hachi 1.0.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d03f917e4b7693f16612d130fb9808df41a4f66f962d757ec8e2dbedd6f039e1
-  data.tar.gz: 76ee4ec9ba69e732b17c7bff865fa5aaa5a251339b39b7daacc4e104000f99a3
+  metadata.gz: a88c7c477df9e4dbd8566ff3464424dbd994f9d976f9e235b6c1244200d32fd7
+  data.tar.gz: 1729ececbdb34f98abff15b7d80c189729d10d840f199876c87dc8eb22411581
 SHA512:
-  metadata.gz: 9281deed1829c4efe3ea82ed2ecafa616535cb4038867ab9ef480e28a328b39ad66c270503b5ef40d80b18c99dce849231aaa31e6c59a24ec5073dfebf9c103b
-  data.tar.gz: 637a3945b65862633bdfeeb1723f4179bd7a61ae989cc725b4427d94257dc5aa71c972100110afdadd61717294b7001957349ffb90a1978dcce70060186f82e6
+  metadata.gz: 40517bf2830268e88af14dc70ffc1af9f1e7c32d509e53883b6e125b48b7e689b81f628eb6225f2b76c517479ab19efb721ccea0b24b8bf9df11b598796aeb4d
+  data.tar.gz: e334655c99088a1038618b85a03f068fe3c459bd25f5eb179cc6a69bfb654aed185893e0d139ea270854cb87e80e6c62120c70a8f7e1a2f79e4325207b66c0be

data/.github/workflows/test.yml

@@ -4,23 +4,20 @@ on: [pull_request]
 
 jobs:
   build:
-
     runs-on: ubuntu-latest
 
     strategy:
       fail-fast: false
       matrix:
-        ruby: [2.7, '3.0']
+        ruby: [2.7, "3.0", 3.1]
 
     steps:
-    - uses: actions/checkout@v2
-    - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
-      with:
-        ruby-version: ${{ matrix.ruby }}
-        bundler-cache: true
-    - name: Build and test with Rake
-      run: |
-        gem install bundler
-        bundle install
-        bundle exec rake
+      - uses: actions/checkout@v3
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+      - name: Test with Rake
+        run: |
+          bundle exec rake

data/.gitignore

@@ -11,7 +11,7 @@
 /tmp/
 
 # Used by dotenv library to load environment variables.
-# .env
+.env
 
 ## Specific to RubyMotion:
 .dat*
@@ -51,3 +51,7 @@ Gemfile.lock
 
 # RSpec
 .rspec_status
+
+# Docker
+Dockerfile
+docker-compose.yml

data/README.md

@@ -7,7 +7,7 @@
 
 Hachi(`蜂`) is a dead simple [TheHive](https://github.com/TheHive-Project/TheHive) API wrapper for Ruby.
 
-**Note**: This library supports TheHive v4.
+**Note**: This library supports TheHive v4 & v5.
 
