hachi 0.2.4 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 25c386c075dc1e5962bd50ab50194d9489ab6ac017eb582be0136ea80b130fee
-  data.tar.gz: 50c9377cbf664c06aeb72675799d5657ae9368a3dcbd52e1dab29bf6990e928a
+  metadata.gz: '086d5b7a1c871c39a5913f99bc98e215bc2a51abba1ce645be1e8de47565ebcd'
+  data.tar.gz: db42c7b0091cf6a58f75a22df7591452a3a1f53c2e4b7bf8850cbc08ce4a2461
 SHA512:
-  metadata.gz: fcea0e7d85452ee6a9bfc94cb154abe28234bf0bc87db4b855d296a1ec7119085973fb29d5c71a5304c58c2f78a7a9df30a1b9d6bc3cdc0ea6f72ba02fab8ee0
-  data.tar.gz: b31c9631dc876c7d030fb3171a35985a442cb0c8da5755cd64644d5041e16f995435ef921ef72e4739fafd0048d2f2024c2e499aacb8eb61e4883ecd7611f0dd
+  metadata.gz: 6729860b84933e9b3d7100426a45394a3047f305c1eb323263f55d8219d1559e8cb6131b33b1407d129349b5733f012e6b8fa9a0073946968953dfb6d53640f9
+  data.tar.gz: 1b4ed73ac933cad2b503a2b9ee8a49eb92efaf046465aab04cb6192eb4547d58c4569c710dbb2917b77e94835b14afb12423d42c845dc4a3f933f4c6968bde55

data/.travis.yml

@@ -3,5 +3,5 @@ sudo: false
 language: ruby
 cache: bundler
 rvm:
-  - 2.6.1
+  - 2.6
 before_install: gem install bundler -v 2.0.1

data/README.md

@@ -1,7 +1,7 @@
 # Hachi
 
 [![Gem Version](https://badge.fury.io/rb/hachi.svg)](https://badge.fury.io/rb/hachi)
-[![Build Status](https://travis-ci.org/ninoseki/hachi.svg?branch=master)](https://travis-ci.org/ninoseki/hachi)
+[![Build Status](https://travis-ci.com/ninoseki/hachi.svg?branch=master)](https://travis-ci.com/ninoseki/hachi)
 [![Coverage Status](https://coveralls.io/repos/github/ninoseki/hachi/badge.svg?branch=master)](https://coveralls.io/github/ninoseki/hachi?branch=master)
 [![CodeFactor](https://www.codefactor.io/repository/github/ninoseki/hachi/badge)](https://www.codefactor.io/repository/github/ninoseki/hachi)
 
@@ -46,14 +46,14 @@ See `samples` for more.
 | POST        | /api/alert/_stats                 | Compute stats on alerts     | N/A                                                                                                                                                                 |
 | POST        | /api/alert                        | Create an alert             | `#api.alert.create(title:, description:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, type:, source:, source_ref: nil, artifacts: nil, follow: nil)` |
 | GET         | /api/alert/:alertId               | Get an alert                | `#api.alert.get_by_id(id)`                                                                                                                                          |
-| PATCH       | /api/alert/:alertId               | Update an alert             | N/A                                                                                                                                                                 |
+| PATCH       | /api/alert/:alertId               | Update an alert             | `#api.alert.update(id, title:, description:, severity: nil, tags: nil, tlp: nil, artifacts: nil)`                                                                   |
 | DELETE      | /api/alert/:alertId               | Delete an alert             | `#api.alert.delete_by_id(id)`                                                                                                                                       |
-| POST        | /api/alert/:alertId/markAsRead    | Mark an alert as read       | N/A                                                                                                                                                                 |
-| POST        | /api/alert/:alertId/markAsUnread  | Mark an alert as unread     | N/A                                                                                                                                                                 |
-| POST        | /api/alert/:alertId/createCase    | Create a case from an alert | N/A                                                                                                                                                                 |
+| POST        | /api/alert/:alertId/markAsRead    | Mark an alert as read       | `#api.alert.mark_as_read(id)`                                                                                                                                       |
+| POST        | /api/alert/:alertId/markAsUnread  | Mark an alert as unread     | `#api.alert.mark_as_unread(id)`                                                                                                                                     |
+| POST        | /api/alert/:alertId/createCase    | Create a case from an alert | `#api.alert.promote_to_case(id)`                                                                                                                                    |
 | POST        | /api/alert/:alertId/follow        | Follow an alert             | N/A                                                                                                                                                                 |
 | POST        | /api/alert/:alertId/unfollow      | Unfollow an alert           | N/A                                                                                                                                                                 |
-| POST        | /api/alert/:alertId/merge/:caseId | Merge an alert in a case    | N/A                                                                                                                                                                 |
+| POST        | /api/alert/:alertId/merge/:caseId | Merge an alert in a case    | `#api.alert.merge_into_case(*ids, case_id)`                                                                                                                         |
 
