mihari 0.17.5 → 1.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (55) hide show
  1. checksums.yaml +4 -4
  2. data/.gitignore +3 -0
  3. data/.rubocop.yml +155 -0
  4. data/.travis.yml +7 -1
  5. data/Gemfile +2 -0
  6. data/README.md +45 -73
  7. data/config/pre_commit.yml +3 -0
  8. data/docker/Dockerfile +1 -1
  9. data/lib/mihari.rb +13 -8
  10. data/lib/mihari/alert_viewer.rb +16 -34
  11. data/lib/mihari/analyzers/base.rb +7 -19
  12. data/lib/mihari/analyzers/basic.rb +3 -1
  13. data/lib/mihari/analyzers/binaryedge.rb +2 -2
  14. data/lib/mihari/analyzers/censys.rb +2 -2
  15. data/lib/mihari/analyzers/circl.rb +2 -2
  16. data/lib/mihari/analyzers/onyphe.rb +3 -3
  17. data/lib/mihari/analyzers/otx.rb +74 -0
  18. data/lib/mihari/analyzers/passive_dns.rb +2 -1
  19. data/lib/mihari/analyzers/passivetotal.rb +2 -2
  20. data/lib/mihari/analyzers/pulsedive.rb +2 -2
  21. data/lib/mihari/analyzers/securitytrails.rb +2 -2
  22. data/lib/mihari/analyzers/securitytrails_domain_feed.rb +2 -2
  23. data/lib/mihari/analyzers/shodan.rb +2 -2
  24. data/lib/mihari/analyzers/virustotal.rb +2 -2
  25. data/lib/mihari/analyzers/zoomeye.rb +2 -2
  26. data/lib/mihari/cli.rb +23 -4
  27. data/lib/mihari/config.rb +70 -2
  28. data/lib/mihari/configurable.rb +1 -1
  29. data/lib/mihari/database.rb +68 -0
  30. data/lib/mihari/emitters/base.rb +1 -1
  31. data/lib/mihari/emitters/database.rb +29 -0
  32. data/lib/mihari/emitters/misp.rb +8 -1
  33. data/lib/mihari/emitters/slack.rb +4 -2
  34. data/lib/mihari/emitters/stdout.rb +2 -1
  35. data/lib/mihari/emitters/the_hive.rb +28 -14
  36. data/lib/mihari/models/alert.rb +11 -0
  37. data/lib/mihari/models/artifact.rb +27 -0
  38. data/lib/mihari/models/tag.rb +10 -0
  39. data/lib/mihari/models/tagging.rb +10 -0
  40. data/lib/mihari/notifiers/slack.rb +7 -4
  41. data/lib/mihari/serializers/alert.rb +12 -0
  42. data/lib/mihari/serializers/artifact.rb +9 -0
  43. data/lib/mihari/serializers/tag.rb +9 -0
  44. data/lib/mihari/slack_monkeypatch.rb +16 -0
  45. data/lib/mihari/status.rb +1 -1
  46. data/lib/mihari/type_checker.rb +1 -1
  47. data/lib/mihari/version.rb +1 -1
  48. data/mihari.gemspec +13 -5
  49. metadata +149 -30
  50. data/lib/mihari/artifact.rb +0 -36
  51. data/lib/mihari/cache.rb +0 -35
  52. data/lib/mihari/the_hive.rb +0 -42
  53. data/lib/mihari/the_hive/alert.rb +0 -25
  54. data/lib/mihari/the_hive/artifact.rb +0 -33
  55. data/lib/mihari/the_hive/base.rb +0 -14
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 004a0d8f2ddeda5059f6748657b786b9470a290eb4d593ff0bb0632ebb495d3d
4
- data.tar.gz: c4f51acdb2dc76e52a445e382ce3c15b215b29f9abd860ca1c05fe814b24bf96
3
+ metadata.gz: 901c334bf0485bbb82a422a1900347e77e476143afaef3036c177ceadbb7e6c6
4
+ data.tar.gz: 3fd3663d4d05518b46f9d1a53d9d742b150a84ffba93aaf4d9ebdcbd93505342
5
5
  SHA512:
6
- metadata.gz: f3d1b8959e726240a7257f999347ff2fc81b9bf359948dfc9f09a9edad66d76225f8a4e16b105d1bda2ee5675100e13705fdb448dc6986493234280f849c4637
7
- data.tar.gz: 1b6dd5276812e5ba6f6c7997cb921acd261dbcced5af3599253b3995ced1450a8a998e8bdd88155ebe44ce3e724fb71da6e59fb72c2c6ed12222f1e1efd07dcc
6
+ metadata.gz: b97df59e99c969940ffe54a1ecf1e655f582ed4f2372c4e08feb3572fd7f38e767303911a4ec36151325da78415738a0f952f35dfbd010bd9dc6a1832635c78a
7
+ data.tar.gz: b092fdfa627a2ab2d2e4a71c4e070e1788fa496b3be6f64e038b332632adbdd4d70c2cae239e14814a31f03def374eb215f3cc580695af38d9562e1b2e1da4e1
data/.gitignore CHANGED
@@ -54,3 +54,6 @@ Gemfile.lock
54
54
 
