mihari 0.4.0 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: afc816e7fe81735a8e8b007fe32884b1188f09b9fa905fe1603584b4a6d6fbfb
-  data.tar.gz: c7f689b44a4964e982744d67861c6f93f567e4c01ae0d6c43c6419dba063aa73
+  metadata.gz: d2122f13495ae81a98410887ee84dd41cbe5dbea0cf70b28afac5943d899a543
+  data.tar.gz: '08b3eb468a8bb767990b3bea8d2b18950d4240611fec189a9ed4d6272ba84aab'
 SHA512:
-  metadata.gz: 3dfe252ff2f2572328a2101fd50a97cb4ff236430d60d5985f861b885f78daef780f93f67975e78be5debe6ee6fab88777bacc2f7e338681becf2251e755513f
-  data.tar.gz: 8ec54176b1f19bcb1b7542e376d7a8a87aef0fb076270408bdea60a08bbb6efe787b9824436c39129a61d0e99a953154d31277a9ebb67dd644fcbcaaf91650be
+  metadata.gz: b98c1c679ab601b40f918be6eb3bb4ea1c80761abe79944b1c2111abb6eec87d430ffb5e7571591875ecabf631753cb428dab98ae11dfe7708ac87ea1f6c50f8
+  data.tar.gz: 4d6a0b87a14dbb6de755f623e6544743966b26101a49b7dc71a7c4604fb662a052c52071c638e7fdedfcd918bf783cb90cd46567e0f31a30e93322181942af4a

data/lib/mihari/analyzers/base.rb

@@ -48,16 +48,16 @@ module Mihari
 
       # @return [Array<Mihari::Artifact>]
       def normalized_artifacts
-        artifacts.map do |artifact|
+        @normalized_artifacts ||= artifacts.map do |artifact|
           artifact.is_a?(Artifact) ? artifact : Artifact.new(artifact)
         end.select(&:valid?)
       end
 
       # @return [Array<Mihari::Artifact>]
       def unique_artifacts
-        normalized_artifacts.reject do |artifact|
-          the_hive.valid? && the_hive.exists?(data: artifact.data, data_type: artifact.data_type)
-        end
+        return normalized_artifacts unless the_hive.valid?
+
+        the_hive.find_non_existing_artifacts(normalized_artifacts)
       end
     end
   end

data/lib/mihari/emitters/slack.rb

@@ -125,11 +125,11 @@ module Mihari
         end.flatten
       end
 
-      def emit(title:, description:, artifacts:, tags:)
+      def emit(title:, description:, artifacts:, tags: [])
         return if artifacts.empty?
 
         attachments = to_attachments(artifacts)
-        tags << ["N/A"] if tags.empty?
+        tags = ["N/A"] if tags.empty?
 
         notifier = ::Slack::Notifier.new(slack_webhook_url, channel: slack_channel)
         notifier.post(text: "#{title} (desc.: #{description} / tags: #{tags.join(', ')})", attachments: attachments)

data/lib/mihari/the_hive.rb

@@ -25,9 +25,14 @@ module Mihari
       @api ||= Hachi::API.new
     end
 
-    # @return [Hash]
+    # @return [Array]
     def search(data:, data_type:, range: "all")
-      api.artifact.search(data: data, data_type: data_type, range: range)
+      api.artifact.search({ data: data, data_type: data_type }, range: range)
+    end
+
+    # @return [Array]
+    def search_all(data:, range: "all")
+      api.artifact.search({ data: data }, range: range)
     end
 
     # @return [true, false]
@@ -36,6 +41,16 @@ module Mihari
       !res.empty?
     end
 
+    # @return [Array<Mihari::Artifact>]
+    def find_non_existing_artifacts(artifacts)
+      data = artifacts.map(&:data)
+      results = search_all(data: data)
+      keys = results.map { |result| result.dig("data") }.compact.uniq
+      artifacts.reject do |artifact|
+        keys.include? artifact.data
+      end
+    end
+
     # @return [Hash]
     def create_alert(title:, description:, artifacts:, tags: [])
       api.alert.create(

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "0.4.0"
+  VERSION = "0.4.2"
 end

data/mihari.gemspec

@@ -34,7 +34,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency "addressable", "~> 2.6"
   spec.add_dependency "censu", "~> 0.2"
   spec.add_dependency "email_address", "~> 0.1"
-  spec.add_dependency "hachi", "~> 0.1"
+  spec.add_dependency "hachi", "~> 0.2"
   spec.add_dependency "mem", "~> 0.1"
   spec.add_dependency "net-ping", "~> 2.0"
   spec.add_dependency "onyphe", "~> 0.2"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mihari
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.2
 platform: ruby
 authors:
 - Manabu Niseki
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-08-07 00:00:00.000000000 Z
+date: 2019-08-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -142,14 +142,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '0.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '0.2'
 - !ruby/object:Gem::Dependency
   name: mem
   requirement: !ruby/object:Gem::Requirement
@@ -336,7 +336,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.2
+rubygems_version: 3.0.4
 signing_key: 
 specification_version: 4
 summary: A framework for continuous malicious hosts monitoring.