webmock", "~> 3.12"
 end

data/lib/hachi.rb

@@ -8,11 +8,13 @@ require "hachi/models/base"
 require "hachi/models/alert"
 require "hachi/models/artifact"
 require "hachi/models/case"
+require "hachi/models/user"
 
 require "hachi/clients/base"
 require "hachi/clients/alert"
 require "hachi/clients/artifact"
 require "hachi/clients/case"
+require "hachi/clients/user"
 
 module Hachi
   class Error < StandardError; end

data/lib/hachi/api.rb

@@ -1,18 +1,69 @@
 # frozen_string_literal: true
 
+require 'forwardable'
+
 module Hachi
   class API
-    attr_reader :alert
-    attr_reader :artifact
-    attr_reader :case
+    extend Forwardable
+
+    # @return [String] TheHive API endpoint
+    attr_reader :api_endpoint
 
+    # @return [String] TheHive API key
+    attr_reader :api_key
+
+    #
+    # @param [String, nil] api_endpoint TheHive API endpoint
+    # @param [String, nil] api_key TheHive API key
+    #
+    # @raise [ArgumentError] When given or an empty endpoint or key
+    #
     def initialize(api_endpoint: ENV["THEHIVE_API_ENDPOINT"], api_key: ENV["THEHIVE_API_KEY"])
-      raise(ArgumentError, "api_endpoint argument is required") unless api_endpoint
-      raise(ArgumentError, "api_key argument is required") unless api_key
+      @api_endpoint = api_endpoint
+      raise ArgumentError, "api_endpoint argument is required" unless api_endpoint
+
+      @api_key = api_key
+      raise ArgumentError, "api_key argument is required" unless api_key
+
+      @base = Clients::Base.new(api_endpoint: api_endpoint, api_key: api_key)
+    end
+
+    def_delegators :@base, :get, :post, :delete, :push
+
+    #
+    # Alert API endpoint client
+    #
+    # @return [Clients::Alert]
+    #
+    def alert
+      @alert ||= Clients::Alert.new(api_endpoint: api_endpoint, api_key: api_key)
+    end
+
+    #
+    # Artifact API endpoint client
+    #
+    # @return [Clients::Artifact]
+    #
+    def artifact
+      @artifact ||= Clients::Artifact.new(api_endpoint: api_endpoint, api_key: api_key)
+    end
+
+    #
+    # Case API endpoint client
+    #
+    # @return [Clients::Case]
+    #
+    def case
+      @case ||= Clients::Case.new(api_endpoint: api_endpoint, api_key: api_key)
+    end
 
-      @alert = Clients::Alert.new(api_endpoint: api_endpoint, api_key: api_key)
-      @artifact = Clients::Artifact.new(api_endpoint: api_endpoint, api_key: api_key)
-      @case = Clients::Case.new(api_endpoint: api_endpoint, api_key: api_key)
+    #
+    # User API endpoint client
+    #
+    # @return [Clients::User]
+    #
+    def user
+      @user ||= Clients::User.new(api_endpoint: api_endpoint, api_key: api_key)
     end
   end
 end

data/lib/hachi/clients/alert.rb

@@ -6,19 +6,56 @@ require "securerandom"
 module Hachi
   module Clients
     class Alert < Base
+      #
+      # List alerts
+      #
+      # @return [Array]
+      #
       def list
         get("/api/alert") { |json| json }
       end
 
+      #
+      # Get an alert
+      #
+      # @param [String] id Alert ID
+      #
+      # @return [Hash]
+      #
       def get_by_id(id)
         get("/api/alert/#{id}") { |json| json }
       end
 
+      #
+      # Delete an alert
+      #
+      # @param [String] id Alert ID
+      #
+      # @return [String]
+      #
       def delete_by_id(id)
         delete("/api/alert/#{id}") { |json| json }
       end
 
