mihari 4.12.0 → 5.0.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (148) hide show
  1. checksums.yaml +4 -4
  2. data/Steepfile +0 -1
  3. data/lib/mihari/analyzers/base.rb +18 -37
  4. data/lib/mihari/analyzers/rule.rb +23 -36
  5. data/lib/mihari/cli/main.rb +6 -11
  6. data/lib/mihari/commands/initializer.rb +47 -0
  7. data/lib/mihari/commands/searcher.rb +57 -0
  8. data/lib/mihari/commands/validator.rb +2 -2
  9. data/lib/mihari/constants.rb +3 -3
  10. data/lib/mihari/database.rb +52 -87
  11. data/lib/mihari/emitters/database.rb +16 -7
  12. data/lib/mihari/emitters/misp.rb +13 -5
  13. data/lib/mihari/emitters/slack.rb +15 -8
  14. data/lib/mihari/emitters/the_hive.rb +42 -21
  15. data/lib/mihari/emitters/webhook.rb +99 -31
  16. data/lib/mihari/entities/alert.rb +7 -5
  17. data/lib/mihari/entities/artifact.rb +20 -8
  18. data/lib/mihari/entities/config.rb +2 -6
  19. data/lib/mihari/entities/rule.rb +8 -0
  20. data/lib/mihari/http.rb +13 -13
  21. data/lib/mihari/mixins/{disallowed_data_value.rb → falsepositive.rb} +8 -8
  22. data/lib/mihari/models/alert.rb +2 -15
  23. data/lib/mihari/models/artifact.rb +28 -17
  24. data/lib/mihari/models/rule.rb +7 -13
  25. data/lib/mihari/schemas/emitter.rb +6 -8
  26. data/lib/mihari/schemas/rule.rb +11 -13
  27. data/lib/mihari/structs/config.rb +41 -0
  28. data/lib/mihari/structs/filters.rb +2 -2
  29. data/lib/mihari/structs/rule.rb +94 -85
  30. data/lib/mihari/templates/rule.yml.erb +5 -23
  31. data/lib/mihari/types.rb +1 -1
  32. data/lib/mihari/version.rb +1 -1
  33. data/lib/mihari/web/api.rb +0 -2
  34. data/lib/mihari/web/endpoints/alerts.rb +11 -3
  35. data/lib/mihari/web/endpoints/configs.rb +1 -6
  36. data/lib/mihari/web/endpoints/rules.rb +27 -15
  37. data/lib/mihari/web/public/assets/{fa-brands-400-b1d1c1b0.ttf → fa-brands-400-2ef6fdde.ttf} +0 -0
  38. data/lib/mihari/web/public/assets/fa-brands-400-f4617423.woff2 +0 -0
  39. data/lib/mihari/web/public/assets/fa-regular-400-12dea17b.ttf +0 -0
  40. data/lib/mihari/web/public/assets/fa-regular-400-7ba24c41.woff2 +0 -0
  41. data/lib/mihari/web/public/assets/fa-solid-900-67a880b4.ttf +0 -0
  42. data/lib/mihari/web/public/assets/fa-solid-900-e2c5cf54.woff2 +0 -0
  43. data/lib/mihari/web/public/assets/fa-v4compatibility-7c377405.woff2 +0 -0
  44. data/lib/mihari/web/public/assets/fa-v4compatibility-8d9500e8.ttf +0 -0
  45. data/lib/mihari/web/public/assets/{index-07aa1ba2.css → index-625e95fe.css} +3 -3
  46. data/lib/mihari/web/public/assets/index-63900d73.js +50 -0
  47. data/lib/mihari/web/public/index.html +2 -2
  48. data/lib/mihari/web/public/redoc-static.html +26 -27
  49. data/lib/mihari.rb +11 -21
  50. data/mihari.gemspec +4 -4
  51. metadata +25 -111
  52. data/lib/mihari/cli/init.rb +0 -11
  53. data/lib/mihari/cli/validator.rb +0 -11
