mihari 4.12.0 → 5.0.1

data/sig/lib/mihari/analyzers/base.rbs

@@ -1,90 +0,0 @@
-module Mihari
-  module Analyzers
-    class Base
-      # extend Dry::Initializer
-
-      include Mixins::AutonomousSystem
-      include Mixins::Configurable
-      include Mixins::Retriable
-
-      attr_accessor ignore_old_artifacts: bool
-
-      attr_accessor ignore_threshold: Integer
-
-      def initialize: (*untyped args, **untyped kwargs) -> void
-
-      # @return [Array<String>, Array<Mihari::Artifact>]
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      # @return [String]
-      def title: () -> String
-
-      # @return [String]
-      def description: () -> String
-
-      # @return [String]
-      def source: () -> String
-
-      # @return [Array<String>]
-      def tags: () -> ::Array[String]
-
-      #
-      # Set artifacts & run emitters in parallel
-      #
-      # @return [nil]
-      #
-      def run: () -> void
-
-      #
-      # Run emitter
-      #
-      # @param [Mihari::Emitters::Base] emitter
-      #
-      # @return [nil]
-      #
-      def run_emitter: (untyped emitter) -> void
-
-      def self.inherited: (untyped child) -> untyped
-
-      #
-      # Normalize artifacts
-      # - Uniquefy artifacts by native #uniq
-      # - Convert data (string) into an artifact
-      # - Reject an invalid artifact
-      #
-      # @return [Array<Mihari::Artifact>]
-      #
-      def normalized_artifacts: () -> Array[Mihari::Artifact]
-
-      private
-
-      #
-      # Uniquefy artifacts
-      #
-      # @return [Array<Mihari::Artifact>]
-      #
-      def unique_artifacts: () -> Array[Mihari::Artifact]
-
-      #
-      # Enriched artifacts
-      #
-      # @return [Array<Mihari::Artifact>]
-      #
-      def enriched_artifacts: () -> Array[Mihari::Artifact]
-
-      #
-      # Set enriched artifacts
-      #
-      # @return [nil]
-      #
-      def set_enriched_artifacts: () -> void
-
-      #
-      # Select valid emitters
-      #
-      # @return [Array<Mihari::Emitters::Base>]
-      #
-      def valid_emitters: () -> Array[Mihari::Emitters::Base]
-    end
-  end
-end

data/sig/lib/mihari/analyzers/binaryedge.rbs

@@ -1,26 +0,0 @@
-module Mihari
-  module Analyzers
-    class BinaryEdge < Base
-
-      attr_reader query: String
-
-      attr_reader interval: ::Integer
-
-      attr_reader api_key: String?
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      PAGE_SIZE: ::Integer
-
-      def search_with_page: (String query, ?page: ::Integer page) -> Hash[(String | Symbol), untyped]
-
-      def search: () -> Array[Hash[(String | Symbol), untyped]]
-
-      def configuration_keys: () -> ::Array["binaryedge_api_key"]
-
-      def api: () -> untyped
-    end
-  end
-end

data/sig/lib/mihari/analyzers/censys.rbs

@@ -1,41 +0,0 @@
-module Mihari
-  module Analyzers
-    class Censys < Base
-      attr_reader query: String
-
-      attr_reader interval: ::Integer
-
-      attr_reader id: String?
-
-      attr_reader secret: String?
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      def search: () -> Array[String]
-
-      #
-      # Extract IPv4s from Censys search API response
-      #
-      # @param [Structs::Censys::Response] response
-      #
-      # @return [Array<String>]
-      #
-      def response_to_artifacts: (Mihari::Structs::Censys::Response response) -> Array[String]
-
-      #
-      # Build an artifact from a Shodan search API response
-      #
-      # @param [Structs::Censys::Hit] hit
-      #
-      # @return [Artifact]
-      #
-      def build_artifact: (Mihari::Structs::Censys::Hit hit) -> Mihari::Artifact
-
-      def configuration_keys: () -> ::Array["censys_id" | "censys_secret"]
-
-      def api: () -> untyped
-    end
-  end
-end

data/sig/lib/mihari/analyzers/circl.rbs

@@ -1,31 +0,0 @@
-module Mihari
-  module Analyzers
-    class CIRCL < Base
-      include Mixins::Refang
-
-      attr_reader query: String
-
-      attr_reader type: String?
-
-      attr_reader username: String?
-
-      attr_reader password: String?
-
-      def initialize: (*untyped args, **untyped kwargs) -> void
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      def configuration_keys: () -> ::Array["circl_passive_password" | "circl_passive_username"]
-
-      def api: () -> untyped
-
-      def search: () -> Array[String]
-
-      def passive_dns_search: () -> Array[String]
-
-      def passive_ssl_search: () -> Array[String]
-    end
-  end
-end