 ### Artifact(Observable)
 
@@ -81,7 +81,22 @@ See `samples` for more.
 | PATCH       | /api/case/:caseId                  | Update a case                         | N/A                                                                                                                  |
 | DELETE      | /api/case/:caseId                  | Remove a case                         | `#api.case.delete_by_id(id)`                                                                                         |
 | GET         | /api/case/:caseId/links            | Get list of cases linked to this case | `#api.case.links(id)`                                                                                                |
-| POST        | /api/case/:caseId1/_merge/:caseId2 | Merge two cases                       | N/A                                                                                                                  |
+| POST        | /api/case/:caseId1/_merge/:caseId2 | Merge two cases                       | `#api.case.merge(id1, id2)`                                                                                          |
+
+### User
+
+| HTTP Method | URI                               | Action              | API method                                           |
+|-------------|-----------------------------------|---------------------|------------------------------------------------------|
+| GET         | /api/logout                       | Logout              | N/A                                                  |
+| POST        | /api/login                        | User login          | N/A                                                  |
+| GET         | /api/user/current                 | Get current user    | `#api.user.current`                                  |
+| POST        | /api/user/_search                 | Find user           | N/A                                                  |
+| POST        | /api/user                         | Create a user       | `#api.user.create(login:, name:, roles:, password:)` |
+| GET         | /api/user/:userId                 | Get a user          | `#api.user.get_by_id(id)`                            |
+| DELETE      | /api/user/:userId                 | Delete a case       | `#api.user.delete_by_id(id)`                         |
+| PATCH       | /api/user/:userId                 | Update user details | N/A                                                  |
+| POST        | /api/user/:userId/password/set    | Set password        | N/A                                                  |
+| POST        | /api/user/:userId/password/change | Change password     | N/A                                                  |
 
 ## License
 

data/hachi.gemspec

@@ -26,8 +26,8 @@ Gem::Specification.new do |spec|
 
   spec.add_development_dependency "bundler", "~> 2.0"
   spec.add_development_dependency "coveralls", "~> 0.8"
-  spec.add_development_dependency "rake", "~> 12.3"
-  spec.add_development_dependency "rspec", "~> 3.8"
+  spec.add_development_dependency "rake", "~> 13.0"
+  spec.add_development_dependency "rspec", "~> 3.9"
   spec.add_development_dependency "vcr", "~> 5.0"
-  spec.add_development_dependency "webmock", "~> 3.6"
+  spec.add_development_dependency "webmock", "~> 3.7"
 end

data/lib/hachi/api.rb

@@ -2,17 +2,60 @@
 
 module Hachi
   class API
-    attr_reader :alert
-    attr_reader :artifact
-    attr_reader :case
+    # @return [String] TheHive API endpoint
+    attr_reader :api_endpoint
 