  54. data/lib/mihari/commands/init.rb +0 -51
  55. data/lib/mihari/commands/search.rb +0 -63
  56. data/lib/mihari/emitters/http.rb +0 -127
  57. data/lib/mihari/entities/source.rb +0 -9
  58. data/lib/mihari/status.rb +0 -55
  59. data/lib/mihari/web/endpoints/sources.rb +0 -19
  60. data/lib/mihari/web/public/assets/fa-brands-400-c61287c2.woff2 +0 -0
  61. data/lib/mihari/web/public/assets/fa-regular-400-5da313b0.woff2 +0 -0
  62. data/lib/mihari/web/public/assets/fa-regular-400-d7b19fe2.ttf +0 -0
  63. data/lib/mihari/web/public/assets/fa-solid-900-8f06540f.woff2 +0 -0
  64. data/lib/mihari/web/public/assets/fa-solid-900-e4f6a7e9.ttf +0 -0
  65. data/lib/mihari/web/public/assets/fa-v4compatibility-2ddb3b41.ttf +0 -0
  66. data/lib/mihari/web/public/assets/fa-v4compatibility-f46715c9.woff2 +0 -0
  67. data/lib/mihari/web/public/assets/index-a7fe697b.js +0 -63
  68. data/sig/lib/mihari/analyzers/base.rbs +0 -90
  69. data/sig/lib/mihari/analyzers/binaryedge.rbs +0 -26
  70. data/sig/lib/mihari/analyzers/censys.rbs +0 -41
  71. data/sig/lib/mihari/analyzers/circl.rbs +0 -31
  72. data/sig/lib/mihari/analyzers/crtsh.rbs +0 -17
  73. data/sig/lib/mihari/analyzers/dnpedia.rbs +0 -15
  74. data/sig/lib/mihari/analyzers/dnstwister.rbs +0 -25
  75. data/sig/lib/mihari/analyzers/feed.rbs +0 -20
  76. data/sig/lib/mihari/analyzers/onyphe.rbs +0 -34
  77. data/sig/lib/mihari/analyzers/otx.rbs +0 -33
  78. data/sig/lib/mihari/analyzers/passivetotal.rbs +0 -35
  79. data/sig/lib/mihari/analyzers/pulsedive.rbs +0 -27
  80. data/sig/lib/mihari/analyzers/rule.rbs +0 -68
  81. data/sig/lib/mihari/analyzers/securitytrails.rbs +0 -33
  82. data/sig/lib/mihari/analyzers/shodan.rbs +0 -36
  83. data/sig/lib/mihari/analyzers/urlscan.rbs +0 -31
  84. data/sig/lib/mihari/analyzers/virustotal.rbs +0 -31
  85. data/sig/lib/mihari/analyzers/virustotal_intelligence.rbs +0 -33
  86. data/sig/lib/mihari/analyzers/zoomeye.rbs +0 -35
  87. data/sig/lib/mihari/cli/base.rbs +0 -9
  88. data/sig/lib/mihari/cli/init.rbs +0 -7
  89. data/sig/lib/mihari/cli/main.rbs +0 -9
  90. data/sig/lib/mihari/cli/validator.rbs +0 -7
  91. data/sig/lib/mihari/commands/init.rbs +0 -9
  92. data/sig/lib/mihari/commands/json.rbs +0 -7
  93. data/sig/lib/mihari/commands/search.rbs +0 -35
  94. data/sig/lib/mihari/commands/validator.rbs +0 -9
  95. data/sig/lib/mihari/commands/web.rbs +0 -7
  96. data/sig/lib/mihari/constants.rbs +0 -5
  97. data/sig/lib/mihari/database.rbs +0 -25
  98. data/sig/lib/mihari/emitters/base.rbs +0 -18
  99. data/sig/lib/mihari/emitters/database.rbs +0 -9
  100. data/sig/lib/mihari/emitters/http.rbs +0 -35
  101. data/sig/lib/mihari/emitters/misp.rbs +0 -34
  102. data/sig/lib/mihari/emitters/slack.rbs +0 -73
  103. data/sig/lib/mihari/emitters/stdout.rbs +0 -9
