mihari 3.6.0 → 3.7.2

data/sig/lib/mihari/models/artifact.rbs

@@ -0,0 +1,65 @@
+class ArtifactValidator < ActiveModel::Validator
+  def validate: (Mihari::Artifact record) -> (nil | Mihari::Artifact)
+end
+
+module Mihari
+  class Artifact < ActiveRecord::Base
+    attr_accessor data (): String
+    attr_accessor data_type (): String
+
+    attr_accessor autonomous_system(): Mihari::AutonomousSystem
+    attr_accessor geolocation (): Mihari::Geolocation
+    attr_accessor whois_record(): Mihari::WhoisRecord
+    attr_accessor dns_records(): Array[Mihari::DnsRecord]
+    attr_accessor reverse_dns_names(): Array[Mihari::ReverseDnsName]
+
+    include ActiveModel::Validations
+
+    def initialize: (Hash[(String | Symbol), untyped] attributes) -> void
+
+    #
+    # Check uniqueness of artifact
+    #
+    # @param [Boolean] ignore_old_artifacts
+    # @param [Integer] ignore_threshold
+    #
+    # @return [Boolean] true if it is unique. Otherwise false.
+    #
+    def unique?: (?ignore_old_artifacts: bool ignore_old_artifacts, ?ignore_threshold: ::Integer ignore_threshold) -> (bool)
+
+    #
+    # Enrich(add) whois record
+    #
+    def enrich_whois: () -> void
+
+    #
+    # Enrich(add) DNS records
+    #
+    def enrich_dns: () -> void
+
+    #
+    # Enrich(add) reverse DNS names
+    #
+    def enrich_reverse_dns: () -> void
+
+    def enrich_geolocation: () -> void
+
+    def enrich_autonomous_system: () -> void
+
+    def enrich_all: () -> void
+
+    private
+
+    def normalize_as_domain: (String url_or_domain) -> String
+
+    def can_enrich_whois?: () -> bool
+
+    def can_enrich_dns?: () -> bool
+
+    def can_enrich_revese_dns?: () -> bool
+
+    def can_enrich_geolocation?: () -> bool
+
+    def can_enrich_autonomous_system?: () -> bool
+  end
+end

data/sig/lib/mihari/models/autonomous_system.rbs

@@ -0,0 +1,14 @@
+module Mihari
+  class AutonomousSystem < ActiveRecord::Base
+    attr_accessor asn (): Integer
+
+    #
+    # Build AS by IP
+    #
+    # @param [String] ip
+    #
+    # @return [Mihari::AutonomousSystem]
+    #
+    def self.build_by_ip: (String ip) -> Mihari::AutonomousSystem?
+  end
+end

data/sig/lib/mihari/models/dns.rbs

@@ -0,0 +1,19 @@
+module Mihari
+  class DnsRecord < ActiveRecord::Base
+    attr_accessor resource (): String
+    attr_accessor value (): String
+
+    #
+    # Build DNS records
+    #
+    # @param [String] domain
+    #
+    # @return [Array<Mihari::DnsRecord>]
+    #
+    def self.build_by_domain: (String domain) -> Array[Mihari::DnsRecord]
+
+    private
+
+    def self.get_values: (String domain, singleton(Resolv::DNS::Query) resource_type) -> Array[Mihari::DnsRecord]
+  end
+end

data/sig/lib/mihari/models/geolocation.rbs

@@ -0,0 +1,15 @@
+module Mihari
+  class Geolocation < ActiveRecord::Base
+    attr_accessor country (): String
+    attr_accessor country_code (): String
+
+    #
+    # Build geolocation by IP
+    #
+    # @param [String] ip
+    #
+    # @return [Mihari::Geolocation]
+    #
+    def self.build_by_ip: (String ip) -> Mihari::Geolocation?
+  end
+end

data/sig/lib/mihari/models/reverse_dns.rbs

@@ -0,0 +1,14 @@
+module Mihari
+  class ReverseDnsName < ActiveRecord::Base
+    attr_accessor name (): String
+
+    #
+    # Build reverse DNS names
+    #
+    # @param [String] ip
+    #
+    # @return [Array<Mihari::ReverseDnsName>]
+    #
+    def self.build_by_ip: (String ip) -> Array[Mihari::ReverseDnsName]
+  end
+end