-      def create(title:, description:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, type:, source:, source_ref: nil, artifacts: nil, follow: nil)
+      #
+      # Create an alert
+      #
+      # @param [String] title
+      # @param [String] description
+      # @param [String, nil] severity
+      # @param [String, nil] date
+      # @param [String, nil] tags
+      # @param [String, nil] tlp
+      # @param [String, nil] status
+      # @param [String, nil] type
+      # @param [String, nil] source
+      # @param [String, nil] source_ref
+      # @param [String, nil] artifacts
+      # @param [String, nil] follow
+      #
+      # @return [Hash]
+      #
+      def create(title:, description:, type:, source:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, source_ref: nil, artifacts: nil, follow: nil)
         alert = Models::Alert.new(
           title: title,
           description: description,
@@ -33,11 +70,94 @@ module Hachi
           artifacts: artifacts,
           follow: follow,
         )
-        post("/api/alert", alert.payload) { |json| json }
+        post("/api/alert", json: alert.payload) { |json| json }
       end
 
-      def search(attributes, range: "all")
-        _search("/api/alert/_search", attributes: attributes, range: range) { |json| json }
+      #
+      # Find alerts
+      #
+      # @param [Hash] query
+      # @param [String] range
+      # @param [String, nil] sort
+      #
+      # @return [Array]
+      #
+      def search(query, range: "all", sort: nil)
+        _search("/api/alert/_search", query: query, range: range, sort: sort) { |json| json }
+      end
+
+      #
+      # Mark an alert as read
+      #
+      # @param [String] id Alert ID
+      #
+      # @return [Hash]
+      #
+      def mark_as_read(id)
+        post("/api/alert/#{id}/markAsRead") { |json| json }
+      end
+
+      #
+      # Mark an alert as unread
+      #
+      # @param [String] id Alert ID
+      #
+      # @return [Hash] hash
+      #
+      def mark_as_unread(id)
+        post("/api/alert/#{id}/markAsUnread") { |json| json }
+      end
+
+      #
+      # Create a case from an alert
+      #
+      # @param [String] id Alert ID
+      #
+      # @return [Hash]
+      #
+      def promote_to_case(id)
+        post("/api/alert/#{id}/createCase") { |json| json }
+      end
+
+      #
+      # Merge an alert / alerts in a case
+      #
+      # @param [String, Array] *ids Alert ID(s)
+      # @param [String] case_id Case ID
+      #
+      # @return [Hash]
+      #
+      def merge_into_case(*ids, case_id)
+        params = {
+          alertIds: ids.flatten,
+          caseId: case_id
+        }
+        post("/api/alert/merge/_bulk", json: params) { |json| json }
+      end
+
+      #
+      # Update an alert
+      #
+      # @param [String, nil] id
+      # @param [String, nil] title
+      # @param [String, nil] description
+      # @param [String, nil] severity
+      # @param [String, nil] tags
+      # @param [String, nil] tlp
+      # @param [String, nil] artifacts
+      #
+      # @return [Hash]
+      #
+      def update(id, title: nil, description: nil, severity: nil, tags: nil, tlp: nil, artifacts: nil)
+        attributes = {
+          title: title,
+          description: description,
+          severity: severity,
+          tags: tags,
+          tlp: tlp,
+          artifacts: artifacts,
+        }.compact
+        patch("/api/alert/#{id}", json: attributes) { |json| json }
       end
     end
   end

data/lib/hachi/clients/artifact.rb

@@ -3,6 +3,18 @@
 module Hachi
   module Clients
     class Artifact < Base
+      #
+      # Create an artifact
+      #
+      # @param [String] case_id Artifact ID
+      # @param [String] data
+      # @param [String] data_type
+      # @param [String, nil] message
+      # @param [Integer, nil] tlp
+      # @param [Array<String>, nil] tags
+      #
+      # @return [Hash]
+      #
       def create(case_id, data:, data_type:, message: nil, tlp: nil, tags: nil)
         artifact = Models::Artifact.new(
           data: data,
@@ -12,21 +24,50 @@ module Hachi
           tags: tags,
         )
 
-        post("/api/case/#{case_id}/artifact", artifact.payload) { |json| json }
+        post("/api/case/#{case_id}/artifact", json: artifact.payload) { |json| json }
       end
 
+      #
+      # Get an artifact
+      #
+      # @param [String] id Artifact ID
+      #
+      # @return [Hash]
+      #
       def get_by_id(id)
         get("/api/case/artifact/#{id}") { |json| json }
       end
 