+    # @return [String] TheHive API key
+    attr_reader :api_key
+
+    #
+    # @param [String, nil] api_endpoint TheHive API endpoint
+    # @param [String, nil] api_key TheHive API key
+    #
+    # @raise [ArgumentError] When given or an empty endpoint or key
+    #
     def initialize(api_endpoint: ENV["THEHIVE_API_ENDPOINT"], api_key: ENV["THEHIVE_API_KEY"])
-      raise(ArgumentError, "api_endpoint argument is required") unless api_endpoint
-      raise(ArgumentError, "api_key argument is required") unless api_key
+      @api_endpoint = api_endpoint
+      raise ArgumentError, "api_endpoint argument is required" unless api_endpoint
+
+      @api_key = api_key
+      raise ArgumentError, "api_key argument is required" unless api_key
+    end
+
+    #
+    # Alert API endpoint client
+    #
+    # @return [Clients::Alert]
+    #
+    def alert
+      @alert ||= Clients::Alert.new(api_endpoint: api_endpoint, api_key: api_key)
+    end
+
+    #
+    # Artifact API endpoint client
+    #
+    # @return [Clients::Artifact]
+    #
+    def artifact
+      @artifact ||= Clients::Artifact.new(api_endpoint: api_endpoint, api_key: api_key)
+    end
+
+    #
+    # Case API endpoint client
+    #
+    # @return [Clients::Case]
+    #
+    def case
+      @case ||= Clients::Case.new(api_endpoint: api_endpoint, api_key: api_key)
+    end
 
-      @alert = Clients::Alert.new(api_endpoint: api_endpoint, api_key: api_key)
-      @artifact = Clients::Artifact.new(api_endpoint: api_endpoint, api_key: api_key)
-      @case = Clients::Case.new(api_endpoint: api_endpoint, api_key: api_key)
+    #
+    # User API endpoint client
+    #
+    # @return [Clients::User]
+    #
+    def user
+      @user ||= Clients::User.new(api_endpoint: api_endpoint, api_key: api_key)
     end
   end
 end

data/lib/hachi/clients/alert.rb

@@ -6,18 +6,55 @@ require "securerandom"
 module Hachi
   module Clients
     class Alert < Base
+      #
+      # List alerts
+      #
+      # @return [Array]
+      #
       def list
         get("/api/alert") { |json| json }
       end
 
+      #
+      # Get an alert
+      #
+      # @param [String] id Alert ID
+      #
+      # @return [Hash]
+      #
       def get_by_id(id)
         get("/api/alert/#{id}") { |json| json }
       end
 
+      #
+      # Delete an alert
+      #
+      # @param [String] id Alert ID
+      #
+      # @return [String]
+      #
       def delete_by_id(id)
         delete("/api/alert/#{id}") { |json| json }
       end
 
+      #
+      # Create an alert
+      #
+      # @param [String] title
+      # @param [String] description
+      # @param [String, nil] severity
+      # @param [String, nil] date
+      # @param [String, nil] tags
+      # @param [String, nil] tlp
+      # @param [String, nil] status
+      # @param [String, nil] type
+      # @param [String, nil] source
+      # @param [String, nil] source_ref
+      # @param [String, nil] artifacts
+      # @param [String, nil] follow
+      #
+      # @return [Hash]
+      #
       def create(title:, description:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, type:, source:, source_ref: nil, artifacts: nil, follow: nil)
         alert = Models::Alert.new(
           title: title,
@@ -36,9 +73,92 @@ module Hachi
         post("/api/alert", alert.payload) { |json| json }
       end
 