 ## Installation
 
@@ -17,95 +17,21 @@ gem install hachi
 
 ## Usage
 
+Hachi tries to load API settings from `ENV` by default. Or you can set them manually.
+
+| Name         | Default                     | Desc.                                           |
+|--------------|-----------------------------|-------------------------------------------------|
+| api_key      | ENV["THEHIVE_API_KEY"]      | TheHive API key                                 |
+| api_endpoint | ENV["THEHIVE_API_ENDPOINT"] | TheHive API endpoint                            |
+| api_version  | ENV["THEHIVE_API_VERSION"]  | TheHive API version (`nil` for v4, `v1` for v5) |
+
 ```ruby
 require "hachi"
 
-# when given nothing, it tries to load your API key from ENV["THEHIVE_API_KEY"] & API endpoint from ENV["THEHIVE_API_ENDPOINT"]
+# when given nothing, it tries to load your API key from ENV
 api = Hachi::API.new
 # or you can set them manually
 api = Hachi::API.new(api_endpoint: "http://your_api_endpoint", api_key: "yoru_api_key")
-
-# list alerts
-api.alert.list
-
-# search artifacts
-query = { "_and": [{ "_or": [{ "_field": "data", "_value": "1.1.1.1" }, { "_field": "data", "_value": "example.com" }] }] }
-api.artifact.search(query)
-```
-
-See `samples` for more.
-
-## Implemented methods
-
-### Alert
-
-| HTTP Method | URI                               | Action                      | API method                                                                                                                                                          |
-|-------------|-----------------------------------|-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| GET         | /api/alert                        | List alerts                 | `#api.alert.list`                                                                                                                                                   |
-| POST        | /api/alert/_search                | Find alerts                 | `#api.alert.search(query, range: "all")`                                                                                                                            |
-| PATCH       | /api/alert/_bulk                  | Update alerts in bulk       | N/A                                                                                                                                                                 |
-| POST        | /api/alert/_stats                 | Compute stats on alerts     | N/A                                                                                                                                                                 |
-| POST        | /api/alert                        | Create an alert             | `#api.alert.create(title:, description:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, type:, source:, source_ref: nil, artifacts: nil, follow: nil)` |
-| GET         | /api/alert/:alertId               | Get an alert                | `#api.alert.get_by_id(id)`                                                                                                                                          |
-| PATCH       | /api/alert/:alertId               | Update an alert             | `#api.alert.update(id, title:, description:, severity: nil, tags: nil, tlp: nil, artifacts: nil)`                                                                   |
-| DELETE      | /api/alert/:alertId               | Delete an alert             | `#api.alert.delete_by_id(id)`                                                                                                                                       |
-| POST        | /api/alert/:alertId/markAsRead    | Mark an alert as read       | `#api.alert.mark_as_read(id)`                                                                                                                                       |
-| POST        | /api/alert/:alertId/markAsUnread  | Mark an alert as unread     | `#api.alert.mark_as_unread(id)`                                                                                                                                     |
-| POST        | /api/alert/:alertId/createCase    | Create a case from an alert | `#api.alert.promote_to_case(id)`                                                                                                                                    |
-| POST        | /api/alert/:alertId/follow        | Follow an alert             | N/A                                                                                                                                                                 |
-| POST        | /api/alert/:alertId/unfollow      | Unfollow an alert           | N/A                                                                                                                                                                 |
-| POST        | /api/alert/:alertId/merge/:caseId | Merge an alert in a case    | `#api.alert.merge_into_case(*ids, case_id)`                                                                                                                         |
-
-### Artifact(Observable)
-
-| HTTP Method | URI                                    | Action                          | API method                                                                            |
-|-------------|----------------------------------------|---------------------------------|---------------------------------------------------------------------------------------|
-| POST        | /api/case/artifact/_search             | Find observables                | `#api.artifact.search(query, range: "all")`                                           |
-| POST        | /api/case/artifact/_stats              | Compute stats on observables    | N/A                                                                                   |
-| POST        | /api/case/:caseId/artifact             | Create an observable            | `#api.artifact.create(case_id, data:, data_type:, message: nil, tlp: nil, tags: nil)` |
-| GET         | /api/case/artifact/:artifactId         | Get an observable               | `#api.artifact.get_by_id(id)`                                                         |
-| DELETE      | /api/case/artifact/:artifactId         | Remove an observable            | `#api.artifact.delete_by_id(id)`                                                      |
-| PATCH       | /api/case/artifact/:artifactId         | Update an observable            | N/A                                                                                   |
-| GET         | /api/case/artifact/:artifactId/similar | Get list of similar observables | `#api.artifact.similar(id)`                                                           |
-| PATCH       | /api/case/artifact/_bulk               | Update observables in bulk      | N/A                                                                                   |
-
-### Case
-
-| HTTP Method | URI                                | Action                                | API method                                                                                                           |
-|-------------|------------------------------------|---------------------------------------|----------------------------------------------------------------------------------------------------------------------|
-| GET         | /api/case                          | List cases                            | `#api.case.list`                                                                                                     |
-| POST        | /api/case/_search                  | Find cases                            | `#api.case.search(query, range: "all")`                                                                              |
-| PATCH       | /api/case/_bulk                    | Update cases in bulk                  | N/A                                                                                                                  |
-| POST        | /api/case/_stats                   | Compute stats on cases                | N/A                                                                                                                  |
-| POST        | /api/case                          | Create a case                         | `#api.case.create(title:, description:, severity: nil, start_date: nil, owner: nil, flag: nil, tlp: nil, tags: nil)` |
-| GET         | /api/case/:caseId                  | Get a case                            | `#api.case.get_by_id(id)`                                                                                            |
-| PATCH       | /api/case/:caseId                  | Update a case                         | N/A                                                                                                                  |
-| DELETE      | /api/case/:caseId                  | Remove a case                         | `#api.case.delete_by_id(id)`                                                                                         |
-| GET         | /api/case/:caseId/links            | Get list of cases linked to this case | `#api.case.links(id)`                                                                                                |
-| POST        | /api/case/:caseId1/_merge/:caseId2 | Merge two cases                       | `#api.case.merge(id1, id2)`                                                                                          |
-
-### User
-
-| HTTP Method | URI                               | Action              | API method                                           |
-|-------------|-----------------------------------|---------------------|------------------------------------------------------|
-| GET         | /api/logout                       | Logout              | N/A                                                  |
-| POST        | /api/login                        | User login          | N/A                                                  |
-| GET         | /api/user/current                 | Get current user    | `#api.user.current`                                  |
-| POST        | /api/user/_search                 | Find user           | N/A                                                  |
-| POST        | /api/user                         | Create a user       | `#api.user.create(login:, name:, roles:, password:)` |
-| GET         | /api/user/:userId                 | Get a user          | `#api.user.get_by_id(id)`                            |
-| DELETE      | /api/user/:userId                 | Delete a case       | `#api.user.delete_by_id(id)`                         |
-| PATCH       | /api/user/:userId                 | Update user details | N/A                                                  |
-| POST        | /api/user/:userId/password/set    | Set password        | N/A                                                  |
-| POST        | /api/user/:userId/password/change | Change password     | N/A                                                  |
-
-
-## How to interact with unimplemented API endpoints
-
-`Hachi::API` exposes `get`, `post`, `delete` and `patch` methods. You can interact with the API endpoints via the methods.
-
-```ruby
-alerts = api.get("/api/alert" ) { |json| json }
 ```
 
