mihari 4.11.0 → 5.0.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (154) hide show
  1. checksums.yaml +4 -4
  2. data/.github/workflows/test.yml +1 -1
  3. data/README.md +13 -3
  4. data/Steepfile +0 -1
  5. data/build_frontend.sh +0 -3
  6. data/docker/Dockerfile +11 -12
  7. data/images/Tines-Full_Logo-Tines_Black.png +0 -0
  8. data/lib/mihari/analyzers/base.rb +12 -28
  9. data/lib/mihari/analyzers/rule.rb +23 -36
  10. data/lib/mihari/cli/main.rb +6 -11
  11. data/lib/mihari/commands/initializer.rb +47 -0
  12. data/lib/mihari/commands/{search.rb → searcher.rb} +9 -20
  13. data/lib/mihari/commands/validator.rb +2 -2
  14. data/lib/mihari/commands/web.rb +4 -2
  15. data/lib/mihari/constants.rb +3 -3
  16. data/lib/mihari/database.rb +52 -87
  17. data/lib/mihari/emitters/database.rb +16 -7
  18. data/lib/mihari/emitters/misp.rb +13 -5
  19. data/lib/mihari/emitters/slack.rb +15 -8
  20. data/lib/mihari/emitters/the_hive.rb +42 -21
  21. data/lib/mihari/emitters/webhook.rb +99 -31
  22. data/lib/mihari/entities/alert.rb +7 -5
  23. data/lib/mihari/entities/artifact.rb +20 -8
  24. data/lib/mihari/entities/config.rb +2 -6
  25. data/lib/mihari/entities/rule.rb +8 -0
  26. data/lib/mihari/http.rb +13 -13
  27. data/lib/mihari/mixins/{disallowed_data_value.rb → falsepositive.rb} +8 -8
  28. data/lib/mihari/models/alert.rb +2 -15
  29. data/lib/mihari/models/artifact.rb +28 -17
  30. data/lib/mihari/models/rule.rb +7 -13
  31. data/lib/mihari/schemas/emitter.rb +6 -8
  32. data/lib/mihari/schemas/rule.rb +11 -13
  33. data/lib/mihari/structs/config.rb +41 -0
  34. data/lib/mihari/structs/filters.rb +2 -2
  35. data/lib/mihari/structs/rule.rb +96 -83
  36. data/lib/mihari/templates/rule.yml.erb +5 -23
  37. data/lib/mihari/types.rb +1 -1
  38. data/lib/mihari/version.rb +1 -1
  39. data/lib/mihari/web/api.rb +0 -2
  40. data/lib/mihari/web/app.rb +10 -4
  41. data/lib/mihari/web/endpoints/alerts.rb +11 -3
  42. data/lib/mihari/web/endpoints/configs.rb +1 -6
  43. data/lib/mihari/web/endpoints/rules.rb +27 -15
  44. data/lib/mihari/web/public/assets/{fa-brands-400.c7ae37d3.ttf → fa-brands-400-2ef6fdde.ttf} +0 -0
  45. data/lib/mihari/web/public/assets/fa-brands-400-f4617423.woff2 +0 -0
  46. data/lib/mihari/web/public/assets/fa-regular-400-12dea17b.ttf +0 -0
  47. data/lib/mihari/web/public/assets/fa-regular-400-7ba24c41.woff2 +0 -0
  48. data/lib/mihari/web/public/assets/fa-solid-900-67a880b4.ttf +0 -0
  49. data/lib/mihari/web/public/assets/fa-solid-900-e2c5cf54.woff2 +0 -0
  50. data/lib/mihari/web/public/assets/fa-v4compatibility-7c377405.woff2 +0 -0
  51. data/lib/mihari/web/public/assets/fa-v4compatibility-8d9500e8.ttf +0 -0
  52. data/lib/mihari/web/public/assets/{index.e1e67d84.css → index-625e95fe.css} +3 -3
  53. data/lib/mihari/web/public/assets/index-63900d73.js +50 -0
  54. data/lib/mihari/web/public/index.html +3 -3
  55. data/lib/mihari/web/public/redoc-static.html +26 -27
  56. data/lib/mihari.rb +11 -21
  57. data/mihari.gemspec +14 -14
  58. metadata +46 -131
  59. data/lib/mihari/cli/init.rb +0 -11
  60. data/lib/mihari/cli/validator.rb +0 -11
  61. data/lib/mihari/commands/init.rb +0 -51
  62. data/lib/mihari/emitters/http.rb +0 -127
  63. data/lib/mihari/entities/source.rb +0 -9
  64. data/lib/mihari/status.rb +0 -55
  65. data/lib/mihari/web/endpoints/sources.rb +0 -19
