hachi 0.3.2 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3a64cb219a699afb02768ce856250ee2baa3eb77b51f8fc2bcb76b1ccc36b44a
-  data.tar.gz: 8de8ee38a60140d62e6740c874fddd679e91748cba187c6789b9afc3f3cfd09d
+  metadata.gz: d03f917e4b7693f16612d130fb9808df41a4f66f962d757ec8e2dbedd6f039e1
+  data.tar.gz: 76ee4ec9ba69e732b17c7bff865fa5aaa5a251339b39b7daacc4e104000f99a3
 SHA512:
-  metadata.gz: f66d6cf5bcb7c252a2ca4355e0409b28667dc7d9f55c356e482cab043bf6559f6d5eae49e08e83fa58cdf42493ab97fb481eb5c0907d0af5bcfd29b20aeb85bc
-  data.tar.gz: d00975cc9e11bfca85828a821f6d9915458f43d6adc22d957fc6dcc13a39b91e06bb315e290b0f5ca12cb87d79915e6611ea7b5542b695e661c13910e7d99f36
+  metadata.gz: 9281deed1829c4efe3ea82ed2ecafa616535cb4038867ab9ef480e28a328b39ad66c270503b5ef40d80b18c99dce849231aaa31e6c59a24ec5073dfebf9c103b
+  data.tar.gz: 637a3945b65862633bdfeeb1723f4179bd7a61ae989cc725b4427d94257dc5aa71c972100110afdadd61717294b7001957349ffb90a1978dcce70060186f82e6

data/.github/workflows/test.yml

@@ -0,0 +1,26 @@
+name: Ruby CI
+
+on: [pull_request]
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: [2.7, '3.0']
+
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby }}
+        bundler-cache: true
+    - name: Build and test with Rake
+      run: |
+        gem install bundler
+        bundle install
+        bundle exec rake

data/README.md

@@ -1,12 +1,14 @@
 # Hachi
 
 [![Gem Version](https://badge.fury.io/rb/hachi.svg)](https://badge.fury.io/rb/hachi)
-[![Build Status](https://travis-ci.com/ninoseki/hachi.svg?branch=master)](https://travis-ci.com/ninoseki/hachi)
+[![Ruby CI](https://github.com/ninoseki/hachi/actions/workflows/test.yml/badge.svg)](https://github.com/ninoseki/hachi/actions/workflows/test.yml)
 [![Coverage Status](https://coveralls.io/repos/github/ninoseki/hachi/badge.svg?branch=master)](https://coveralls.io/github/ninoseki/hachi?branch=master)
 [![CodeFactor](https://www.codefactor.io/repository/github/ninoseki/hachi/badge)](https://www.codefactor.io/repository/github/ninoseki/hachi)
 
 Hachi(`蜂`) is a dead simple [TheHive](https://github.com/TheHive-Project/TheHive) API wrapper for Ruby.
 
+**Note**: This library supports TheHive v4.
+
 ## Installation
 
 ```bash
@@ -26,10 +28,9 @@ api = Hachi::API.new(api_endpoint: "http://your_api_endpoint", api_key: "yoru_ap
 # list alerts
 api.alert.list
 
-# search atrifacts
-api.artifact.search(data: "1.1.1.1", data_type: "ip")
-# you can do a bulk search by giving an array as an input
-api.artifact.search(data: %w(1.1.1.1 8.8.8.8 github.com))
+# search artifacts
+query = { "_and": [{ "_or": [{ "_field": "data", "_value": "1.1.1.1" }, { "_field": "data", "_value": "example.com" }] }] }
+api.artifact.search(query)
 ```
 
 See `samples` for more.
@@ -41,7 +42,7 @@ See `samples` for more.
 | HTTP Method | URI                               | Action                      | API method                                                                                                                                                          |
 |-------------|-----------------------------------|-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | GET         | /api/alert                        | List alerts                 | `#api.alert.list`                                                                                                                                                   |
-| POST        | /api/alert/_search                | Find alerts                 | `#api.alert.search(attributes, range: "all")`                                                                                                                       |
+| POST        | /api/alert/_search                | Find alerts                 | `#api.alert.search(query, range: "all")`                                                                                                                            |
 | PATCH       | /api/alert/_bulk                  | Update alerts in bulk       | N/A                                                                                                                                                                 |
 | POST        | /api/alert/_stats                 | Compute stats on alerts     | N/A                                                                                                                                                                 |
 | POST        | /api/alert                        | Create an alert             | `#api.alert.create(title:, description:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, type:, source:, source_ref: nil, artifacts: nil, follow: nil)` |
@@ -59,7 +60,7 @@ See `samples` for more.
 
