mihari 3.3.0 → 3.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 56538b2cc9269fa7e92a2c8cd98746caae7a480b7961fb83482a2189f5318992
-  data.tar.gz: 9c4561c9e820a42b9b4d65b1e0ad02901034cc7eb124d7c5409418cab43bc5bd
+  metadata.gz: 142df147927aee93e6c653b2eb29cca50f4ba11606d68f1302af21780d6f0dc5
+  data.tar.gz: 594f762c94e361cc53cab08b39abad5e3503555b51d93add3cbce744fcbff711
 SHA512:
-  metadata.gz: 0b43cf2ee5e73607593e2c140dbc4ec70dcc8ad1eb436914a016f852f8dabed7f1aafd2f048565356f3fbed865540488e0766bc7f3a86bd6845c722419472abe
-  data.tar.gz: 485bbcd01bcd8016b3a50b5e61fcac4cef8f527812570c734eff8a0fe6a75fc3b8e79e50d2a147c4edc20eee0370609ec5c2021bd28172bedff484bd04707379
+  metadata.gz: 8483d2d125e30f04bdaf74243877dd9a261511d7d857f6dba42c6ea54af5de95f63c23759d1937badfdb5ae75819b99e70270edb0fb2f466601b8eaf6912dc8e
+  data.tar.gz: 8ffca15aadc0bc783086dd11df9fd051933af31e6778fcd4a67ddf51af5532b452603526a0303eb7c1dfdb530636a6e91df8440210189af3dc0f2806a4e64218

data/README.md

@@ -53,6 +53,10 @@ Mihari supports the following services by default.
 
 - [Mihari Knowledge Base](https://www.notion.so/Mihari-Knowledge-Base-266994ff61204428ba6cfcebe40b0bd1)
 
+## Presentations
+
+- [Adversary Infrastructure Tracking with Mihari](https://ninoseki.github.io/presentations/Adversary%20Infrastructure%20Tracking%20with%20Mihari.pdf)
+
 ## License
 
 The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/lib/mihari/cli/analyzer.rb

@@ -22,6 +22,9 @@ require "mihari/commands/json"
 module Mihari
   module CLI
     class Analyzer < Base
+      class_option :ignore_old_artifacts, type: :boolean, default: false, desc: "Whether to ignore old artifacts from checking or not."
+      class_option :ignore_threshold, type: :numeric, default: 0, desc: "Number of days to define whether an artifact is old or not."
+
       include Mihari::Commands::BinaryEdge
       include Mihari::Commands::Censys
       include Mihari::Commands::CIRCL

data/lib/mihari/cli/base.rb

@@ -14,9 +14,6 @@ module Mihari
 
       class_option :config, type: :string, desc: "Path to the config file"
 
-      class_option :ignore_old_artifacts, type: :boolean, default: false, desc: "Whether to ignore old artifacts from checking or not. Only affects with analyze commands."
-      class_option :ignore_threshold, type: :numeric, default: 0, desc: "Number of days to define whether an artifact is old or not. Only affects with analyze commands."
-
       class << self
         def exit_on_failure?
           true

data/lib/mihari/commands/search.rb

@@ -13,12 +13,21 @@ module Mihari
             rule = load_rule(rule)
 
             # validate rule schema
-            validate_rule rule
+            rule = validate_rule(rule)
 
-            analyzer = build_rule_analyzer(**rule)
+            analyzer = build_rule_analyzer(
+              title: rule[:title],
+              description: rule[:description],
+              queries: rule[:queries],
+              tags: rule[:tags],
+              allowed_data_types: rule[:allowed_data_types],
+              disallowed_data_values: rule[:disallowed_data_values],
+              source: rule[:source],
+              id: rule[:id]
+            )
 
-            ignore_old_artifacts = options["ignore_old_artifacts"] || false
-            ignore_threshold = options["ignore_threshold"] || 0
+            ignore_old_artifacts = rule[:ignore_old_artifacts]
+            ignore_threshold = rule[:ignore_threshold]
 
             with_error_handling do
               run_rule_analyzer analyzer, ignore_old_artifacts: ignore_old_artifacts, ignore_threshold: ignore_threshold
@@ -42,7 +51,7 @@ module Mihari
       #
       # @return [Mihari::Analyzers::Rule]
       #
-      def build_rule_analyzer(title:, description:, queries:, tags: nil, allowed_data_types: nil, disallowed_data_values: nil, source: nil)
+      def build_rule_analyzer(title:, description:, queries:, tags: nil, allowed_data_types: nil, disallowed_data_values: nil, source: nil, id: nil)
         tags = [] if tags.nil?
         allowed_data_types = ALLOWED_DATA_TYPES if allowed_data_types.nil?
         disallowed_data_values = [] if disallowed_data_values.nil?
@@ -54,7 +63,8 @@ module Mihari
           queries: queries,
           allowed_data_types: allowed_data_types,
           disallowed_data_values: disallowed_data_values,
-          source: source
+          source: source,
+          id: id
         )
       end
 
@@ -62,8 +72,6 @@ module Mihari
       # Run rule analyzer
       #
       # @param [Mihari::Analyzer::Rule] analyzer
-      # @param [Boolean] ignore_old_artifacts
-      # @param [Integer] ignore_threshold
       #
       # @return [nil]
       #

data/lib/mihari/mixins/rule.rb

@@ -20,10 +20,12 @@ module Mihari
       end
 
       #
-      # Validate rule schema
+      # Validate rule schema and return a normalized rule
       #
       # @param [Hash] rule
       #
+      # @return [Hash]
+      #
       def validate_rule(rule)
         error_message = "Failed to parse the input as a rule!"
 
@@ -42,6 +44,8 @@ module Mihari
           puts error_message.colorize(:red)
           raise ArgumentError, "Invalid rule schema"
         end
+
+        result.to_h
       end
 
       #

data/lib/mihari/schemas/rule.rb

@@ -64,6 +64,9 @@ module Mihari
 
       optional(:allowed_data_types).value(array[DataTypes]).default(ALLOWED_DATA_TYPES)
       optional(:disallowed_data_values).value(array[:string]).default([])
+
+      optional(:ignore_old_artifacts).value(:bool).default(false)
+      optional(:ignore_threshold).value(:integer).default(0)
     end
 
     class RuleContract < Dry::Validation::Contract

data/lib/mihari/templates/rule.yml.erb

@@ -15,6 +15,9 @@ allowed_data_types: # Array<String> (Optional, defaults to ["hash", "ip", "domai
   - mail
 disallowed_data_values: [] # Array<String> (Optional, defaults to [])
 
+ignore_old_artifacts: true # Whether to ignore old artifacts from checking or not (Optional, defaults to true)
+ignore_threshold: 0 # Number of days to define whether an artifact is old or not (Optional, defaults to 0)
+
 queries: # Array<Hash> (required)
   - analyzer: shodan # String (required)
     query: ... # String (required)

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "3.3.0"
+  VERSION = "3.4.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mihari
 version: !ruby/object:Gem::Version
-  version: 3.3.0
+  version: 3.4.0
 platform: ruby
 authors:
 - Manabu Niseki
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2021-08-02 00:00:00.000000000 Z
+date: 2021-08-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler