mihari 4.11.0 → 5.0.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.github/workflows/test.yml +1 -1
- data/README.md +13 -3
- data/Steepfile +0 -1
- data/build_frontend.sh +0 -3
- data/docker/Dockerfile +11 -12
- data/images/Tines-Full_Logo-Tines_Black.png +0 -0
- data/lib/mihari/analyzers/base.rb +12 -28
- data/lib/mihari/analyzers/rule.rb +23 -36
- data/lib/mihari/cli/main.rb +6 -11
- data/lib/mihari/commands/initializer.rb +47 -0
- data/lib/mihari/commands/{search.rb → searcher.rb} +9 -20
- data/lib/mihari/commands/validator.rb +2 -2
- data/lib/mihari/commands/web.rb +4 -2
- data/lib/mihari/constants.rb +3 -3
- data/lib/mihari/database.rb +52 -87
- data/lib/mihari/emitters/database.rb +16 -7
- data/lib/mihari/emitters/misp.rb +13 -5
- data/lib/mihari/emitters/slack.rb +15 -8
- data/lib/mihari/emitters/the_hive.rb +42 -21
- data/lib/mihari/emitters/webhook.rb +99 -31
- data/lib/mihari/entities/alert.rb +7 -5
- data/lib/mihari/entities/artifact.rb +20 -8
- data/lib/mihari/entities/config.rb +2 -6
- data/lib/mihari/entities/rule.rb +8 -0
- data/lib/mihari/http.rb +13 -13
- data/lib/mihari/mixins/{disallowed_data_value.rb → falsepositive.rb} +8 -8
- data/lib/mihari/models/alert.rb +2 -15
- data/lib/mihari/models/artifact.rb +28 -17
- data/lib/mihari/models/rule.rb +7 -13
- data/lib/mihari/schemas/emitter.rb +6 -8
- data/lib/mihari/schemas/rule.rb +11 -13
- data/lib/mihari/structs/config.rb +41 -0
- data/lib/mihari/structs/filters.rb +2 -2
- data/lib/mihari/structs/rule.rb +96 -83
- data/lib/mihari/templates/rule.yml.erb +5 -23
- data/lib/mihari/types.rb +1 -1
- data/lib/mihari/version.rb +1 -1
- data/lib/mihari/web/api.rb +0 -2
- data/lib/mihari/web/app.rb +10 -4
- data/lib/mihari/web/endpoints/alerts.rb +11 -3
- data/lib/mihari/web/endpoints/configs.rb +1 -6
- data/lib/mihari/web/endpoints/rules.rb +27 -15
- data/lib/mihari/web/public/assets/{fa-brands-400.c7ae37d3.ttf → fa-brands-400-2ef6fdde.ttf} +0 -0
- data/lib/mihari/web/public/assets/fa-brands-400-f4617423.woff2 +0 -0
- data/lib/mihari/web/public/assets/fa-regular-400-12dea17b.ttf +0 -0
- data/lib/mihari/web/public/assets/fa-regular-400-7ba24c41.woff2 +0 -0
- data/lib/mihari/web/public/assets/fa-solid-900-67a880b4.ttf +0 -0
- data/lib/mihari/web/public/assets/fa-solid-900-e2c5cf54.woff2 +0 -0
- data/lib/mihari/web/public/assets/fa-v4compatibility-7c377405.woff2 +0 -0
- data/lib/mihari/web/public/assets/fa-v4compatibility-8d9500e8.ttf +0 -0
- data/lib/mihari/web/public/assets/{index.e1e67d84.css → index-625e95fe.css} +3 -3
- data/lib/mihari/web/public/assets/index-63900d73.js +50 -0
- data/lib/mihari/web/public/index.html +3 -3
- data/lib/mihari/web/public/redoc-static.html +26 -27
- data/lib/mihari.rb +11 -21
- data/mihari.gemspec +14 -14
- metadata +46 -131
- data/lib/mihari/cli/init.rb +0 -11
- data/lib/mihari/cli/validator.rb +0 -11
- data/lib/mihari/commands/init.rb +0 -51
- data/lib/mihari/emitters/http.rb +0 -127
- data/lib/mihari/entities/source.rb +0 -9
- data/lib/mihari/status.rb +0 -55
- data/lib/mihari/web/endpoints/sources.rb +0 -19
- data/lib/mihari/web/public/assets/fa-brands-400.3fe890d0.woff2 +0 -0
- data/lib/mihari/web/public/assets/fa-regular-400.fdc1f753.ttf +0 -0
- data/lib/mihari/web/public/assets/fa-regular-400.fe69d948.woff2 +0 -0