 | HTTP Method | URI                                    | Action                          | API method                                                                            |
 |-------------|----------------------------------------|---------------------------------|---------------------------------------------------------------------------------------|
-| POST        | /api/case/artifact/_search             | Find observables                | `#api.artifact.search(attributes, range: "all")`                                      |
+| POST        | /api/case/artifact/_search             | Find observables                | `#api.artifact.search(query, range: "all")`                                           |
 | POST        | /api/case/artifact/_stats              | Compute stats on observables    | N/A                                                                                   |
 | POST        | /api/case/:caseId/artifact             | Create an observable            | `#api.artifact.create(case_id, data:, data_type:, message: nil, tlp: nil, tags: nil)` |
 | GET         | /api/case/artifact/:artifactId         | Get an observable               | `#api.artifact.get_by_id(id)`                                                         |
@@ -73,7 +74,7 @@ See `samples` for more.
 | HTTP Method | URI                                | Action                                | API method                                                                                                           |
 |-------------|------------------------------------|---------------------------------------|----------------------------------------------------------------------------------------------------------------------|
 | GET         | /api/case                          | List cases                            | `#api.case.list`                                                                                                     |
-| POST        | /api/case/_search                  | Find cases                            | `#api.case.search(attributes, range: "all")`                                                                         |
+| POST        | /api/case/_search                  | Find cases                            | `#api.case.search(query, range: "all")`                                                                              |
 | PATCH       | /api/case/_bulk                    | Update cases in bulk                  | N/A                                                                                                                  |
 | POST        | /api/case/_stats                   | Compute stats on cases                | N/A                                                                                                                  |
 | POST        | /api/case                          | Create a case                         | `#api.case.create(title:, description:, severity: nil, start_date: nil, owner: nil, flag: nil, tlp: nil, tags: nil)` |
@@ -98,6 +99,15 @@ See `samples` for more.
 | POST        | /api/user/:userId/password/set    | Set password        | N/A                                                  |
 | POST        | /api/user/:userId/password/change | Change password     | N/A                                                  |
 
+
+## How to interact with unimplemented API endpoints
+
+`Hachi::API` exposes `get`, `post`, `delete` and `patch` methods. You can interact with the API endpoints via the methods.
+
+```ruby
+alerts = api.get("/api/alert" ) { |json| json }
+```
+
 ## License
 
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/Rakefile

@@ -3,4 +3,4 @@ require "rspec/core/rake_task"
 
 RSpec::Core::RakeTask.new(:spec)
 
-task :default => :spec
+task default: :spec

data/hachi.gemspec

@@ -24,10 +24,10 @@ Gem::Specification.new do |spec|
   spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "bundler", "~> 2.1"
+  spec.add_development_dependency "bundler", "~> 2.2"
   spec.add_development_dependency "coveralls", "~> 0.8"
   spec.add_development_dependency "rake", "~> 13.0"
-  spec.add_development_dependency "rspec", "~> 3.9"
+  spec.add_development_dependency "rspec", "~> 3.10"
   spec.add_development_dependency "vcr", "~> 6.0"
-  spec.add_development_dependency "webmock", "~> 3.8"
+  spec.add_development_dependency "webmock", "~> 3.12"
 end

data/lib/hachi/api.rb

@@ -1,7 +1,11 @@
 # frozen_string_literal: true
 
+require 'forwardable'
+
 module Hachi
   class API
+    extend Forwardable
+
     # @return [String] TheHive API endpoint
     attr_reader :api_endpoint
 
@@ -20,8 +24,12 @@ module Hachi
 
       @api_key = api_key
       raise ArgumentError, "api_key argument is required" unless api_key
+
+      @base = Clients::Base.new(api_endpoint: api_endpoint, api_key: api_key)
     end
 