 ## License

data/hachi.gemspec

@@ -24,10 +24,12 @@ Gem::Specification.new do |spec|
   spec.executables = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "bundler", "~> 2.2"
-  spec.add_development_dependency "coveralls", "~> 0.8"
+  spec.add_development_dependency "bundler", "~> 2.3"
+  spec.add_development_dependency "coveralls_reborn", "~> 0.24"
+  spec.add_development_dependency "dotenv", "~> 2.7"
   spec.add_development_dependency "rake", "~> 13.0"
-  spec.add_development_dependency "rspec", "~> 3.10"
-  spec.add_development_dependency "vcr", "~> 6.0"
-  spec.add_development_dependency "webmock", "~> 3.12"
+  spec.add_development_dependency "rspec", "~> 3.11"
+  spec.add_development_dependency "simplecov-lcov", "~> 0.8.0"
+  spec.add_development_dependency "vcr", "~> 6.1"
+  spec.add_development_dependency "webmock", "~> 3.14"
 end

data/lib/hachi/api.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'forwardable'
+require "forwardable"
 
 module Hachi
   class API
@@ -12,20 +12,26 @@ module Hachi
     # @return [String] TheHive API key
     attr_reader :api_key
 
+    # @return [String, nil] TheHive API version
+    attr_reader :api_version
+
     #
     # @param [String, nil] api_endpoint TheHive API endpoint
     # @param [String, nil] api_key TheHive API key
+    # @param [String, nil] api_version TheHive API version
     #
     # @raise [ArgumentError] When given or an empty endpoint or key
     #
-    def initialize(api_endpoint: ENV["THEHIVE_API_ENDPOINT"], api_key: ENV["THEHIVE_API_KEY"])
+    def initialize(api_endpoint: ENV.fetch("THEHIVE_API_ENDPOINT", nil), api_key: ENV.fetch("THEHIVE_API_KEY", nil), api_version: ENV.fetch("THEHIVE_API_VERSION", nil))
       @api_endpoint = api_endpoint
       raise ArgumentError, "api_endpoint argument is required" unless api_endpoint
 
       @api_key = api_key
       raise ArgumentError, "api_key argument is required" unless api_key
 
-      @base = Clients::Base.new(api_endpoint: api_endpoint, api_key: api_key)
+      @api_version = api_version
+
+      @base = Clients::Base.new(api_endpoint: api_endpoint, api_key: api_key, api_version: api_version)
     end
 
     def_delegators :@base, :get, :post, :delete, :push
@@ -36,7 +42,7 @@ module Hachi
     # @return [Clients::Alert]
     #
     def alert
-      @alert ||= Clients::Alert.new(api_endpoint: api_endpoint, api_key: api_key)
+      @alert ||= Clients::Alert.new(api_endpoint: api_endpoint, api_key: api_key, api_version: api_version)
     end
 
     #
@@ -45,7 +51,7 @@ module Hachi
     # @return [Clients::Artifact]
     #
     def artifact
-      @artifact ||= Clients::Artifact.new(api_endpoint: api_endpoint, api_key: api_key)
+      @artifact ||= Clients::Artifact.new(api_endpoint: api_endpoint, api_key: api_key, api_version: api_version)
     end
 