  104. data/sig/lib/mihari/emitters/the_hive.rbs +0 -32
  105. data/sig/lib/mihari/emitters/webhook.rbs +0 -20
  106. data/sig/lib/mihari/enrichers/base.rbs +0 -12
  107. data/sig/lib/mihari/enrichers/google_public_dns.rbs +0 -18
  108. data/sig/lib/mihari/enrichers/ipinfo.rbs +0 -16
  109. data/sig/lib/mihari/errors.rbs +0 -10
  110. data/sig/lib/mihari/feed/parser.rbs +0 -11
  111. data/sig/lib/mihari/feed/reader.rbs +0 -56
  112. data/sig/lib/mihari/http.rbs +0 -64
  113. data/sig/lib/mihari/mixins/autonomous_system.rbs +0 -14
  114. data/sig/lib/mihari/mixins/configurable.rbs +0 -30
  115. data/sig/lib/mihari/mixins/configuration.rbs +0 -45
  116. data/sig/lib/mihari/mixins/disallowed_data_value.rbs +0 -23
  117. data/sig/lib/mihari/mixins/error_notification.rbs +0 -12
  118. data/sig/lib/mihari/mixins/hash.rbs +0 -14
  119. data/sig/lib/mihari/mixins/refang.rbs +0 -14
  120. data/sig/lib/mihari/mixins/retriable.rbs +0 -15
  121. data/sig/lib/mihari/models/alert.rbs +0 -18
  122. data/sig/lib/mihari/models/artifact.rbs +0 -69
  123. data/sig/lib/mihari/models/autonomous_system.rbs +0 -14
  124. data/sig/lib/mihari/models/cpe.rbs +0 -7
  125. data/sig/lib/mihari/models/dns.rbs +0 -19
  126. data/sig/lib/mihari/models/geolocation.rbs +0 -15
  127. data/sig/lib/mihari/models/port.rbs +0 -7
  128. data/sig/lib/mihari/models/reverse_dns.rbs +0 -14
  129. data/sig/lib/mihari/models/rule.rbs +0 -17
  130. data/sig/lib/mihari/models/tag.rbs +0 -5
  131. data/sig/lib/mihari/models/tagging.rbs +0 -4
  132. data/sig/lib/mihari/models/whois.rbs +0 -66
  133. data/sig/lib/mihari/status.rbs +0 -25
  134. data/sig/lib/mihari/structs/censys.rbs +0 -58
  135. data/sig/lib/mihari/structs/filters.rbs +0 -40
  136. data/sig/lib/mihari/structs/google_public_dns.rbs +0 -21
  137. data/sig/lib/mihari/structs/greynoise.rbs +0 -30
  138. data/sig/lib/mihari/structs/ipinfo.rbs +0 -17
  139. data/sig/lib/mihari/structs/onyphe.rbs +0 -25
  140. data/sig/lib/mihari/structs/rule.rbs +0 -57
  141. data/sig/lib/mihari/structs/shodan.rbs +0 -30
  142. data/sig/lib/mihari/structs/urlscan.rbs +0 -28
  143. data/sig/lib/mihari/structs/virustotal_intelligence.rbs +0 -33
  144. data/sig/lib/mihari/type_checker.rbs +0 -48
  145. data/sig/lib/mihari/types.rbs +0 -23
  146. data/sig/lib/mihari/version.rbs +0 -3
  147. data/sig/lib/mihari/web/app.rbs +0 -5
  148. data/sig/lib/mihari.rbs +0 -54
data/lib/mihari.rb CHANGED
@@ -55,18 +55,11 @@ require "mihari/errors"
55
55
  require "mihari/mixins/autonomous_system"
56
56
  require "mihari/mixins/configurable"
57
57
  require "mihari/mixins/database"
58
- require "mihari/mixins/disallowed_data_value"
58
+ require "mihari/mixins/falsepositive"
59
59
  require "mihari/mixins/error_notification"
60
60
  require "mihari/mixins/refang"
61
61
  require "mihari/mixins/retriable"
62
62
 
