mihari 3.4.0 → 3.6.1

data/sig/lib/mihari/emitters/stdout.rbs

@@ -0,0 +1,9 @@
+module Mihari
+  module Emitters
+    class StandardOutput < Base
+      def valid?: () -> ::TrueClass
+
+      def emit: (title: String title, description: String description, artifacts: Array[Mihari::Artifact] artifacts, source: String source, tags: Array[String] tags) -> void
+    end
+  end
+end

data/sig/lib/mihari/emitters/the_hive.rbs

@@ -0,0 +1,24 @@
+module Mihari
+  module Emitters
+    class TheHive < Base
+      # @return [true, false]
+      def valid?: () -> bool
+
+      def emit: (title: untyped title, description: untyped description, artifacts: untyped artifacts, ?tags: untyped tags, **untyped _options) -> (nil | untyped)
+
+      private
+
+      def configuration_keys: () -> ::Array["thehive_api_endpoint" | "thehive_api_key"]
+
+      def api: () -> untyped
+
+      # @return [true, false]
+      def api_endpont?: () -> bool
+
+      # @return [true, false]
+      def api_key?: () -> bool
+
+      def ping?: () -> bool
+    end
+  end
+end

data/sig/lib/mihari/emitters/webhook.rbs

@@ -0,0 +1,20 @@
+module Mihari
+  module Emitters
+    class Webhook < Base
+      # @return [true, false]
+      def valid?: () -> bool
+
+      def emit: (title: String title, description: String description, artifacts: Array[Mihari::Artifact] artifacts, source: String source, tags: Array[String] tags) -> void
+
+      private
+
+      def configuration_keys: () -> ::Array["webhook_url"]
+
+      def webhook_url: () -> String?
+
+      def webhook_url?: () -> bool
+
+      def use_json_body?: () -> bool?
+    end
+  end
+end

data/sig/lib/mihari/errors.rbs

@@ -0,0 +1,10 @@
+module Mihari
+  class Error < StandardError
+  end
+
+  class InvalidInputError < Error
+  end
+
+  class RetryableError < Error
+  end
+end

data/sig/lib/mihari/mixins/configurable.rbs

@@ -0,0 +1,26 @@
+module Mihari
+  module Mixins
+    module Configurable
+      #
+      # Check whether it is configured or not
+      #
+      # @return [Boolean]
+      #
+      def configured?: () -> bool
+
+      #
+      # Configuration values
+      #
+      # @return [Array<Hash>, nil] Configuration values as a list of hash. Returns nil if there is any keys.
+      #
+      def configuration_values: () -> untyped
+
+      #
+      # Configuration keys
+      #
+      # @return [Array<String>] A list of cofiguration keys
+      #
+      def configuration_keys: () -> Array[String]
+    end
+  end
+end

data/sig/lib/mihari/mixins/configuration.rbs

@@ -0,0 +1,45 @@
+module Mihari
+  module Mixins
+    module Configuration
+      #
+      # Load config file into hash
+      #
+      # @param [String] path Path to YAML file
+      #
+      # @return [Hash]
+      #
+      def load_config: (String path) -> Hash
+
+      #
+      # Validate config schema
+      #
+      # @param [Hash] config
+      #
+      def validate_config: (Hash config) -> void
+
+      #
+      # Returns a template for config
+      #
+      # @return [String] A template for config
+      #
+      def config_template: () -> String
+
+      #
+      # Create (blank) config file
+      #
+      # @param [String] filename
+      # @param [Dry::Files] files
+      # @param [String] template
+      #
+      # @return [nil]
+      #
+      def initialize_config_yaml: (String filename, ?untyped files, ?template: String template) -> nil
+
+      private
+
+      def show_validation_errors: (untyped errors) -> void
+
+      def _load_config: (String path) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/mixins/disallowed_data_value.rbs

@@ -0,0 +1,25 @@
+module Mihari
+  module Mixins
+    module DisallowedDataValue
+      # include Mem
+
+      #
+      # Normalize a value as a disallowed data value
+      #
+      # @param [String] value Data value
+      #
+      # @return [String, Regexp] Normalized value
+      #
+      def normalize_disallowed_data_value: (String value) -> (String | Regexp)
+
+      #
+      # Check whetehr a value is valid format as a disallowed data value
+      #
+      # @param [String] value Data value
+      #
+      # @return [Boolean] true if it is valid, otherwise false
+      #
+      def valid_disallowed_data_value?: (String value) -> bool
+    end
+  end
+end

data/sig/lib/mihari/mixins/hash.rbs

@@ -0,0 +1,14 @@
+module Mihari
+  module Mixins
+    module Hash
+      #
+      # Symbolize hash keys
+      #
+      # @param [Hash] hash
+      #
+      # @return [Hash]
+      #
+      def symbolize_hash: (Hash hash) -> Hash
+    end
+  end
+end