     #
@@ -54,7 +60,7 @@ module Hachi
     # @return [Clients::Case]
     #
     def case
-      @case ||= Clients::Case.new(api_endpoint: api_endpoint, api_key: api_key)
+      @case ||= Clients::Case.new(api_endpoint: api_endpoint, api_key: api_key, api_version: api_version)
     end
 
     #
@@ -63,7 +69,25 @@ module Hachi
     # @return [Clients::User]
     #
     def user
-      @user ||= Clients::User.new(api_endpoint: api_endpoint, api_key: api_key)
+      @user ||= Clients::User.new(api_endpoint: api_endpoint, api_key: api_key, api_version: api_version)
+    end
+
+    #
+    # Observable API endpoint client
+    #
+    # @return [Clients::Observable]
+    #
+    def observable
+      @observable ||= Clients::Observable.new(api_endpoint: api_endpoint, api_key: api_key, api_version: api_version)
+    end
+
+    #
+    # Query API endpoint client
+    #
+    # @return [Clients::Query]
+    #
+    def query
+      @query ||= Clients::Query.new(api_endpoint: api_endpoint, api_key: api_key, api_version: api_version)
     end
   end
 end

data/lib/hachi/awrence/methods.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+# forked from https://github.com/technicalpanda/awrence
+module Hachi
+  module Awrence
+    module Methods
+      # Recursively converts Rubyish snake_case hash keys to camelBack JSON-style
+      # hash keys suitable for use with a JSON API.
+      #
+      def to_camelback_keys(value = self)
+        process_value(:to_camelback_keys, value, first_upper: false)
+      end
+
+      # Recursively converts Rubyish snake_case hash keys to CamelCase JSON-style
+      # hash keys suitable for use with a JSON API.
+      #
+      def to_camel_keys(value = self)
+        process_value(:to_camel_keys, value, first_upper: true)
+      end
+
+      private
+
+      def camelize_key(key, first_upper: true)
+        case key
+        when Symbol
+          camelize(key.to_s, first_upper: first_upper).to_sym
+        when String
+          camelize(key, first_upper: first_upper)
+        else
+          key # Awrence can't camelize anything except strings and symbols
+        end
+      end
+
+      def camelize(snake_word, first_upper: true)
+        return snake_word if snake_word.start_with? "_"
+
+        if first_upper
+          str = snake_word.to_s
+          str = gsubbed(str, /(?:^|_)([^_\s]+)/)
+          gsubbed(str, %r{/([^/]*)}, "::")
+        else
+          parts = snake_word.split("_", 2)
+          parts[0] << camelize(parts[1]) if parts.size > 1
+          parts[0] || ""
+        end
+      end
+
+      def gsubbed(str, pattern, extra = "")
+        str.gsub(pattern) do
+          extra + (Hachi::Awrence.acronyms[Regexp.last_match(1)] || Regexp.last_match(1).capitalize)
+        end
+      end
+
+      def process_value(method, value, first_upper: true)
+        case value
+        when Array
+          value.map { |v| send(method, v) }
+        when Hash
+          value.to_h { |k, v| [camelize_key(k, first_upper: first_upper), send(method, v)] }
+        else
+          value
+        end
+      end
+    end
+  end
+end

data/lib/hachi/clients/alert.rb

@@ -6,15 +6,6 @@ require "securerandom"
 module Hachi
   module Clients
     class Alert < Base
-      #
-      # List alerts
-      #
-      # @return [Array]
-      #
-      def list
-        get("/api/alert") { |json| json }
-      end
-
       #
       # Get an alert
       #
@@ -23,7 +14,7 @@ module Hachi
       # @return [Hash]
       #
       def get_by_id(id)
-        get("/api/alert/#{id}") { |json| json }
+        get("/alert/#{id}") { |json| json }
       end
 
       #
@@ -34,130 +25,29 @@ module Hachi
       # @return [String]
       #
       def delete_by_id(id)
-        delete("/api/alert/#{id}") { |json| json }
+        delete("/alert/#{id}") { |json| json }
       end
 