- data/lib/mihari/web/public/assets/fa-solid-900.6d53c706.ttf +0 -0
- data/lib/mihari/web/public/assets/fa-solid-900.d27bc752.woff2 +0 -0
- data/lib/mihari/web/public/assets/fa-v4compatibility.4d73f280.ttf +0 -0
- data/lib/mihari/web/public/assets/fa-v4compatibility.7d1c2ce5.woff2 +0 -0
- data/lib/mihari/web/public/assets/index.d3a61a69.js +0 -68
- data/sig/lib/mihari/analyzers/base.rbs +0 -90
- data/sig/lib/mihari/analyzers/binaryedge.rbs +0 -26
- data/sig/lib/mihari/analyzers/censys.rbs +0 -41
- data/sig/lib/mihari/analyzers/circl.rbs +0 -31
- data/sig/lib/mihari/analyzers/crtsh.rbs +0 -17
- data/sig/lib/mihari/analyzers/dnpedia.rbs +0 -15
- data/sig/lib/mihari/analyzers/dnstwister.rbs +0 -25
- data/sig/lib/mihari/analyzers/feed.rbs +0 -20
- data/sig/lib/mihari/analyzers/onyphe.rbs +0 -34
- data/sig/lib/mihari/analyzers/otx.rbs +0 -33
- data/sig/lib/mihari/analyzers/passivetotal.rbs +0 -35
- data/sig/lib/mihari/analyzers/pulsedive.rbs +0 -27
- data/sig/lib/mihari/analyzers/rule.rbs +0 -68
- data/sig/lib/mihari/analyzers/securitytrails.rbs +0 -33
- data/sig/lib/mihari/analyzers/shodan.rbs +0 -36
- data/sig/lib/mihari/analyzers/urlscan.rbs +0 -31
- data/sig/lib/mihari/analyzers/virustotal.rbs +0 -31
- data/sig/lib/mihari/analyzers/virustotal_intelligence.rbs +0 -33
- data/sig/lib/mihari/analyzers/zoomeye.rbs +0 -35
- data/sig/lib/mihari/cli/base.rbs +0 -9
- data/sig/lib/mihari/cli/init.rbs +0 -7
- data/sig/lib/mihari/cli/main.rbs +0 -9
- data/sig/lib/mihari/cli/validator.rbs +0 -7
- data/sig/lib/mihari/commands/init.rbs +0 -9
- data/sig/lib/mihari/commands/json.rbs +0 -7
- data/sig/lib/mihari/commands/search.rbs +0 -35
- data/sig/lib/mihari/commands/validator.rbs +0 -9
- data/sig/lib/mihari/commands/web.rbs +0 -7
- data/sig/lib/mihari/constants.rbs +0 -5
- data/sig/lib/mihari/database.rbs +0 -25
- data/sig/lib/mihari/emitters/base.rbs +0 -18
- data/sig/lib/mihari/emitters/database.rbs +0 -9
- data/sig/lib/mihari/emitters/http.rbs +0 -35
- data/sig/lib/mihari/emitters/misp.rbs +0 -34
- data/sig/lib/mihari/emitters/slack.rbs +0 -73
- data/sig/lib/mihari/emitters/stdout.rbs +0 -9
- data/sig/lib/mihari/emitters/the_hive.rbs +0 -32
- data/sig/lib/mihari/emitters/webhook.rbs +0 -20
- data/sig/lib/mihari/enrichers/base.rbs +0 -12
- data/sig/lib/mihari/enrichers/google_public_dns.rbs +0 -18
- data/sig/lib/mihari/enrichers/ipinfo.rbs +0 -16
- data/sig/lib/mihari/errors.rbs +0 -10
- data/sig/lib/mihari/feed/parser.rbs +0 -11
- data/sig/lib/mihari/feed/reader.rbs +0 -56
- data/sig/lib/mihari/http.rbs +0 -64
- data/sig/lib/mihari/mixins/autonomous_system.rbs +0 -14
- data/sig/lib/mihari/mixins/configurable.rbs +0 -30
- data/sig/lib/mihari/mixins/configuration.rbs +0 -45
- data/sig/lib/mihari/mixins/disallowed_data_value.rbs +0 -23
- data/sig/lib/mihari/mixins/error_notification.rbs +0 -12
- data/sig/lib/mihari/mixins/hash.rbs +0 -14
- data/sig/lib/mihari/mixins/refang.rbs +0 -14
- data/sig/lib/mihari/mixins/retriable.rbs +0 -15
- data/sig/lib/mihari/models/alert.rbs +0 -18
- data/sig/lib/mihari/models/artifact.rbs +0 -69
- data/sig/lib/mihari/models/autonomous_system.rbs +0 -14
- data/sig/lib/mihari/models/cpe.rbs +0 -7
- data/sig/lib/mihari/models/dns.rbs +0 -19