  66. data/lib/mihari/web/public/assets/fa-brands-400.3fe890d0.woff2 +0 -0
  67. data/lib/mihari/web/public/assets/fa-regular-400.fdc1f753.ttf +0 -0
  68. data/lib/mihari/web/public/assets/fa-regular-400.fe69d948.woff2 +0 -0
  69. data/lib/mihari/web/public/assets/fa-solid-900.6d53c706.ttf +0 -0
  70. data/lib/mihari/web/public/assets/fa-solid-900.d27bc752.woff2 +0 -0
  71. data/lib/mihari/web/public/assets/fa-v4compatibility.4d73f280.ttf +0 -0
  72. data/lib/mihari/web/public/assets/fa-v4compatibility.7d1c2ce5.woff2 +0 -0
  73. data/lib/mihari/web/public/assets/index.d3a61a69.js +0 -68
  74. data/sig/lib/mihari/analyzers/base.rbs +0 -90
  75. data/sig/lib/mihari/analyzers/binaryedge.rbs +0 -26
  76. data/sig/lib/mihari/analyzers/censys.rbs +0 -41
  77. data/sig/lib/mihari/analyzers/circl.rbs +0 -31
  78. data/sig/lib/mihari/analyzers/crtsh.rbs +0 -17
  79. data/sig/lib/mihari/analyzers/dnpedia.rbs +0 -15
  80. data/sig/lib/mihari/analyzers/dnstwister.rbs +0 -25
  81. data/sig/lib/mihari/analyzers/feed.rbs +0 -20
  82. data/sig/lib/mihari/analyzers/onyphe.rbs +0 -34
  83. data/sig/lib/mihari/analyzers/otx.rbs +0 -33
  84. data/sig/lib/mihari/analyzers/passivetotal.rbs +0 -35
  85. data/sig/lib/mihari/analyzers/pulsedive.rbs +0 -27
  86. data/sig/lib/mihari/analyzers/rule.rbs +0 -68
  87. data/sig/lib/mihari/analyzers/securitytrails.rbs +0 -33
  88. data/sig/lib/mihari/analyzers/shodan.rbs +0 -36
  89. data/sig/lib/mihari/analyzers/urlscan.rbs +0 -31
  90. data/sig/lib/mihari/analyzers/virustotal.rbs +0 -31
  91. data/sig/lib/mihari/analyzers/virustotal_intelligence.rbs +0 -33
  92. data/sig/lib/mihari/analyzers/zoomeye.rbs +0 -35
  93. data/sig/lib/mihari/cli/base.rbs +0 -9
  94. data/sig/lib/mihari/cli/init.rbs +0 -7
  95. data/sig/lib/mihari/cli/main.rbs +0 -9
  96. data/sig/lib/mihari/cli/validator.rbs +0 -7
  97. data/sig/lib/mihari/commands/init.rbs +0 -9
  98. data/sig/lib/mihari/commands/json.rbs +0 -7
  99. data/sig/lib/mihari/commands/search.rbs +0 -35
  100. data/sig/lib/mihari/commands/validator.rbs +0 -9
  101. data/sig/lib/mihari/commands/web.rbs +0 -7
  102. data/sig/lib/mihari/constants.rbs +0 -5
  103. data/sig/lib/mihari/database.rbs +0 -25
  104. data/sig/lib/mihari/emitters/base.rbs +0 -18
  105. data/sig/lib/mihari/emitters/database.rbs +0 -9
  106. data/sig/lib/mihari/emitters/http.rbs +0 -35
  107. data/sig/lib/mihari/emitters/misp.rbs +0 -34
  108. data/sig/lib/mihari/emitters/slack.rbs +0 -73
  109. data/sig/lib/mihari/emitters/stdout.rbs +0 -9
  110. data/sig/lib/mihari/emitters/the_hive.rbs +0 -32
  111. data/sig/lib/mihari/emitters/webhook.rbs +0 -20
  112. data/sig/lib/mihari/enrichers/base.rbs +0 -12
  113. data/sig/lib/mihari/enrichers/google_public_dns.rbs +0 -18
  114. data/sig/lib/mihari/enrichers/ipinfo.rbs +0 -16
  115. data/sig/lib/mihari/errors.rbs +0 -10
  116. data/sig/lib/mihari/feed/parser.rbs +0 -11
  117. data/sig/lib/mihari/feed/reader.rbs +0 -56
  118. data/sig/lib/mihari/http.rbs +0 -64
  119. data/sig/lib/mihari/mixins/autonomous_system.rbs +0 -14
  120. data/sig/lib/mihari/mixins/configurable.rbs +0 -30
  121. data/sig/lib/mihari/mixins/configuration.rbs +0 -45
  122. data/sig/lib/mihari/mixins/disallowed_data_value.rbs +0 -23
  123. data/sig/lib/mihari/mixins/error_notification.rbs +0 -12
  124. data/sig/lib/mihari/mixins/hash.rbs +0 -14
  125. data/sig/lib/mihari/mixins/refang.rbs +0 -14