+      #
+      # Delete an artifact
+      #
+      # @param [String] id Artifact ID
+      #
+      # @return [String]
+      #
       def delete_by_id(id)
         delete("/api/case/artifact/#{id}") { |json| json }
       end
 
-      def search(attributes, range: "all")
-        _search("/api/case/artifact/_search", attributes: attributes, range: range) { |json| json }
+      #
+      # Find artifacts
+      #
+      # @param [Hash] query
+      # @param [String] range
+      #
+      # @return [Array]
+      #
+      def search(query, range: "all")
+        _search("/api/case/artifact/_search", query: query, range: range) { |json| json }
       end
 
+      #
+      # Get list of similar observables
+      #
+      # @param [String] id Artifact ID
+      #
+      # @return [Array]
+      #
       def similar(id)
         get("/api/case/artifact/#{id}/similar") { |json| json }
       end

data/lib/hachi/clients/base.rb

@@ -2,18 +2,64 @@
 
 require "json"
 require "net/https"
+require "uri"
 
 module Hachi
   module Clients
     class Base
-      attr_reader :api_endpoint
-      attr_reader :api_key
+      attr_reader :api_endpoint, :api_key
 
       def initialize(api_endpoint:, api_key:)
         @api_endpoint = URI(api_endpoint)
         @api_key = api_key
       end
 
+      def get(path, params: {}, &block)
+        url = url_for(path)
+        url.query = URI.encode_www_form(params) unless params.empty?
+
+        get = Net::HTTP::Get.new(url)
+        get.add_field "Authorization", "Bearer #{api_key}"
+        request(get, &block)
+      end
+
+      def post(path, params: {}, json: {}, &block)
+        url = url_for(path)
+        url.query = URI.encode_www_form(params) unless params.empty?
+
+        post = Net::HTTP::Post.new(url)
+        post.body = json.is_a?(Hash) ? json.to_json : json.to_s
+
+        post.add_field "Content-Type", "application/json"
+        post.add_field "Authorization", "Bearer #{api_key}"
+
+        request(post, &block)
+      end
+
+      def delete(path, params: {}, json: {}, &block)
+        url = url_for(path)
+        url.query = URI.encode_www_form(params) unless params.empty?
+
+        delete = Net::HTTP::Delete.new(url)
+        delete.body = json.is_a?(Hash) ? json.to_json : json.to_s
+
+        delete.add_field "Authorization", "Bearer #{api_key}"
+        request(delete, &block)
+      end
+
+      def patch(path, params: {}, json: {}, &block)
+        url = url_for(path)
+        url.query = URI.encode_www_form(params) unless params.empty?
+
+        patch = Net::HTTP::Patch.new(url)
+        patch.body = json.is_a?(Hash) ? json.to_json : json.to_s
+
+        patch.add_field "Content-Type", "application/json"
+        patch.add_field "Authorization", "Bearer #{api_key}"
+
+        request(patch, &block)
+      end
+
       private
 
       def base_url
@@ -73,36 +119,6 @@ module Hachi
         end
       end
 
-      def get(path, params = {}, &block)
-        url = url_for(path)
-        url.query = URI.encode_www_form(params) unless params.empty?
-
-        get = Net::HTTP::Get.new(url)
-        get.add_field "Authorization", "Bearer #{api_key}"
-        request(get, &block)
-      end
-
-      def post(path, params = {}, &block)
-        url = url_for(path)
-
-        post = Net::HTTP::Post.new(url)
-        post.body = params.is_a?(Hash) ? params.to_json : params.to_s
-
-        post.add_field "Content-Type", "application/json"
-        post.add_field "Authorization", "Bearer #{api_key}"
-
-        request(post, &block)
-      end
-
-      def delete(path, params = {}, &block)
-        url = url_for(path)
-        url.query = URI.encode_www_form(params) unless params.empty?
-
-        delete = Net::HTTP::Delete.new(url)
-        delete.add_field "Authorization", "Bearer #{api_key}"
-        request(delete, &block)
-      end
-
       def validate_range(range)
         return true if range == "all"
         raise ArgumentError, "range should be 'all' or `from-to`" unless range.match?(/(\d+)-(\d+)/)
@@ -113,49 +129,16 @@ module Hachi
         raise ArgumentError, "from should be smaller than to"
       end
 
