mihari 3.4.0 → 3.6.1

data/sig/lib/mihari/cli/init.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module CLI
+    class Initialization < Base
+      include Mihari::Commands::Initialization
+    end
+  end
+end

data/sig/lib/mihari/cli/main.rbs

@@ -0,0 +1,9 @@
+module Mihari
+  module CLI
+    class Main < Base
+      include Mihari::Commands::Search
+
+      include Mihari::Commands::Web
+    end
+  end
+end

data/sig/lib/mihari/cli/mixins/utils.rbs

@@ -0,0 +1,50 @@
+module Mihari
+  module CLI
+    module Mixins
+      module Utils
+        #
+        # Send an exception notification if there is any error in a block
+        #
+        # @return [Nil]
+        #
+        def with_error_handling: () { () -> untyped } -> void
+
+        #
+        # Check required keys in JSON
+        #
+        # @param [Hash] json
+        #
+        # @return [Boolean]
+        #
+        def required_alert_keys?: (Hash[(String | Symbol), untyped] json) -> bool
+
+        #
+        # Load configuration and establish DB connection
+        #
+        # @return [Hash]
+        #
+        def load_configuration: () -> Hash[(String | Symbol), untyped]
+
+        #
+        # Run analyzer
+        #
+        # @param [Class<Mihari::Analyzers::Base>] analyzer_class
+        # @param [String] query
+        # @param [Hash] options
+        #
+        # @return [nil]
+        #
+        def run_analyzer: (untyped analyzer_class, query: String query, options: untyped options) -> void
+
+        #
+        # Normalize options (reject keys not for analyzers)
+        #
+        # @param [Hash] options
+        #
+        # @return [Hash]
+        #
+        def normalize_options: (Hash[(String | Symbol), untyped] options) -> Hash[(String | Symbol), untyped]
+      end
+    end
+  end
+end

data/sig/lib/mihari/cli/validator.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module CLI
+    class Validator < Base
+      include Mihari::Commands::Validator
+    end
+  end
+end

data/sig/lib/mihari/commands/binaryedge.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module BinaryEdge
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/censys.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module Censys
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/circl.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module CIRCL
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/crtsh.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module Crtsh
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/dnpedia.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module DNPedia
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/dnstwister.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module DNSTwister
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/init.rbs

@@ -0,0 +1,11 @@
+module Mihari
+  module Commands
+    module Initialization
+      include Mixins::Configuration
+
+      include Mixins::Rule
+
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/json.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module JSON
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/onyphe.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module Onyphe
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/otx.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module OTX
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/passivetotal.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module PassiveTotal
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/pulsedive.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module Pulsedive
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/search.rbs

@@ -0,0 +1,35 @@
+module Mihari
+  module Commands
+    module Search
+      include Mixins::Rule
+
+      def self.included: (untyped thor) -> untyped
+
+      private
+
+      #
+      # Build a rule analyzer
+      #
+      # @param [String] title
+      # @param [String] description
+      # @param [Array<Hash>] queries
+      # @param [Array<String>, nil] tags
+      # @param [Array<String>, nil] allowed_data_types
+      # @param [Array<String>, nil] disallowed_data_values
+      # @param [String, nil] source
+      #
+      # @return [Mihari::Analyzers::Rule]
+      #
+      def build_rule_analyzer: (title: String title, description: String description, queries: Array[Hash[(String | Symbol), untyped]] queries, ?tags: Array[String]? tags, ?allowed_data_types: Array[String]? allowed_data_types, ?disallowed_data_values: Array[String]? disallowed_data_values, ?source: String? source, ?id: String? id) -> Mihari::Analyzers::Rule
+
+      #
+      # Run rule analyzer
+      #
+      # @param [Mihari::Analyzer::Rule] analyzer
+      #
+      # @return [nil]
+      #
+      def run_rule_analyzer: (Mihari::Analyzers::Rule analyzer, ?ignore_old_artifacts: bool ignore_old_artifacts, ?ignore_threshold: ::Integer ignore_threshold) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/securitytrails.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module SecurityTrails
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/shodan.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module Shodan
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/spyse.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module Spyse
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/urlscan.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module Urlscan
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/validator.rbs

@@ -0,0 +1,11 @@
+module Mihari
+  module Commands
+    module Validator
+      include Mixins::Rule
+
+      include Mixins::Configuration
+
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/virustotal.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module VirusTotal
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/web.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module Web
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/commands/zoomeye.rbs

