mihari 3.6.0 → 3.7.2

data/lib/mihari/emitters/the_hive.rb

@@ -6,7 +6,7 @@ require "net/ping"
 module Mihari
   module Emitters
     class TheHive < Base
-      # @return [true, false]
+      # @return [Boolean]
       def valid?
         api_endpont? && api_key? && ping?
       end
@@ -34,16 +34,29 @@ module Mihari
         @api ||= Hachi::API.new(api_endpoint: Mihari.config.thehive_api_endpoint, api_key: Mihari.config.thehive_api_key)
       end
 
-      # @return [true, false]
+      #
+      # Check whether an API endpoint is set or not
+      #
+      # @return [Boolean]
+      #
       def api_endpont?
         !Mihari.config.thehive_api_endpoint.nil?
       end
 
-      # @return [true, false]
+      #
+      # Check whether an API key is set or not
+      #
+      # @return [Boolean]
+      # ]
       def api_key?
         !Mihari.config.thehive_api_key.nil?
       end
 
+      #
+      # Check whether an API endpoint is reachable or not
+      #
+      # @return [Boolean]
+      #
       def ping?
         base_url = Mihari.config.thehive_api_endpoint
         base_url = base_url.end_with?("/") ? base_url[0..-2] : base_url

data/lib/mihari/emitters/webhook.rb

@@ -7,7 +7,7 @@ require "uri"
 module Mihari
   module Emitters
     class Webhook < Base
-      # @return [true, false]
+      # @return [Boolean]
       def valid?
         webhook_url?
       end
@@ -24,7 +24,7 @@ module Mihari
           tags: tags
         }
 
-        if use_json_body
+        if use_json_body?
           Net::HTTP.post(uri, data.to_json, "Content-Type" => "application/json")
         else
           Net::HTTP.post_form(uri, data)
@@ -37,15 +37,30 @@ module Mihari
         %w[webhook_url]
       end
 
+      #
+      # Webhook URL
+      #
+      # @return [String, nil]
+      #
       def webhook_url
         @webhook_url ||= Mihari.config.webhook_url
       end
 
+      #
+      # Check whether a webhook URL is set or not
+      #
+      # @return [<Type>] <description>
+      #
       def webhook_url?
         !webhook_url.nil?
       end
 
-      def use_json_body
+      #
+      # Check whether to use JSON body or NOT
+      #
+      # @return [<Type>] <description>
+      #
+      def use_json_body?
         @use_json_body ||= Mihari.config.webhook_use_json_body
       end
     end

data/lib/mihari/enrichers/base.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Mihari
+  module Enrichers
+    class Base
+      include Mixins::Configurable
+
+      def self.inherited(child)
+        Mihari.enrichers << child
+      end
+
+      # @return [Boolean]
+      def valid?
+        raise NotImplementedError, "You must implement #{self.class}##{__method__}"
+      end
+    end
+  end
+end

data/lib/mihari/enrichers/ipinfo.rb

@@ -0,0 +1,49 @@
+require "http"
+require "json"
+require "memist"
+
+module Mihari
+  module Enrichers
+    class IPInfo < Base
+      # @return [Boolean]
+      def valid?
+        Mihari.config.ipinfo_api_key.nil?
+      end
+
+      private
+
+      def configuration_keys
+        %w[ipinfo_api_key]
+      end
+
+      class << self
+        include Memist::Memoizable
+
+        #
+        # Query IPInfo
+        #
+        # @param [String] ip
+        #
+        # @return [Mihari::Structs::IPInfo::Response, nil]
+        #
+        def query(ip)
+          headers = {}
+          token = Mihari.config.ipinfo_api_key
+          unless token.nil?
+            headers[:authorization] = "Bearer #{token}"
+          end
+
+          begin
+            res = HTTP.headers(headers).get("https://ipinfo.io/#{ip}/json")
+            data = JSON.parse(res.body.to_s)
+
+            Structs::IPInfo::Response.from_dynamic! data
+          rescue HTTP::Error
+            nil
+          end
+        end
+        memoize :query
+      end
+    end
+  end
+end

data/lib/mihari/mixins/autonomous_system.rb

@@ -0,0 +1,19 @@
+module Mihari
+  module Mixins
+    module AutonomousSystem
+      #
+      # Normalize ASN value
+      #
+      # @param [String, Integer] asn
+      #
+      # @return [Integer]
+      #
+      def normalize_asn(asn)
+        return asn if asn.is_a?(Integer)
+        return asn.to_i unless asn.start_with?("AS")
+
+        asn.delete_prefix("AS").to_i
+      end
+    end
+  end
+end

