mihari 4.12.0 → 5.0.0

data/lib/mihari/emitters/misp.rb

@@ -14,7 +14,7 @@ module Mihari
       def initialize(*args, **kwargs)
         super(*args, **kwargs)
 
-        @url = kwargs[:url] || kwargs[:api_endpoint] || Mihari.config.misp_url
+        @url = kwargs[:url] || Mihari.config.misp_url
         @api_key = kwargs[:api_key] || Mihari.config.misp_api_key
 
         ::MISP.configure do |config|
@@ -39,16 +39,24 @@ module Mihari
         true
       end
 
-      def emit(title:, artifacts:, tags: [], **_options)
+      #
+      # Create a MISP event
+      #
+      # @param [Arra<Mihari::Artifact>] artifacts
+      # @param [Mihari::Structs::Rule] rule
+      #
+      # @return [::MISP::Event]
+      #
+      def emit(rule:, artifacts:, **_options)
         return if artifacts.empty?
 
-        event = ::MISP::Event.new(info: title)
+        event = ::MISP::Event.new(info: rule.title)
 
         artifacts.each do |artifact|
           event.attributes << build_attribute(artifact)
         end
 
-        tags.each do |tag|
+        rule.tags.each do |tag|
           event.add_tag name: tag
         end
 
@@ -66,7 +74,7 @@ module Mihari
       #
       # @param [Mihari::Artifact] artifact
       #
-      # @return [::MISP::Attribute] <description>
+      # @return [::MISP::Attribute]
       #
       def build_attribute(artifact)
         ::MISP::Attribute.new(value: artifact.data, type: to_misp_type(type: artifact.data_type, value: artifact.data))

data/lib/mihari/emitters/slack.rb

@@ -167,30 +167,37 @@ module Mihari
       #
       # Build a text
       #
-      # @param [String] title
-      # @param [String] description
-      # @param [Array<String>] tags
+      # @param [Mihari::Structs::Rule] rule
       #
       # @return [String]
       #
-      def to_text(title:, description:, tags: [])
+      def to_text(rule)
+        tags = rule.tags
         tags = ["N/A"] if tags.empty?
 
         [
-          "*#{title}*",
-          "*Desc.*: #{description}",
+          "*#{rule.title}*",
+          "*Desc.*: #{rule.description}",
           "*Tags*: #{tags.join(", ")}"
         ].join("\n")
       end
 
-      def emit(title:, description:, artifacts:, tags: [], **_options)
+      def emit(rule:, artifacts:, **_options)
         return if artifacts.empty?
 
         attachments = to_attachments(artifacts)
-        text = to_text(title: title, description: description, tags: tags)
+        text = to_text(rule)
 
         notifier.post(text: text, attachments: attachments, mrkdwn: true)
       end
+
+      def configuration_keys
+        %w[slack_webhook_url slack_channel]
+      end
+
+      def configured?
+        valid?
+      end
     end
   end
 end

data/lib/mihari/emitters/the_hive.rb

@@ -17,7 +17,7 @@ module Mihari
       def initialize(*args, **kwargs)
         super(*args, **kwargs)
 
-        @url = kwargs[:url] || kwargs[:api_endpoint] || Mihari.config.thehive_url
+        @url = kwargs[:url] || Mihari.config.thehive_url
         @api_key = kwargs[:api_key] || Mihari.config.thehive_api_key
         @api_version = kwargs[:api_version] || Mihari.config.thehive_api_version
       end
@@ -38,10 +38,18 @@ module Mihari
         true
       end
 
-      def emit(title:, description:, artifacts:, tags: [], **_options)
+      #
+      # Create a Hive alert
+      #
+      # @param [Arra<Mihari::Artifact>] artifacts
+      # @param [Mihari::Structs::Rule] rule
+      #
+      # @return [::MISP::Event]
+      #
+      def emit(rule:, artifacts:, **_options)
         return if artifacts.empty?
 