data/sig/lib/mihari/analyzers/crtsh.rbs

@@ -1,17 +0,0 @@
-module Mihari
-  module Analyzers
-    class Crtsh < Base
-      attr_reader query: String
-
-      attr_reader exclude_expired: bool
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      def api: () -> untyped
-
-      def search: () -> Array[Hash[(String | Symbol), untyped]]
-    end
-  end
-end

data/sig/lib/mihari/analyzers/dnpedia.rbs

@@ -1,15 +0,0 @@
-module Mihari
-  module Analyzers
-    class DNPedia < Base
-      attr_reader query: String
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      def api: () -> untyped
-
-      def search: () -> Array[Mihari::Artifact]
-    end
-  end
-end

data/sig/lib/mihari/analyzers/dnstwister.rbs

@@ -1,25 +0,0 @@
-module Mihari
-  module Analyzers
-    class DNSTwister < Base
-      include Mixins::Refang
-
-      attr_reader query: String
-
-      attr_reader type: String
-
-      def initialize: (*untyped args, **untyped kwargs) -> void
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      def valid_type?: () -> bool
-
-      def api: () -> untyped
-
-      def resolvable?: (String domain) -> bool
-
-      def search: () -> Array[String]
-    end
-  end
-end

data/sig/lib/mihari/analyzers/feed.rbs

@@ -1,20 +0,0 @@
-module Mihari
-  module Analyzers
-    class Feed < Base
-      attr_reader query: String
-
-      attr_reader http_request_headers: Hash[(String | Symbol), untyped]
-      attr_reader http_request_method: String
-      attr_reader http_request_payload_type: String?
-      attr_reader http_request_payload: Hash[(String | Symbol), untyped]
-
-      attr_reader selector: String
-
-      def artifacts: () ->  (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      def data: () -> Array[Hash]
-    end
-  end
-end

data/sig/lib/mihari/analyzers/onyphe.rbs

@@ -1,34 +0,0 @@
-module Mihari
-  module Analyzers
-    class Onyphe < Base
-      attr_reader query: String
-
-      attr_reader interval: ::Integer
-
-      attr_reader api_key: String?
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      PAGE_SIZE: ::Integer
-
-      def configuration_keys: () -> ::Array["onyphe_api_key"]
-
-      def api: () -> untyped
-
-      def search_with_page: (String query, ?page: ::Integer page) -> Mihari::Structs::Onyphe::Response
-
-      def search: () -> Array[Mihari::Structs::Onyphe::Response]
-
-      #
-      # Build an artifact from an Onyphe search API result
-      #
-      # @param [Structs::Onyphe::Result] result
-      #
-      # @return [Artifact]
-      #
-      def build_artifact: (Mihari::Structs::Onyphe::Result result) -> Mihari::Artifact
-    end
-  end
-end

data/sig/lib/mihari/analyzers/otx.rbs

@@ -1,33 +0,0 @@
-module Mihari
-  module Analyzers
-    class OTX < Base
-      include Mixins::Refang
-
-      attr_reader query: String
-
-      attr_reader type: String?
-
-      attr_reader api_key: String?
-
-      def initialize: (*untyped args, **untyped kwargs) -> void
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      def configuration_keys: () -> ::Array["otx_api_key"]
-
-      def domain_client: () -> untyped
-
-      def ip_client: () -> untyped
-
-      def valid_type?: () -> bool
-
-      def search: () -> Array[String]
-
-      def domain_search: () -> Array[String]
-
-      def ip_search: () -> Array[String]
-    end
-  end
-end

data/sig/lib/mihari/analyzers/passivetotal.rbs

@@ -1,35 +0,0 @@
-module Mihari
-  module Analyzers
-    class PassiveTotal < Base
-      include Mixins::Refang
-
-      attr_reader query: String
-
-      attr_reader type: String?
-
-      attr_reader username: String?
-
-      attr_reader api_key: String?
-
-      def initialize: (*untyped args, **untyped kwargs) -> void
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      def configuration_keys: () -> ::Array["passivetotal_username" | "passivetotal_api_key"]
-
-      def api: () -> untyped
-
-      def valid_type?: () -> bool
-
-      def search: () -> Array[String]
-
-      def passive_dns_search: () -> Array[String]
-
-      def reverse_whois_search: () -> Array[Mihari::Artifact]
-
-      def ssl_search: () -> Array[Mihari::Artifact]
-    end
-  end
-end