-      def _search(path, attributes:, range: "all")
+      def _search(path, query:, range: "all", sort: nil)
         validate_range range
 
-        attributes = normalize_attributes(attributes)
-        conditions = attributes.map do |key, value|
-          if key == :data && value.is_a?(Array)
-            { _or: decompose_data(value) }
-          else
-            { _string: "#{key}:#{value}" }
-          end
-        end
+        query_string = build_query_string(range: range, sort: sort)
 
-        default_conditions = {
-          _and: [
-            { _not: { status: "Deleted" } },
-            { _not: { _in: { _field: "_type", _values: ["dashboard", "data", "user", "analyzer", "caseTemplate", "reportTemplate", "action"] } } },
-          ],
-        }
-
-        query = {
-          _and: [conditions, default_conditions].flatten,
-        }
-
-        post("#{path}?range=#{range}", query: query) { |json| json }
-      end
-
-      def decompose_data(data)
-        data.map do |elem|
-          { _field: "data", _value: elem }
-        end
-      end
-
-      def normalize_attributes(attributes)
-        h = {}
-        attributes.each do |key, value|
-          h[camelize(key).to_sym] = value
-        end
-        h
+        post("#{path}?#{query_string}", json: { query: query }) { |json| json }
       end
 
-      def camelize(string)
-        head, *others = string.to_s.split("_")
-        [head, others.map(&:capitalize)].flatten.join
+      def build_query_string(params)
+        URI.encode_www_form(params.reject { |_k, v| v.nil? })
       end
     end
   end

data/lib/hachi/clients/case.rb

@@ -3,18 +3,51 @@
 module Hachi
   module Clients
     class Case < Base
+      #
+      # List cases
+      #
+      # @return [Array]
+      #
       def list
         get("/api/case") { |json| json }
       end
 
+      #
+      # Get a case
+      #
+      # @param [String] id Case ID
+      #
+      # @return [Hash]
+      #
       def get_by_id(id)
         get("/api/case/#{id}") { |json| json }
       end
 
+      #
+      # Delete a case
+      #
+      # @param [String] id Case ID
+      #
+      # @return [String]
+      #
       def delete_by_id(id)
         delete("/api/case/#{id}") { |json| json }
       end
 
+      #
+      # Create a case
+      #
+      # @param [String, nil] title
+      # @param [String, nil] description
+      # @param [Integer, nil] severity
+      # @param [String, nil] start_date
+      # @param [String, nil] owner
+      # @param [Boolean, nil] flag
+      # @param [Intege, nil] tlp
+      # @param [String, nil] tags
+      #
+      # @return [Hash]
+      #
       def create(title:, description:, severity: nil, start_date: nil, owner: nil, flag: nil, tlp: nil, tags: nil)
         kase = Models::Case.new(
           title: title,
@@ -27,16 +60,86 @@ module Hachi
           tags: tags,
         )
 
-        post("/api/case", kase.payload) { |json| json }
+        post("/api/case", json: kase.payload) { |json| json }
       end
 
-      def search(attributes, range: "all")
-        _search("/api/case/_search", attributes: attributes, range: range) { |json| json }
+      #
+      # Find cases
+      #
+      # @param [Hash] query
+      # @param [String] range
+      #
+      # @return [Hash]
+      #
+      def search(query, range: "all")
+        _search("/api/case/_search", query: query, range: range) { |json| json }
       end
 