63
- def truthy?(value)
64
- return true if value == "true"
65
- return true if value == true
66
-
67
- false
68
- end
69
-
70
63
  module Mihari
71
64
  extend Dry::Configurable
72
65
 
@@ -78,14 +71,13 @@ module Mihari
78
71
  setting :circl_passive_password, default: ENV.fetch("CIRCL_PASSIVE_PASSWORD", nil)
79
72
  setting :circl_passive_username, default: ENV.fetch("CIRCL_PASSIVE_USERNAME", nil)
80
73
 
81
- setting :database, default: ENV.fetch("DATABASE", "mihari.db")
74
+ setting :database_url, default: URI(ENV.fetch("DATABASE_URL", "sqlite3:///mihari.db"))
82
75
 
83
76
  setting :greynoise_api_key, default: ENV.fetch("GREYNOISE_API_KEY", nil)
84
77
 
85
78
  setting :ipinfo_api_key, default: ENV.fetch("IPINFO_API_KEY", nil)
86
79
 
87
- # TODO: deprecate MISP_API_ENDPOINT
88
- setting :misp_url, default: ENV.fetch("MISP_URL", nil) || ENV.fetch("MISP_API_ENDPOINT", nil)
80
+ setting :misp_url, default: ENV.fetch("MISP_URL", nil)
89
81
  setting :misp_api_key, default: ENV.fetch("MISP_API_KEY", nil)
90
82
 
91
83
  setting :onyphe_api_key, default: ENV.fetch("ONYPHE_API_KEY", nil)
@@ -104,8 +96,7 @@ module Mihari
104
96
  setting :slack_channel, default: ENV.fetch("SLACK_CHANNEL", nil)
105
97
  setting :slack_webhook_url, default: ENV.fetch("SLACK_WEBHOOK_URL", nil)
106
98
 
107
- # TODO: deprecate THEHIVE_API_ENDPOINT
108
- setting :thehive_url, default: ENV.fetch("THEHIVE_URL", nil) || ENV.fetch("THEHIVE_API_ENDPOINT", nil)
99
+ setting :thehive_url, default: ENV.fetch("THEHIVE_URL", nil)
109
100
  setting :thehive_api_key, default: ENV.fetch("THEHIVE_API_KEY", nil)
110
101
  setting :thehive_api_version, default: ENV.fetch("THEHIVE_API_VERSION", nil)
111
102
 
@@ -113,9 +104,6 @@ module Mihari
113
104
 
114
105
  setting :virustotal_api_key, default: ENV.fetch("VIRUSTOTAL_API_KEY", nil)
115
106
 
116
- setting :webhook_url, default: ENV.fetch("WEBHOOK_URL", nil)
117
- setting :webhook_use_json_body, constructor: ->(value = ENV.fetch("WEBHOOK_USE_JSON_BODY", nil)) { truthy?(value) }
118
-
119
107
  setting :zoomeye_api_key, default: ENV.fetch("ZOOMEYE_API_KEY", nil)
120
108
 
121
109
  setting :sentry_dsn, default: ENV.fetch("SENTRY_DSN", nil)
@@ -138,6 +126,12 @@ module Mihari
138
126
  end
139
127
  memoize :enrichers
140
128
 
129
+ def configs
130
+ (Mihari.analyzers + Mihari.emitters + Mihari.enrichers).map do |klass|
131
+ Mihari::Structs::Config.from_class(klass)
132
+ end.compact
133
+ end
134
+
141
135
  def logger
142
136
  SemanticLogger.default_level = :info
143
137
  SemanticLogger.add_appender(io: $stderr, formatter: :color)
@@ -171,6 +165,7 @@ require "mihari/types"
171
165
 