       #
       # Create an alert
       #
-      # @param [String] title
-      # @param [String] description
-      # @param [String, nil] severity
-      # @param [String, nil] date
-      # @param [String, nil] tags
-      # @param [String, nil] tlp
-      # @param [String, nil] status
-      # @param [String, nil] type
-      # @param [String, nil] source
-      # @param [String, nil] source_ref
-      # @param [String, nil] artifacts
-      # @param [String, nil] follow
-      #
-      # @return [Hash]
-      #
-      def create(title:, description:, type:, source:, severity: nil, date: nil, tags: nil, tlp: nil, status: nil, source_ref: nil, artifacts: nil, follow: nil)
-        alert = Models::Alert.new(
-          title: title,
-          description: description,
-          severity: severity,
-          date: date,
-          tags: tags,
-          tlp: tlp,
-          status: status,
-          type: type,
-          source: source,
-          source_ref: source_ref,
-          artifacts: artifacts,
-          follow: follow,
-        )
-        post("/api/alert", json: alert.payload) { |json| json }
-      end
-
-      #
-      # Find alerts
-      #
-      # @param [Hash] query
-      # @param [String] range
-      # @param [String, nil] sort
-      #
-      # @return [Array]
-      #
-      def search(query, range: "all", sort: nil)
-        _search("/api/alert/_search", query: query, range: range, sort: sort) { |json| json }
-      end
-
-      #
-      # Mark an alert as read
-      #
-      # @param [String] id Alert ID
-      #
-      # @return [Hash]
-      #
-      def mark_as_read(id)
-        post("/api/alert/#{id}/markAsRead") { |json| json }
-      end
-
-      #
-      # Mark an alert as unread
-      #
-      # @param [String] id Alert ID
-      #
-      # @return [Hash] hash
-      #
-      def mark_as_unread(id)
-        post("/api/alert/#{id}/markAsUnread") { |json| json }
-      end
-
-      #
-      # Create a case from an alert
-      #
-      # @param [String] id Alert ID
-      #
-      # @return [Hash]
-      #
-      def promote_to_case(id)
-        post("/api/alert/#{id}/createCase") { |json| json }
-      end
-
-      #
-      # Merge an alert / alerts in a case
-      #
-      # @param [String, Array] *ids Alert ID(s)
-      # @param [String] case_id Case ID
+      # @param [Hash] payload
       #
       # @return [Hash]
       #
-      def merge_into_case(*ids, case_id)
-        params = {
-          alertIds: ids.flatten,
-          caseId: case_id
-        }
-        post("/api/alert/merge/_bulk", json: params) { |json| json }
+      def create(**payload)
+        post("/alert", json: payload) { |json| json }
       end
 
-      #
       # Update an alert
       #
-      # @param [String, nil] id
-      # @param [String, nil] title
-      # @param [String, nil] description
-      # @param [String, nil] severity
-      # @param [String, nil] tags
-      # @param [String, nil] tlp
-      # @param [String, nil] artifacts
+      # @param [String] id
+      # @param [Hash] payload
       #
       # @return [Hash]
       #
-      def update(id, title: nil, description: nil, severity: nil, tags: nil, tlp: nil, artifacts: nil)
-        attributes = {
-          title: title,
-          description: description,
-          severity: severity,
-          tags: tags,
-          tlp: tlp,
-          artifacts: artifacts,
-        }.compact
-        patch("/api/alert/#{id}", json: attributes) { |json| json }
+      def update(id, **payload)
+        patch("/alert/#{id}", json: payload) { |json| json }
       end
     end
   end

data/lib/hachi/clients/artifact.rb

@@ -7,24 +7,12 @@ module Hachi
       # Create an artifact
       #
       # @param [String] case_id Artifact ID
-      # @param [String] data
-      # @param [String] data_type
-      # @param [String, nil] message
-      # @param [Integer, nil] tlp
-      # @param [Array<String>, nil] tags
+      # @param [Hash] payload
       #
       # @return [Hash]
       #
-      def create(case_id, data:, data_type:, message: nil, tlp: nil, tags: nil)
-        artifact = Models::Artifact.new(
-          data: data,
-          data_type: data_type,
-          message: message,
-          tlp: tlp,
-          tags: tags,
-        )
-
-        post("/api/case/#{case_id}/artifact", json: artifact.payload) { |json| json }
+      def create(case_id, **payload)
+        post("/api/case/#{case_id}/artifact", json: payload) { |json| json }
       end
 
       #
@@ -48,29 +36,6 @@ module Hachi
       def delete_by_id(id)
         delete("/api/case/artifact/#{id}") { |json| json }
       end
-
-      #
-      # Find artifacts
-      #
-      # @param [Hash] query
-      # @param [String] range
-      #
-      # @return [Array]
-      #
-      def search(query, range: "all")
-        _search("/api/case/artifact/_search", query: query, range: range) { |json| json }
-      end
-
-      #
-      # Get list of similar observables
-      #
-      # @param [String] id Artifact ID
-      #
-      # @return [Array]
-      #
-      def similar(id)
-        get("/api/case/artifact/#{id}/similar") { |json| json }
-      end
     end
   end
 end