  126. data/sig/lib/mihari/mixins/retriable.rbs +0 -15
  127. data/sig/lib/mihari/models/alert.rbs +0 -18
  128. data/sig/lib/mihari/models/artifact.rbs +0 -69
  129. data/sig/lib/mihari/models/autonomous_system.rbs +0 -14
  130. data/sig/lib/mihari/models/cpe.rbs +0 -7
  131. data/sig/lib/mihari/models/dns.rbs +0 -19
  132. data/sig/lib/mihari/models/geolocation.rbs +0 -15
  133. data/sig/lib/mihari/models/port.rbs +0 -7
  134. data/sig/lib/mihari/models/reverse_dns.rbs +0 -14
  135. data/sig/lib/mihari/models/rule.rbs +0 -17
  136. data/sig/lib/mihari/models/tag.rbs +0 -5
  137. data/sig/lib/mihari/models/tagging.rbs +0 -4
  138. data/sig/lib/mihari/models/whois.rbs +0 -66
  139. data/sig/lib/mihari/status.rbs +0 -25
  140. data/sig/lib/mihari/structs/censys.rbs +0 -58
  141. data/sig/lib/mihari/structs/filters.rbs +0 -40
  142. data/sig/lib/mihari/structs/google_public_dns.rbs +0 -21
  143. data/sig/lib/mihari/structs/greynoise.rbs +0 -30
  144. data/sig/lib/mihari/structs/ipinfo.rbs +0 -17
  145. data/sig/lib/mihari/structs/onyphe.rbs +0 -25
  146. data/sig/lib/mihari/structs/rule.rbs +0 -57
  147. data/sig/lib/mihari/structs/shodan.rbs +0 -30
  148. data/sig/lib/mihari/structs/urlscan.rbs +0 -28
  149. data/sig/lib/mihari/structs/virustotal_intelligence.rbs +0 -33
  150. data/sig/lib/mihari/type_checker.rbs +0 -48
  151. data/sig/lib/mihari/types.rbs +0 -23
  152. data/sig/lib/mihari/version.rbs +0 -3
  153. data/sig/lib/mihari/web/app.rbs +0 -5
  154. data/sig/lib/mihari.rbs +0 -54
@@ -1,127 +0,0 @@
1
- # frozen_string_literal: true
2
-
3
- require "erb"
4
-
5
- module Mihari
6
- module Emitters
7
- class PayloadTemplate < ERB
8
- def self.template
9
- %{
10
- {
11
- "title": "<%= @title %>",
12
- "description": "<%= @description %>",
13
- "source": "<%= @source %>",
14
- "artifacts": [
15
- <% @artifacts.each_with_index do |artifact, idx| %>
16
- "<%= artifact.data %>"
17
- <%= ',' if idx < (@artifacts.length - 1) %>
18
- <% end %>
19
- ],
20
- "tags": [
21
- <% @tags.each_with_index do |tag, idx| %>
22
- "<%= tag %>"
23
- <%= ',' if idx < (@tags.length - 1) %>
24
- <% end %>
25
- ]
26
- }
27
- }
28
- end
29
-
30
- def initialize(title:, description:, artifacts:, source:, tags:, options: {})
31
- @title = title
32
- @description = description
33
- @artifacts = artifacts
34
- @source = source
35
- @tags = tags
36
-
37
- @template = options.fetch(:template, self.class.template)
38
- super(@template)
39
- end
40
-
41
- def result
42
- super(binding)
43
- end
44
- end
45
-
46
- class HTTP < Base
47
- # @return [Addressable::URI, nil]
48
- attr_reader :uri
49
-
50
- # @return [Hash]
51
- attr_reader :http_request_headers
52
-
53
- # @return [String]
54
- attr_reader :http_request_method
55
-
56
- # @return [String, nil]
57
- attr_reader :template
58
-
59
- def initialize(*args, **kwargs)
60
- super(*args, **kwargs)
61
-
62
- uri = kwargs[:url] || kwargs[:uri]
63
- http_request_headers = kwargs[:http_request_headers] || {}
64
- http_request_method = kwargs[:http_request_method] || "POST"
65
- template = kwargs[:template]
66
-
67
- @uri = Addressable::URI.parse(uri) if uri
68
- @http_request_headers = http_request_headers
69
- @http_request_method = http_request_method
70
- @template = template
71
- end
72
-
73
- def emit(title:, description:, artifacts:, source:, tags:)
74
- return if artifacts.empty?
