mihari 0.2.1 → 0.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +21 -12
- data/lib/mihari/analyzers/base.rb +11 -1
- data/lib/mihari/analyzers/basic.rb +3 -1
- data/lib/mihari/cli.rb +2 -1
- data/lib/mihari/notifiers/the_hive.rb +7 -2
- data/lib/mihari/the_hive.rb +9 -2
- data/lib/mihari/version.rb +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: fca44bdfc7be51ca91f0daa4e7761b6f430e63c7eeb185b9a285180f38f9e688
|
|
4
|
+
data.tar.gz: acb42896cad9c436b0ee2fefc4d086fa44f299574244ae373e79c93a1496bba6
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 05b97240bb7e59483e8d5ecb68cb77c27ee41deebd42d9c948b796d550e41362cca972b8cea152b16f1c3b546bb14e95c7a0a74b5d3b9f8bd2f1c29f941220d7
|
|
7
|
+
data.tar.gz: 6e55ab64c2b43cd9efa20ee631b615ce834868461aef220fbba8bb1a873240a488b6e2f9ec88c29e4918ffcc1c286fbec47897a8e65948f81a12fe992de7cb0a
|
data/README.md
CHANGED
|
@@ -12,6 +12,8 @@ mihari(`見張り`) is a framework for continuous malicious hosts (C2 / landing
|
|
|
12
12
|
- mihari creates an alert with the artifacts on the TheHive instance.
|
|
13
13
|
- mihari sends a notification to Slack. (Optional)
|
|
14
14
|
|
|
15
|
+
Check this blog post for more detail: [Continuous C2 hunting with Censys, Shodan, Onyphe and TheHive](https://hackmd.io/s/SkUaSrqoE)
|
|
16
|
+
|
|
15
17
|
### Screenshots
|
|
16
18
|
|
|
17
19
|
- TheHive alert example
|
|
@@ -66,21 +68,23 @@ mihari onyphe "YOUR QUERY"
|
|
|
66
68
|
echo '{ "title": "test", "description": "test", "artifacts": ["1.1.1.1", "github.com", "2.2.2.2"] }' | mihari import_from_json
|
|
67
69
|
```
|
|
68
70
|
|
|
69
|
-
The input is a JSON data should have `title`, `description` and `artifacts` key.
|
|
71
|
+
The input is a JSON data should have `title`, `description` and `artifacts` key. `tags` key is an optional parameter.
|
|
70
72
|
|
|
71
73
|
```json
|
|
72
74
|
{
|
|
73
75
|
"title": "test",
|
|
74
76
|
"description": "test",
|
|
75
|
-
"artifacts": ["1.1.1.1", "github.com"]
|
|
77
|
+
"artifacts": ["1.1.1.1", "github.com"],
|
|
78
|
+
"tags": ["test"]
|
|
76
79
|
}
|
|
77
80
|
```
|
|
78
81
|
|
|
79
|
-
| Key | Desc. |
|
|
80
|
-
|
|
81
|
-
| title | A title of an alert |
|
|
82
|
-
| description | A description of an alert |
|
|
83
|
-
| artifacts | An array of artifacts (supported data types: ip, domain, url, email, hash) |
|
|
82
|
+
| Key | Desc. | Required or optional |
|
|
83
|
+
|-------------|----------------------------------------------------------------------------|----------------------|
|
|
84
|
+
| title | A title of an alert | Required |
|
|
85
|
+
| description | A description of an alert | Required |
|
|
86
|
+
| artifacts | An array of artifacts (supported data types: ip, domain, url, email, hash) | Required |
|
|
87
|
+
| tags | An array of tags | Optional |
|
|
84
88
|
|
|
85
89
|
## Configuration
|
|
86
90
|
|
|
@@ -101,11 +105,12 @@ All configuration is done via ENV variables.
|
|
|
101
105
|
|
|
102
106
|
Create a class which extends `Mihari::Analyzers::Base` and implements the following methods.