+      #
+      # Get list of cases linked to this case
+      #
+      # @param [String] id Case ID
+      #
+      # @return [Array]
+      #
       def links(id)
         get("/api/case/#{id}/links") { |json| json }
       end
+
+      #
+      # Merge two cases
+      #
+      # @param [String] id1 Case ID
+      # @param [String] id2 Case ID
+      #
+      # @return [Hash]
+      #
+      def merge(id1, id2)
+        post("/api/case/#{id1}/_merge/#{id2}") { |json| json }
+      end
+
+      #
+      # Update a case
+      #
+      # @param [String, nil] id
+      # @param [String, nil] title
+      # @param [String, nil] description
+      # @param [String, nil] severity
+      # @param [String, nil] start_date
+      # @param [String, nil] owner
+      # @param [Boolean, nil] flag
+      # @param [Integer, nil] tlp
+      # @param [String, nil] tags
+      # @param [String, nil] status
+      # @param [String, nil] resolution_status
+      # @param [String, nil] impact_status
+      # @param [String, nil] summary
+      # @param [String, nil] end_date
+      # @param [String, nil] metrics
+      # @param [String, nil] custom_fields
+      #
+      # @return [Hash]
+      #
+      def update(id, title: nil, description: nil, severity: nil, start_date: nil, owner: nil, flag: nil, tlp: nil, tags: nil, status: nil, resolution_status: nil, impact_status: nil, summary: nil, end_date: nil, metrics: nil, custom_fields: nil )
+        attributes = {
+          title: title,
+          description: description,
+          severity: severity,
+          startDate: start_date,
+          owner: owner,
+          flag: flag,
+          tlp: tlp,
+          tags: tags,
+          status: status,
+          resolutionStatus: resolution_status,
+          impactStatus: impact_status,
+          summary: summary,
+          endDate: end_date,
+          metrics: metrics,
+          customFields: custom_fields
+        }.compact
+        patch("/api/case/#{id}", json: attributes) { |json| json }
+      end
     end
   end
 end

data/lib/hachi/clients/user.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Hachi
+  module Clients
+    class User < Base
+      #
+      # Get current user
+      #
+      # @return [Hash]
+      #
+      def current
+        get("/api/user/current") { |json| json }
+      end
+
+      #
+      # Get a user
+      #
+      # @param [String] id User ID
+      #
+      # @return [Hash]
+      #
+      def get_by_id(id)
+        get("/api/user/#{id}") { |json| json }
+      end
+
+      #
+      # Delete a user
+      #
+      # @param [String] id User ID
+      #
+      # @return [String]
+      #
+      def delete_by_id(id)
+        delete("/api/user/#{id}") { |json| json }
+      end
+
+      #
+      # Create a user
+      #
+      # @param [String] login
+      # @param [String] name
+      # @param [Array<String>] roles
+      # @param [String] password
+      #
+      # @return [Hash]
+      #
+      def create(login:, name:, roles:, password:)
+        user = Models::User.new(
+          login: login,
+          name: name,
+          roles: roles,
+          password: password
+        )
+
+        post("/api/user", json: user.payload) { |json| json }
+      end
+    end
+  end
+end

data/lib/hachi/models/alert.rb

@@ -6,20 +6,9 @@ require "securerandom"
 module Hachi
   module Models
     class Alert < Base
-      attr_reader :title
-      attr_reader :description
-      attr_reader :severity
-      attr_reader :date
-      attr_reader :tags
-      attr_reader :tlp
-      attr_reader :status
-      attr_reader :type
-      attr_reader :source
-      attr_reader :source_ref
-      attr_reader :artifacts
-      attr_reader :follow
+      attr_reader :title, :description, :severity, :date, :tags, :tlp, :status, :type, :source, :source_ref, :artifacts, :follow
 
-      def initialize(title:, description:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, type:, source:, source_ref: nil, artifacts: nil, follow: nil)
+      def initialize(title:, description:, type:, source:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, source_ref: nil, artifacts: nil, follow: nil)
         @title = title
         @description = description
         @severity = severity
@@ -30,7 +19,7 @@ module Hachi
         @type = type
         @source = source
         @source_ref = source_ref || SecureRandom.hex(10)
-        @artifacts = artifacts.nil? ? nil : artifacts.map { |a| Artifact.new a }
+        @artifacts = artifacts.nil? ? nil : artifacts.map { |a| Artifact.new(**a) }
         @follow = follow
 
         validate_date if date

data/lib/hachi/models/artifact.rb

@@ -5,11 +5,7 @@ module Hachi
     class Artifact < Base
       DATA_TYPES = %w(filename file fqdn hash uri_path ip domain mail autonomous-system registry mail_subject regexp user-agent other url).freeze
 