data/sig/lib/mihari/models/tag.rbs

@@ -0,0 +1,5 @@
+module Mihari
+  class Tag < ActiveRecord::Base
+    attr_accessor name (): String
+  end
+end

data/sig/lib/mihari/models/tagging.rbs

@@ -0,0 +1,4 @@
+module Mihari
+  class Tagging < ActiveRecord::Base
+  end
+end

data/sig/lib/mihari/models/whois.rbs

@@ -0,0 +1,66 @@
+module Mihari
+  class WhoisRecord < ActiveRecord::Base
+    attr_accessor domain (): String
+    attr_accessor created_on (): DateTime?
+    attr_accessor updated_on (): DateTime?
+    attr_accessor expires_on (): DateTime?
+    attr_accessor registrar (): Hash[(String | Symbol), untyped]
+    attr_accessor contacts (): Array[Hash[(String | Symbol), untyped]]
+
+    #
+    # Build whois record
+    #
+    # @param [Stinrg] domain
+    #
+    # @return [WhoisRecord, nil]
+    #
+    def self.build_by_domain: (String domain) -> Mihari::WhoisRecord?
+
+    private
+
+    #
+    # Get created_on
+    #
+    # @param [::Whois::Parser:] parser
+    #
+    # @return [Date, nil]
+    #
+    def self.get_created_on: (untyped parser) -> Date?
+
+    #
+    # Get updated_on
+    #
+    # @param [::Whois::Parser:] parser
+    #
+    # @return [Date, nil]
+    #
+    def self.get_updated_on: (untyped parser) -> Date?
+
+    #
+    # Get expires_on
+    #
+    # @param [::Whois::Parser:] parser
+    #
+    # @return [Date, nil]
+    #
+    def self.get_expires_on: (untyped parser) -> Date?
+
+    #
+    # Get registrar
+    #
+    # @param [::Whois::Parser:] parser
+    #
+    # @return [Hash, nil]
+    #
+    def self.get_registrar: (untyped parser) -> Hash[(String | Symbol), untyped]?
+
+    #
+    # Get contacts
+    #
+    # @param [::Whois::Parser:] parser
+    #
+    # @return [Array[Hash[(String | Symbol), untyped]], nil]
+    #
+    def self.get_contacts: (untyped parser) -> Array[Hash[(String | Symbol), untyped]]?
+  end
+end

data/sig/lib/mihari/notifiers/base.rbs

@@ -0,0 +1,18 @@
+module Mihari
+  module Notifiers
+    class Base
+      # Validate notifier availability
+      #
+      # @return [Boolean]
+      #
+      def valid?: () -> bool
+
+      #
+      # Send a notification
+      #
+      # @return [nil]
+      #
+      def notify: () -> void
+    end
+  end
+end

data/sig/lib/mihari/notifiers/exception_notifier.rbs

@@ -0,0 +1,75 @@
+module Mihari
+  module Notifiers
+    class ExceptionNotifier
+      def initialize: () -> void
+
+      def valid?: () -> bool
+
+      def notify: (Exception exception) -> void
+
+      #
+      # Send notification to Slack
+      #
+      # @param [String] text
+      # @param [Array<Hash>] attachments
+      #
+      # @return [nil]
+      #
+      def notify_to_slack: (text: String text, attachments: Array[Hash[(String | Symbol), untyped]] attachments) -> void
+
+      #
+      # Send notification to STDOUT
+      #
+      # @param [Exception] exception
+      #
+      # @return [nil]
+      #
+      def notify_to_stdout: (Exception exception) -> void
+
+      #
+      # Convert exception to attachments (for Slack)
+      #
+      # @param [Exception] exception
+      # @param [String] clean_message
+      #
+      # @return [Array<Hash>]
+      #
+      def to_attachments: (Exception exception, String clean_message) -> ::Array[{ color: untyped, text: untyped, fields: untyped, :mrkdwn_in => ::Array["text" | "fields"] }]
+
+      #
+      # Convert exception class to text
+      #
+      # @param [Class<Exception>] exception_class
+      #
+      # @return [String]
+      #
+      def to_text: (singleton(Exception) exception_class) -> ::String
+
+      #
+      # Convert clean_message and backtrace into fields (for Slack)
+      #
+      # @param [String] clean_message
+      # @param [Array] backtrace
+      #
+      # @return [Array<Hash>]
+      #
+      def to_fields: (String clean_message, untyped backtrace) -> Array[Hash[(String | Symbol), untyped]]
+
+      #
+      # Hostname of runnning instance
+      #
+      # @return [String]
+      #
+      def hostname: () -> String
+
+      #
+      # Format backtrace in string
+      #
+      # @param [Array] backtrace
+      #
+      # @return [String]
+      #
+      def format_backtrace: (untyped backtrace) -> (nil | ::String)
+    end
+  end
+end