-        payload = payload(title: title, description: description, artifacts: artifacts, tags: tags)
+        payload = payload(rule: rule, artifacts: artifacts)
         api.alert.create(**payload)
       end
 
@@ -93,36 +101,49 @@ module Mihari
         !api_key.nil?
       end
 
-      def payload(title:, description:, artifacts:, tags: [])
-        if normalized_api_version.nil?
-          return v4_payload(title: title, description: description, artifacts: artifacts,
-            tags: tags)
-        end
+      #
+      # Build payload for alert
+      #
+      # @param [Arra<Mihari::Artifact>] artifacts
+      # @param [Mihari::Structs::Rule] rule
+      #
+      # @return [<Type>] <description>
+      #
+      def payload(rule:, artifacts:)
+        return v4_payload(rule: rule, artifacts: artifacts) if normalized_api_version.nil?
 
-        v5_payload(title: title, description: description, artifacts: artifacts, tags: tags)
+        v5_payload(rule: rule, artifacts: artifacts)
       end
 
-      def v4_payload(title:, description:, artifacts:, tags: [])
+      def v4_payload(rule:, artifacts:)
         {
-          title: title,
-          description: description,
+          title: rule.title,
+          description: rule.description,
           artifacts: artifacts.map do |artifact|
-                       { data: artifact.data, data_type: artifact.data_type, message: description }
-                     end,
-          tags: tags,
+            {
+              data: artifact.data,
+              data_type: artifact.data_type,
+              message: rule.description
+            }
+          end,
+          tags: rule.tags,
           type: "external",
           source: "mihari"
         }
       end
 
-      def v5_payload(title:, description:, artifacts:, tags: [])
+      def v5_payload(rule:, artifacts:)
         {
-          title: title,
-          description: description,
+          title: rule.title,
+          description: rule.description,
           observables: artifacts.map do |artifact|
-                         { data: artifact.data, data_type: artifact.data_type, message: description }
-                       end,
-          tags: tags,
+            {
+              data: artifact.data,
+              data_type: artifact.data_type,
+              message: rule.description
+            }
+          end,
+          tags: rule.tags,
           type: "external",
           source: "mihari",
           source_ref: "1"

data/lib/mihari/emitters/webhook.rb

@@ -1,54 +1,122 @@
 # frozen_string_literal: true
 
+require "erb"
+
 module Mihari
   module Emitters
-    class Webhook < Base
-      # @return [Boolean]
-      def valid?
-        webhook_url?
+    class PayloadTemplate < ERB
+      def self.template
+        %{
+					{
+						"rule": {
+              "id": "<%= @rule.id %>",
+              "title": "<%= @rule.title %>",
+              "description": "<%= @rule.description %>"
+            },
+						"artifacts": [
+							<% @artifacts.each_with_index do |artifact, idx| %>
+								"<%= artifact.data %>"
+								<%= ',' if idx < (@artifacts.length - 1) %>
+							<% end %>
+						],
+						"tags": [
+							<% @rule.tags.each_with_index do |tag, idx| %>
+								"<%= tag %>"
+								<%= ',' if idx < (@rule.tags.length - 1) %>
+							<% end %>
+						]
+					}
+				}
       end
 
-      def emit(title:, description:, artifacts:, source:, tags:)
-        return if artifacts.empty?
+      def initialize(artifacts:, rule:, options: {})
+        @artifacts = artifacts
+        @rule = rule
 
-        headers = { "content-type": "application/x-www-form-urlencoded" }
-        headers["content-type"] = "application/json" if use_json_body?
+        @template = options.fetch(:template, self.class.template)
+        super(@template)
+      end
 
-        emitter = Emitters::HTTP.new(uri: Mihari.config.webhook_url)
-        emitter.emit(title: title, description: description, artifacts: artifacts, source: source, tags: tags)
+      def result
+        super(binding)
       end
+    end
 
-      private
+    class Webhook < Base
+      # @return [Addressable::URI, nil]
+      attr_reader :url
 
-      def configuration_keys
-        %w[webhook_url]
-      end
+      # @return [Hash]
+      attr_reader :headers
+
+      # @return [String]
+      attr_reader :method
 
-      #
-      # Webhook URL
-      #
       # @return [String, nil]
-      #
-      def webhook_url
-        @webhook_url ||= Mihari.config.webhook_url
+      attr_reader :template
+
+      def initialize(*args, **kwargs)
+        super(*args, **kwargs)
+
+        url = kwargs[:url]
+        headers = kwargs[:headers] || {}
+        method = kwargs[:method] || "POST"
+        template = kwargs[:template]
+
+        @url = Addressable::URI.parse(url)
+        @headers = headers
+        @method = method
+        @template = template
       end
 
