hachi 1.0.0 → 2.0.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.github/workflows/test.yml +10 -13
- data/.gitignore +5 -1
- data/README.md +10 -84
- data/hachi.gemspec +7 -5
- data/lib/hachi/api.rb +31 -7
- data/lib/hachi/awrence/methods.rb +66 -0
- data/lib/hachi/clients/alert.rb +9 -119
- data/lib/hachi/clients/artifact.rb +3 -38
- data/lib/hachi/clients/base.rb +28 -26
- data/lib/hachi/clients/case.rb +9 -102
- data/lib/hachi/clients/observable.rb +53 -0
- data/lib/hachi/clients/query.rb +18 -0
- data/lib/hachi/clients/user.rb +6 -16
- data/lib/hachi/version.rb +1 -1
- data/lib/hachi.rb +15 -6
- metadata +45 -23
- data/lib/hachi/models/alert.rb +0 -63
- data/lib/hachi/models/artifact.rb +0 -40
- data/lib/hachi/models/base.rb +0 -31
- data/lib/hachi/models/case.rb +0 -54
- data/lib/hachi/models/user.rb +0 -36
- data/samples/01_create_an_alert.rb +0 -17
- data/samples/02_search_artifacts.rb +0 -16
- data/samples/03_list_cases.rb +0 -16
- data/samples/04_merge_alerts.rb +0 -17
data/lib/hachi/models/base.rb
DELETED
@@ -1,31 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
module Hachi
|
4
|
-
module Models
|
5
|
-
class Base
|
6
|
-
private
|
7
|
-
|
8
|
-
def validate_severity
|
9
|
-
return true if severity >= 1 && severity <= 3
|
10
|
-
|
11
|
-
raise ArgumentError, "severity should be 1 - 3 (1: low; 2: medium; 3: high)"
|
12
|
-
end
|
13
|
-
|
14
|
-
def validate_tlp
|
15
|
-
return true if tlp >= 0 && tlp <= 3
|
16
|
-
|
17
|
-
raise ArgumentError, "tlp should be 0 - 3 (0: white; 1: green; 2: amber; 3: red)"
|
18
|
-
end
|
19
|
-
|
20
|
-
def validate_status
|
21
|
-
return true if %w(New Updated Ignored Imported).include?(status)
|
22
|
-
|
23
|
-
raise ArgumentError, "status should be New, Updated, Ignored or Imported"
|
24
|
-
end
|
25
|
-
|
26
|
-
def validate_tags
|
27
|
-
raise ArgumentError, "tags should be an array" unless tags.is_a?(Array)
|
28
|
-
end
|
29
|
-
end
|
30
|
-
end
|
31
|
-
end
|
data/lib/hachi/models/case.rb
DELETED
@@ -1,54 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
module Hachi
|
4
|
-
module Models
|
5
|
-
class Case < Base
|
6
|
-
attr_reader :title, :description, :severity, :start_date, :owner, :flag, :tlp, :tags
|
7
|
-
|
8
|
-
def initialize(title:, description:, severity: nil, start_date: nil, owner: nil, flag: nil, tlp: nil, tags: nil)
|
9
|
-
@title = title
|
10
|
-
@description = description
|
11
|
-
@severity = severity
|
12
|
-
@start_date = start_date
|
13
|
-
@owner = owner
|
14
|
-
@flag = flag
|
15
|
-
@tlp = tlp
|
16
|
-
@tags = tags
|
17
|
-
|
18
|
-
validate_flag if flag
|
19
|
-
validate_severity if severity
|
20
|
-
validate_start_date if start_date
|
21
|
-
validate_tags if tags
|
22
|
-
validate_tlp if tlp
|
23
|
-
end
|
24
|
-
|
25
|
-
def payload
|
26
|
-
{
|
27
|
-
title: title,
|
28
|
-
description: description,
|
29
|
-
severity: severity,
|
30
|
-
startDate: start_date,
|
31
|
-
owner: owner,
|
32
|
-
flag: flag,
|
33
|
-
tlp: tlp,
|
34
|
-
tags: tags
|
35
|
-
}.compact
|
36
|
-
end
|
37
|
-
|
38
|
-
private
|
39
|
-
|
40
|
-
def validate_start_date
|
41
|
-
DateTime.parse(start_date)
|
42
|
-
true
|
43
|
-
rescue ArgumentError => _e
|
44
|
-
raise ArgumentError, "date should be Date format"
|
45
