mihari 3.6.0 → 3.7.2

data/lib/mihari/analyzers/securitytrails.rb

@@ -35,10 +35,20 @@ module Mihari
         @api ||= ::SecurityTrails::API.new(Mihari.config.securitytrails_api_key)
       end
 
+      #
+      # Check whether a type is valid or not
+      #
+      # @return [Boolean]
+      #
       def valid_type?
         %w[ip domain mail].include? type
       end
 
+      #
+      # IP/domain/mail search
+      #
+      # @return [Array<String>]
+      #
       def search
         case type
         when "domain"
@@ -52,6 +62,11 @@ module Mihari
         end
       end
 
+      #
+      # Domain search
+      #
+      # @return [Array<String>]
+      #
       def domain_search
         result = api.history.get_all_dns_history(query, type: "a")
         records = result["records"] || []
@@ -60,12 +75,22 @@ module Mihari
         end.flatten.compact.uniq
       end
 
+      #
+      # IP search
+      #
+      # @return [Array<String>]
+      #
       def ip_search
         result = api.domains.search(filter: { ipv4: query })
         records = result["records"] || []
         records.filter_map { |record| record["hostname"] }.uniq
       end
 
+      #
+      # Mail search
+      #
+      # @return [Array<String>]
+      #
       def mail_search
         result = api.domains.search(filter: { whois_email: query })
         records = result["records"] || []

data/lib/mihari/analyzers/shodan.rb

@@ -33,6 +33,14 @@ module Mihari
         @api ||= ::Shodan::API.new(key: Mihari.config.shodan_api_key)
       end
 
+      #
+      # Search with pagination
+      #
+      # @param [String] query
+      # @param [Integer] page
+      #
+      # @return [Hash]
+      #
       def search_with_page(query, page: 1)
         api.host.search(query, page: page)
       rescue ::Shodan::Error => e
@@ -41,6 +49,11 @@ module Mihari
         raise e
       end
 
+      #
+      # Search
+      #
+      # @return [Array<Hash>]
+      #
       def search
         responses = []
         (1..Float::INFINITY).each do |page|

data/lib/mihari/analyzers/spyse.rb

@@ -30,10 +30,20 @@ module Mihari
         @api ||= ::Spyse::API.new(Mihari.config.spyse_api_key)
       end
 
+      #
+      # Check whether a type is valid or not
+      #
+      # @return [Boolean]
+      #
       def valid_type?
         %w[ip domain cert].include? type
       end
 
+      #
+      # Domain search
+      #
+      # @return [Array<String>]
+      #
       def domain_search
         res = api.domain.search(search_params, limit: 100)
         items = res.dig("data", "items") || []
@@ -42,6 +52,11 @@ module Mihari
         end.uniq.compact
       end
 
+      #
+      # IP search
+      #
+      # @return [Array<String>]
+      #
       def ip_search
         res = api.ip.search(search_params, limit: 100)
         items = res.dig("data", "items") || []
@@ -50,6 +65,11 @@ module Mihari
         end.uniq.compact
       end
 
+      #
+      # IP/domain search
+      #
+      # @return [Array<String>]
+      #
       def search
         case type
         when "domain"

data/lib/mihari/analyzers/urlscan.rb

@@ -43,12 +43,22 @@ module Mihari
         @api ||= ::UrlScan::API.new(Mihari.config.urlscan_api_key)
       end
 
+      #
+      # Search
+      #
+      # @return [Array<Hash>]
+      #
       def search
         return api.pro.similar(query) if use_similarity
 
         api.search(query, size: 10_000)
       end
 
+      #
+      # Check whether a data type is valid or not
+      #
+      # @return [Boolean]
+      #
       def valid_alllowed_data_types?
         allowed_data_types.all? { |type| SUPPORTED_DATA_TYPES.include? type }
       end

data/lib/mihari/analyzers/virustotal.rb

@@ -35,10 +35,20 @@ module Mihari
         @api = ::VirusTotal::API.new(key: Mihari.config.virustotal_api_key)
       end
 