@@ -0,0 +1,7 @@
+module Mihari
+  module Commands
+    module ZoomEye
+      def self.included: (untyped thor) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/constants.rbs

@@ -0,0 +1,3 @@
+module Mihari
+  ALLOWED_DATA_TYPES: Array[String]
+end

data/sig/lib/mihari/database.rbs

@@ -0,0 +1,25 @@
+class InitialSchema
+  def change: () -> void
+end
+
+class AddeSourceToArtifactSchema
+  def change: () -> void
+end
+
+class EnrichmentsSchema
+  def change: () -> void
+end
+
+module Mihari
+  class Database
+    def self.connect: () -> void
+
+    def self.close: () -> void
+
+    def self.destroy!: () -> void
+  end
+end
+
+class Object
+  def adapter: () -> ("postgresql" | "mysql2" | "sqlite3")
+end

data/sig/lib/mihari/emitters/base.rbs

@@ -0,0 +1,18 @@
+module Mihari
+  module Emitters
+    class Base
+      include Mixins::Configurable
+
+      include Mixins::Retriable
+
+      def self.inherited: (untyped child) -> untyped
+
+      # @return [true, false]
+      def valid?: () -> bool
+
+      def run: (**untyped params) -> void
+
+      def emit: () -> void
+    end
+  end
+end

data/sig/lib/mihari/emitters/database.rbs

@@ -0,0 +1,9 @@
+module Mihari
+  module Emitters
+    class Database < Base
+      def valid?: () -> bool
+
+      def emit: (title: String title, description: String description, artifacts: Array[Mihari::Artifact] artifacts, source: String source, ?tags: Array[String] tags) -> void
+    end
+  end
+end

data/sig/lib/mihari/emitters/misp.rbs

@@ -0,0 +1,28 @@
+module Mihari
+  module Emitters
+    class MISP < Base
+      def initialize: () -> void
+
+      # @return [true, false]
+      def valid?: () -> bool
+
+      def emit: (title: String title, artifacts: Array[Mihari::Artifact] artifacts, ?tags: Array[String] tags, **untyped _options) -> void
+
+      private
+
+      def configuration_keys: () -> ::Array["misp_api_endpoint" | "misp_api_key"]
+
+      def build_attribute: (Mihari::Artifact artifact) -> untyped
+
+      def hash_type: (String value) -> String?
+
+      def to_misp_type: (type: String `type`, value: String value) -> String?
+
+      def api_endpoint?: () -> bool
+
+      def api_key?: () -> bool
+
+      def ping?: () -> bool
+    end
+  end
+end

data/sig/lib/mihari/emitters/slack.rbs

@@ -0,0 +1,58 @@
+module Mihari
+  module Emitters
+    class Attachment
+      attr_reader data: String
+      attr_reader data_type: String
+      # include Mem
+
+      # extend Dry::Initializer
+
+      def actions: () -> Array[Hash[(String | Symbol), untyped]]
+
+      def vt_link: () -> (nil | { :type => "button", text: "VirusTotal", url: String })
+
+      def urlscan_link: () -> (nil | { :type => "button", text: "urlscan.io", url: String })
+
+      def censys_link: () -> (nil | { :type => "button", text: "Censys", url: String })
+
+      def shodan_link: () -> (nil | { :type => "button", text: "Shodan", url: String })
+
+      # @return [Array]
+      def to_a: () -> ::Array[{ text: String, fallback: "VT & urlscan.io links", actions: Array[Hash[(String | Symbol), untyped]] }]
+
+      private
+
+      # @return [String]
+      def _urlscan_link: () -> String?
+
+      # @return [String]
+      def _vt_link: () -> String?
+
+      def _censys_link: () -> String?
+
+      def _shodan_link: () -> String?
+
+      # @return [String]
+      def sha256: () -> String
+
+      # @return [String]
+      def defanged_data: () -> String
+    end
+
+    class Slack < Base
+      def notifier: () -> Mihari::Notifiers::Slack
+
+      def valid?: () -> bool
+
+      def to_attachments: (Array[Mihari::Artifact] artifacts) -> Array[Mihari::Emitters::Attachment]
+
+      def to_text: (title: String title, description: String description, ?tags: Array[String] tags) -> String
+
+      def emit: (title: String title, description: String description, artifacts: Array[Mihari::Artifact] artifacts, ?tags: Array[String] tags, **untyped _options) -> void
+
+      private
+
+      def configuration_keys: () -> ::Array["slack_webhook_url"]
+    end
+  end
+end