55
55
  # solargraph
56
56
  .solargraph.yml
57
+
58
+ # SQLite
59
+ *.db
data/.rubocop.yml ADDED
@@ -0,0 +1,155 @@
1
+ # Relaxed.Ruby.Style
2
+ ## Version 2.5
3
+
4
+ require:
5
+ - rubocop-performance
6
+
7
+ Style/Alias:
8
+ Enabled: false
9
+ StyleGuide: https://relaxed.ruby.style/#stylealias
10
+
11
+ Style/AsciiComments:
12
+ Enabled: false
13
+ StyleGuide: https://relaxed.ruby.style/#styleasciicomments
14
+
15
+ Style/BeginBlock:
16
+ Enabled: false
17
+ StyleGuide: https://relaxed.ruby.style/#stylebeginblock
18
+
19
+ Style/BlockDelimiters:
20
+ Enabled: false
21
+ StyleGuide: https://relaxed.ruby.style/#styleblockdelimiters
22
+
23
+ Style/CommentAnnotation:
24
+ Enabled: false
25
+ StyleGuide: https://relaxed.ruby.style/#stylecommentannotation
26
+
27
+ Style/Documentation:
28
+ Enabled: false
29
+ StyleGuide: https://relaxed.ruby.style/#styledocumentation
30
+
31
+ Layout/DotPosition:
32
+ Enabled: false
33
+ StyleGuide: https://relaxed.ruby.style/#layoutdotposition
34
+
35
+ Style/DoubleNegation:
36
+ Enabled: false
37
+ StyleGuide: https://relaxed.ruby.style/#styledoublenegation
38
+
39
+ Style/EndBlock:
40
+ Enabled: false
41
+ StyleGuide: https://relaxed.ruby.style/#styleendblock
42
+
43
+ Style/FormatString:
44
+ Enabled: false
45
+ StyleGuide: https://relaxed.ruby.style/#styleformatstring
46
+
47
+ Style/IfUnlessModifier:
48
+ Enabled: false
49
+ StyleGuide: https://relaxed.ruby.style/#styleifunlessmodifier
50
+
51
+ Style/Lambda:
52
+ Enabled: false
53
+ StyleGuide: https://relaxed.ruby.style/#stylelambda
54
+
55
+ Style/ModuleFunction:
56
+ Enabled: false
57
+ StyleGuide: https://relaxed.ruby.style/#stylemodulefunction
58
+
59
+ Style/MultilineBlockChain:
60
+ Enabled: false
61
+ StyleGuide: https://relaxed.ruby.style/#stylemultilineblockchain
62
+
63
+ Style/NegatedIf:
64
+ Enabled: false
65
+ StyleGuide: https://relaxed.ruby.style/#stylenegatedif
66
+
67
+ Style/NegatedWhile:
68
+ Enabled: false
69
+ StyleGuide: https://relaxed.ruby.style/#stylenegatedwhile
70
+
71
+ Style/NumericPredicate:
72
+ Enabled: false
73
+ StyleGuide: https://relaxed.ruby.style/#stylenumericpredicate
74
+
75
+ Style/ParallelAssignment:
76
+ Enabled: false
77
+ StyleGuide: https://relaxed.ruby.style/#styleparallelassignment
78
+
79
+ Style/PercentLiteralDelimiters:
80
+ Enabled: false
81
+ StyleGuide: https://relaxed.ruby.style/#stylepercentliteraldelimiters
82
+
83
+ Style/PerlBackrefs:
84
+ Enabled: false
85
+ StyleGuide: https://relaxed.ruby.style/#styleperlbackrefs
86
+
87
+ Style/Semicolon:
88
+ Enabled: false
89
