mihari 3.12.0 → 4.1.2

data/lib/mihari/web/endpoints/artifacts.rb

@@ -6,7 +6,8 @@ module Mihari
       namespace :artifacts do
         desc "Get an artifact", {
           success: Entities::Artifact,
-          failure: [{ code: 404, message: "Not found", model: Entities::Message }]
+          failure: [{ code: 404, message: "Not found", model: Entities::Message }],
+          summary: "Get an artifact"
         }
         params do
           requires :id, type: Integer
@@ -38,7 +39,8 @@ module Mihari
 
         desc "Enrich an artifact", {
           success: Entities::Message,
-          failure: [{ code: 404, message: "Not found", model: Entities::Message }]
+          failure: [{ code: 404, message: "Not found", model: Entities::Message }],
+          summary: "Enrich an artifact"
         }
         params do
           requires :id, type: Integer
@@ -67,7 +69,8 @@ module Mihari
 
         desc "Delete an artifact", {
           success: Entities::Message,
-          failure: [{ code: 404, message: "Not found", model: Entities::Message }]
+          failure: [{ code: 404, message: "Not found", model: Entities::Message }],
+          summary: "Delete an artifact"
         }
         params do
           requires :id, type: Integer

data/lib/mihari/web/endpoints/command.rb

@@ -8,7 +8,8 @@ module Mihari
       namespace :command do
         desc "Run a command", {
           success: Entities::CommandResult,
-          failure: [{ code: 400, message: "Bad request", model: Entities::Message }]
+          failure: [{ code: 400, message: "Bad request", model: Entities::Message }],
+          summary: "Run a command"
         }
         params do
           requires :command, type: String, documentation: { param_type: "body" }

data/lib/mihari/web/endpoints/configs.rb

@@ -6,7 +6,8 @@ module Mihari
       namespace :configs do
         desc "Get configs", {
           is_array: true,
-          success: Entities::Config
+          success: Entities::Config,
+          summary: "Get configs"
         }
         get "/" do
           statuses = Status.check

data/lib/mihari/web/endpoints/ip_addresses.rb

@@ -6,7 +6,8 @@ module Mihari
       namespace :ip_addresses do
         desc "Get an IP address", {
           success: Entities::IPAddress,
-          failure: [{ code: 404, message: "Not found", model: Entities::Message }]
+          failure: [{ code: 404, message: "Not found", model: Entities::Message }],
+          summary: "Get an IP address"
         }
         params do
           requires :ip, type: String, regexp: /\A[0-9.]+\z/