data/sig/lib/mihari/analyzers/pulsedive.rbs

@@ -1,27 +0,0 @@
-module Mihari
-  module Analyzers
-    class Pulsedive < Base
-      include Mixins::Refang
-
-      attr_reader query: String
-
-      attr_reader type: String?
-
-      attr_reader api_key: String?
-
-      def initialize: (*untyped args, **untyped kwargs) -> void
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      def configuration_keys: () -> ::Array["pulsedive_api_key"]
-
-      def api: () -> untyped
-
-      def valid_type?: () -> bool
-
-      def search: () -> Array[Mihari::Artifact]
-    end
-  end
-end

data/sig/lib/mihari/analyzers/rule.rbs

@@ -1,68 +0,0 @@
-module Mihari
-  module Analyzers
-    ANALYZER_TO_CLASS: Hash[String, singleton(Mihari::Analyzers::Base)]
-
-    class Rule < Base
-      include Mihari::Mixins::DisallowedDataValue
-
-      attr_reader title: String
-      attr_reader description: String
-      attr_reader queries: Hash[(String | Symbol), untyped]
-      attr_reader tags: Array[String]
-      attr_reader allowed_data_types: Array[String]
-      attr_reader disallowed_data_values: Array[String]
-      attr_reader source: String
-      attr_reader id: String?
-
-      def initialize: (**untyped kwargs) -> void
-
-      #
-      # Returns a list of artifacts matched with queries
-      #
-      # @return [Array<Mihari::Artifact>]
-      #
-      def artifacts: () -> (Array[Mihari::Artifact])
-
-      #
-      # Normalize artifacts
-      # - Uniquefy artifacts by #uniq(&:data)
-      # - Reject an invalid artifact (for just in case)
-      # - Select artifacts with allowed data types
-      # - Reject artifacts with disallowed data values
-      #
-      # @return [Array<Mihari::Artifact>]
-      #
-      def normalized_artifacts: () -> untyped
-
-      #
-      # Normalized disallowed data values
-      #
-      # @return [Array<Regexp, String>]
-      #
-      def normalized_disallowed_data_values: () -> untyped
-
-      #
-      # Check whether a value is a disallowed data value or not
-      #
-      # @return [Boolean]
-      #
-      def disallowed_data_value?: (untyped value) -> untyped
-
-      private
-
-      #
-      # Get analyzer class
-      #
-      # @param [String] analyzer_name
-      #
-      # @return [Class<Mihari::Analyzers::Base>] analyzer class
-      #
-      def get_analyzer_class: (untyped analyzer_name) -> untyped
-
-      #
-      # Validate configuration of analyzers
-      #
-      def validate_analyzer_configurations: () -> untyped
-    end
-  end
-end

data/sig/lib/mihari/analyzers/securitytrails.rbs

@@ -1,33 +0,0 @@
-module Mihari
-  module Analyzers
-    class SecurityTrails < Base
-      include Mixins::Refang
-
-      attr_reader query: String
-
-      attr_reader type: String?
-
-      attr_reader api_key: String?
-
-      def initialize: (*untyped args, **untyped kwargs) -> void
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      def configuration_keys: () -> ::Array["securitytrails_api_key"]
-
-      def api: () -> untyped
-
-      def valid_type?: () -> bool
-
-      def search: () -> Array[String]
-
-      def domain_search: () -> Array[String]
-
-      def ip_search: () -> Array[Mihari::Artifact]
-
-      def mail_search: () -> Array[Mihari::Artifact]
-    end
-  end
-end

data/sig/lib/mihari/analyzers/shodan.rbs

@@ -1,36 +0,0 @@
-module Mihari
-  module Analyzers
-    class Shodan < Base
-      attr_reader query: String
-
-      attr_reader interval: ::Integer
-
-      attr_reader api_key: String?
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      PAGE_SIZE: ::Integer
-
-      def configuration_keys: () -> ::Array["shodan_api_key"]
-
-      def api: () -> untyped
-
-      def search_with_page: (String query, ?page: ::Integer page) -> Hash[(String | Symbol), untyped]
-
-      def search: () -> Array[Hash[(String | Symbol), untyped]]
-
-      def collect_metadata_by_ip: (Array[Mihari::Structs::Shodan::Match] matches, ip: String) -> Array[Hash[(String | Symbol), untyped]]
-
-      #
-      # Build an artifact from a Shodan search API response
-      #
-      # @param [Structs::Shodan::Match] match
-      #
-      # @return [Artifact]
-      #
-      def build_artifact: (Mihari::Structs::Shodan::Match match) -> Mihari::Artifact
-    end
-  end
-end