+    def_delegators :@base, :get, :post, :delete, :push
+
     #
     # Alert API endpoint client
     #

data/lib/hachi/clients/alert.rb

@@ -55,7 +55,7 @@ module Hachi
       #
       # @return [Hash]
       #
-      def create(title:, description:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, type:, source:, source_ref: nil, artifacts: nil, follow: nil)
+      def create(title:, description:, type:, source:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, source_ref: nil, artifacts: nil, follow: nil)
         alert = Models::Alert.new(
           title: title,
           description: description,
@@ -70,20 +70,20 @@ module Hachi
           artifacts: artifacts,
           follow: follow,
         )
-        post("/api/alert", alert.payload) { |json| json }
+        post("/api/alert", json: alert.payload) { |json| json }
       end
 
       #
       # Find alerts
       #
-      # @param [Hash] attributes
+      # @param [Hash] query
       # @param [String] range
       # @param [String, nil] sort
       #
       # @return [Array]
       #
-      def search(attributes, range: "all", sort: nil)
-        _search("/api/alert/_search", attributes: attributes, range: range, sort: sort) { |json| json }
+      def search(query, range: "all", sort: nil)
+        _search("/api/alert/_search", query: query, range: range, sort: sort) { |json| json }
       end
 
       #
@@ -132,7 +132,7 @@ module Hachi
           alertIds: ids.flatten,
           caseId: case_id
         }
-        post("/api/alert/merge/_bulk", params) { |json| json }
+        post("/api/alert/merge/_bulk", json: params) { |json| json }
       end
 
       #
@@ -157,7 +157,7 @@ module Hachi
           tlp: tlp,
           artifacts: artifacts,
         }.compact
-        patch("/api/alert/#{id}", attributes) { |json| json }
+        patch("/api/alert/#{id}", json: attributes) { |json| json }
       end
     end
   end

data/lib/hachi/clients/artifact.rb

@@ -24,7 +24,7 @@ module Hachi
           tags: tags,
         )
 
-        post("/api/case/#{case_id}/artifact", artifact.payload) { |json| json }
+        post("/api/case/#{case_id}/artifact", json: artifact.payload) { |json| json }
       end
 
       #
@@ -52,13 +52,13 @@ module Hachi
       #
       # Find artifacts
       #
-      # @param [Hash] attributes
+      # @param [Hash] query
       # @param [String] range
       #
       # @return [Array]
       #
-      def search( range: "all", **attributes)
-        _search("/api/case/artifact/_search", attributes: attributes, range: range) { |json| json }
+      def search(query, range: "all")
+        _search("/api/case/artifact/_search", query: query, range: range) { |json| json }
       end
 
       #

data/lib/hachi/clients/base.rb

@@ -7,14 +7,59 @@ require "uri"
 module Hachi
   module Clients
     class Base
-      attr_reader :api_endpoint
-      attr_reader :api_key
+      attr_reader :api_endpoint, :api_key
 
       def initialize(api_endpoint:, api_key:)
         @api_endpoint = URI(api_endpoint)
         @api_key = api_key
       end
 
+      def get(path, params: {}, &block)
+        url = url_for(path)
+        url.query = URI.encode_www_form(params) unless params.empty?
+
+        get = Net::HTTP::Get.new(url)
+        get.add_field "Authorization", "Bearer #{api_key}"
+        request(get, &block)
+      end
+
+      def post(path, params: {}, json: {}, &block)
+        url = url_for(path)
+        url.query = URI.encode_www_form(params) unless params.empty?
+
+        post = Net::HTTP::Post.new(url)
+        post.body = json.is_a?(Hash) ? json.to_json : json.to_s
+
+        post.add_field "Content-Type", "application/json"
+        post.add_field "Authorization", "Bearer #{api_key}"
+
+        request(post, &block)
+      end
+
+      def delete(path, params: {}, json: {}, &block)
+        url = url_for(path)
+        url.query = URI.encode_www_form(params) unless params.empty?
+
+        delete = Net::HTTP::Delete.new(url)
+        delete.body = json.is_a?(Hash) ? json.to_json : json.to_s
+
+        delete.add_field "Authorization", "Bearer #{api_key}"
+        request(delete, &block)
+      end
+
+      def patch(path, params: {}, json: {}, &block)
+        url = url_for(path)
+        url.query = URI.encode_www_form(params) unless params.empty?
+
+        patch = Net::HTTP::Patch.new(url)
+        patch.body = json.is_a?(Hash) ? json.to_json : json.to_s
+
+        patch.add_field "Content-Type", "application/json"
+        patch.add_field "Authorization", "Bearer #{api_key}"
+
+        request(patch, &block)
+      end
+
       private
 