data/lib/mihari/mixins/disallowed_data_value.rb

@@ -17,7 +17,7 @@ module Mihari
 
         # if a value is surrounded by slashes, take it as a regexp
         value_without_slashes = value[1..-2]
-        Regexp.compile value_without_slashes
+        Regexp.compile value_without_slashes.to_s
       end
 
       memoize :normalize_disallowed_data_value

data/lib/mihari/models/artifact.rb

@@ -16,6 +16,8 @@ end
 
 module Mihari
   class Artifact < ActiveRecord::Base
+    belongs_to :alert
+
     has_one :autonomous_system, dependent: :destroy
     has_one :geolocation, dependent: :destroy
     has_one :whois_record, dependent: :destroy
@@ -80,6 +82,35 @@ module Mihari
       self.reverse_dns_names = ReverseDnsName.build_by_ip(data)
     end
 
+    #
+    # Enrich(add) geolocation
+    #
+    def enrich_geolocation
+      return unless can_enrich_geolocation?
+
+      self.geolocation = Geolocation.build_by_ip(data)
+    end
+
+    #
+    # Enrich(add) geolocation
+    #
+    def enrich_autonomous_system
+      return unless can_enrich_autonomous_system?
+
+      self.autonomous_system = AutonomousSystem.build_by_ip(data)
+    end
+
+    #
+    # Enrich all the enrichable relationships of the artifact
+    #
+    def enrich_all
+      enrich_autonomous_system
+      enrich_dns
+      enrich_geolocation
+      enrich_reverse_dns
+      enrich_whois
+    end
+
     private
 
     def normalize_as_domain(url_or_domain)
@@ -89,15 +120,23 @@ module Mihari
     end
 
     def can_enrich_whois?
-      %w[domain url].include? data_type
+      %w[domain url].include?(data_type) && whois_record.nil?
     end
 
     def can_enrich_dns?
-      %w[domain url].include? data_type
+      %w[domain url].include?(data_type) && dns_records.empty?
     end
 
     def can_enrich_revese_dns?
-      data_type == "ip"
+      data_type == "ip" && reverse_dns_names.empty?
+    end
+
+    def can_enrich_geolocation?
+      data_type == "ip" && geolocation.nil?
+    end
+
+    def can_enrich_autonomous_system?
+      data_type == "ip" && autonomous_system.nil?
     end
   end
 end

data/lib/mihari/models/autonomous_system.rb

@@ -4,6 +4,23 @@ require "active_record"
 
 module Mihari
   class AutonomousSystem < ActiveRecord::Base
-    has_one :artifact, dependent: :destroy
+    belongs_to :artifact
+
+    class << self
+      #
+      # Build AS
+      #
+      # @param [String] ip
+      #
+      # @return [Mihari::AutonomousSystem, nil]
+      #
+      def build_by_ip(ip)
+        res = Enrichers::IPInfo.query(ip)
+
+        return nil if res.nil? || res.asn.nil?
+
+        new(asn: res.asn)
+      end
+    end
   end
 end

data/lib/mihari/models/dns.rb

@@ -5,6 +5,8 @@ require "resolv"
 
 module Mihari
   class DnsRecord < ActiveRecord::Base
+    belongs_to :artifact
+
     class << self
       #
       # Build DNS records

data/lib/mihari/models/geolocation.rb

@@ -1,9 +1,29 @@
 # frozen_string_literal: true
 
 require "active_record"
+require "normalize_country"
 
 module Mihari
   class Geolocation < ActiveRecord::Base
-    has_one :artifact, dependent: :destroy
+    belongs_to :artifact
+
+    class << self
+      #
+      # Build Geolocation
+      #
+      # @param [String] ip
+      #
+      # @return [Mihari::Geolocation, nil]
+      #
+      def build_by_ip(ip)
+        res = Enrichers::IPInfo.query(ip)
+
+        unless res.nil?
+          return new(country: NormalizeCountry(res.country_code, to: :short), country_code: res.country_code)
+        end
+
+        nil
+      end
+    end
   end
 end

data/lib/mihari/models/reverse_dns.rb

@@ -5,6 +5,8 @@ require "resolv"
 
 module Mihari
   class ReverseDnsName < ActiveRecord::Base
+    belongs_to :artifact
+
     class << self
       #
       # Build reverse DNS names

data/lib/mihari/models/whois.rb

@@ -6,7 +6,7 @@ require "public_suffix"
 
 module Mihari
   class WhoisRecord < ActiveRecord::Base
-    has_one :artifact, dependent: :destroy
+    belongs_to :artifact
 