data/sig/lib/mihari/mixins/refang.rbs

@@ -0,0 +1,14 @@
+module Mihari
+  module Mixins
+    module Refang
+      #
+      # Refang defanged indicator
+      #
+      # @param [String] indicator
+      #
+      # @return [String]
+      #
+      def refang: (String indicator) -> String
+    end
+  end
+end

data/sig/lib/mihari/mixins/retriable.rbs

@@ -0,0 +1,15 @@
+module Mihari
+  module Mixins
+    module Retriable
+      #
+      # Retry on error
+      #
+      # @param [Integer] times
+      # @param [Integer] interval
+      #
+      # @return [nil]
+      #
+      def retry_on_error: (?times: ::Integer times, ?interval: ::Integer interval) { () -> untyped } -> nil
+    end
+  end
+end

data/sig/lib/mihari/mixins/rule.rbs

@@ -0,0 +1,41 @@
+module Mihari
+  module Mixins
+    module Rule
+      #
+      # Load rule into hash
+      #
+      # @param [String] path Path to YAML file or YAML string
+      #
+      # @return [Hash]
+      #
+      def load_rule: (String path) -> Hash
+
+      #
+      # Validate rule schema and return a normalized rule
+      #
+      # @param [Hash] rule
+      #
+      # @return [Hash]
+      #
+      def validate_rule: (Hash rule) -> Hash
+
+      #
+      # Returns a template for rule
+      #
+      # @return [String] A template for rule
+      #
+      def rule_template: () -> String
+
+      #
+      # Create (blank) rule file
+      #
+      # @param [String] filename
+      # @param [Dry::Files] files
+      # @param [String] template
+      #
+      # @return [nil]
+      #
+      def initialize_rule_yaml: (String filename, ?untyped files, ?template: String template) -> nil
+    end
+  end
+end

data/sig/lib/mihari/models/alert.rbs

@@ -0,0 +1,46 @@
+module Mihari
+  class Alert < ActiveRecord::Base
+    attr_accessor title (): String
+    attr_accessor description (): String?
+    attr_accessor source (): String
+
+    attr_accessor artifacts(): Array[Mihari::Artifact]
+    attr_accessor Tags(): Array[Mihari::Tag]
+
+    #
+    # Search alerts
+    #
+    # @param [String, nil] artifact_data
+    # @param [String, nil] description
+    # @param [String, nil] source
+    # @param [String, nil] tag_name
+    # @param [String, nil] title
+    # @param [DateTime, nil] from_at
+    # @param [DateTime, nil] to_at
+    # @param [Integer, nil] limit
+    # @param [Integer, nil] page
+    #
+    # @return [Array<Hash>]
+    #
+    def self.search: (?artifact_data: String? artifact_data, ?description: String? description, ?source: String? source, ?tag_name: String? tag_name, ?title: String? title, ?from_at: DateTime? from_at, ?to_at: DateTime? to_at, ?limit: ::Integer limit, ?page: ::Integer page) -> Array[Hash[(String | Symbol), untyped]]
+
+    #
+    # Count alerts
+    #
+    # @param [String, nil] artifact_data
+    # @param [String, nil] description
+    # @param [String, nil] source
+    # @param [String, nil] tag_name
+    # @param [String, nil] title
+    # @param [DateTime, nil] from_at
+    # @param [DateTime, nil] to_at
+    #
+    # @return [Integer]
+    #
+    def self.count: (?artifact_data: String? artifact_data, ?description: String? description, ?source: String? source, ?tag_name: String? tag_name, ?title: String? title, ?from_at: DateTime? from_at, ?to_at: DateTime? to_at) -> Integer
+
+    private
+
+    def self.build_relation: (?artifact_data: String? artifact_data, ?title: String? title, ?description: String? description, ?source: String? source, ?tag_name: String? tag_name, ?from_at: DateTime? from_at, ?to_at: DateTime? to_at) -> Mihari::Alert
+  end
+end