+      #
+      # Find alerts
+      #
+      # @param [Hash] attributes
+      # @param [String] range
+      # @param [String, nil] sort
+      #
+      # @return [Array]
+      #
       def search(attributes, range: "all", sort: nil)
         _search("/api/alert/_search", attributes: attributes, range: range, sort: sort) { |json| json }
       end
+
+      #
+      # Mark an alert as read
+      #
+      # @param [String] id Alert ID
+      #
+      # @return [Hash]
+      #
+      def mark_as_read(id)
+        post("/api/alert/#{id}/markAsRead") { |json| json }
+      end
+
+      #
+      # Mark an alert as unread
+      #
+      # @param [String] id Alert ID
+      #
+      # @return [Hash] hash
+      #
+      def mark_as_unread(id)
+        post("/api/alert/#{id}/markAsUnread") { |json| json }
+      end
+
+      #
+      # Create a case from an alert
+      #
+      # @param [String] id Alert ID
+      #
+      # @return [Hash]
+      #
+      def promote_to_case(id)
+        post("/api/alert/#{id}/createCase") { |json| json }
+      end
+
+      #
+      # Merge an alert / alerts in a case
+      #
+      # @param [String, Array] *ids Alert ID(s)
+      # @param [String] case_id Case ID
+      #
+      # @return [Hash]
+      #
+      def merge_into_case(*ids, case_id)
+        params = {
+          alertIds: ids,
+          caseId: case_id
+        }
+        post("/api/alert/merge/_bulk", params) { |json| json }
+      end
+
+      #
+      # Update an alert
+      #
+      # @param [String, nil] id
+      # @param [String, nil] title
+      # @param [String, nil] description
+      # @param [String, nil] severity
+      # @param [String, nil] tags
+      # @param [String, nil] tlp
+      # @param [String, nil] artifacts
+      #
+      # @return [Hash]
+      #
+      def update(id, title: nil, description: nil, severity: nil, tags: nil, tlp: nil, artifacts: nil)
+        attributes = {
+          title: title,
+          description: description,
+          severity: severity,
+          tags: tags,
+          tlp: tlp,
+          artifacts: artifacts,
+        }.compact
+        patch("/api/alert/#{id}", attributes) { |json| json }
+      end
     end
   end
 end

data/lib/hachi/clients/artifact.rb

@@ -3,6 +3,18 @@
 module Hachi
   module Clients
     class Artifact < Base
+      #
+      # Create an artifact
+      #
+      # @param [String] case_id Artifact ID
+      # @param [String] data
+      # @param [String] data_type
+      # @param [String, nil] message
+      # @param [Integer, nil] tlp
+      # @param [Array<String>, nil] tags
+      #
+      # @return [Hash]
+      #
       def create(case_id, data:, data_type:, message: nil, tlp: nil, tags: nil)
         artifact = Models::Artifact.new(
           data: data,
@@ -15,18 +27,47 @@ module Hachi
         post("/api/case/#{case_id}/artifact", artifact.payload) { |json| json }
       end
 
+      #
+      # Get an artifact
+      #
+      # @param [String] id Artifact ID
+      #
+      # @return [Hash]
+      #
       def get_by_id(id)
         get("/api/case/artifact/#{id}") { |json| json }
       end
 
+      #
+      # Delete an artifact
+      #
+      # @param [String] id Artifact ID
+      #
+      # @return [String]
+      #
       def delete_by_id(id)
         delete("/api/case/artifact/#{id}") { |json| json }
       end
 
+      #
+      # Find artifacts
+      #
+      # @param [Hash] attributes
+      # @param [String] range
+      #
+      # @return [Array]
+      #
       def search(attributes, range: "all")
         _search("/api/case/artifact/_search", attributes: attributes, range: range) { |json| json }
       end
 