-      #
-      # Check whether a webhook URL is set or not
-      #
-      # @return [Boolean]
-      #
-      def webhook_url?
-        !webhook_url.nil?
+      def emit(artifacts:, rule:)
+        return if artifacts.empty?
+
+        res = nil
+
+        payload_ = payload_as_string(artifacts: artifacts, rule: rule)
+        payload = JSON.parse(payload_)
+
+        client = Mihari::HTTP.new(url, headers: headers, payload: payload)
+
+        case method
+        when "GET"
+          res = client.get
+        when "POST"
+          res = client.post
+        end
+
+        res
       end
 
+      def valid?
+        return false if url.nil?
+
+        %w[http https].include? url.scheme.downcase
+      end
+
+      private
+
       #
-      # Check whether to use JSON body or not
+      # Convert payload into string
       #
-      # @return [Boolean]
+      # @param [Array<Mihari::Artifact>] artifacts
+      # @param [Mihari::Structs::Rule] rule
       #
-      def use_json_body?
-        @use_json_body ||= Mihari.config.webhook_use_json_body
+      # @return [String]
+      #
+      def payload_as_string(artifacts:, rule:)
+        @payload_as_string ||= [].tap do |out|
+          options = {}
+          options[:template] = File.read(template) unless template.nil?
+
+          payload_template = PayloadTemplate.new(
+            artifacts: artifacts,
+            rule: rule,
+            options: options
+          )
+          out << payload_template.result
+        end.first
       end
     end
   end

data/lib/mihari/entities/alert.rb

@@ -3,13 +3,15 @@
 module Mihari
   module Entities
     class Alert < Grape::Entity
-      expose :id, documentation: { type: Integer, required: true }
-      expose :title, documentation: { type: String, required: true }
-      expose :description, documentation: { type: String, required: true }
-      expose :source, documentation: { type: String, required: true }
+      expose :id,
+        documentation: { type: String, required: true,
+                         desc: "String representation of the ID" } do |alert, _options|
+        alert.id.to_s
+      end
+      expose :rule_id, documentation: { type: String, required: true }, as: :ruleId
       expose :created_at, documentation: { type: DateTime, required: true }, as: :createdAt
 
-      expose :artifacts, using: Entities::Artifact, documentation: { type: Entities::Artifact, is_array: true }
+      expose :artifacts, using: Entities::BaseArtifact, documentation: { type: Entities::BaseArtifact, is_array: true }
       expose :tags, using: Entities::Tag, documentation: { type: Entities::Tag, is_array: true, required: true }
     end
 

data/lib/mihari/entities/artifact.rb

@@ -2,29 +2,41 @@
 
 module Mihari
   module Entities
-    class Artifact < Grape::Entity
-      expose :id, documentation: { type: Integer, required: true }
+    class BaseArtifact < Grape::Entity
+      expose :id,
+        documentation: { type: String, required: true,
+                         desc: "String representation of the ID" } do |artifact, _options|
+        artifact.id.to_s
+      end
       expose :data, documentation: { type: String, required: true }
       expose :data_type, documentation: { type: String, required: true }, as: :dataType
       expose :source, documentation: { type: String, required: true }
       expose :tags, documentation: { type: String, is_array: true }
 
       expose :metadata, documentation: { type: Hash }
+    end
 
-      expose :autonomous_system, using: Entities::AutonomousSystem, documentation: { type: Entities::AutonomousSystem, required: false }, as: :autonomousSystem
+    class Artifact < BaseArtifact
+      expose :autonomous_system, using: Entities::AutonomousSystem,
+        documentation: { type: Entities::AutonomousSystem, required: false }, as: :autonomousSystem
       expose :geolocation, using: Entities::Geolocation, documentation: { type: Entities::Geolocation, required: false }
-      expose :whois_record, using: Entities::WhoisRecord, documentation: { type: Entities::WhoisRecord, required: false }, as: :whoisRecord
+      expose :whois_record, using: Entities::WhoisRecord,
+        documentation: { type: Entities::WhoisRecord, required: false }, as: :whoisRecord
 