+ StyleGuide: https://relaxed.ruby.style/#stylesemicolon
90
+
91
+ Style/SignalException:
92
+ Enabled: false
93
+ StyleGuide: https://relaxed.ruby.style/#stylesignalexception
94
+
95
+ Style/SingleLineBlockParams:
96
+ Enabled: false
97
+ StyleGuide: https://relaxed.ruby.style/#stylesinglelineblockparams
98
+
99
+ Style/SingleLineMethods:
100
+ Enabled: false
101
+ StyleGuide: https://relaxed.ruby.style/#stylesinglelinemethods
102
+
103
+ Layout/SpaceBeforeBlockBraces:
104
+ Enabled: false
105
+ StyleGuide: https://relaxed.ruby.style/#layoutspacebeforeblockbraces
106
+
107
+ Layout/SpaceInsideParens:
108
+ Enabled: false
109
+ StyleGuide: https://relaxed.ruby.style/#layoutspaceinsideparens
110
+
111
+ Style/SpecialGlobalVars:
112
+ Enabled: false
113
+ StyleGuide: https://relaxed.ruby.style/#stylespecialglobalvars
114
+
115
+ Style/StringLiterals:
116
+ Enabled: false
117
+ StyleGuide: https://relaxed.ruby.style/#stylestringliterals
118
+
119
+ Style/TrailingCommaInArguments:
120
+ Enabled: false
121
+ StyleGuide: https://relaxed.ruby.style/#styletrailingcommainarguments
122
+
123
+ Style/TrailingCommaInArrayLiteral:
124
+ Enabled: false
125
+ StyleGuide: https://relaxed.ruby.style/#styletrailingcommainarrayliteral
126
+
127
+ Style/TrailingCommaInHashLiteral:
128
+ Enabled: false
129
+ StyleGuide: https://relaxed.ruby.style/#styletrailingcommainhashliteral
130
+
131
+ Style/SymbolArray:
132
+ Enabled: false
133
+ StyleGuide: http://relaxed.ruby.style/#stylesymbolarray
134
+
135
+ Style/WhileUntilModifier:
136
+ Enabled: false
137
+ StyleGuide: https://relaxed.ruby.style/#stylewhileuntilmodifier
138
+
139
+ Style/WordArray:
140
+ Enabled: false
141
+ StyleGuide: https://relaxed.ruby.style/#stylewordarray
142
+
143
+ Lint/AmbiguousRegexpLiteral:
144
+ Enabled: false
145
+ StyleGuide: https://relaxed.ruby.style/#lintambiguousregexpliteral
146
+
147
+ Lint/AssignmentInCondition:
148
+ Enabled: false
149
+ StyleGuide: https://relaxed.ruby.style/#lintassignmentincondition
150
+
151
+ Layout/LineLength:
152
+ Enabled: false
153
+
154
+ Metrics:
155
+ Enabled: false
data/.travis.yml CHANGED
@@ -1,7 +1,13 @@
1
1
  ---
2
- sudo: false
3
2
  language: ruby
4
3
  cache: bundler
4
+ services:
5
+ - postgresql
5
6
  rvm:
6
7
  - 2.6
8
+ - 2.7
9
+ env:
10
+ - DATABASE=":memory:"
11
+ - DATABASE="postgresql://postgres@0.0.0.0:5432/travis_ci_test"
7
12
  before_install: gem install bundler -v 2.1
13
+ before_script: psql -c 'create database travis_ci_test;' -U postgres
data/Gemfile CHANGED
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  source "https://rubygems.org"
2
4
 