+      #
+      # Check whether a type is valid or not
+      #
+      # @return [Boolean]
+      #
       def valid_type?
         %w[ip domain].include? type
       end
 
+      #
+      # Search
+      #
+      # @return [Array<String>]
+      #
       def search
         case type
         when "domain"
@@ -50,6 +60,11 @@ module Mihari
         end
       end
 
+      #
+      # Domain search
+      #
+      # @return [Array<String>]
+      #
       def domain_search
         res = api.domain.resolutions(query)
 
@@ -59,6 +74,11 @@ module Mihari
         end.uniq
       end
 
+      #
+      # IP search
+      #
+      # @return [Array<String>]
+      #
       def ip_search
         res = api.ip_address.resolutions(query)
 

data/lib/mihari/analyzers/zoomeye.rb

@@ -26,6 +26,11 @@ module Mihari
 
       PAGE_SIZE = 10
 
+      #
+      # Check whether a type is valid or not
+      #
+      # @return [Boolean]
+      #
       def valid_type?
         %w[host web].include? type
       end
@@ -38,6 +43,13 @@ module Mihari
         @api ||= ::ZoomEye::API.new(api_key: Mihari.config.zoomeye_api_key)
       end
 
+      #
+      # Convert responses into an array of String
+      #
+      # @param [Array<Hash>] responses
+      #
+      # @return [Array<String>]
+      #
       def convert_responses(responses)
         responses.map do |res|
           matches = res["matches"] || []
@@ -47,12 +59,25 @@ module Mihari
         end.flatten.compact.uniq
       end
 
+      #
+      # Host search
+      #
+      # @param [String] query
+      # @param [Integer] page
+      #
+      # @return [Hash, nil]
+      #
       def _host_search(query, page: 1)
         api.host.search(query, page: page)
       rescue ::ZoomEye::Error => _e
         nil
       end
 
+      #
+      # Host search
+      #
+      # @return [Array<String>]
+      #
       def host_search
         responses = []
         (1..Float::INFINITY).each do |page|
@@ -66,12 +91,25 @@ module Mihari
         convert_responses responses.compact
       end
 
+      #
+      # Web search
+      #
+      # @param [String] query
+      # @param [Integer] page
+      #
+      # @return [Hash, nil]
+      #
       def _web_search(query, page: 1)
         api.web.search(query, page: page)
       rescue ::ZoomEye::Error => _e
         nil
       end
 
+      #
+      # Web search
+      #
+      # @return [Array<String>]
+      #
       def web_search
         responses = []
         (1..Float::INFINITY).each do |page|

data/lib/mihari/database.rb

@@ -74,6 +74,17 @@ class EnrichmentsSchema < ActiveRecord::Migration[6.1]
   end
 end
 
+class EnrichmentCreatedAtSchema < ActiveRecord::Migration[6.1]
+  def change
+    # Add created_at column because now it is able to enrich an atrifact after the creation
+    add_column :autonomous_systems, :created_at, :datetime, if_not_exists: true
+    add_column :geolocations, :created_at, :datetime, if_not_exists: true
+    add_column :whois_records, :created_at, :datetime, if_not_exists: true
+    add_column :dns_records, :created_at, :datetime, if_not_exists: true
+    add_column :reverse_dns_names, :created_at, :datetime, if_not_exists: true
+  end
+end
+
 def adapter
   return "postgresql" if Mihari.config.database.start_with?("postgresql://", "postgres://")
   return "mysql2" if Mihari.config.database.start_with?("mysql2://")
@@ -101,6 +112,7 @@ module Mihari
         InitialSchema.migrate(:up)
         AddeSourceToArtifactSchema.migrate(:up)
         EnrichmentsSchema.migrate(:up)
+        EnrichmentCreatedAtSchema.migrate(:up)
       rescue StandardError
         # Do nothing
       end
@@ -116,6 +128,7 @@ module Mihari
         InitialSchema.migrate(:down)
         AddeSourceToArtifactSchema.migrate(:down)
         EnrichmentsSchema.migrate(:down)
+        EnrichmentCreatedAtSchema.migrate(:down)
       end
     end
   end

