mihari 3.10.0 → 4.0.0

data/lib/mihari/web/endpoints/rules.rb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+module Mihari
+  module Endpoints
+    class Rules < Grape::API
+      namespace :rules do
+        desc "Search rules", {
+          is_array: true,
+          success: Entities::Rule,
+          failure: [{ code: 404, message: "Not found", model: Entities::Message }],
+          summary: "Search rules"
+        }
+        params do
+          optional :page, type: Integer
+
+          optional :title, type: String
+          optional :description, type: String
+          optional :tag, type: String
+
+          optional :fromAt, type: DateTime
+          optional :toAt, type: DateTime
+        end
+        get "/" do
+          filter = params.to_h.to_snake_keys
+
+          # set page & limit
+          page = filter["page"] || 1
+          filter["page"] = page.to_i
+
+          limit = 10
+          filter["limit"] = 10
+
+          # normalize keys
+          filter["tag_name"] = filter["tag"]
+
+          # symbolize hash keys
+          filter = filter.to_h.symbolize_keys
+
+          search_filter_with_pagenation = Structs::Rule::SearchFilterWithPagination.new(**filter)
+          rules = Mihari::Rule.search(search_filter_with_pagenation)
+          total = Mihari::Rule.count(search_filter_with_pagenation.without_pagination)
+
+          present({ rules: rules.map(&:to_h), total: total, current_page: page, page_size: limit }, with: Entities::RulesWithPagination)
+        end
+
+        desc "Get a rule", {
+          success: Entities::Rule,
+          failure: [{ code: 404, message: "Not found", model: Entities::Message }],
+          summary: "Get a rule"
+        }
+        params do
+          requires :id, type: String
+        end
+        get "/:id" do
+          id = params["id"].to_s
+
+          begin
+            rule = Mihari::Rule.find(id)
+          rescue ActiveRecord::RecordNotFound
+            error!({ message: "ID:#{id} is not found" }, 404)
+          end
+
+          present rule.to_h, with: Entities::Rule
+        end
+
+        desc "Run a rule", {
+          success: Entities::Message,
+          summary: "Run a rule"
+        }
+        params do
+          requires :id, type: String
+        end
+        get "/:id/run" do
+          id = params["id"].to_s
+
+          begin
+            rule = Mihari::Rule.find(id)
+          rescue ActiveRecord::RecordNotFound
+            error!({ message: "ID:#{id} is not found" }, 404)
+          end
+
+          Mihari::CLI::Main.start ["search", rule.id]
+
+          status 201
+          present({ message: "ID:#{id} is ran successfully" }, with: Entities::Message)
+        end
+
+        desc "Create a rule", {
+          success: Entities::Rule,
+          summary: "Create a rule"
+        }
+        post "/" do
+          rule = Structs::Rule::Rule.new(params)
+
+          begin
+            rule.validate!
+          rescue RuleValidationError
+            error!({ message: "Data format is invalid", details: rule.errors.to_h }, 400) if rule.errors?
+
+            # when NoMethodError occurs
+            error!({ message: "Data format is invalid" }, 400)
+          end
+
+          begin
+            model = rule.to_model
+            model.save
+          rescue ActiveRecord::RecordNotUnique
+            error!({ message: "ID:#{rule.id} is already registered" }, 400)
+          end
+
+          status 201
+          present model.to_h, with: Entities::Rule
+        end
+
+        desc "Delete a rule", {
+          success: Entities::Message,
+          failure: [{ code: 404, message: "Not found", model: Entities::Message }],
+          summary: "Delete a rule"
+        }
+        params do
+          requires :id, type: String
+        end
+        delete "/:id" do
+          id = params["id"].to_s
+
+          begin
+            rule = Mihari::Rule.find(id)
+          rescue ActiveRecord::RecordNotFound
+            error!({ message: "ID:#{id} is not found" }, 404)
+          end
+
+          rule.destroy
+
+          status 204
+          present({ message: "ID:#{id} is deleted" }, with: Entities::Message)
+        end
+      end
+    end
+  end
+end

data/lib/mihari/web/endpoints/sources.rb

@@ -6,7 +6,8 @@ module Mihari
       namespace :sources do
         desc "Get sources", {
           is_array: true,
-          success: Entities::Sources
+          success: Entities::Sources,
+          summary: "Get sources"
         }
         get "/" do
           sources = Mihari::Alert.distinct.pluck(:source)

data/lib/mihari/web/endpoints/tags.rb

@@ -6,7 +6,8 @@ module Mihari
       namespace :tags do
         desc "Get tags", {
           is_array: true,
-          success: Entities::Tags
+          success: Entities::Tags,
+          summary: "Get tags"
         }
         get "/" do
           tags = Mihari::Tag.distinct.pluck(:name)
@@ -15,7 +16,8 @@ module Mihari
 
         desc "Delete a tag", {
           success: Entities::Message,
-          failure: [{ code: 404, message: "Not found", model: Entities::Message }]
+          failure: [{ code: 404, message: "Not found", model: Entities::Message }],
+          summary: "Delete a tag"
         }
         params do
           requires :name, type: String

data/lib/mihari/web/entities/artifact.rb

@@ -9,15 +9,17 @@ module Mihari
       expose :source, documentation: { type: String, required: true }
       expose :tags, documentation: { type: String, is_array: true }
 