data/lib/mihari/web/endpoints/rules.rb

@@ -0,0 +1,175 @@
+# frozen_string_literal: true
+
+module Mihari
+  module Endpoints
+    class Rules < Grape::API
+      namespace :rules do
+        desc "Search rules", {
+          is_array: true,
+          success: Entities::Rule,
+          failure: [{ code: 404, message: "Not found", model: Entities::Message }],
+          summary: "Search rules"
+        }
+        params do
+          optional :page, type: Integer
+
+          optional :title, type: String
+          optional :description, type: String
+          optional :tag, type: String
+
+          optional :fromAt, type: DateTime
+          optional :toAt, type: DateTime
+        end
+        get "/" do
+          filter = params.to_h.to_snake_keys
+
+          # set page & limit
+          page = filter["page"] || 1
+          filter["page"] = page.to_i
+
+          limit = 10
+          filter["limit"] = 10
+
+          # normalize keys
+          filter["tag_name"] = filter["tag"]
+
+          # symbolize hash keys
+          filter = filter.to_h.symbolize_keys
+
+          search_filter_with_pagenation = Structs::Rule::SearchFilterWithPagination.new(**filter)
+          rules = Mihari::Rule.search(search_filter_with_pagenation)
+          total = Mihari::Rule.count(search_filter_with_pagenation.without_pagination)
+
+          present({ rules: rules.map(&:to_h), total: total, current_page: page, page_size: limit }, with: Entities::RulesWithPagination)
+        end
+
+        desc "Get a rule", {
+          success: Entities::Rule,
+          failure: [{ code: 404, message: "Not found", model: Entities::Message }],
+          summary: "Get a rule"
+        }
+        params do
+          requires :id, type: String
+        end
+        get "/:id" do
+          id = params["id"].to_s
+
+          begin
+            rule = Mihari::Rule.find(id)
+          rescue ActiveRecord::RecordNotFound
+            error!({ message: "ID:#{id} is not found" }, 404)
+          end
+
+          present rule.to_h, with: Entities::Rule
+        end
+
+        desc "Run a rule", {
+          success: Entities::Message,
+          summary: "Run a rule"
+        }
+        params do
+          requires :id, type: String
+        end
+        get "/:id/run" do
+          id = params["id"].to_s
+
+          begin
+            rule = Mihari::Rule.find(id)
+          rescue ActiveRecord::RecordNotFound
+            error!({ message: "ID:#{id} is not found" }, 404)
+          end
+
+          Mihari::CLI::Main.start ["search", rule.id]
+
+          status 201
+          present({ message: "ID:#{id} is ran successfully" }, with: Entities::Message)
+        end
+
+        desc "Create a rule", {
+          success: Entities::Rule,
+          summary: "Create a rule"
+        }
+        post "/" do
+          rule = Structs::Rule::Rule.new(params)
+
+          begin
+            rule.validate!
+          rescue RuleValidationError
+            error!({ message: "Data format is invalid", details: rule.errors.to_h }, 400) if rule.errors?
+
+            # when NoMethodError occurs
+            error!({ message: "Data format is invalid" }, 400)
+          end
+
+          begin
+            model = rule.to_model
+            model.save
+          rescue ActiveRecord::RecordNotUnique
+            error!({ message: "ID:#{rule.id} is already registered" }, 400)
+          end
+
+          status 201
+          present model.to_h, with: Entities::Rule
+        end
+
+        desc "Update a rule", {
+          success: Entities::Rule,
+          summary: "Update a rule"
+        }
+        put "/" do
+          id = params["id"].to_s
+
+          begin
+            Mihari::Rule.find(id)
+          rescue ActiveRecord::RecordNotFound
+            error!({ message: "ID:#{id} is not found" }, 404)
+          end
+
+          rule = Structs::Rule::Rule.new(params)
+
+          begin
+            rule.validate!
+          rescue RuleValidationError
+            error!({ message: "Data format is invalid", details: rule.errors.to_h }, 400) if rule.errors?
+
+            # when NoMethodError occurs
+            error!({ message: "Data format is invalid" }, 400)
+          end
+
+          begin
+            model = rule.to_model
+            model.save
+          rescue ActiveRecord::RecordNotUnique
+            error!({ message: "ID:#{rule.id} is already registered" }, 400)
+          end
+
+          status 201
+          present model.to_h, with: Entities::Rule
+        end
+
+        desc "Delete a rule", {
+          success: Entities::Message,
+          failure: [{ code: 404, message: "Not found", model: Entities::Message }],
+          summary: "Delete a rule"
+        }
+        params do
+          requires :id, type: String
+        end
+        delete "/:id" do
+          id = params["id"].to_s
+
+          begin
+            rule = Mihari::Rule.find(id)
+          rescue ActiveRecord::RecordNotFound
+            error!({ message: "ID:#{id} is not found" }, 404)
+          end
+
+          rule.destroy
+
+          status 204
+          present({ message: "ID:#{id} is deleted" }, with: Entities::Message)
+        end
+      end
+    end
+  end
+end

data/lib/mihari/web/endpoints/sources.rb

@@ -6,7 +6,8 @@ module Mihari
       namespace :sources do
         desc "Get sources", {
           is_array: true,
-          success: Entities::Sources
+          success: Entities::Sources,
+          summary: "Get sources"
         }
         get "/" do
           sources = Mihari::Alert.distinct.pluck(:source)