data/sig/lib/mihari/analyzers/urlscan.rbs

@@ -1,31 +0,0 @@
-SUPPORTED_DATA_TYPES: untyped
-
-module Mihari
-  module Analyzers
-    class Urlscan < Base
-      attr_reader query: String
-
-      attr_reader allowed_data_types: Array[String]
-
-      attr_reader interval: ::Integer
-
-      attr_reader api_key: String?
-
-      def initialize: (*untyped args, **untyped kwargs) -> void
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      def configuration_keys: () -> ::Array["urlscan_api_key"]
-
-      def api: () -> untyped
-
-      def search_with_search_after: (search_after: String?) -> Array[Hash[(String | Symbol), untyped]]
-
-      def search: () -> Array[Mihari::Structs::Urlscan::Response]
-
-      def valid_alllowed_data_types?: () -> bool
-    end
-  end
-end

data/sig/lib/mihari/analyzers/virustotal.rbs

@@ -1,31 +0,0 @@
-module Mihari
-  module Analyzers
-    class VirusTotal < Base
-      attr_reader query: String
-
-      attr_reader type: String?
-
-      attr_reader api_key: String?
-
-      include Mixins::Refang
-
-      def initialize: (*untyped args, **untyped kwargs) -> void
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      def configuration_keys: () -> ::Array["virustotal_api_key"]
-
-      def api: () -> untyped
-
-      def valid_type?: () -> bool
-
-      def search: () -> Array[Mihari::Artifact]
-
-      def domain_search: () -> Array[Mihari::Artifact]
-
-      def ip_search: () -> Array[Mihari::Artifact]
-    end
-  end
-end

data/sig/lib/mihari/analyzers/virustotal_intelligence.rbs

@@ -1,33 +0,0 @@
-module Mihari
-  module Analyzers
-    class VirusTotalIntelligence < Base
-      attr_reader query: String
-
-      attr_reader interval: ::Integer
-
-      attr_reader api_key: String?
-
-      def initialize: (*untyped args, **untyped kwargs) -> void
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      def configuration_keys: () -> ::Array["virustotal_api_key"]
-
-      #
-      # VT API
-      #
-      # @return [::VirusTotal::API]
-      #
-      def api: () -> untyped
-
-      #
-      # Search with cursor
-      #
-      # @return [Array<Mihari::Structs::VirusTotalIntelligence::Response>]
-      #
-      def search_witgh_cursor: () -> Array[Mihari::Structs::VirusTotalIntelligence::Response]
-    end
-  end
-end

data/sig/lib/mihari/analyzers/zoomeye.rbs

@@ -1,35 +0,0 @@
-module Mihari
-  module Analyzers
-    class ZoomEye < Base
-      attr_reader query: String
-
-      attr_reader type: String?
-
-      attr_reader interval: ::Integer
-
-      attr_reader api_key: String?
-
-      def artifacts: () -> (Array[String] | Array[Mihari::Artifact])
-
-      private
-
-      PAGE_SIZE: ::Integer
-
-      def valid_type?: () -> bool
-
-      def configuration_keys: () -> ::Array["zoomeye_api_key"]
-
-      def api: () -> untyped
-
-      def convert_responses: (Array[Hash[(String | Symbol), untyped]] responses) -> Array[Mihari::Artifact]
-
-      def _host_search: (String query, ?page: ::Integer page) -> (Hash[(String | Symbol), untyped] | nil)
-
-      def host_search: () -> Array[String]
-
-      def _web_search: (String query, ?page: ::Integer page) -> (Hash[(String | Symbol), untyped] | nil)
-
-      def web_search: () -> Array[String]
-    end
-  end
-end

data/sig/lib/mihari/cli/base.rbs

@@ -1,9 +0,0 @@
-module Mihari
-  module CLI
-    class Base
-      include Mihari::Mixins::Hash
-
-      def self.exit_on_failure?: () -> ::TrueClass
-    end
-  end
-end

data/sig/lib/mihari/cli/init.rbs

@@ -1,7 +0,0 @@
-module Mihari
-  module CLI
-    class Initialization < Base
-      include Mihari::Commands::Initialization
-    end
-  end
-end