data/lib/mihari/emitters/base.rb

@@ -10,7 +10,7 @@ module Mihari
         Mihari.emitters << child
       end
 
-      # @return [true, false]
+      # @return [Boolean]
       def valid?
         raise NotImplementedError, "You must implement #{self.class}##{__method__}"
       end

data/lib/mihari/emitters/misp.rb

@@ -15,7 +15,7 @@ module Mihari
         end
       end
 
-      # @return [true, false]
+      # @return [Boolean]
       def valid?
         api_endpoint? && api_key? && ping?
       end
@@ -42,10 +42,24 @@ module Mihari
         %w[misp_api_endpoint misp_api_key]
       end
 
+      #
+      # Build a MISP attribute
+      #
+      # @param [Mihari::Artifact] artifact
+      #
+      # @return [::MISP::Attribute] <description>
+      #
       def build_attribute(artifact)
         ::MISP::Attribute.new(value: artifact.data, type: to_misp_type(type: artifact.data_type, value: artifact.data))
       end
 
+      #
+      # Get a type of a hash
+      #
+      # @param [String] value
+      #
+      # @return [String]
+      #
       def hash_type(value)
         case value.length
         when 32
@@ -59,6 +73,14 @@ module Mihari
         end
       end
 
+      #
+      # Convert a type to a MISP type
+      #
+      # @param [String] type
+      # @param [String] value
+      #
+      # @return [String]
+      #
       def to_misp_type(type:, value:)
         type = type.to_sym
         table = {
@@ -72,20 +94,31 @@ module Mihari
         hash_type value
       end
 
-      def create_attribute(artifact)
-        artifact.data_type
-      end
-
+      #
+      # Check whether an API endpoint is set or not
+      #
+      # @return [Boolean]
+      #
       def api_endpoint?
         api_endpoint = ::MISP.configuration.api_endpoint
         !api_endpoint.nil? && !api_endpoint.empty?
       end
 
+      #
+      # Check whether an API key is set or not
+      #
+      # @return [Boolean]
+      #
       def api_key?
         api_key = ::MISP.configuration.api_key
         !api_key.nil? && !api_key.empty?
       end
 
+      #
+      # Check whether an API endpoint is reachable or not
+      #
+      # @return [Boolean]
+      #
       def ping?
         base_url = ::MISP.configuration.api_endpoint
         base_url = base_url.end_with?("/") ? base_url[0..-2] : base_url

data/lib/mihari/emitters/slack.rb

@@ -55,7 +55,7 @@ module Mihari
 
       private
 
-      # @return [String]
+      # @return [String, nil]
       def _urlscan_link
         case data_type
         when "ip"
@@ -69,7 +69,7 @@ module Mihari
       end
       memoize :_urlscan_link
 
-      # @return [String]
+      # @return [String, nil]
       def _vt_link
         case data_type
         when "hash"
@@ -86,11 +86,13 @@ module Mihari
       end
       memoize :_vt_link
 
+      # @return [String, nil]
       def _censys_link
         data_type == "ip" ? "https://search.censys.io/hosts/#{data}" : nil
       end
       memoize :_censys_link
 
+      # @return [String, nil]
       def _shodan_link
         data_type == "ip" ? "https://www.shodan.io/host/#{data}" : nil
       end
@@ -116,12 +118,28 @@ module Mihari
         notifier.valid?
       end
 
+      #
+      # Build attachements
+      #
+      # @param [Array<Mihari::Artifact>] artifacts
+      #
+      # @return [Array<Mihari::Emitters::Attachment>]
+      #
       def to_attachments(artifacts)
         artifacts.map do |artifact|
           Attachment.new(data: artifact.data, data_type: artifact.data_type).to_a
         end.flatten
       end
 
+      #
+      # Build a text
+      #
+      # @param [String] title
+      # @param [String] description
+      # @param [Array<String>] tags
+      #
+      # @return [String]
+      #
       def to_text(title:, description:, tags: [])
         tags = ["N/A"] if tags.empty?