data/lib/mihari/web/endpoints/tags.rb

@@ -6,7 +6,8 @@ module Mihari
       namespace :tags do
         desc "Get tags", {
           is_array: true,
-          success: Entities::Tags
+          success: Entities::Tags,
+          summary: "Get tags"
         }
         get "/" do
           tags = Mihari::Tag.distinct.pluck(:name)
@@ -15,7 +16,8 @@ module Mihari
 
         desc "Delete a tag", {
           success: Entities::Message,
-          failure: [{ code: 404, message: "Not found", model: Entities::Message }]
+          failure: [{ code: 404, message: "Not found", model: Entities::Message }],
+          summary: "Delete a tag"
         }
         params do
           requires :name, type: String

data/lib/mihari/web/entities/artifact.rb

@@ -9,6 +9,8 @@ module Mihari
       expose :source, documentation: { type: String, required: true }
       expose :tags, documentation: { type: String, is_array: true }
 
+      expose :metadata, documentation: { type: Hash }
+
       expose :autonomous_system, using: Entities::AutonomousSystem, documentation: { type: Entities::AutonomousSystem, required: false }, as: :autonomousSystem
       expose :geolocation, using: Entities::Geolocation, documentation: { type: Entities::Geolocation, required: false }
       expose :whois_record, using: Entities::WhoisRecord, documentation: { type: Entities::WhoisRecord, required: false }, as: :whoisRecord

data/lib/mihari/web/entities/rule.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Mihari
+  module Entities
+    class Query < Grape::Entity
+      expose :analyzer, documentation: { type: String, required: true }
+      expose :query, documentation: { type: String, required: true }
+      expose :interval, documentation: { type: Integer, required: false }
+    end
+
+    class Rule < Grape::Entity
+      expose :id, documentation: { type: String, required: true }
+
+      expose :yaml, documentation: { type: String, required: true }
+
+      expose :title, documentation: { type: String, required: true }
+      expose :description, documentation: { type: String, required: true }
+      expose :queries, using: Entities::Query, documentation: { type: Entities::Query, is_array: true, required: true }
+      expose :tags, documentation: { type: String, is_array: true }
+      expose :allowed_data_types, documentation: { type: String, is_array: true }, as: :allowedDtaTypes
+      expose :disallowed_data_values, documentation: { type: String, is_array: true }, as: :disallowedDataValues
+      expose :ignore_old_artifacts, documentation: { type: "boolean", required: true }, as: :ignoreOldArtifacts
+      expose :ignore_threshold, documentation: { type: Integer, required: true }, as: :ignoreThreshold
+
+      expose :created_at, documentation: { type: DateTime, required: true }, as: :createdAt
+    end
+
+    class RulesWithPagination < Grape::Entity
+      expose :rules, using: Entities::Rule, documentation: { type: Entities::Rule, is_array: true, required: true }
+      expose :total, documentation: { type: Integer, required: true }
+      expose :current_page, documentation: { type: Integer, required: true }, as: :currentPage
+      expose :page_size, documentation: { type: Integer, required: true }, as: :pageSize
+    end
+  end
+end

data/lib/mihari/web/middleware/connection_adapter.rb

@@ -0,0 +1,19 @@
+module Mihari
+  module Middleware
+    class ConnectionAdapter
+      include Mixins::Database
+
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        with_db_connection do
+          status, headers, body = @app.call(env)
+
+          [status, headers, body]
+        end
+      end
+    end
+  end
+end

data/lib/mihari/web/public/index.html

@@ -1 +1 @@
-<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="icon" href="/static/favicon.ico"><title>Mihari</title><link href="/static/js/app.5dc97aae.js" rel="preload" as="script"></head><body><noscript><strong>We're sorry but Mihari doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div><script src="/static/js/app.5dc97aae.js"></script></body></html>
+<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="icon" href="/static/favicon.ico"><title>Mihari</title><link href="/static/js/app.b88ce341.js" rel="preload" as="script"></head><body><noscript><strong>We're sorry but Mihari doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div><script src="/static/js/app.b88ce341.js"></script></body></html>