mihari 3.6.0 → 3.7.2

data/sig/lib/mihari/emitters/base.rbs

@@ -0,0 +1,18 @@
+module Mihari
+  module Emitters
+    class Base
+      include Mixins::Configurable
+
+      include Mixins::Retriable
+
+      def self.inherited: (untyped child) -> untyped
+
+      # @return [true, false]
+      def valid?: () -> bool
+
+      def run: (**untyped params) -> void
+
+      def emit: () -> void
+    end
+  end
+end

data/sig/lib/mihari/emitters/database.rbs

@@ -0,0 +1,9 @@
+module Mihari
+  module Emitters
+    class Database < Base
+      def valid?: () -> bool
+
+      def emit: (title: String title, description: String description, artifacts: Array[Mihari::Artifact] artifacts, source: String source, ?tags: Array[String] tags) -> void
+    end
+  end
+end

data/sig/lib/mihari/emitters/misp.rbs

@@ -0,0 +1,28 @@
+module Mihari
+  module Emitters
+    class MISP < Base
+      def initialize: () -> void
+
+      # @return [true, false]
+      def valid?: () -> bool
+
+      def emit: (title: String title, artifacts: Array[Mihari::Artifact] artifacts, ?tags: Array[String] tags, **untyped _options) -> void
+
+      private
+
+      def configuration_keys: () -> ::Array["misp_api_endpoint" | "misp_api_key"]
+
+      def build_attribute: (Mihari::Artifact artifact) -> untyped
+
+      def hash_type: (String value) -> String?
+
+      def to_misp_type: (type: String `type`, value: String value) -> String?
+
+      def api_endpoint?: () -> bool
+
+      def api_key?: () -> bool
+
+      def ping?: () -> bool
+    end
+  end
+end

data/sig/lib/mihari/emitters/slack.rbs

@@ -0,0 +1,58 @@
+module Mihari
+  module Emitters
+    class Attachment
+      attr_reader data: String
+      attr_reader data_type: String
+      # include Mem
+
+      # extend Dry::Initializer
+
+      def actions: () -> Array[Hash[(String | Symbol), untyped]]
+
+      def vt_link: () -> (nil | { :type => "button", text: "VirusTotal", url: String })
+
+      def urlscan_link: () -> (nil | { :type => "button", text: "urlscan.io", url: String })
+
+      def censys_link: () -> (nil | { :type => "button", text: "Censys", url: String })
+
+      def shodan_link: () -> (nil | { :type => "button", text: "Shodan", url: String })
+
+      # @return [Array]
+      def to_a: () -> ::Array[{ text: String, fallback: "VT & urlscan.io links", actions: Array[Hash[(String | Symbol), untyped]] }]
+
+      private
+
+      # @return [String]
+      def _urlscan_link: () -> String?
+
+      # @return [String]
+      def _vt_link: () -> String?
+
+      def _censys_link: () -> String?
+
+      def _shodan_link: () -> String?
+
+      # @return [String]
+      def sha256: () -> String
+
+      # @return [String]
+      def defanged_data: () -> String
+    end
+
+    class Slack < Base
+      def notifier: () -> Mihari::Notifiers::Slack
+
+      def valid?: () -> bool
+
+      def to_attachments: (Array[Mihari::Artifact] artifacts) -> Array[Mihari::Emitters::Attachment]
+
+      def to_text: (title: String title, description: String description, ?tags: Array[String] tags) -> String
+
+      def emit: (title: String title, description: String description, artifacts: Array[Mihari::Artifact] artifacts, ?tags: Array[String] tags, **untyped _options) -> void
+
+      private
+
+      def configuration_keys: () -> ::Array["slack_webhook_url"]
+    end
+  end
+end

data/sig/lib/mihari/emitters/stdout.rbs

@@ -0,0 +1,9 @@
+module Mihari
+  module Emitters
+    class StandardOutput < Base
+      def valid?: () -> ::TrueClass
+
+      def emit: (title: String title, description: String description, artifacts: Array[Mihari::Artifact] artifacts, source: String source, tags: Array[String] tags) -> void
+    end
+  end
+end

data/sig/lib/mihari/emitters/the_hive.rbs

@@ -0,0 +1,24 @@
+module Mihari
+  module Emitters
+    class TheHive < Base
+      # @return [true, false]
+      def valid?: () -> bool
+
+      def emit: (title: untyped title, description: untyped description, artifacts: untyped artifacts, ?tags: untyped tags, **untyped _options) -> (nil | untyped)
+
+      private
+
+      def configuration_keys: () -> ::Array["thehive_api_endpoint" | "thehive_api_key"]
+
+      def api: () -> untyped
+
+      # @return [true, false]
+      def api_endpont?: () -> bool
+
+      # @return [true, false]
+      def api_key?: () -> bool
+
+      def ping?: () -> bool
+    end
+  end
+end