data/sig/lib/mihari/models/artifact.rbs

@@ -0,0 +1,54 @@
+class ArtifactValidator < ActiveModel::Validator
+  def validate: (Mihari::Artifact record) -> (nil | Mihari::Artifact)
+end
+
+module Mihari
+  class Artifact < ActiveRecord::Base
+    attr_accessor data (): String
+    attr_accessor data_type (): String
+
+    attr_accessor geolocation (): Mihari::Geolocation
+    attr_accessor whois_record(): Mihari::WhoisRecord
+    attr_accessor dns_records(): Array[Mihari::DnsRecord]
+    attr_accessor reverse_dns_names(): Array[Mihari::ReverseDnsName]
+
+    include ActiveModel::Validations
+
+    def initialize: (Hash[(String | Symbol), untyped] attributes) -> void
+
+    #
+    # Check uniqueness of artifact
+    #
+    # @param [Boolean] ignore_old_artifacts
+    # @param [Integer] ignore_threshold
+    #
+    # @return [Boolean] true if it is unique. Otherwise false.
+    #
+    def unique?: (?ignore_old_artifacts: bool ignore_old_artifacts, ?ignore_threshold: ::Integer ignore_threshold) -> (bool)
+
+    #
+    # Enrich(add) whois record
+    #
+    def enrich_whois: () -> void
+
+    #
+    # Enrich(add) DNS records
+    #
+    def enrich_dns: () -> void
+
+    #
+    # Enrich(add) reverse DNS names
+    #
+    def enrich_reverse_dns: () -> void
+
+    private
+
+    def normalize_as_domain: (String url_or_domain) -> String
+
+    def can_enrich_whois?: () -> bool
+
+    def can_enrich_dns?: () -> bool
+
+    def can_enrich_revese_dns?: () -> bool
+  end
+end

data/sig/lib/mihari/models/autonomous_system.rbs

@@ -0,0 +1,5 @@
+module Mihari
+  class AutonomousSystem < ActiveRecord::Base
+    attr_accessor asn (): Integer
+  end
+end

data/sig/lib/mihari/models/dns.rbs

@@ -0,0 +1,19 @@
+module Mihari
+  class DnsRecord < ActiveRecord::Base
+    attr_accessor resource (): String
+    attr_accessor value (): String
+
+    #
+    # Build DNS records
+    #
+    # @param [String] domain
+    #
+    # @return [Array<Mihari::DnsRecord>]
+    #
+    def self.build_by_domain: (String domain) -> Array[Mihari::DnsRecord]
+
+    private
+
+    def self.get_values: (String domain, singleton(Resolv::DNS::Query) resource_type) -> Array[Mihari::DnsRecord]
+  end
+end

data/sig/lib/mihari/models/geolocation.rbs

@@ -0,0 +1,6 @@
+module Mihari
+  class Geolocation < ActiveRecord::Base
+    attr_accessor country (): String
+    attr_accessor country_code (): String
+  end
+end

data/sig/lib/mihari/models/reverse_dns.rbs

@@ -0,0 +1,14 @@
+module Mihari
+  class ReverseDnsName < ActiveRecord::Base
+    attr_accessor name (): String
+
+    #
+    # Build reverse DNS names
+    #
+    # @param [String] ip
+    #
+    # @return [Array<Mihari::ReverseDnsName>]
+    #
+    def self.build_by_ip: (String ip) -> Array[Mihari::ReverseDnsName]
+  end
+end

data/sig/lib/mihari/models/tag.rbs

@@ -0,0 +1,5 @@
+module Mihari
+  class Tag < ActiveRecord::Base
+    attr_accessor name (): String
+  end
+end

data/sig/lib/mihari/models/tagging.rbs

@@ -0,0 +1,4 @@
+module Mihari
+  class Tagging < ActiveRecord::Base
+  end
+end

data/sig/lib/mihari/models/whois.rbs

@@ -0,0 +1,66 @@
+module Mihari
+  class WhoisRecord < ActiveRecord::Base
+    attr_accessor domain (): String
+    attr_accessor created_on (): DateTime?
+    attr_accessor updated_on (): DateTime?
+    attr_accessor expires_on (): DateTime?
+    attr_accessor registrar (): Hash[(String | Symbol), untyped]
+    attr_accessor contacts (): Array[Hash[(String | Symbol), untyped]]
+
+    #
+    # Build whois record
+    #
+    # @param [Stinrg] domain
+    #
+    # @return [WhoisRecord, nil]
+    #
+    def self.build_by_domain: (String domain) -> Mihari::WhoisRecord?
+
+    private
+
+    #
+    # Get created_on
+    #
+    # @param [::Whois::Parser:] parser
+    #
+    # @return [Date, nil]
+    #
+    def self.get_created_on: (untyped parser) -> Date?
+
+    #
+    # Get updated_on
+    #
+    # @param [::Whois::Parser:] parser
+    #
+    # @return [Date, nil]
+    #
+    def self.get_updated_on: (untyped parser) -> Date?
+
+    #
+    # Get expires_on
+    #
+    # @param [::Whois::Parser:] parser
+    #
+    # @return [Date, nil]
+    #
+    def self.get_expires_on: (untyped parser) -> Date?
+
+    #
+    # Get registrar
+    #
+    # @param [::Whois::Parser:] parser
+    #
+    # @return [Hash, nil]
+    #
+    def self.get_registrar: (untyped parser) -> Hash[(String | Symbol), untyped]?
+
+    #
+    # Get contacts
+    #
+    # @param [::Whois::Parser:] parser
+    #
+    # @return [Array[Hash[(String | Symbol), untyped]], nil]
+    #
+    def self.get_contacts: (untyped parser) -> Array[Hash[(String | Symbol), untyped]]?
+  end
+end