|
|
103
107
|
|
|
104
|
-
| Name | Desc. | @return |
|
|
105
|
-
|
|
106
|
-
| `#title` | A title of an alert | String |
|
|
107
|
-
| `#description` | A description of an alert | String |
|
|
108
|
-
| `#artifacts` | An array of artifacts (supported data types: ip, domain, url, email, hash) | Array<String> |
|
|
108
|
+
| Name | Desc. | @return | Required or optional |
|
|
109
|
+
|----------------|----------------------------------------------------------------------------|---------------|----------------------|
|
|
110
|
+
| `#title` | A title of an alert | String | Required |
|
|
111
|
+
| `#description` | A description of an alert | String | Required |
|
|
112
|
+
| `#artifacts` | An array of artifacts (supported data types: ip, domain, url, email, hash) | Array<String> | Required |
|
|
113
|
+
| `#tags` | An array of tags | Array<String> | Optional |
|
|
109
114
|
|
|
110
115
|
```ruby
|
|
111
116
|
require "mihari"
|
|
@@ -124,6 +129,10 @@ module Mihari
|
|
|
124
129
|
def artifacts
|
|
125
130
|
["9.9.9.9", "example.com"]
|
|
126
131
|
end
|
|
132
|
+
|
|
133
|
+
def tags
|
|
134
|
+
["example"]
|
|
135
|
+
end
|
|
127
136
|
end
|
|
128
137
|
end
|
|
129
138
|
end
|
|
@@ -24,6 +24,11 @@ module Mihari
|
|
|
24
24
|
raise NotImplementedError, "You must implement #{self.class}##{__method__}"
|
|
25
25
|
end
|
|
26
26
|
|
|
27
|
+
# @return [Array<String>]
|
|
28
|
+
def tags
|
|
29
|
+
[]
|
|
30
|
+
end
|
|
31
|
+
|
|
27
32
|
def run(reject_exists_ones: true)
|
|
28
33
|
unique_artifacts = normalized_artifacts.reject do |artifact|
|
|
29
34
|
reject_exists_ones & the_hive.valid? && the_hive.exists?(data: artifact.data, data_type: artifact.data_type)
|
|
@@ -33,7 +38,12 @@ module Mihari
|
|
|
33
38
|
notifier = notifier_class.new
|
|
34
39
|
next unless notifier.valid?
|
|
35
40
|
|
|
36
|
-
notifier.notify(
|
|
41
|
+
notifier.notify(
|
|
42
|
+
title: title,
|
|
43
|
+
description: description,
|
|
44
|
+
artifacts: unique_artifacts,
|
|
45
|
+
tags: tags
|
|
46
|
+
)
|
|
37
47
|
end
|
|
38
48
|
end
|
|
39
49
|
|
|
@@ -6,13 +6,15 @@ module Mihari
|
|
|
6
6
|
attr_reader :title
|
|
7
7
|
attr_reader :description
|
|
8
8
|
attr_reader :artifacts
|
|
9
|
+
attr_reader :tags
|
|
9
10
|
|
|
10
|
-
def initialize(title:, description:, artifacts:)
|
|
11
|
+
def initialize(title:, description:, artifacts:, tags: [])
|
|
11
12
|
super()
|
|
12
13
|
|
|
13
14
|
@title = title
|
|
14
15
|
@description = description
|
|
15
16
|
@artifacts = artifacts
|
|
17
|
+
@tags = tags
|
|
16
18
|
end
|
|
17
19
|
end
|
|
18
20
|
end
|
data/lib/mihari/cli.rb
CHANGED
|
@@ -40,9 +40,10 @@ module Mihari
|
|
|
40
40
|
title = json.dig("title")
|
|
41
41
|
description = json.dig("description")
|
|
42
42
|
artifacts = json.dig("artifacts")
|
|
43
|
+
tags = json.dig("tags") || []
|
|
43
44
|
|
|
44
45
|
with_error_handling do
|
|
45
|
-
basic = Analyzers::Basic.new(title: title, description: description, artifacts: artifacts)
|
|
46
|
+
basic = Analyzers::Basic.new(title: title, description: description, artifacts: artifacts, tags: tags)
|
|
46
47
|
basic.run
|
|
47
48
|
end
|
|
48
49
|
end
|
|
@@ -14,10 +14,15 @@ module Mihari
|
|
|
14
14
|
api.valid?
|
|
15
15
|
end
|
|
16
16
|
|
|
17
|
-
def notify(title:, description:, artifacts:)
|
|
17
|
+
def notify(title:, description:, artifacts:, tags: [])
|
|
18
18
|
return if artifacts.empty?
|
|
19
19
|
|
|
20
|
-
res = api.create_alert(
|
|
20
|
+
res = api.create_alert(
|
|
21
|
+
title: title,
|
|
22
|
+
description: description,
|
|
23
|
+
artifacts: artifacts.map(&:to_h),
|
|
24
|
+
tags: tags
|
|
25
|
+
)
|
|
21
26
|
id = res.dig("id")
|
|
22
27
|
puts "A new alret is created. (id: #{id})"
|
|
23
28
|
end
|
data/lib/mihari/the_hive.rb
CHANGED
|
@@ -34,8 +34,15 @@ module Mihari
|
|
|
34
34
|
end
|
|
35
35
|
|
|
36
36
|
# @return [Hash]
|
|
37
|
-
def create_alert(title:, description:, artifacts:)
|
|
38
|
-
api.alert.create(
|
|
37
|
+
def create_alert(title:, description:, artifacts:, tags: [])
|
|
38
|
+
api.alert.create(
|
|
39
|
+
title: title,
|
|
40
|
+
description: description,
|
|
41
|
+
artifacts: artifacts,
|
|
42
|
+
tags: tags,
|
|
43
|
+
type: "external",
|
|
44
|
+
source: "mihari"
|
|
45
|
+
)
|
|
39
46
|
end
|
|
40
47
|
end
|
|
41
48
|
end
|
data/lib/mihari/version.rb
CHANGED
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: mihari
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.2.
|
|
4
|
+
version: 0.2.2
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Manabu Niseki
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2019-05-
|
|
11
|
+
date: 2019-05-09 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: bundler
|