       def base_url
@@ -74,48 +119,6 @@ module Hachi
         end
       end
 
-      def get(path, params = {}, &block)
-        url = url_for(path)
-        url.query = URI.encode_www_form(params) unless params.empty?
-
-        get = Net::HTTP::Get.new(url)
-        get.add_field "Authorization", "Bearer #{api_key}"
-        request(get, &block)
-      end
-
-      def post(path, params = {}, &block)
-        url = url_for(path)
-
-        post = Net::HTTP::Post.new(url)
-        post.body = params.is_a?(Hash) ? params.to_json : params.to_s
-
-        post.add_field "Content-Type", "application/json"
-        post.add_field "Authorization", "Bearer #{api_key}"
-
-        request(post, &block)
-      end
-
-      def delete(path, params = {}, &block)
-        url = url_for(path)
-        url.query = URI.encode_www_form(params) unless params.empty?
-
-        delete = Net::HTTP::Delete.new(url)
-        delete.add_field "Authorization", "Bearer #{api_key}"
-        request(delete, &block)
-      end
-
-      def patch(path, params = {}, &block)
-        url = url_for(path)
-
-        patch = Net::HTTP::Patch.new(url)
-        patch.body = params.is_a?(Hash) ? params.to_json : params.to_s
-
-        patch.add_field "Content-Type", "application/json"
-        patch.add_field "Authorization", "Bearer #{api_key}"
-
-        request(patch, &block)
-      end
-
       def validate_range(range)
         return true if range == "all"
         raise ArgumentError, "range should be 'all' or `from-to`" unless range.match?(/(\d+)-(\d+)/)
@@ -126,51 +129,12 @@ module Hachi
         raise ArgumentError, "from should be smaller than to"
       end
 
-      def _search(path, attributes:, range: "all", sort: nil)
+      def _search(path, query:, range: "all", sort: nil)
         validate_range range
 
-        attributes = normalize_attributes(attributes)
-        conditions = attributes.map do |key, value|
-          if key == :data && value.is_a?(Array)
-            { _or: decompose_data(value) }
-          else
-            { _string: "#{key}:\"#{value}\"" }
-          end
-        end
-
-        default_conditions = {
-          _and: [
-            { _not: { status: "Deleted" } },
-            { _not: { _in: { _field: "_type", _values: ["dashboard", "data", "user", "analyzer", "caseTemplate", "reportTemplate", "action"] } } },
-          ],
-        }
-
-        query = {
-          _and: [conditions, default_conditions].flatten,
-        }
-
         query_string = build_query_string(range: range, sort: sort)
 
-        post("#{path}?#{query_string}", query: query) { |json| json }
-      end
-
-      def decompose_data(data)
-        data.map do |elem|
-          { _field: "data", _value: elem }
-        end
-      end
-
-      def normalize_attributes(attributes)
-        h = {}
-        attributes.each do |key, value|
-          h[camelize(key).to_sym] = value
-        end
-        h
-      end
-
-      def camelize(string)
-        head, *others = string.to_s.split("_")
-        [head, others.map(&:capitalize)].flatten.join
+        post("#{path}?#{query_string}", json: { query: query }) { |json| json }
       end
 
       def build_query_string(params)

data/lib/hachi/clients/case.rb

@@ -60,19 +60,19 @@ module Hachi
           tags: tags,
         )
 
-        post("/api/case", kase.payload) { |json| json }
+        post("/api/case", json: kase.payload) { |json| json }
       end
 
       #
       # Find cases
       #
-      # @param [Hash] attributes
+      # @param [Hash] query
       # @param [String] range
       #
       # @return [Hash]
       #
-      def search(range: "all", **attributes)
-        _search("/api/case/_search", attributes: attributes, range: range) { |json| json }
+      def search(query, range: "all")
+        _search("/api/case/_search", query: query, range: range) { |json| json }
       end
 
       #
@@ -138,7 +138,7 @@ module Hachi
           metrics: metrics,
           customFields: custom_fields
         }.compact
-        patch("/api/case/#{id}", attributes) { |json| json }
+        patch("/api/case/#{id}", json: attributes) { |json| json }
       end
     end
   end

data/lib/hachi/clients/user.rb

@@ -52,7 +52,7 @@ module Hachi
           password: password
         )
 