- data/sig/lib/mihari/models/geolocation.rbs +0 -15
- data/sig/lib/mihari/models/port.rbs +0 -7
- data/sig/lib/mihari/models/reverse_dns.rbs +0 -14
- data/sig/lib/mihari/models/rule.rbs +0 -17
- data/sig/lib/mihari/models/tag.rbs +0 -5
- data/sig/lib/mihari/models/tagging.rbs +0 -4
- data/sig/lib/mihari/models/whois.rbs +0 -66
- data/sig/lib/mihari/status.rbs +0 -25
- data/sig/lib/mihari/structs/censys.rbs +0 -58
- data/sig/lib/mihari/structs/filters.rbs +0 -40
- data/sig/lib/mihari/structs/google_public_dns.rbs +0 -21
- data/sig/lib/mihari/structs/greynoise.rbs +0 -30
- data/sig/lib/mihari/structs/ipinfo.rbs +0 -17
- data/sig/lib/mihari/structs/onyphe.rbs +0 -25
- data/sig/lib/mihari/structs/rule.rbs +0 -57
- data/sig/lib/mihari/structs/shodan.rbs +0 -30
- data/sig/lib/mihari/structs/urlscan.rbs +0 -28
- data/sig/lib/mihari/structs/virustotal_intelligence.rbs +0 -33
- data/sig/lib/mihari/type_checker.rbs +0 -48
- data/sig/lib/mihari/types.rbs +0 -23
- data/sig/lib/mihari/version.rbs +0 -3
- data/sig/lib/mihari/web/app.rbs +0 -5
- data/sig/lib/mihari.rbs +0 -54
data/lib/mihari/emitters/http.rb
DELETED
@@ -1,127 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
require "erb"
|
4
|
-
|
5
|
-
module Mihari
|
6
|
-
module Emitters
|
7
|
-
class PayloadTemplate < ERB
|
8
|
-
def self.template
|
9
|
-
%{
|
10
|
-
{
|
11
|
-
"title": "<%= @title %>",
|
12
|
-
"description": "<%= @description %>",
|
13
|
-
"source": "<%= @source %>",
|
14
|
-
"artifacts": [
|
15
|
-
<% @artifacts.each_with_index do |artifact, idx| %>
|
16
|
-
"<%= artifact.data %>"
|
17
|
-
<%= ',' if idx < (@artifacts.length - 1) %>
|
18
|
-
<% end %>
|
19
|
-
],
|
20
|
-
"tags": [
|
21
|
-
<% @tags.each_with_index do |tag, idx| %>
|
22
|
-
"<%= tag %>"
|
23
|
-
<%= ',' if idx < (@tags.length - 1) %>
|
24
|
-
<% end %>
|
25
|
-
]
|
26
|
-
}
|
27
|
-
}
|
28
|
-
end
|
29
|
-
|
30
|
-
def initialize(title:, description:, artifacts:, source:, tags:, options: {})
|
31
|
-
@title = title
|
32
|
-
@description = description
|
33
|
-
@artifacts = artifacts
|
34
|
-
@source = source
|
35
|
-
@tags = tags
|
36
|
-
|
37
|
-
@template = options.fetch(:template, self.class.template)
|
38
|
-
super(@template)
|
39
|
-
end
|
40
|
-
|
41
|
-
def result
|
42
|
-
super(binding)
|
43
|
-
end
|
44
|
-
end
|
45
|
-
|
46
|
-
class HTTP < Base
|
47
|
-
# @return [Addressable::URI, nil]
|
48
|
-
attr_reader :uri
|
49
|
-
|
50
|
-
# @return [Hash]
|
51
|
-
attr_reader :http_request_headers
|
52
|
-
|
53
|
-
# @return [String]
|
54
|
-
attr_reader :http_request_method
|
55
|
-
|
56
|
-
# @return [String, nil]
|
57
|
-
attr_reader :template
|
58
|
-
|
59
|
-
def initialize(*args, **kwargs)
|
60
|
-
super(*args, **kwargs)
|
61
|
-
|
62
|
-
uri = kwargs[:url] || kwargs[:uri]
|
63
|
-
http_request_headers = kwargs[:http_request_headers] || {}
|
64
|
-
http_request_method = kwargs[:http_request_method] || "POST"
|
65
|
-
template = kwargs[:template]
|
66
|
-
|
67
|
-
@uri = Addressable::URI.parse(uri) if uri
|
68
|
-
@http_request_headers = http_request_headers
|
69
|
-
@http_request_method = http_request_method
|
70
|
-
@template = template
|
71
|
-
end
|
72
|
-
|
73
|
-
def emit(title:, description:, artifacts:, source:, tags:)
|
74
|
-
return if artifacts.empty?