     @memo = {}
 

data/lib/mihari/status.rb

@@ -18,7 +18,7 @@ module Mihari
     # @return [Array<Hash>]
     #
     def statuses
-      (Mihari.analyzers + Mihari.emitters).map do |klass|
+      (Mihari.analyzers + Mihari.emitters + Mihari.enrichers).map do |klass|
         name = klass.to_s.split("::").last.to_s
 
         [name, build_status(klass)]
@@ -36,11 +36,16 @@ module Mihari
       return nil if klass == Mihari::Analyzers::Rule
 
       is_analyzer = klass.ancestors.include?(Mihari::Analyzers::Base)
+      is_emitter = klass.ancestors.include?(Mihari::Emitters::Base)
+      is_enricher = klass.ancestors.include?(Mihari::Enrichers::Base)
 
       instance = is_analyzer ? klass.new("dummy") : klass.new
       is_configured = instance.configured?
       values = instance.configuration_values
-      type = is_analyzer ? "Analyzer" : "Emitter"
+
+      type = "Analyzer"
+      type = "Emitter" if is_emitter
+      type = "Enricher" if is_enricher
 
       values ? { is_configured: is_configured, values: values, type: type } : nil
     rescue ArgumentError => _e

data/lib/mihari/structs/ipinfo.rb

@@ -0,0 +1,39 @@
+require "json"
+require "dry/struct"
+
+module Mihari
+  module Structs
+    module IPInfo
+      class Response < Dry::Struct
+        attribute :ip, Types::String
+        attribute :hostname, Types::String.optional
+        attribute :loc, Types::String
+        attribute :country_code, Types::String
+        attribute :asn, Types::Integer.optional
+
+        class << self
+          include Mixins::AutonomousSystem
+
+          def from_dynamic!(d)
+            d = Types::Hash[d]
+
+            asn = nil
+            org = d["org"]
+            unless org.nil?
+              asn = org.split.first
+              asn = normalize_asn(asn)
+            end
+
+            new(
+              ip: d.fetch("ip"),
+              loc: d.fetch("loc"),
+              hostname: d["hostname"],
+              country_code: d.fetch("country"),
+              asn: asn
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mihari/structs/onyphe.rb

@@ -6,7 +6,7 @@ module Mihari
     module Onyphe
       class Result < Dry::Struct
         attribute :asn, Types::String
-        attribute :country_code, Types::String
+        attribute :country_code, Types::String.optional
         attribute :ip, Types::String
 
         def self.from_dynamic!(d)
@@ -15,7 +15,7 @@ module Mihari
             asn: d.fetch("asn"),
             ip: d.fetch("ip"),
             # Onyphe's country = 2-letter country code
-            country_code: d.fetch("country")
+            country_code: d["country"]
           )
         end
       end

data/lib/mihari/type_checker.rb

@@ -18,12 +18,12 @@ module Mihari
       raise ArgumentError if data.is_a?(Hash)
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def hash?
       md5? || sha1? || sha256? || sha512?
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def ip?
       IPAddr.new data
       true
@@ -31,7 +31,7 @@ module Mihari
       false
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def domain?
       uri = Addressable::URI.parse("http://#{data}")
       uri.host == data && PublicSuffix.valid?(uri.host)
@@ -39,7 +39,7 @@ module Mihari
       false
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def url?
       uri = Addressable::URI.parse(data)
       uri.scheme && uri.host && uri.path && PublicSuffix.valid?(uri.host)
@@ -47,7 +47,7 @@ module Mihari
       false
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def mail?
       EmailAddress.valid? data, host_validation: :syntax
     end
@@ -83,22 +83,22 @@ module Mihari
 
     private
 
-    # @return [true, false]
+    # @return [Boolean]
     def md5?
       data.match?(/^[A-Fa-f0-9]{32}$/)
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def sha1?
       data.match?(/^[A-Fa-f0-9]{40}$/)
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def sha256?
       data.match?(/^[A-Fa-f0-9]{64}$/)
     end
 
-    # @return [true, false]
+    # @return [Boolean]
     def sha512?
       data.match?(/^[A-Fa-f0-9]{128}$/)
     end