172
166
  # Structs
173
167
  require "mihari/structs/censys"
168
+ require "mihari/structs/config"
174
169
  require "mihari/structs/filters"
175
170
  require "mihari/structs/google_public_dns"
176
171
  require "mihari/structs/greynoise"
@@ -212,7 +207,6 @@ require "mihari/models/whois"
212
207
  require "mihari/emitters/base"
213
208
 
214
209
  require "mihari/emitters/database"
215
- require "mihari/emitters/http"
216
210
  require "mihari/emitters/misp"
217
211
  require "mihari/emitters/slack"
218
212
  require "mihari/emitters/the_hive"
@@ -252,7 +246,6 @@ require "mihari/entities/geolocation"
252
246
  require "mihari/entities/ip_address"
253
247
  require "mihari/entities/port"
254
248
  require "mihari/entities/reverse_dns"
255
- require "mihari/entities/source"
256
249
  require "mihari/entities/tag"
257
250
  require "mihari/entities/whois"
258
251
 
@@ -262,9 +255,6 @@ require "mihari/entities/alert"
262
255
 
263
256
  require "mihari/entities/rule"
264
257
 
265
- # Status checker
266
- require "mihari/status"
267
-
268
258
  # Web app
269
259
  require "mihari/web/app"
270
260
 
data/mihari.gemspec CHANGED
@@ -28,8 +28,8 @@ Gem::Specification.new do |spec|
28
28
  spec.require_paths = ["lib"]
29
29
 