3
5
  # Specify your gem's dependencies in mihari.gemspec
data/README.md CHANGED
@@ -10,19 +10,15 @@ Mihari is a helper to run queries & manage results continuously. Mihari can be u
10
10
 
11
11
  ## How it works
12
12
 
13
- - Mihari makes a query against Shodan, Censys, VirusTotal, SecurityTrails, etc. and extracts artifacts from the results.
14
- - Mihari checks whether [TheHive](https://thehive-project.org/) contains the artifacts or not.
13
+ - Mihari makes a query against Shodan, Censys, VirusTotal, SecurityTrails, etc. and extracts artifacts (IP addresses, domains, URLs and hashes) from the results.
14
+ - Mihari checks whether a DB (SQLite3 or PostgreSQL) contains the artifacts or not.
15
15
  - If it doesn't contain the artifacts:
16
- - Mihari creates an alert on TheHive.
16
+ - Mihari creates an alert on TheHive. (Optional)
17
17
  - Mihari sends a notification to Slack. (Optional)
18
18
  - Mihari creates an event on MISP. (Optional)
19
19
 
20
20
  ![img](https://github.com/ninoseki/mihari/raw/master/screenshots/eyecatch.png)
21
21
 
22
- Check this blog post for more details: [Continuous C2 hunting with Censys, Shodan, Onyphe and TheHive](https://hackmd.io/s/SkUaSrqoE).
23
-
24
- You can use mihari without TheHive but note that mihari depends on TheHive to manage artifacts. It means mihari might make duplications when without TheHive.
25
-
26
22
  ### Screenshots
27
23
 
28
24
  - TheHive alert example
@@ -37,6 +33,17 @@ You can use mihari without TheHive but note that mihari depends on TheHive to ma
37
33
 
38
34
  ![img](https://github.com/ninoseki/mihari/raw/master/screenshots/misp.png)
39
35
 
36
+ ## Requirements
37
+
38
+ - Ruby 2.6+
39
+ - SQLite3
40
+ - libpq
41
+
42
+ ```bash
43
+ # For Debian / Ubuntu
44
+ apt-get install sqlite3 libsqlite3-dev libpq-dev
45
+ ```
46
+
40
47
  ## Installation
41
48
 
42
49
  ```bash
@@ -60,6 +67,7 @@ Mihari supports the following services by default.
60
67
  - [DN Pedia](https://dnpedia.com/)
61
68
  - [dnstwister](https://dnstwister.report/)
62
69
  - [Onyphe](https://onyphe.io)
70
+ - [OTX](https://otx.alienvault.com/)
63
71
  - [PassiveTotal](https://community.riskiq.com/)
64
72
  - [SecurityTrails](https://securitytrails.com/)
65
73
  - [Shodan](https://shodan.io)
@@ -82,6 +90,7 @@ Commands:
82
90
  mihari http_hash # Cross search with search engines by a hash of an HTTP response (SHA256, MD5 and MurmurHash3)
83
91
  mihari import_from_json # Give a JSON input via STDIN
84
92
  mihari onyphe [QUERY] # Onyphe datascan search by a query
93
+ mihari otx [IP|DOMAIN] # OTX lookup by an IP or domain
85
94
  mihari passive_dns [IP|DOMAIN] # Cross search with passive DNS services by an ip or domain
86
95
  mihari passive_ssl [SHA1] # Cross search with passive SSL services by an SHA1 certificate fingerprint
87
96
  mihari passivetotal [IP|DOMAIN|EMAIL|SHA1] # PassiveTotal lookup by an ip, domain, email or SHA1 certificate fingerprint
@@ -109,7 +118,7 @@ You can get aggregated results by using the following commands.
109
118
 
110
119
  | Command | Desc. |
111
120
  |-----------------|---------------------------------------------------------------------------------------------------------|
112
- | passive_dns | Passive DNS lookup with CIRCL passive DNS, PassiveTotal, Pulsedive, SecurityTrails and VirusTotal |
121
+ | passive_dns | Passive DNS lookup with CIRCL passive DNS, OTX, PassiveTotal, Pulsedive, SecurityTrails and VirusTotal |
113
122
  | passive_ssl | Passive SSL lookup with CIRCL passive SSL and PassiveTotal |
114
123
  | reverse_whois | Revese Whois lookup with PassiveTotal and SecurityTrails |
115
124
  | http_hash | HTTP response hash lookup with BinaryEdge(SHA256), Censys(SHA256), Onyphpe(MD5) and Shodan(MurmurHash3) |
@@ -156,49 +165,13 @@ mihari http_hash --html /tmp/index.html
156
165
 
157
166
  ```bash
158
167
  # Censys lookup for PANDA C2
159
- $ mihari censys '("PANDA" AND "SMAdmin" AND "layui")' --title "PANDA C2"
160
- {
161
- "title": "PANDA C2",
162
- "description": "query = (\"PANDA\" AND \"SMAdmin\" AND \"layui\")",
163
- "artifacts": [
164
- "154.223.165.223",
165
- "154.194.2.31",
166
- "45.114.127.119",
167
- "..."
168
- ],
169
- "tags": []
170
- }
168
+ mihari censys '("PANDA" AND "SMAdmin" AND "layui")' --title "PANDA C2"
171
169
 