|
-
end
|
46
|
-
|
47
|
-
def validate_flag
|
48
|
-
return true if [true, false].include?(flag)
|
49
|
-
|
50
|
-
raise ArgumentError, "flag should be true or false"
|
51
|
-
end
|
52
|
-
end
|
53
|
-
end
|
54
|
-
end
|
data/lib/hachi/models/user.rb
DELETED
@@ -1,36 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
module Hachi
|
4
|
-
module Models
|
5
|
-
class User < Base
|
6
|
-
attr_reader :login, :name, :roles, :password
|
7
|
-
|
8
|
-
ROLES = %w(read write admin).freeze
|
9
|
-
|
10
|
-
def initialize(login:, name:, roles:, password:)
|
11
|
-
@login = login
|
12
|
-
@name = name
|
13
|
-
@roles = roles
|
14
|
-
@password = password
|
15
|
-
|
16
|
-
validate_roles
|
17
|
-
end
|
18
|
-
|
19
|
-
def payload
|
20
|
-
{
|
21
|
-
login: login,
|
22
|
-
name: name,
|
23
|
-
roles: roles,
|
24
|
-
password: password
|
25
|
-
}.compact
|
26
|
-
end
|
27
|
-
|
28
|
-
private
|
29
|
-
|
30
|
-
def validate_roles
|
31
|
-
raise ArgumentError, "roles should be an array" unless roles.is_a?(Array)
|
32
|
-
raise ArgumentError, "role should be one of #{ROLES.join('.')}" unless roles.all? { |role| ROLES.include? role }
|
33
|
-
end
|
34
|
-
end
|
35
|
-
end
|
36
|
-
end
|
@@ -1,17 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
$LOAD_PATH.unshift("#{__dir__}/../lib")
|
4
|
-
|
5
|
-
require "hachi"
|
6
|
-
|
7
|
-
api = Hachi::API.new
|
8
|
-
|
9
|
-
# create a simple alert
|
10
|
-
api.alert.create(title: "test", description: "test", type: "test", source: "test")
|
11
|
-
|
12
|
-
# create an alert with artifacts
|
13
|
-
artifacts = [
|
14
|
-
{ data: "1.1.1.1", data_type: "ip", message: "test" },
|
15
|
-
{ data: "github.com", data_type: "domain", tags: ["test"] }
|
16
|
-
]
|
17
|
-
api.alert.create(title: "test", description: "test", type: "test", source: "test", artifacts: artifacts)
|
@@ -1,16 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
$LOAD_PATH.unshift("#{__dir__}/../lib")
|
4
|
-
|
5
|
-
require "hachi"
|
6
|
-
|
7
|
-
api = Hachi::API.new
|
8
|
-
|
9
|
-
# search artifacts
|
10
|
-
results = api.artifact.search(data: "1.1.1.1", data_type: "ip")
|
11
|
-
ids = results.map { |result| result.dig("id") }
|
12
|
-
|
13
|
-
ids.each do |id|
|
14
|
-
artifact = api.artifact.get_by_id(id)
|
15
|
-
p artifact
|
16
|
-
end
|
data/samples/03_list_cases.rb
DELETED
@@ -1,16 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
$LOAD_PATH.unshift("#{__dir__}/../lib")
|
4
|
-
|
5
|
-
require "hachi"
|
6
|
-
|
7
|
-
api = Hachi::API.new
|
8
|
-
|
9
|
-
# list up cases
|
10
|
-
results = api.case.list
|
11
|
-
ids = results.map { |result| result.dig("id") }
|
12
|
-
|
13
|
-
ids.each do |id|
|
14
|
-
kase = api.case.get_by_id(id)
|
15
|
-
p kase
|
16
|
-
end
|
data/samples/04_merge_alerts.rb
DELETED
@@ -1,17 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
$LOAD_PATH.unshift("#{__dir__}/../lib")
|
4
|
-
|
5
|
-
require "hachi"
|
6
|
-
|
7
|
-
def api
|
8
|
-
@api ||= Hachi::API.new
|
9
|
-
end
|
10
|
-
|
11
|
-
description = ARGV[0].to_s
|
12
|
-
case_id = ARGV[1].to_s
|
13
|
-
|
14
|
-
alerts = api.alert.search(description: description)
|
15
|
-
alert_ids = alerts.map { |alert| alert.dig "id" }
|
16
|
-
|
17
|
-
api.alert.merge_into_case(alert_ids, case_id)
|