data/sig/lib/mihari/emitters/webhook.rbs

@@ -0,0 +1,20 @@
+module Mihari
+  module Emitters
+    class Webhook < Base
+      # @return [true, false]
+      def valid?: () -> bool
+
+      def emit: (title: String title, description: String description, artifacts: Array[Mihari::Artifact] artifacts, source: String source, tags: Array[String] tags) -> void
+
+      private
+
+      def configuration_keys: () -> ::Array["webhook_url"]
+
+      def webhook_url: () -> String?
+
+      def webhook_url?: () -> bool
+
+      def use_json_body?: () -> bool?
+    end
+  end
+end

data/sig/lib/mihari/enrichers/base.rbs

@@ -0,0 +1,12 @@
+module Mihari
+  module Enrichers
+    class Base
+      include Mixins::Configurable
+
+      def self.inherited: (untyped child) -> untyped
+
+      # @return [Boolean]
+      def valid?: () -> bool
+    end
+  end
+end

data/sig/lib/mihari/enrichers/ipinfo.rbs

@@ -0,0 +1,16 @@
+module Mihari
+  module Enrichers
+    class IPInfo
+      def valid?: () -> bool
+
+      #
+      # Query IPInfo
+      #
+      # @param [String] ip
+      #
+      # @return [Mihari::Structs::IPInfo::Response, nil]
+      #
+      def self.query: (String ip) -> Mihari::Structs::IPInfo::Response?
+    end
+  end
+end

data/sig/lib/mihari/errors.rbs

@@ -0,0 +1,10 @@
+module Mihari
+  class Error < StandardError
+  end
+
+  class InvalidInputError < Error
+  end
+
+  class RetryableError < Error
+  end
+end

data/sig/lib/mihari/mixins/autonomous_system.rbs

@@ -0,0 +1,14 @@
+module Mihari
+  module Mixins
+    module AutonomousSystem
+      #
+      # Normalize ASN value
+      #
+      # @param [String, Integer] asn
+      #
+      # @return [Integer]
+      #
+      def normalize_asn: (String | Integer asn) -> Integer
+    end
+  end
+end

data/sig/lib/mihari/mixins/configurable.rbs

@@ -0,0 +1,26 @@
+module Mihari
+  module Mixins
+    module Configurable
+      #
+      # Check whether it is configured or not
+      #
+      # @return [Boolean]
+      #
+      def configured?: () -> bool
+
+      #
+      # Configuration values
+      #
+      # @return [Array<Hash>, nil] Configuration values as a list of hash. Returns nil if there is any keys.
+      #
+      def configuration_values: () -> untyped
+
+      #
+      # Configuration keys
+      #
+      # @return [Array<String>] A list of cofiguration keys
+      #
+      def configuration_keys: () -> Array[String]
+    end
+  end
+end

data/sig/lib/mihari/mixins/configuration.rbs

@@ -0,0 +1,45 @@
+module Mihari
+  module Mixins
+    module Configuration
+      #
+      # Load config file into hash
+      #
+      # @param [String] path Path to YAML file
+      #
+      # @return [Hash]
+      #
+      def load_config: (String path) -> Hash
+
+      #
+      # Validate config schema
+      #
+      # @param [Hash] config
+      #
+      def validate_config: (Hash config) -> void
+
+      #
+      # Returns a template for config
+      #
+      # @return [String] A template for config
+      #
+      def config_template: () -> String
+
+      #
+      # Create (blank) config file
+      #
+      # @param [String] filename
+      # @param [Dry::Files] files
+      # @param [String] template
+      #
+      # @return [nil]
+      #
+      def initialize_config_yaml: (String filename, ?untyped files, ?template: String template) -> nil
+
+      private
+
+      def show_validation_errors: (untyped errors) -> void
+
+      def _load_config: (String path) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/mixins/disallowed_data_value.rbs