+      #
+      # Get list of similar observables
+      #
+      # @param [String] id Artifact ID
+      #
+      # @return [Array]
+      #
       def similar(id)
         get("/api/case/artifact/#{id}/similar") { |json| json }
       end

data/lib/hachi/clients/base.rb

@@ -104,6 +104,18 @@ module Hachi
         request(delete, &block)
       end
 
+      def patch(path, params = {}, &block)
+        url = url_for(path)
+
+        patch = Net::HTTP::Patch.new(url)
+        patch.body = params.is_a?(Hash) ? params.to_json : params.to_s
+
+        patch.add_field "Content-Type", "application/json"
+        patch.add_field "Authorization", "Bearer #{api_key}"
+
+        request(patch, &block)
+      end
+
       def validate_range(range)
         return true if range == "all"
         raise ArgumentError, "range should be 'all' or `from-to`" unless range.match?(/(\d+)-(\d+)/)

data/lib/hachi/clients/case.rb

@@ -3,18 +3,51 @@
 module Hachi
   module Clients
     class Case < Base
+      #
+      # List cases
+      #
+      # @return [Array]
+      #
       def list
         get("/api/case") { |json| json }
       end
 
+      #
+      # Get a case
+      #
+      # @param [String] id Case ID
+      #
+      # @return [Hash]
+      #
       def get_by_id(id)
         get("/api/case/#{id}") { |json| json }
       end
 
+      #
+      # Delete a case
+      #
+      # @param [String] id Case ID
+      #
+      # @return [String]
+      #
       def delete_by_id(id)
         delete("/api/case/#{id}") { |json| json }
       end
 
+      #
+      # Create a case
+      #
+      # @param [String, nil] title
+      # @param [String, nil] description
+      # @param [Integer, nil] severity
+      # @param [String, nil] start_date
+      # @param [String, nil] owner
+      # @param [Boolean, nil] flag
+      # @param [Intege, nil] tlp
+      # @param [String, nil] tags
+      #
+      # @return [Hash]
+      #
       def create(title:, description:, severity: nil, start_date: nil, owner: nil, flag: nil, tlp: nil, tags: nil)
         kase = Models::Case.new(
           title: title,
@@ -30,13 +63,83 @@ module Hachi
         post("/api/case", kase.payload) { |json| json }
       end
 
+      #
+      # Find cases
+      #
+      # @param [Hash] attributes
+      # @param [String] range
+      #
+      # @return [Hash]
+      #
       def search(attributes, range: "all")
         _search("/api/case/_search", attributes: attributes, range: range) { |json| json }
       end
 
+      #
+      # Get list of cases linked to this case
+      #
+      # @param [String] id Case ID
+      #
+      # @return [Array]
+      #
       def links(id)
         get("/api/case/#{id}/links") { |json| json }
       end
+
+      #
+      # Merge two cases
+      #
+      # @param [String] id1 Case ID
+      # @param [String] id2 Case ID
+      #
+      # @return [Hash]
+      #
+      def merge(id1, id2)
+        post("/api/case/#{id1}/_merge/#{id2}") { |json| json }
+      end
+
+      #
+      # Update a case
+      #
+      # @param [String, nil] id
+      # @param [String, nil] title
+      # @param [String, nil] description
+      # @param [String, nil] severity
+      # @param [String, nil] start_date
+      # @param [String, nil] owner
+      # @param [Boolean, nil] flag
+      # @param [Integer, nil] tlp
+      # @param [String, nil] tags
+      # @param [String, nil] status
+      # @param [String, nil] resolution_status
+      # @param [String, nil] impact_status
+      # @param [String, nil] summary
+      # @param [String, nil] end_date
+      # @param [String, nil] metrics
+      # @param [String, nil] custom_fields
+      #
+      # @return [Hash]
+      #
+      def update(id, title: nil, description: nil, severity: nil, start_date: nil, owner: nil, flag: nil, tlp: nil, tags: nil, status: nil, resolution_status: nil, impact_status: nil, summary: nil, end_date: nil, metrics: nil, custom_fields: nil )
+        attributes = {
+          title: title,
+          description: description,
+          severity: severity,
+          startDate: start_date,
+          owner: owner,
+          flag: flag,
+          tlp: tlp,
+          tags: tags,
+          status: status,
+          resolutionStatus: resolution_status,
+          impactStatus: impact_status,
+          summary: summary,
+          endDate: end_date,
+          metrics: metrics,
+          customFields: custom_fields
+        }.compact
+        patch("/api/case/#{id}", attributes) { |json| json }
+      end
     end
   end
 end

