mihari 3.6.0 → 3.6.1

data/lib/mihari/analyzers/shodan.rb

@@ -33,6 +33,14 @@ module Mihari
         @api ||= ::Shodan::API.new(key: Mihari.config.shodan_api_key)
       end
 
+      #
+      # Search with pagination
+      #
+      # @param [String] query
+      # @param [Integer] page
+      #
+      # @return [Hash]
+      #
       def search_with_page(query, page: 1)
         api.host.search(query, page: page)
       rescue ::Shodan::Error => e
@@ -41,6 +49,11 @@ module Mihari
         raise e
       end
 
+      #
+      # Search
+      #
+      # @return [Array<Hash>]
+      #
       def search
         responses = []
         (1..Float::INFINITY).each do |page|

data/lib/mihari/analyzers/spyse.rb

@@ -30,10 +30,20 @@ module Mihari
         @api ||= ::Spyse::API.new(Mihari.config.spyse_api_key)
       end
 
+      #
+      # Check whether a type is valid or not
+      #
+      # @return [Boolean]
+      #
       def valid_type?
         %w[ip domain cert].include? type
       end
 
+      #
+      # Domain search
+      #
+      # @return [Array<String>]
+      #
       def domain_search
         res = api.domain.search(search_params, limit: 100)
         items = res.dig("data", "items") || []
@@ -42,6 +52,11 @@ module Mihari
         end.uniq.compact
       end
 
+      #
+      # IP search
+      #
+      # @return [Array<String>]
+      #
       def ip_search
         res = api.ip.search(search_params, limit: 100)
         items = res.dig("data", "items") || []
@@ -50,6 +65,11 @@ module Mihari
         end.uniq.compact
       end
 
+      #
+      # IP/domain search
+      #
+      # @return [Array<String>]
+      #
       def search
         case type
         when "domain"

data/lib/mihari/analyzers/urlscan.rb

@@ -43,12 +43,22 @@ module Mihari
         @api ||= ::UrlScan::API.new(Mihari.config.urlscan_api_key)
       end
 
+      #
+      # Search
+      #
+      # @return [Array<Hash>]
+      #
       def search
         return api.pro.similar(query) if use_similarity
 
         api.search(query, size: 10_000)
       end
 
+      #
+      # Check whether a data type is valid or not
+      #
+      # @return [Boolean]
+      #
       def valid_alllowed_data_types?
         allowed_data_types.all? { |type| SUPPORTED_DATA_TYPES.include? type }
       end

data/lib/mihari/analyzers/virustotal.rb

@@ -35,10 +35,20 @@ module Mihari
         @api = ::VirusTotal::API.new(key: Mihari.config.virustotal_api_key)
       end
 
+      #
+      # Check whether a type is valid or not
+      #
+      # @return [Boolean]
+      #
       def valid_type?
         %w[ip domain].include? type
       end
 
+      #
+      # Search
+      #
+      # @return [Array<String>]
+      #
       def search
         case type
         when "domain"
@@ -50,6 +60,11 @@ module Mihari
         end
       end
 
+      #
+      # Domain search
+      #
+      # @return [Array<String>]
+      #
       def domain_search
         res = api.domain.resolutions(query)
 
@@ -59,6 +74,11 @@ module Mihari
         end.uniq
       end
 
+      #
+      # IP search
+      #
+      # @return [Array<String>]
+      #
       def ip_search
         res = api.ip_address.resolutions(query)
 

data/lib/mihari/analyzers/zoomeye.rb

@@ -26,6 +26,11 @@ module Mihari
 
       PAGE_SIZE = 10
 
+      #
+      # Check whether a type is valid or not
+      #
+      # @return [Boolean]
+      #
       def valid_type?
         %w[host web].include? type
       end
@@ -38,6 +43,13 @@ module Mihari
         @api ||= ::ZoomEye::API.new(api_key: Mihari.config.zoomeye_api_key)
       end
 
