mihari 3.9.2 → 3.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c12a4ec4b0c1eee79deba3e5f3a511edcea4a13d7d72dc8142dbd85821095f55
-  data.tar.gz: 4a1e388e55efff4b715caf2261990e6122afd4eb26aca0874a33d3025a16ba5b
+  metadata.gz: c4d53239fe8be60cdc674dc22c14f801147a71144649cec83f4fd3caaf2c99fa
+  data.tar.gz: 71b9b3746164b1f3eec9b98a807a6940e85a9184991efd7dd9abe5bd9b3f3578
 SHA512:
-  metadata.gz: 8ead20235892bf77e222eff200f25539ffdd68cd21d14c5000d9196e518b9d2da2b461a2fe5d3dae4bc4bd899fb210f5f75b6330afad61826bc84dcfe40af23f
-  data.tar.gz: 4b5679794091a79adb426ef34c5396819c702d67ad84791dec1430eba0f007d1dcab5f7defc53b5dab06e8a0e174963c777fb05606f79a5f16c4377f07847f75
+  metadata.gz: 6bee10443bd55e0ac483e8495c508bcce95dc56073aeb99f6c1566f38fb73707140baa838c07212c39795017d109aef8e9478f560bc3d04a21cbb949a48c9b61
+  data.tar.gz: c35f757168a737c37dcbf9a54d0408eabdfbf807a7a57db77c59c10f9a5b803d6731c615f3360db93b05647ee5e6cdcd35518baf4a7a7efe8d73e198d7f2664e

data/lib/mihari/analyzers/greynoise.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require "greynoise"
+
+module Mihari
+  module Analyzers
+    class GreyNoise < Base
+      param :query
+      option :title, default: proc { "GreyNoise search" }
+      option :description, default: proc { "query = #{query}" }
+      option :tags, default: proc { [] }
+
+      def artifacts
+        res = Structs::GreyNoise::Response.from_dynamic!(search)
+        res.data.map do |datum|
+          build_artifact datum
+        end
+      end
+
+      private
+
+      PAGE_SIZE = 10_000
+
+      def configuration_keys
+        %w[greynoise_api_key]
+      end
+
+      def api
+        @api ||= ::GreyNoise::API.new(key: Mihari.config.greynoise_api_key)
+      end
+
+      #
+      # Search
+      #
+      # @return [Hash]
+      #
+      def search
+        api.experimental.gnql(query, size: PAGE_SIZE)
+      end
+
+      #
+      # Build an artifact from a GreyNoise search API response
+      #
+      # @param [Structs::GreyNoise::Datum] datum
+      #
+      # @return [Artifact]
+      #
+      def build_artifact(datum)
+        as = AutonomousSystem.new(asn: normalize_asn(datum.metadata.asn))
+
+        geolocation = Geolocation.new(
+          country: datum.metadata.country,
+          country_code: datum.metadata.country_code
+        )
+
+        Artifact.new(
+          data: datum.ip,
+          source: source,
+          autonomous_system: as,
+          geolocation: geolocation
+        )
+      end
+    end
+  end
+end

data/lib/mihari/analyzers/rule.rb

@@ -11,6 +11,7 @@ module Mihari
       "crtsh" => Crtsh,
       "dnpedia" => DNPedia,
       "dnstwister" => DNSTwister,
+      "greynoise" => GreyNoise,
       "onyphe" => Onyphe,
       "otx" => OTX,
       "passivetotal" => PassiveTotal,

data/lib/mihari/analyzers/shodan.rb

@@ -78,7 +78,9 @@ module Mihari
       # @return [Artifact]
       #
       def build_artifact(match)
-        as = AutonomousSystem.new(asn: normalize_asn(match.asn))
+        as = nil
+        as = AutonomousSystem.new(asn: normalize_asn(match.asn)) unless match.asn.nil?
+
         geolocation = Geolocation.new(
           country: match.location.country_name,
           country_code: match.location.country_code

data/lib/mihari/cli/analyzer.rb

@@ -6,6 +6,7 @@ require "mihari/commands/circl"
 require "mihari/commands/crtsh"
 require "mihari/commands/dnpedia"
 require "mihari/commands/dnstwister"
+require "mihari/commands/greynoise"
 require "mihari/commands/onyphe"
 require "mihari/commands/otx"
 require "mihari/commands/passivetotal"
@@ -33,6 +34,7 @@ module Mihari
       include Mihari::Commands::Crtsh
       include Mihari::Commands::DNPedia
       include Mihari::Commands::DNSTwister
+      include Mihari::Commands::GreyNoise
       include Mihari::Commands::JSON
       include Mihari::Commands::Onyphe
       include Mihari::Commands::OTX

data/lib/mihari/commands/greynoise.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Mihari
+  module Commands
+    module GreyNoise
+      def self.included(thor)
+        thor.class_eval do
+          desc "greynoise [QUERY]", "GreyNoise search"
+          method_option :title, type: :string, desc: "title"
+          method_option :description, type: :string, desc: "description"
+          method_option :tags, type: :array, desc: "tags"
+          def greynoise(query)
+            with_error_handling do
+              run_analyzer Analyzers::GreyNoise, query: query, options: options
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mihari/schemas/configuration.rb