75
-
76
- res = nil
77
-
78
- payload_ = payload_as_string(
79
- title: title,
80
- description: description,
81
- artifacts: artifacts,
82
- source: source,
83
- tags: tags
84
- )
85
- payload = JSON.parse(payload_)
86
-
87
- client = Mihari::HTTP.new(uri, headers: http_request_headers, payload: payload)
88
-
89
- case http_request_method
90
- when "GET"
91
- res = client.get
92
- when "POST"
93
- res = client.post
94
- end
95
-
96
- res
97
- end
98
-
99
- def valid?
100
- return false if uri.nil?
101
-
102
- ["http", "https"].include? uri.scheme.downcase
103
- end
104
-
105
- private
106
-
107
- def payload_as_string(title:, description:, artifacts:, source:, tags:)
108
- @payload_as_string ||= [].tap do |out|
109
- options = {}
110
- unless template.nil?
111
- options[:template] = File.read(template)
112
- end
113
-
114
- payload_template = PayloadTemplate.new(
115
- title: title,
116
- description: description,
117
- artifacts: artifacts,
118
- source: source,
119
- tags: tags,
120
- options: options
121
- )
122
- out << payload_template.result
123
- end.first
124
- end
125
- end
126
- end
127
- end
@@ -1,9 +0,0 @@
1
- # frozen_string_literal: true
2
-
3
- module Mihari
4
- module Entities
5
- class Sources < Grape::Entity
6
- expose :sources, documentation: { type: Array[String], required: true }
7
- end
8
- end
9
- end
data/lib/mihari/status.rb DELETED
@@ -1,55 +0,0 @@
1
- # frozen_string_literal: true
2
-
3
- module Mihari
4
- class Status
5
- def check
6
- statuses
7
- end
8
-
9
- def self.check
10
- new.check
11
- end
12
-
13
- private
14
-
15
- #
16
- # Statuses of analyzers and emitters
17
- #
18
- # @return [Array<Hash>]
19
- #
20
- def statuses
21
- (Mihari.analyzers + Mihari.emitters + Mihari.enrichers).to_h do |klass|
22
- name = klass.to_s.split("::").last.to_s
23
-
24
- [name, build_status(klass)]
25
- end.compact
26
- end
27
-
28
- #
29
- # Build a status of a class
30
- #
31
- # @param [Class<Mihari::Analyzers::Base>, Class<Mihari::Emitters::Base>] klass
32
- #
33
- # @return [Hash, nil]
34
- #
35
- def build_status(klass)
36
- return nil if klass == Mihari::Analyzers::Rule
37
-
38
- is_analyzer = klass.ancestors.include?(Mihari::Analyzers::Base)
39
- is_emitter = klass.ancestors.include?(Mihari::Emitters::Base)
40
- is_enricher = klass.ancestors.include?(Mihari::Enrichers::Base)
41
-
42
- instance = is_analyzer ? klass.new("dummy") : klass.new
43
- is_configured = instance.configured?
44
- values = instance.configuration_values
45
-
46
- type = "Analyzer"
47
- type = "Emitter" if is_emitter
48
- type = "Enricher" if is_enricher
49
-
50
- values ? { is_configured: is_configured, values: values, type: type } : nil
51
- rescue ArgumentError => _e
52
- nil
53
- end
54
- end
55
- end
@@ -1,19 +0,0 @@
1
- # frozen_string_literal: true
2
-
3
- module Mihari
4
- module Endpoints
5
- class Sources < Grape::API
6
- namespace :sources do
7
- desc "Get sources", {
8
- is_array: true,
9
- success: Entities::Sources,
10
- summary: "Get sources"
11
- }
12
- get "/" do
13
- sources = Mihari::Alert.distinct.pluck(:source)
14
- present({ sources: sources }, with: Entities::Sources)
15
- end
16
- end
17
- end
18
- end
19
- end