@@ -0,0 +1,25 @@
+module Mihari
+  module Mixins
+    module DisallowedDataValue
+      # include Mem
+
+      #
+      # Normalize a value as a disallowed data value
+      #
+      # @param [String] value Data value
+      #
+      # @return [String, Regexp] Normalized value
+      #
+      def normalize_disallowed_data_value: (String value) -> (String | Regexp)
+
+      #
+      # Check whetehr a value is valid format as a disallowed data value
+      #
+      # @param [String] value Data value
+      #
+      # @return [Boolean] true if it is valid, otherwise false
+      #
+      def valid_disallowed_data_value?: (String value) -> bool
+    end
+  end
+end

data/sig/lib/mihari/mixins/hash.rbs

@@ -0,0 +1,14 @@
+module Mihari
+  module Mixins
+    module Hash
+      #
+      # Symbolize hash keys
+      #
+      # @param [Hash] hash
+      #
+      # @return [Hash]
+      #
+      def symbolize_hash: (Hash hash) -> Hash
+    end
+  end
+end

data/sig/lib/mihari/mixins/refang.rbs

@@ -0,0 +1,14 @@
+module Mihari
+  module Mixins
+    module Refang
+      #
+      # Refang defanged indicator
+      #
+      # @param [String] indicator
+      #
+      # @return [String]
+      #
+      def refang: (String indicator) -> String
+    end
+  end
+end

data/sig/lib/mihari/mixins/retriable.rbs

@@ -0,0 +1,15 @@
+module Mihari
+  module Mixins
+    module Retriable
+      #
+      # Retry on error
+      #
+      # @param [Integer] times
+      # @param [Integer] interval
+      #
+      # @return [nil]
+      #
+      def retry_on_error: (?times: ::Integer times, ?interval: ::Integer interval) { () -> untyped } -> nil
+    end
+  end
+end

data/sig/lib/mihari/mixins/rule.rbs

@@ -0,0 +1,41 @@
+module Mihari
+  module Mixins
+    module Rule
+      #
+      # Load rule into hash
+      #
+      # @param [String] path Path to YAML file or YAML string
+      #
+      # @return [Hash]
+      #
+      def load_rule: (String path) -> Hash
+
+      #
+      # Validate rule schema and return a normalized rule
+      #
+      # @param [Hash] rule
+      #
+      # @return [Hash]
+      #
+      def validate_rule: (Hash rule) -> Hash
+
+      #
+      # Returns a template for rule
+      #
+      # @return [String] A template for rule
+      #
+      def rule_template: () -> String
+
+      #
+      # Create (blank) rule file
+      #
+      # @param [String] filename
+      # @param [Dry::Files] files
+      # @param [String] template
+      #
+      # @return [nil]
+      #
+      def initialize_rule_yaml: (String filename, ?untyped files, ?template: String template) -> nil
+    end
+  end
+end

data/sig/lib/mihari/models/alert.rbs

@@ -0,0 +1,46 @@
+module Mihari
+  class Alert < ActiveRecord::Base
+    attr_accessor title (): String
+    attr_accessor description (): String?
+    attr_accessor source (): String
+
+    attr_accessor artifacts(): Array[Mihari::Artifact]
+    attr_accessor Tags(): Array[Mihari::Tag]
+
+    #
+    # Search alerts
+    #
+    # @param [String, nil] artifact_data
+    # @param [String, nil] description
+    # @param [String, nil] source
+    # @param [String, nil] tag_name
+    # @param [String, nil] title
+    # @param [DateTime, nil] from_at
+    # @param [DateTime, nil] to_at
+    # @param [Integer, nil] limit
+    # @param [Integer, nil] page
+    #
+    # @return [Array<Hash>]
+    #
+    def self.search: (?artifact_data: String? artifact_data, ?description: String? description, ?source: String? source, ?tag_name: String? tag_name, ?title: String? title, ?from_at: DateTime? from_at, ?to_at: DateTime? to_at, ?limit: ::Integer limit, ?page: ::Integer page) -> Array[Hash[(String | Symbol), untyped]]
+
+    #
+    # Count alerts
+    #
+    # @param [String, nil] artifact_data
+    # @param [String, nil] description
+    # @param [String, nil] source
+    # @param [String, nil] tag_name
+    # @param [String, nil] title
+    # @param [DateTime, nil] from_at
+    # @param [DateTime, nil] to_at
+    #
+    # @return [Integer]
+    #
+    def self.count: (?artifact_data: String? artifact_data, ?description: String? description, ?source: String? source, ?tag_name: String? tag_name, ?title: String? title, ?from_at: DateTime? from_at, ?to_at: DateTime? to_at) -> Integer
+
+    private
+
+    def self.build_relation: (?artifact_data: String? artifact_data, ?title: String? title, ?description: String? description, ?source: String? source, ?tag_name: String? tag_name, ?from_at: DateTime? from_at, ?to_at: DateTime? to_at) -> Mihari::Alert
+  end
+end