@@ -13,6 +13,8 @@ module Mihari
       optional(:censys_secret).value(:string)
       optional(:circl_passive_password).value(:string)
       optional(:circl_passive_username).value(:string)
+      optional(:database).value(:string)
+      optional(:greynoise_api_key).value(:string)
       optional(:ipinfo_api_key).value(:string)
       optional(:misp_api_endpoint).value(:string)
       optional(:misp_api_key).value(:string)
@@ -30,10 +32,9 @@ module Mihari
       optional(:thehive_api_key).value(:string)
       optional(:urlscan_api_key).value(:string)
       optional(:virustotal_api_key).value(:string)
-      optional(:zoomeye_api_key).value(:string)
       optional(:webhook_url).value(:string)
       optional(:webhook_use_json_body).value(:bool)
-      optional(:database).value(:string)
+      optional(:zoomeye_api_key).value(:string)
     end
 
     class ConfigurationContract < Dry::Validation::Contract

data/lib/mihari/structs/greynoise.rb

@@ -0,0 +1,55 @@
+require "json"
+require "dry/struct"
+
+module Mihari
+  module Structs
+    module GreyNoise
+      class Metadata < Dry::Struct
+        attribute :country, Types::String
+        attribute :country_code, Types::String
+        attribute :asn, Types::String
+
+        def self.from_dynamic!(d)
+          d = Types::Hash[d]
+          new(
+            country: d.fetch("country"),
+            country_code: d.fetch("country_code"),
+            asn: d.fetch("asn")
+          )
+        end
+      end
+
+      class Datum < Dry::Struct
+        attribute :ip, Types::String
+        attribute :metadata, Metadata
+
+        def self.from_dynamic!(d)
+          d = Types::Hash[d]
+          new(
+            ip: d.fetch("ip"),
+            metadata: Metadata.from_dynamic!(d.fetch("metadata"))
+          )
+        end
+      end
+
+      class Response < Dry::Struct
+        attribute :complete, Types::Bool
+        attribute :count, Types::Int
+        attribute :data, Types.Array(Datum)
+        attribute :message, Types::String
+        attribute :query, Types::String
+
+        def self.from_dynamic!(d)
+          d = Types::Hash[d]
+          new(
+            complete: d.fetch("complete"),
+            count: d.fetch("count"),
+            data: d.fetch("data").map { |x| Datum.from_dynamic!(x) },
+            message: d.fetch("message"),
+            query: d.fetch("query")
+          )
+        end
+      end
+    end
+  end
+end

data/lib/mihari/structs/shodan.rb

@@ -18,7 +18,7 @@ module Mihari
       end
 
       class Match < Dry::Struct
-        attribute :asn, Types::String
+        attribute :asn, Types::String.optional
         attribute :hostnames, Types.Array(Types::String)
         attribute :location, Location
         attribute :domains, Types.Array(Types::String)
@@ -27,7 +27,7 @@ module Mihari
         def self.from_dynamic!(d)
           d = Types::Hash[d]
           new(
-            asn: d.fetch("asn"),
+            asn: d["asn"],
             hostnames: d.fetch("hostnames"),
             location: Location.from_dynamic!(d.fetch("location")),
             domains: d.fetch("domains"),

data/lib/mihari/types.rb

@@ -19,6 +19,7 @@ module Mihari
       "circl",
       "dnpedia",
       "dnstwister",
+      "greynoise",
       "onyphe",
       "otx",
       "passivetotal",

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "3.9.2"
+  VERSION = "3.10.0"
 end

data/lib/mihari/web/public/index.html

@@ -1 +1 @@
-<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="icon" href="/static/favicon.ico"><title>Mihari</title><link href="/static/js/app.14008741.js" rel="preload" as="script"></head><body><noscript><strong>We're sorry but Mihari doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div><script src="/static/js/app.14008741.js"></script></body></html>
+<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,initial-scale=1"><link rel="icon" href="/static/favicon.ico"><title>Mihari</title><link href="/static/js/app.0a0cc502.js" rel="preload" as="script"></head><body><noscript><strong>We're sorry but Mihari doesn't work properly without JavaScript enabled. Please enable it to continue.</strong></noscript><div id="app"></div><script src="/static/js/app.0a0cc502.js"></script></body></html>