172
170
  # VirusTotal passive DNS lookup of a FAKESPY host
173
- $ mihari virustotal "jppost-hi.top" --title "FAKESPY host passive DNS results"
174
- {
175
- "title": "FAKESPY host passive DNS results",
176
- "description": "indicator = jppost-hi.top",
177
- "artifacts": [
178
- "185.22.152.28",
179
- "192.236.200.44",
180
- "193.148.69.12",
181
- "..."
182
- ],
183
- "tags": []
184
- }
171
+ mihari virustotal "jppost-hi.top" --title "FAKESPY passive DNS"
185
172
 
186
173
  # You can pass a "defanged" indicator as an input
187
- $ mihari virustotal "jppost-hi[.]top" --title "FAKESPY host passive DNS results"
188
-
189
- # SecurityTrails domain feed lookup for finding (possibly) Apple phishing websites
190
- $ mihari securitytrails_domain_feed "apple-" --type new
191
- {
192
- "title": "SecurityTrails domain feed lookup",
193
- "description": "Regexp = /apple-/",
194
- "artifacts": [
195
- "apple-sign.online",
196
- "apple-log-in.com",
197
- "apple-locator-id.info",
198
- "..."
199
- ],
200
- "tags": []
201
- }
174
+ mihari virustotal "jppost-hi[.]top" --title "FAKESPY passive DNS"
202
175
  ```
203
176
 
204
177
  ### Import from JSON
@@ -229,28 +202,30 @@ The input is a JSON data should have `title`, `description` and `artifacts` key.
229
202
 
230
203
  Configuration can be done via environment variables or a YAML file.
231
204
 
232
- | Key | Desc. | Recommended or optional |
233
- |------------------------|--------------------------------|--------------------------------|
234
- | THEHIVE_API_ENDPOINT | TheHive URL | Recommended |
235
- | THEHIVE_API_KEY | TheHive API key | Recommended |
236
- | MISP_API_ENDPOINT | MISP URL | Optional |
237
- | MISP_API_KEY | MISP API key | Optional |
238
- | SLACK_WEBHOOK_URL | Slack Webhook URL | Optional |
239
- | SLACK_CHANNEL | Slack channel name | Optional (default: `#general`) |
240
- | BINARYEDGE_API_KEY | BinaryEdge API key | Optional |
241
- | CENSYS_ID | Censys API ID | Optional |
242
- | CENSYS_SECRET | Censys secret | Optional |
243
- | CIRCL_PASSIVE_PASSWORD | CIRCL passive DNS/SSL password | Optional |
244
- | CIRCL_PASSIVE_USERNAME | CIRCL passive DNS/SSL username | Optional |
245
- | ONYPHE_API_KEY | Onyphe API key | Optional |
246
- | PASSIVETOTAL_API_KEY | PassiveTotal API key | Optional |
247
- | PASSIVETOTAL_USERNAME | PassiveTotal username | Optional |
248
- | PULSEDIVE_API_KEY | Pulsedive API key | Optional |
249
- | SECURITYTRAILS_API_KEY | SecurityTrails API key | Optional |
250
- | SHODAN_API_KEY | Shodan API key | Optional |
251
- | VIRUSTOTAL_API_KEY | VirusTotal API key | Optional |
252
- | ZOOMEYE_USERNAMME | ZoomEye username | Optional |
253
- | ZOOMEYE_PASSWORD | ZoomEye password | Optional |
205
+ | Key | Description | Default |
206
+ |------------------------|-------------------------------------------------------------------------------------------------|-------------|
207
+ | DATABASE | A path to the SQLite database or a DB URL (e.g. `postgres://postgres:pass@db.host:5432/somedb`) | `mihari.db` |
208
+ | BINARYEDGE_API_KEY | BinaryEdge API key | |
209
+ | CENSYS_ID | Censys API ID | |
210
+ | CENSYS_SECRET | Censys secret | |
211
+ | CIRCL_PASSIVE_PASSWORD | CIRCL passive DNS/SSL password | |
212
+ | CIRCL_PASSIVE_USERNAME | CIRCL passive DNS/SSL username | |
213
+ | MISP_API_ENDPOINT | MISP URL | |
214
+ | MISP_API_KEY | MISP API key | |
215
+ | ONYPHE_API_KEY | Onyphe API key | |
216
+ | OTX_API_KEY | OTX API key | |
217
+ | PASSIVETOTAL_API_KEY | PassiveTotal API key | |
218
+ | PASSIVETOTAL_USERNAME | PassiveTotal username | |
219
+ | PULSEDIVE_API_KEY | Pulsedive API key | |
220
+ | SECURITYTRAILS_API_KEY | SecurityTrails API key | |
221
+ | SHODAN_API_KEY | Shodan API key | |
222
+ | SLACK_CHANNEL | Slack channel name | `#general` |
223
+ | SLACK_WEBHOOK_URL | Slack Webhook URL | |
224
+ | THEHIVE_API_ENDPOINT | TheHive URL | |
225
+ | THEHIVE_API_KEY | TheHive API key | |
226
+ | VIRUSTOTAL_API_KEY | VirusTotal API key | |
227
+ | ZOOMEYE_PASSWORD | ZoomEye password | |
228
+ | ZOOMEYE_USERNAMME | ZoomEye username | |
254
229
 
255
230
  Instead of using environment variables, you can use a YAML file for configuration.
256
231
 
@@ -261,6 +236,7 @@ mihari virustotal 1.1.1.1 --config /path/to/yaml.yml
261
236
  The YAML file should be a YAML hash like below:
262
237
 
263
238
  ```yaml
239
+ database: /tmp/mihari.db
264
240
  thehive_api_endpoint: https://localhost
265
241
  thehive_api_key: foo
266
242
  virustotal_api_key: foo
@@ -314,10 +290,6 @@ example.run
314
290
 