-      expose :reverse_dns_names, using: Entities::ReverseDnsName, documentation: { type: Entities::ReverseDnsName, is_array: true, required: false }, as: :reverseDnsNames do |status, _options|
+      expose :reverse_dns_names, using: Entities::ReverseDnsName,
+        documentation: { type: Entities::ReverseDnsName, is_array: true, required: false }, as: :reverseDnsNames do |status, _options|
         status.reverse_dns_names.empty? ? nil : status.reverse_dns_names
       end
-      expose :dns_records, using: Entities::DnsRecord, documentation: { type: Entities::DnsRecord, is_array: true, required: false }, as: :dnsRecords do |status, _options|
+      expose :dns_records, using: Entities::DnsRecord,
+        documentation: { type: Entities::DnsRecord, is_array: true, required: false }, as: :dnsRecords do |status, _options|
         status.dns_records.empty? ? nil : status.dns_records
       end
-      expose :ceps, using: Entities::CPE, documentation: { type: Entities::CPE, is_array: true, required: false }, as: :cpes do |status, _options|
+      expose :ceps, using: Entities::CPE, documentation: { type: Entities::CPE, is_array: true, required: false },
+        as: :cpes do |status, _options|
         status.cpes.empty? ? nil : status.cpes
       end
-      expose :ports, using: Entities::Port, documentation: { type: Entities::Port, is_array: true, required: false }, as: :ports do |status, _options|
+      expose :ports, using: Entities::Port, documentation: { type: Entities::Port, is_array: true, required: false },
+        as: :ports do |status, _options|
         status.ports.empty? ? nil : status.ports
       end
     end

data/lib/mihari/entities/config.rb

@@ -2,15 +2,11 @@
 
 module Mihari
   module Entities
-    class ConfigStatus < Grape::Entity
+    class Config < Grape::Entity
+      expose :name, documentation: { type: String, required: true }
       expose :type, documentation: { type: String, required: true }
       expose :values, documentation: { type: String, is_array: true, required: true }
       expose :is_configured, documentation: { type: Grape::API::Boolean, required: true }, as: :isConfigured
     end
-
-    class Config < Grape::Entity
-      expose :name, documentation: { type: String, required: true }
-      expose :status, using: Entities::ConfigStatus, documentation: { type: ConfigStatus, required: true }
-    end
   end
 end

data/lib/mihari/entities/rule.rb

@@ -14,9 +14,13 @@ module Mihari
 
     class Rule < Grape::Entity
       expose :id, documentation: { type: String, required: true }
+      expose :title, documentation: { type: String, required: true }
+      expose :description, documentation: { type: String, required: true }
       expose :yaml, documentation: { type: String, required: true }
       expose :created_at, documentation: { type: DateTime, required: true }, as: :createdAt
       expose :updated_at, documentation: { type: DateTime, required: true }, as: :updatedAt
+
+      expose :tags, using: Entities::Tag, documentation: { type: Entities::Tag, is_array: true, required: true }
     end
 
     class RulesWithPagination < Grape::Entity
@@ -25,5 +29,9 @@ module Mihari
       expose :current_page, documentation: { type: Integer, required: true }, as: :currentPage
       expose :page_size, documentation: { type: Integer, required: true }, as: :pageSize
     end
+
+    class RuleIDs < Grape::Entity
+      expose :rule_ids, documentation: { type: Array[String], required: true }, as: :ruleIds
+    end
   end
 end

data/lib/mihari/http.rb

@@ -4,10 +4,10 @@ require "insensitive_hash"
 
 module Mihari
   class HTTP
-    attr_reader :uri, :headers, :payload
+    attr_reader :url, :headers, :payload
 
-    def initialize(uri, headers: {}, payload: {})
-      @uri = uri.is_a?(URI) ? uri : URI(uri.to_s)
+    def initialize(url, headers: {}, payload: {})
+      @url = url.is_a?(URI) ? url : URI(url.to_s)
       @headers = headers.insensitive
       @payload = payload
     end
@@ -18,10 +18,10 @@ module Mihari
     # @return [Net::HTTPResponse]
     #
     def get
-      new_uri = uri.deep_dup
-      new_uri.query = Addressable::URI.form_encode(payload) unless payload.empty?
+      new_url = url.deep_dup
+      new_url.query = Addressable::URI.form_encode(payload) unless payload.empty?
 