+      #
+      # Convert responses into an array of String
+      #
+      # @param [Array<Hash>] responses
+      #
+      # @return [Array<String>]
+      #
       def convert_responses(responses)
         responses.map do |res|
           matches = res["matches"] || []
@@ -47,12 +59,25 @@ module Mihari
         end.flatten.compact.uniq
       end
 
+      #
+      # Host search
+      #
+      # @param [String] query
+      # @param [Integer] page
+      #
+      # @return [Hash, nil]
+      #
       def _host_search(query, page: 1)
         api.host.search(query, page: page)
       rescue ::ZoomEye::Error => _e
         nil
       end
 
+      #
+      # Host search
+      #
+      # @return [Array<String>]
+      #
       def host_search
         responses = []
         (1..Float::INFINITY).each do |page|
@@ -66,12 +91,25 @@ module Mihari
         convert_responses responses.compact
       end
 
+      #
+      # Web search
+      #
+      # @param [String] query
+      # @param [Integer] page
+      #
+      # @return [Hash, nil]
+      #
       def _web_search(query, page: 1)
         api.web.search(query, page: page)
       rescue ::ZoomEye::Error => _e
         nil
       end
 
+      #
+      # Web search
+      #
+      # @return [Array<String>]
+      #
       def web_search
         responses = []
         (1..Float::INFINITY).each do |page|

data/lib/mihari/emitters/base.rb

@@ -10,7 +10,7 @@ module Mihari
         Mihari.emitters << child
       end
 
-      # @return [true, false]
+      # @return [Boolean]
       def valid?
         raise NotImplementedError, "You must implement #{self.class}##{__method__}"
       end

data/lib/mihari/emitters/misp.rb

@@ -15,7 +15,7 @@ module Mihari
         end
       end
 
-      # @return [true, false]
+      # @return [Boolean]
       def valid?
         api_endpoint? && api_key? && ping?
       end
@@ -42,10 +42,24 @@ module Mihari
         %w[misp_api_endpoint misp_api_key]
       end
 
+      #
+      # Build a MISP attribute
+      #
+      # @param [Mihari::Artifact] artifact
+      #
+      # @return [::MISP::Attribute] <description>
+      #
       def build_attribute(artifact)
         ::MISP::Attribute.new(value: artifact.data, type: to_misp_type(type: artifact.data_type, value: artifact.data))
       end
 
+      #
+      # Get a type of a hash
+      #
+      # @param [String] value
+      #
+      # @return [String]
+      #
       def hash_type(value)
         case value.length
         when 32
@@ -59,6 +73,14 @@ module Mihari
         end
       end
 
+      #
+      # Convert a type to a MISP type
+      #
+      # @param [String] type
+      # @param [String] value
+      #
+      # @return [String]
+      #
       def to_misp_type(type:, value:)
         type = type.to_sym
         table = {
@@ -72,20 +94,31 @@ module Mihari
         hash_type value
       end
 
-      def create_attribute(artifact)
-        artifact.data_type
-      end
-
+      #
+      # Check whether an API endpoint is set or not
+      #
+      # @return [Boolean]
+      #
       def api_endpoint?
         api_endpoint = ::MISP.configuration.api_endpoint
         !api_endpoint.nil? && !api_endpoint.empty?
       end
 
+      #
+      # Check whether an API key is set or not
+      #
+      # @return [Boolean]
+      #
       def api_key?
         api_key = ::MISP.configuration.api_key
         !api_key.nil? && !api_key.empty?
       end
 
+      #
+      # Check whether an API endpoint is reachable or not
+      #
+      # @return [Boolean]
+      #
       def ping?
         base_url = ::MISP.configuration.api_endpoint
         base_url = base_url.end_with?("/") ? base_url[0..-2] : base_url

data/lib/mihari/emitters/slack.rb

@@ -55,7 +55,7 @@ module Mihari
 
       private
 
-      # @return [String]
+      # @return [String, nil]
       def _urlscan_link
         case data_type
         when "ip"
@@ -69,7 +69,7 @@ module Mihari
       end
       memoize :_urlscan_link
 