data/sig/lib/mihari/notifiers/slack.rbs

@@ -0,0 +1,50 @@
+module Mihari
+  module Notifiers
+    class Slack < Base
+      SLACK_WEBHOOK_URL_KEY: ::String
+
+      SLACK_CHANNEL_KEY: ::String
+
+      DEFAULT_USERNAME: ::String
+
+      #
+      # Slack channel to post
+      #
+      # @return [String]
+      #
+      def slack_channel: () -> String
+
+      #
+      # Slack webhook URL
+      #
+      # @return [String]
+      #
+      def slack_webhook_url: () -> String
+
+      #
+      # Check Slack webhook URL is set
+      #
+      # @return [Boolean]
+      #
+      def slack_webhook_url?: () -> bool
+
+      #
+      # Check Slack webhook URL is set. Alias of #slack_webhook_url?.
+      #
+      # @return [Boolean]
+      #
+      def valid?: () -> bool
+
+      #
+      # Send notification to Slack
+      #
+      # @param [String] text
+      # @param [Array<Hash>] attachments
+      # @param [Boolean] mrkdwn
+      #
+      # @return [nil]
+      #
+      def notify: (text: String text, ?attachments: Array[Hash[(String | Symbol), untyped]] attachments, ?mrkdwn: bool mrkdwn) -> untyped
+    end
+  end
+end

data/sig/lib/mihari/status.rbs

@@ -0,0 +1,25 @@
+module Mihari
+  class Status
+    def check: () -> Array[Hash[(String | Symbol), untyped]]
+
+    def self.check: () -> Array[Hash[(String | Symbol), untyped]]
+
+    private
+
+    #
+    # Statuses of analyzers and emitters
+    #
+    # @return [Array<Hash>]
+    #
+    def statuses: () -> Array[Hash[(String | Symbol), untyped]]
+
+    #
+    # Build a status of a class
+    #
+    # @param [Class<Mihari::Analyzers::Base>, Class<Mihari::Emitters::Base>] klass
+    #
+    # @return [Hash, nil]
+    #
+    def build_status: (singleton(Mihari::Analyzers::Base) | singleton(Mihari::Emitters::Base)) -> Hash[(String|Symbol), untyped]?
+  end
+end

data/sig/lib/mihari/structs/censys.rbs

@@ -0,0 +1,50 @@
+module Mihari
+  module Structs
+    module Censys
+      class AutonomousSystem
+        attr_reader asn: Integer
+
+        def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::Censys::AutonomousSystem
+      end
+
+      class Location
+        attr_reader country: String
+        attr_reader country_code: String
+
+        def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::Censys::Location
+      end
+
+      class Hit
+        attr_reader ip: String
+        attr_reader location: Mihari::Structs::Censys::Location
+        attr_reader autonomous_system: Mihari::Structs::Censys::AutonomousSystem
+
+        def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::Censys::Hit
+      end
+
+      class Links
+        attr_reader next: String
+        attr_reader prev: String
+
+        def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::Censys::Links
+      end
+
+      class Result
+        attr_reader query: String
+        attr_reader total: Integer
+        attr_reader hits: Array[Mihari::Structs::Censys::Hit]
+        attr_reader links: Mihari::Structs::Censys::Links
+
+        def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::Censys::Result
+      end
+
+      class Response
+        attr_reader code: Integer
+        attr_reader status: String
+        attr_reader result: Mihari::Structs::Censys::Result
+
+        def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::Censys::Response
+      end
+    end
+  end
+end

data/sig/lib/mihari/structs/ipinfo.rbs

@@ -0,0 +1,17 @@
+module Mihari
+  module Structs
+    module IPInfo
+      class Response
+        attr_reader ip: String
+        attr_reader hostname: String?
+        attr_reader loc: String
+        attr_reader country_code: String
+        attr_reader asn: Integer?
+
+        def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::IPInfo::Response
+
+        def to_hash: () -> Hash[(String | Symbol), untyped]
+      end
+    end
+  end
+end