-      get = Net::HTTP::Get.new(new_uri)
+      get = Net::HTTP::Get.new(new_url)
       request get
     end
 
@@ -31,7 +31,7 @@ module Mihari
     # @return [Net::HTTPResponse]
     #
     def post
-      post = Net::HTTP::Post.new(uri)
+      post = Net::HTTP::Post.new(url)
 
       case content_type
       when "application/json"
@@ -44,13 +44,13 @@ module Mihari
     end
 
     class << self
-      def get(uri, headers: {}, params: {})
-        client = new(uri, headers: headers, payload: params)
+      def get(url, headers: {}, params: {})
+        client = new(url, headers: headers, payload: params)
         client.get
       end
 
-      def post(uri, headers: {}, payload: {})
-        client = new(uri, headers: headers, payload: payload)
+      def post(url, headers: {}, payload: {})
+        client = new(url, headers: headers, payload: payload)
         client.post
       end
     end
@@ -67,7 +67,7 @@ module Mihari
     # @return [Hahs]
     #
     def https_options
-      return { use_ssl: true } if uri.scheme == "https"
+      return { use_ssl: true } if url.scheme == "https"
 
       {}
     end
@@ -80,7 +80,7 @@ module Mihari
     # @return [Net::HTTPResponse]
     #
     def request(req)
-      Net::HTTP.start(uri.host, uri.port, https_options) do |http|
+      Net::HTTP.start(url.host, url.port, https_options) do |http|
         # set headers
         headers.each do |k, v|
           req[k] = v

data/lib/mihari/mixins/{disallowed_data_value.rb → falsepositive.rb}

@@ -2,24 +2,24 @@
 
 module Mihari
   module Mixins
-    module DisallowedDataValue
+    module FalsePositive
       include Memist::Memoizable
 
       #
-      # Normalize a value as a disallowed data value
+      # Normalize a falsepositive value
       #
-      # @param [String] value Data value
+      # @param [String] value
       #
-      # @return [String, Regexp] Normalized value
+      # @return [String, Regexp]
       #
-      def normalize_disallowed_data_value(value)
+      def normalize_falsepositive(value)
         return value if !value.start_with?("/") || !value.end_with?("/")
 
         # if a value is surrounded by slashes, take it as a regexp
         value_without_slashes = value[1..-2]
         Regexp.compile value_without_slashes.to_s
       end
-      memoize :normalize_disallowed_data_value
+      memoize :normalize_falsepositive
 
       #
       # Check whetehr a value is valid format as a disallowed data value
@@ -28,9 +28,9 @@ module Mihari
       #
       # @return [Boolean] true if it is valid, otherwise false
       #
-      def valid_disallowed_data_value?(value)
+      def valid_falsepositive?(value)
         begin
-          normalize_disallowed_data_value value
+          normalize_falsepositive value
         rescue RegexpError
           return false
         end

data/lib/mihari/models/alert.rb

@@ -28,20 +28,7 @@ module Mihari
         relation = build_relation(filter.without_pagination)
 
         alert_ids = relation.limit(limit).offset(offset).order(id: :desc).pluck(:id).uniq
-        eager_load(
-          {
-            artifacts: [
-              :autonomous_system,
-              :geolocation,
-              :whois_record,
-              :dns_records,
-              :reverse_dns_names,
-              :cpes,
-              :ports
-            ]
-          },
-          :tags
-        ).where(id: [alert_ids]).order(id: :desc)
+        eager_load(:artifacts, :tags).where(id: [alert_ids]).order(id: :desc)
       end
 
       #
@@ -83,7 +70,7 @@ module Mihari
         relation = relation.where(artifacts: { id: artifact_ids }) unless artifact_ids.empty?
         relation = relation.where(tags: { name: filter.tag_name }) if filter.tag_name
 
-        relation = relation.where(source: filter.source) if filter.source
+        relation = relation.where(rule_id: filter.rule_id) if filter.rule_id
         relation = relation.where(title: filter.title) if filter.title
 
         relation = relation.where("description LIKE ?", "%#{filter.description}%") if filter.description