-      # @return [String]
+      # @return [String, nil]
       def _vt_link
         case data_type
         when "hash"
@@ -86,11 +86,13 @@ module Mihari
       end
       memoize :_vt_link
 
+      # @return [String, nil]
       def _censys_link
         data_type == "ip" ? "https://search.censys.io/hosts/#{data}" : nil
       end
       memoize :_censys_link
 
+      # @return [String, nil]
       def _shodan_link
         data_type == "ip" ? "https://www.shodan.io/host/#{data}" : nil
       end
@@ -116,12 +118,28 @@ module Mihari
         notifier.valid?
       end
 
+      #
+      # Build attachements
+      #
+      # @param [Array<Mihari::Artifact>] artifacts
+      #
+      # @return [Array<Mihari::Emitters::Attachment>]
+      #
       def to_attachments(artifacts)
         artifacts.map do |artifact|
           Attachment.new(data: artifact.data, data_type: artifact.data_type).to_a
         end.flatten
       end
 
+      #
+      # Build a text
+      #
+      # @param [String] title
+      # @param [String] description
+      # @param [Array<String>] tags
+      #
+      # @return [String]
+      #
       def to_text(title:, description:, tags: [])
         tags = ["N/A"] if tags.empty?
 

data/lib/mihari/emitters/the_hive.rb

@@ -6,7 +6,7 @@ require "net/ping"
 module Mihari
   module Emitters
     class TheHive < Base
-      # @return [true, false]
+      # @return [Boolean]
       def valid?
         api_endpont? && api_key? && ping?
       end
@@ -34,16 +34,29 @@ module Mihari
         @api ||= Hachi::API.new(api_endpoint: Mihari.config.thehive_api_endpoint, api_key: Mihari.config.thehive_api_key)
       end
 
-      # @return [true, false]
+      #
+      # Check whether an API endpoint is set or not
+      #
+      # @return [Boolean]
+      #
       def api_endpont?
         !Mihari.config.thehive_api_endpoint.nil?
       end
 
-      # @return [true, false]
+      #
+      # Check whether an API key is set or not
+      #
+      # @return [Boolean]
+      # ]
       def api_key?
         !Mihari.config.thehive_api_key.nil?
       end
 
+      #
+      # Check whether an API endpoint is reachable or not
+      #
+      # @return [Boolean]
+      #
       def ping?
         base_url = Mihari.config.thehive_api_endpoint
         base_url = base_url.end_with?("/") ? base_url[0..-2] : base_url

data/lib/mihari/emitters/webhook.rb

@@ -7,7 +7,7 @@ require "uri"
 module Mihari
   module Emitters
     class Webhook < Base
-      # @return [true, false]
+      # @return [Boolean]
       def valid?
         webhook_url?
       end
@@ -24,7 +24,7 @@ module Mihari
           tags: tags
         }
 
-        if use_json_body
+        if use_json_body?
           Net::HTTP.post(uri, data.to_json, "Content-Type" => "application/json")
         else
           Net::HTTP.post_form(uri, data)
@@ -37,15 +37,30 @@ module Mihari
         %w[webhook_url]
       end
 
+      #
+      # Webhook URL
+      #
+      # @return [String, nil]
+      #
       def webhook_url
         @webhook_url ||= Mihari.config.webhook_url
       end
 
+      #
+      # Check whether a webhook URL is set or not
+      #
+      # @return [<Type>] <description>
+      #
       def webhook_url?
         !webhook_url.nil?
       end
 
-      def use_json_body
+      #
+      # Check whether to use JSON body or NOT
+      #
+      # @return [<Type>] <description>
+      #
+      def use_json_body?
         @use_json_body ||= Mihari.config.webhook_use_json_body
       end
     end