-      attr_reader :data
-      attr_reader :data_type
-      attr_reader :message
-      attr_reader :tlp
-      attr_reader :tags
+      attr_reader :data, :data_type, :message, :tlp, :tags
 
       def initialize(data:, data_type:, message: nil, tlp: nil, tags: nil)
         @data = data

data/lib/hachi/models/case.rb

@@ -3,14 +3,7 @@
 module Hachi
   module Models
     class Case < Base
-      attr_reader :title
-      attr_reader :description
-      attr_reader :severity
-      attr_reader :start_date
-      attr_reader :owner
-      attr_reader :flag
-      attr_reader :tlp
-      attr_reader :tags
+      attr_reader :title, :description, :severity, :start_date, :owner, :flag, :tlp, :tags
 
       def initialize(title:, description:, severity: nil, start_date: nil, owner: nil, flag: nil, tlp: nil, tags: nil)
         @title = title

data/lib/hachi/models/user.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Hachi
+  module Models
+    class User < Base
+      attr_reader :login, :name, :roles, :password
+
+      ROLES = %w(read write admin).freeze
+
+      def initialize(login:, name:, roles:, password:)
+        @login = login
+        @name = name
+        @roles = roles
+        @password = password
+
+        validate_roles
+      end
+
+      def payload
+        {
+          login: login,
+          name: name,
+          roles: roles,
+          password: password
+        }.compact
+      end
+
+      private
+
+      def validate_roles
+        raise ArgumentError, "roles should be an array" unless roles.is_a?(Array)
+        raise ArgumentError, "role should be one of #{ROLES.join('.')}" unless roles.all? { |role| ROLES.include? role }
+      end
+    end
+  end
+end

data/lib/hachi/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Hachi
-  VERSION = "0.2.3"
+  VERSION = "1.0.0"
 end

data/renovate.json

@@ -0,0 +1,5 @@
+{
+  "extends": [
+    "config:base"
+  ]
+}

data/samples/04_merge_alerts.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+$LOAD_PATH.unshift("#{__dir__}/../lib")
+
+require "hachi"
+
+def api
+  @api ||= Hachi::API.new
+end
+
+description = ARGV[0].to_s
+case_id = ARGV[1].to_s
+
+alerts = api.alert.search(description: description)
+alert_ids = alerts.map { |alert| alert.dig "id" }
+
+api.alert.merge_into_case(alert_ids, case_id)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hachi
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 1.0.0
 platform: ruby
 authors:
 - Manabu Niseki
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2019-08-11 00:00:00.000000000 Z
+date: 2021-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.2'
 - !ruby/object:Gem::Dependency
   name: coveralls
   requirement: !ruby/object:Gem::Requirement
@@ -44,56 +44,56 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12.3'
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12.3'
+        version: '13.0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.8'
+        version: '3.10'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.8'
+        version: '3.10'
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.6'
+        version: '3.12'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.6'
+        version: '3.12'
 description: A dead simple TheHive API wrapper.
 email:
 - manabu.niseki@gmail.com
@@ -101,9 +101,9 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/workflows/test.yml"
 - ".gitignore"
 - ".rspec"
-- ".travis.yml"
 - Gemfile
 - LICENSE.txt
 - README.md
@@ -117,19 +117,23 @@ files:
 - lib/hachi/clients/artifact.rb
 - lib/hachi/clients/base.rb
 - lib/hachi/clients/case.rb
+- lib/hachi/clients/user.rb
 - lib/hachi/models/alert.rb
 - lib/hachi/models/artifact.rb
 - lib/hachi/models/base.rb
 - lib/hachi/models/case.rb
+- lib/hachi/models/user.rb
 - lib/hachi/version.rb
+- renovate.json
 - samples/01_create_an_alert.rb
 - samples/02_search_artifacts.rb
 - samples/03_list_cases.rb
+- samples/04_merge_alerts.rb
 homepage: https://github.com/ninoseki/hachi
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -144,8 +148,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.4
-signing_key: 
+rubygems_version: 3.2.3
+signing_key:
 specification_version: 4
 summary: A dead simple TheHive API wrapper.
 test_files: []

data/.travis.yml

@@ -1,7 +0,0 @@
----
-sudo: false
-language: ruby
-cache: bundler
-rvm:
-  - 2.6.1
-before_install: gem install bundler -v 2.0.1