-        post("/api/user", user.payload) { |json| json }
+        post("/api/user", json: user.payload) { |json| json }
       end
     end
   end

data/lib/hachi/models/alert.rb

@@ -6,20 +6,9 @@ require "securerandom"
 module Hachi
   module Models
     class Alert < Base
-      attr_reader :title
-      attr_reader :description
-      attr_reader :severity
-      attr_reader :date
-      attr_reader :tags
-      attr_reader :tlp
-      attr_reader :status
-      attr_reader :type
-      attr_reader :source
-      attr_reader :source_ref
-      attr_reader :artifacts
-      attr_reader :follow
+      attr_reader :title, :description, :severity, :date, :tags, :tlp, :status, :type, :source, :source_ref, :artifacts, :follow
 
-      def initialize(title:, description:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, type:, source:, source_ref: nil, artifacts: nil, follow: nil)
+      def initialize(title:, description:, type:, source:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, source_ref: nil, artifacts: nil, follow: nil)
         @title = title
         @description = description
         @severity = severity

data/lib/hachi/models/artifact.rb

@@ -5,11 +5,7 @@ module Hachi
     class Artifact < Base
       DATA_TYPES = %w(filename file fqdn hash uri_path ip domain mail autonomous-system registry mail_subject regexp user-agent other url).freeze
 
-      attr_reader :data
-      attr_reader :data_type
-      attr_reader :message
-      attr_reader :tlp
-      attr_reader :tags
+      attr_reader :data, :data_type, :message, :tlp, :tags
 
       def initialize(data:, data_type:, message: nil, tlp: nil, tags: nil)
         @data = data

data/lib/hachi/models/case.rb

@@ -3,14 +3,7 @@
 module Hachi
   module Models
     class Case < Base
-      attr_reader :title
-      attr_reader :description
-      attr_reader :severity
-      attr_reader :start_date
-      attr_reader :owner
-      attr_reader :flag
-      attr_reader :tlp
-      attr_reader :tags
+      attr_reader :title, :description, :severity, :start_date, :owner, :flag, :tlp, :tags
 
       def initialize(title:, description:, severity: nil, start_date: nil, owner: nil, flag: nil, tlp: nil, tags: nil)
         @title = title

data/lib/hachi/models/user.rb

@@ -3,10 +3,7 @@
 module Hachi
   module Models
     class User < Base
-      attr_reader :login
-      attr_reader :name
-      attr_reader :roles
-      attr_reader :password
+      attr_reader :login, :name, :roles, :password
 
       ROLES = %w(read write admin).freeze
 

data/lib/hachi/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Hachi
-  VERSION = "0.3.2"
+  VERSION = "1.0.0"
 end

data/renovate.json

@@ -0,0 +1,5 @@
+{
+  "extends": [
+    "config:base"
+  ]
+}

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: hachi
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 1.0.0
 platform: ruby
 authors:
 - Manabu Niseki
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2020-07-18 00:00:00.000000000 Z
+date: 2021-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.1'
+        version: '2.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.1'
+        version: '2.2'
 - !ruby/object:Gem::Dependency
   name: coveralls
   requirement: !ruby/object:Gem::Requirement
@@ -58,14 +58,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.9'
+        version: '3.10'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.9'
+        version: '3.10'
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
@@ -86,14 +86,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.8'
+        version: '3.12'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.8'
+        version: '3.12'
 description: A dead simple TheHive API wrapper.
 email:
 - manabu.niseki@gmail.com
@@ -101,9 +101,9 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/workflows/test.yml"
 - ".gitignore"
 - ".rspec"
-- ".travis.yml"
 - Gemfile
 - LICENSE.txt
 - README.md
@@ -124,6 +124,7 @@ files:
 - lib/hachi/models/case.rb
 - lib/hachi/models/user.rb
 - lib/hachi/version.rb
+- renovate.json
 - samples/01_create_an_alert.rb
 - samples/02_search_artifacts.rb
 - samples/03_list_cases.rb
@@ -147,7 +148,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.2.3
 signing_key:
 specification_version: 4
 summary: A dead simple TheHive API wrapper.

data/.travis.yml

@@ -1,8 +0,0 @@
----
-sudo: false
-language: ruby
-cache: bundler
-rvm:
-  - 2.6
-  - 2.7
-before_install: gem install bundler -v 2.1