|
75
|
-
|
76
|
-
res = nil
|
77
|
-
|
78
|
-
payload_ = payload_as_string(
|
79
|
-
title: title,
|
80
|
-
description: description,
|
81
|
-
artifacts: artifacts,
|
82
|
-
source: source,
|
83
|
-
tags: tags
|
84
|
-
)
|
85
|
-
payload = JSON.parse(payload_)
|
86
|
-
|
87
|
-
client = Mihari::HTTP.new(uri, headers: http_request_headers, payload: payload)
|
88
|
-
|
89
|
-
case http_request_method
|
90
|
-
when "GET"
|
91
|
-
res = client.get
|
92
|
-
when "POST"
|
93
|
-
res = client.post
|
94
|
-
end
|
95
|
-
|
96
|
-
res
|
97
|
-
end
|
98
|
-
|
99
|
-
def valid?
|
100
|
-
return false if uri.nil?
|
101
|
-
|
102
|
-
["http", "https"].include? uri.scheme.downcase
|
103
|
-
end
|
104
|
-
|
105
|
-
private
|
106
|
-
|
107
|
-
def payload_as_string(title:, description:, artifacts:, source:, tags:)
|
108
|
-
@payload_as_string ||= [].tap do |out|
|
109
|
-
options = {}
|
110
|
-
unless template.nil?
|
111
|
-
options[:template] = File.read(template)
|
112
|
-
end
|
113
|
-
|
114
|
-
payload_template = PayloadTemplate.new(
|
115
|
-
title: title,
|
116
|
-
description: description,
|
117
|
-
artifacts: artifacts,
|
118
|
-
source: source,
|
119
|
-
tags: tags,
|
120
|
-
options: options
|
121
|
-
)
|
122
|
-
out << payload_template.result
|
123
|
-
end.first
|
124
|
-
end
|
125
|
-
end
|
126
|
-
end
|
127
|
-
end
|
data/lib/mihari/status.rb
DELETED
@@ -1,55 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
module Mihari
|
4
|
-
class Status
|
5
|
-
def check
|
6
|
-
statuses
|
7
|
-
end
|
8
|
-
|
9
|
-
def self.check
|
10
|
-
new.check
|
11
|
-
end
|
12
|
-
|
13
|
-
private
|
14
|
-
|
15
|
-
#
|
16
|
-
# Statuses of analyzers and emitters
|
17
|
-
#
|
18
|
-
# @return [Array<Hash>]
|
19
|
-
#
|
20
|
-
def statuses
|
21
|
-
(Mihari.analyzers + Mihari.emitters + Mihari.enrichers).to_h do |klass|
|
22
|
-
name = klass.to_s.split("::").last.to_s
|
23
|
-
|
24
|
-
[name, build_status(klass)]
|
25
|
-
end.compact
|
26
|
-
end
|
27
|
-
|
28
|
-
#
|
29
|
-
# Build a status of a class
|
30
|
-
#
|
31
|
-
# @param [Class<Mihari::Analyzers::Base>, Class<Mihari::Emitters::Base>] klass
|
32
|
-
#
|
33
|
-
# @return [Hash, nil]
|
34
|
-
#
|
35
|
-
def build_status(klass)
|
36
|
-
return nil if klass == Mihari::Analyzers::Rule
|
37
|
-
|
38
|
-
is_analyzer = klass.ancestors.include?(Mihari::Analyzers::Base)
|
39
|
-
is_emitter = klass.ancestors.include?(Mihari::Emitters::Base)
|
40
|
-
is_enricher = klass.ancestors.include?(Mihari::Enrichers::Base)
|
41
|
-
|
42
|
-
instance = is_analyzer ? klass.new("dummy") : klass.new
|
43
|
-
is_configured = instance.configured?
|
44
|
-
values = instance.configuration_values
|
45
|
-
|
46
|
-
type = "Analyzer"
|
47
|
-
type = "Emitter" if is_emitter
|
48
|
-
type = "Enricher" if is_enricher
|
49
|
-
|
50
|
-
values ? { is_configured: is_configured, values: values, type: type } : nil
|
51
|
-
rescue ArgumentError => _e
|
52
|
-
nil
|
53
|
-
end
|
54
|
-
end
|
55
|
-
end
|
@@ -1,19 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
module Mihari
|
4
|
-
module Endpoints
|
5
|
-
class Sources < Grape::API
|
6
|
-
namespace :sources do
|
7
|
-
desc "Get sources", {
|
8
|
-
is_array: true,
|
9
|
-
success: Entities::Sources,
|
10
|
-
summary: "Get sources"
|
11
|
-
}
|
12
|
-
get "/" do
|
13
|
-
sources = Mihari::Alert.distinct.pluck(:source)
|
14
|
-
present({ sources: sources }, with: Entities::Sources)
|
15
|
-
end
|
16
|
-
end
|
17
|
-
end
|
18
|
-
end
|
19
|
-
end
|
Binary file
|
Binary file
|
Binary file
|
Binary file
|
Binary file
|
Binary file
|
Binary file
|