+      expose :metadata, documentation: { type: Hash }
+
       expose :autonomous_system, using: Entities::AutonomousSystem, documentation: { type: Entities::AutonomousSystem, required: false }, as: :autonomousSystem
       expose :geolocation, using: Entities::Geolocation, documentation: { type: Entities::Geolocation, required: false }
       expose :whois_record, using: Entities::WhoisRecord, documentation: { type: Entities::WhoisRecord, required: false }, as: :whoisRecord
 
       expose :reverse_dns_names, using: Entities::ReverseDnsName, documentation: { type: Entities::ReverseDnsName, is_array: true, required: false }, as: :reverseDnsNames do |status, _options|
-        status.reverse_dns_names.length > 0 ? status.reverse_dns_names : nil
+        status.reverse_dns_names.empty? ? nil : status.reverse_dns_names
       end
       expose :dns_records, using: Entities::DnsRecord, documentation: { type: Entities::DnsRecord, is_array: true, required: false }, as: :dnsRecords do |status, _options|
-        status.dns_records.length > 0 ? status.dns_records : nil
+        status.dns_records.empty? ? nil : status.dns_records
       end
     end
   end

data/lib/mihari/web/entities/rule.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Mihari
+  module Entities
+    class Query < Grape::Entity
+      expose :analyzer, documentation: { type: String, required: true }
+      expose :query, documentation: { type: String, required: true }
+      expose :interval, documentation: { type: Integer, required: false }
+    end
+
+    class Rule < Grape::Entity
+      expose :id, documentation: { type: String, required: true }
+
+      expose :yaml, documentation: { type: String, required: true }
+
+      expose :title, documentation: { type: String, required: true }
+      expose :description, documentation: { type: String, required: true }
+      expose :queries, using: Entities::Query, documentation: { type: Entities::Query, is_array: true, required: true }
+      expose :tags, documentation: { type: String, is_array: true }
+      expose :allowed_data_types, documentation: { type: String, is_array: true }, as: :allowedDtaTypes
+      expose :disallowed_data_values, documentation: { type: String, is_array: true }, as: :disallowedDataValues
+      expose :ignore_old_artifacts, documentation: { type: "boolean", required: true }, as: :ignoreOldArtifacts
+      expose :ignore_threshold, documentation: { type: Integer, required: true }, as: :ignoreThreshold
+
+      expose :created_at, documentation: { type: DateTime, required: true }, as: :createdAt
+    end
+
+    class RulesWithPagination < Grape::Entity
+      expose :rules, using: Entities::Rule, documentation: { type: Entities::Rule, is_array: true, required: true }
+      expose :total, documentation: { type: Integer, required: true }
+      expose :current_page, documentation: { type: Integer, required: true }, as: :currentPage
+      expose :page_size, documentation: { type: Integer, required: true }, as: :pageSize
+    end
+  end
+end

data/lib/mihari/web/entities/whois.rb

@@ -9,7 +9,7 @@ module Mihari
       expose :expires_on, documentation: { type: Date, required: false }, as: :expiresOn
       expose :registrar, documentation: { type: Hash, required: false }
       expose :contacts, documentation: { type: Hash, is_array: true, required: true } do |whois_record, _options|
-        whois_record.contacts.map { |h| h.to_camelback_keys }
+        whois_record.contacts.map(&:to_camelback_keys)
       end
     end
   end

data/lib/mihari/web/middleware/connection_adapter.rb

@@ -0,0 +1,19 @@
+module Mihari
+  module Middleware
+    class ConnectionAdapter
+      include Mixins::Database
+
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        with_db_connection do
+          status, headers, body = @app.call(env)
+
+          [status, headers, body]
+        end
+      end
+    end
+  end
+end

data/lib/mihari/web/public/index.html

@@ -1 +1 @@
-<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="icon" href="/static/favicon.ico"><title>Mihari</title><link href="/static/js/app.0a0cc502.js" rel="preload" as="script"></head><body><noscript><strong>We're sorry but Mihari doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div><script src="/static/js/app.0a0cc502.js"></script></body></html>
+<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="icon" href="/static/favicon.ico"><title>Mihari</title><link href="/static/js/app.49ab738a.js" rel="preload" as="script"></head><body><noscript><strong>We're sorry but Mihari doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div><script src="/static/js/app.49ab738a.js"></script></body></html>