data/lib/hachi/clients/user.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Hachi
+  module Clients
+    class User < Base
+      #
+      # Get current user
+      #
+      # @return [Hash]
+      #
+      def current
+        get("/api/user/current") { |json| json }
+      end
+
+      #
+      # Get a user
+      #
+      # @param [String] id User ID
+      #
+      # @return [Hash]
+      #
+      def get_by_id(id)
+        get("/api/user/#{id}") { |json| json }
+      end
+
+      #
+      # Delete a user
+      #
+      # @param [String] id User ID
+      #
+      # @return [String]
+      #
+      def delete_by_id(id)
+        delete("/api/user/#{id}") { |json| json }
+      end
+
+      #
+      # Create a user
+      #
+      # @param [String] login
+      # @param [String] name
+      # @param [Array<String>] roles
+      # @param [String] password
+      #
+      # @return [Hash]
+      #
+      def create(login:, name:, roles:, password:)
+        user = Models::User.new(
+          login: login,
+          name: name,
+          roles: roles,
+          password: password
+        )
+
+        post("/api/user", user.payload) { |json| json }
+      end
+    end
+  end
+end

data/lib/hachi/models/user.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Hachi
+  module Models
+    class User < Base
+      attr_reader :login
+      attr_reader :name
+      attr_reader :roles
+      attr_reader :password
+
+      ROLES = %w(read write admin).freeze
+
+      def initialize(login:, name:, roles:, password:)
+        @login = login
+        @name = name
+        @roles = roles
+        @password = password
+
+        validate_roles
+      end
+
+      def payload
+        {
+          login: login,
+          name: name,
+          roles: roles,
+          password: password
+        }.compact
+      end
+
+      private
+
+      def validate_roles
+        raise ArgumentError, "roles should be an array" unless roles.is_a?(Array)
+        raise ArgumentError, "role should be one of #{ROLES.join('.')}" unless roles.all? { |role| ROLES.include? role }
+      end
+    end
+  end
+end

data/lib/hachi/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Hachi
-  VERSION = "0.2.4"
+  VERSION = "0.3.0"
 end

data/lib/hachi.rb

@@ -8,11 +8,13 @@ require "hachi/models/base"
 require "hachi/models/alert"
 require "hachi/models/artifact"
 require "hachi/models/case"
+require "hachi/models/user"
 
 require "hachi/clients/base"
 require "hachi/clients/alert"
 require "hachi/clients/artifact"
 require "hachi/clients/case"
+require "hachi/clients/user"
 
 module Hachi
   class Error < StandardError; end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hachi
 version: !ruby/object:Gem::Version
-  version: 0.2.4
+  version: 0.3.0
 platform: ruby
 authors:
 - Manabu Niseki
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-08-11 00:00:00.000000000 Z
+date: 2019-11-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -44,28 +44,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12.3'
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12.3'
+        version: '13.0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.8'
+        version: '3.9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.8'
+        version: '3.9'
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -86,14 +86,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.6'
+        version: '3.7'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.6'
+        version: '3.7'
 description: A dead simple TheHive API wrapper.
 email:
 - manabu.niseki@gmail.com
@@ -117,10 +117,12 @@ files:
 - lib/hachi/clients/artifact.rb
 - lib/hachi/clients/base.rb
 - lib/hachi/clients/case.rb
+- lib/hachi/clients/user.rb
 - lib/hachi/models/alert.rb
 - lib/hachi/models/artifact.rb
 - lib/hachi/models/base.rb
 - lib/hachi/models/case.rb
+- lib/hachi/models/user.rb
 - lib/hachi/version.rb
 - samples/01_create_an_alert.rb
 - samples/02_search_artifacts.rb
@@ -144,7 +146,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.4
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: A dead simple TheHive API wrapper.