315
291
  See `/examples` for more.
316
292
 
317
- ## Caching
318
-
319
- Mihari caches execution results in `/tmp/mihari` and the default cache duration is 7 days. If you want to clear the cache, please clear `/tmp/mihari`.
320
-
321
293
  ## Using it with Docker
322
294
 
323
295
  ```bash
data/config/pre_commit.yml ADDED
@@ -0,0 +1,3 @@
1
+ ---
2
+ :checks_add:
3
+ - :rubocop
data/docker/Dockerfile CHANGED
@@ -1,5 +1,5 @@
1
1
  FROM ruby:2.6-alpine3.10
2
- RUN apk --no-cache add git build-base ruby-dev \
2
+ RUN apk --no-cache add git build-base ruby-dev sqlite-dev postgresql-dev \
3
3
  && cd /tmp/ \
4
4
  && git clone https://github.com/ninoseki/mihari.git \
5
5
  && cd mihari \
data/lib/mihari.rb CHANGED
@@ -19,24 +19,27 @@ module Mihari
19
19
  end
20
20
 
21
21
  require "mihari/version"
22
-
23
22
  require "mihari/errors"
24
23
 
25
- require "mihari/artifact"
26
- require "mihari/cache"
27
24
  require "mihari/config"
25
+
26
+ require "mihari/database"
28
27
  require "mihari/type_checker"
29
28
 
29
+ require "mihari/models/alert"
30
+ require "mihari/models/artifact"
31
+ require "mihari/models/tag"
32
+ require "mihari/models/tagging"
33
+
34
+ require "mihari/serializers/alert"
35
+ require "mihari/serializers/artifact"
36
+ require "mihari/serializers/tag"
37
+
30
38
  require "mihari/html"
31
39
 
32
40
  require "mihari/configurable"
33
41
  require "mihari/retriable"
34
42
 
35
- require "mihari/the_hive/base"
36
- require "mihari/the_hive/alert"
37
- require "mihari/the_hive/artifact"
38
- require "mihari/the_hive"
39
-
40
43
  require "mihari/analyzers/base"
41
44
  require "mihari/analyzers/basic"
42
45
 
@@ -47,6 +50,7 @@ require "mihari/analyzers/crtsh"
47
50
  require "mihari/analyzers/dnpedia"
48
51
  require "mihari/analyzers/dnstwister"
49
52
  require "mihari/analyzers/onyphe"
53
+ require "mihari/analyzers/otx"
50
54
  require "mihari/analyzers/passivetotal"
51
55
  require "mihari/analyzers/pulsedive"
52
56
  require "mihari/analyzers/securitytrails_domain_feed"
@@ -68,6 +72,7 @@ require "mihari/notifiers/slack"
68
72
  require "mihari/notifiers/exception_notifier"
69
73
 
70
74
  require "mihari/emitters/base"
75
+ require "mihari/emitters/database"
71
76
  require "mihari/emitters/misp"
72
77
  require "mihari/emitters/slack"
73
78
  require "mihari/emitters/stdout"