30
30
  spec.add_development_dependency "bundler", "~> 2.4"
31
- spec.add_development_dependency "coveralls_reborn", "~> 0.26"
32
- spec.add_development_dependency "fakefs", "~> 2.0"
31
+ spec.add_development_dependency "coveralls_reborn", "~> 0.27"
32
+ spec.add_development_dependency "fakefs", "~> 2.4"
33
33
  spec.add_development_dependency "mysql2", "~> 0.5"
34
34
  spec.add_development_dependency "overcommit", "~> 0.60"
35
35
  spec.add_development_dependency "pg", "~> 1.4"
@@ -39,7 +39,7 @@ Gem::Specification.new do |spec|
39
39
  spec.add_development_dependency "rerun", "~> 0.14"
40
40
  spec.add_development_dependency "rspec", "~> 3.12"
41
41
  spec.add_development_dependency "simplecov-lcov", "~> 0.8.0"
42
- spec.add_development_dependency "standard", "~> 1.22"
42
+ spec.add_development_dependency "standard", "~> 1.24"
43
43
  spec.add_development_dependency "steep", "~> 1.3"
44
44
  spec.add_development_dependency "timecop", "~> 0.9"
45
45
  spec.add_development_dependency "vcr", "~> 6.1"
@@ -63,7 +63,7 @@ Gem::Specification.new do |spec|
63
63
  spec.add_dependency "dry-validation", "1.10.0"
64
64
  spec.add_dependency "email_address", "0.2.4"
65
65
  spec.add_dependency "grape", "1.7.0"
66
- spec.add_dependency "grape-entity", "0.10.2"
66
+ spec.add_dependency "grape-entity", "1.0.0"
67
67
  spec.add_dependency "grape-swagger", "1.5.0"
68
68
  spec.add_dependency "grape-swagger-entity", "0.5.1"
69
69
  spec.add_dependency "greynoise", "0.1.1"
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: mihari
3
3
  version: !ruby/object:Gem::Version
4
- version: 4.12.0
4
+ version: 5.0.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Manabu Niseki
8
8
  autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2023-02-03 00:00:00.000000000 Z
11
+ date: 2023-02-19 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: bundler
@@ -30,28 +30,28 @@ dependencies:
30
30
  requirements:
31
31
  - - "~>"
32
32
  - !ruby/object:Gem::Version
33
- version: '0.26'
33
+ version: '0.27'
34
34
  type: :development
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - "~>"
39
39
  - !ruby/object:Gem::Version
40
- version: '0.26'
40
+ version: '0.27'
41
41
  - !ruby/object:Gem::Dependency
42
42
  name: fakefs
43
43
  requirement: !ruby/object:Gem::Requirement
44
44
  requirements:
45
45
  - - "~>"
46
46
  - !ruby/object:Gem::Version
47
- version: '2.0'
47
+ version: '2.4'
48
48
  type: :development
49
49
  prerelease: false
50
50
  version_requirements: !ruby/object:Gem::Requirement
51
51
  requirements:
52
52
  - - "~>"
53
53
  - !ruby/object:Gem::Version
54
- version: '2.0'
54
+ version: '2.4'
55
55
  - !ruby/object:Gem::Dependency
56
56
  name: mysql2
57
57
  requirement: !ruby/object:Gem::Requirement
@@ -184,14 +184,14 @@ dependencies:
184
184
  requirements:
185
185
  - - "~>"
186
186
  - !ruby/object:Gem::Version
187
- version: '1.22'
187
+ version: '1.24'
188
188
  type: :development
189
189
  prerelease: false
190
190
  version_requirements: !ruby/object:Gem::Requirement
191
191
  requirements:
192
192
  - - "~>"
193
193
  - !ruby/object:Gem::Version
194
- version: '1.22'
194
+ version: '1.24'
195
195
  - !ruby/object:Gem::Dependency
196
196
  name: steep
197
197
  requirement: !ruby/object:Gem::Requirement
@@ -506,14 +506,14 @@ dependencies:
506
506
  requirements:
507
507
  - - '='
508
508
  - !ruby/object:Gem::Version
509
- version: 0.10.2
509
+ version: 1.0.0
510
510
  type: :runtime
511
511
  prerelease: false
512
512
  version_requirements: !ruby/object:Gem::Requirement
513
513
  requirements:
514
514
  - - '='
515
515
  - !ruby/object:Gem::Version
516
- version: 0.10.2
516
+ version: 1.0.0
517
517
  - !ruby/object:Gem::Dependency
518
518
  name: grape-swagger
519
519
  requirement: !ruby/object:Gem::Requirement
@@ -1066,11 +1066,9 @@ files:
1066
1066
  - lib/mihari/analyzers/virustotal_intelligence.rb
1067
1067
  - lib/mihari/analyzers/zoomeye.rb
1068
1068
  - lib/mihari/cli/base.rb
1069
- - lib/mihari/cli/init.rb
1070
1069
  - lib/mihari/cli/main.rb
1071
- - lib/mihari/cli/validator.rb
1072
- - lib/mihari/commands/init.rb
1073
- - lib/mihari/commands/search.rb
1070
+ - lib/mihari/commands/initializer.rb
1071
+ - lib/mihari/commands/searcher.rb
1074
1072
  - lib/mihari/commands/validator.rb
1075
1073
  - lib/mihari/commands/version.rb
1076
1074
  - lib/mihari/commands/web.rb
@@ -1078,7 +1076,6 @@ files:
1078
1076
  - lib/mihari/database.rb
1079
1077
  - lib/mihari/emitters/base.rb
1080
1078
  - lib/mihari/emitters/database.rb
1081
- - lib/mihari/emitters/http.rb
1082
1079
  - lib/mihari/emitters/misp.rb
1083
1080
  - lib/mihari/emitters/slack.rb
1084
1081
  - lib/mihari/emitters/the_hive.rb
@@ -1100,7 +1097,6 @@ files:
1100
1097
  - lib/mihari/entities/port.rb
1101
1098
  - lib/mihari/entities/reverse_dns.rb
1102
1099
  - lib/mihari/entities/rule.rb
1103
- - lib/mihari/entities/source.rb
1104
1100
  - lib/mihari/entities/tag.rb
1105
1101
  - lib/mihari/entities/whois.rb
1106
1102
  - lib/mihari/errors.rb
@@ -1110,8 +1106,8 @@ files:
1110
1106
  - lib/mihari/mixins/autonomous_system.rb
1111
1107
  - lib/mihari/mixins/configurable.rb
1112
1108
  - lib/mihari/mixins/database.rb
1113
- - lib/mihari/mixins/disallowed_data_value.rb
1114
1109
  - lib/mihari/mixins/error_notification.rb
1110
+ - lib/mihari/mixins/falsepositive.rb
1115
1111
  - lib/mihari/mixins/refang.rb
1116
1112
  - lib/mihari/mixins/retriable.rb
1117
1113
  - lib/mihari/models/alert.rb
@@ -1131,8 +1127,8 @@ files:
1131
1127
  - lib/mihari/schemas/enricher.rb
1132
1128
  - lib/mihari/schemas/macros.rb
1133
1129
  - lib/mihari/schemas/rule.rb
1134
- - lib/mihari/status.rb
1135
1130
  - lib/mihari/structs/censys.rb
1131
+ - lib/mihari/structs/config.rb
1136
1132
  - lib/mihari/structs/filters.rb
1137
1133
  - lib/mihari/structs/google_public_dns.rb
1138
1134
  - lib/mihari/structs/greynoise.rb
@@ -1153,106 +1149,24 @@ files:
1153
1149
  - lib/mihari/web/endpoints/configs.rb
1154
1150
  - lib/mihari/web/endpoints/ip_addresses.rb
1155
1151
  - lib/mihari/web/endpoints/rules.rb
1156
- - lib/mihari/web/endpoints/sources.rb
1157
1152
  - lib/mihari/web/endpoints/tags.rb
1158
1153
  - lib/mihari/web/middleware/connection_adapter.rb
1159
1154
  - lib/mihari/web/middleware/error_notification_adapter.rb
1160
- - lib/mihari/web/public/assets/fa-brands-400-b1d1c1b0.ttf
1161
- - lib/mihari/web/public/assets/fa-brands-400-c61287c2.woff2
1162
- - lib/mihari/web/public/assets/fa-regular-400-5da313b0.woff2
1163
- - lib/mihari/web/public/assets/fa-regular-400-d7b19fe2.ttf
1164
- - lib/mihari/web/public/assets/fa-solid-900-8f06540f.woff2
1165
- - lib/mihari/web/public/assets/fa-solid-900-e4f6a7e9.ttf
1166
- - lib/mihari/web/public/assets/fa-v4compatibility-2ddb3b41.ttf
1167
- - lib/mihari/web/public/assets/fa-v4compatibility-f46715c9.woff2
1168
- - lib/mihari/web/public/assets/index-07aa1ba2.css
1169
- - lib/mihari/web/public/assets/index-a7fe697b.js
1155
+ - lib/mihari/web/public/assets/fa-brands-400-2ef6fdde.ttf
1156
+ - lib/mihari/web/public/assets/fa-brands-400-f4617423.woff2
1157
+ - lib/mihari/web/public/assets/fa-regular-400-12dea17b.ttf
1158
+ - lib/mihari/web/public/assets/fa-regular-400-7ba24c41.woff2
1159
+ - lib/mihari/web/public/assets/fa-solid-900-67a880b4.ttf
1160
+ - lib/mihari/web/public/assets/fa-solid-900-e2c5cf54.woff2
1161
+ - lib/mihari/web/public/assets/fa-v4compatibility-7c377405.woff2
1162
+ - lib/mihari/web/public/assets/fa-v4compatibility-8d9500e8.ttf
1163
+ - lib/mihari/web/public/assets/index-625e95fe.css
1164
+ - lib/mihari/web/public/assets/index-63900d73.js
1170
1165
  - lib/mihari/web/public/favicon.ico
1171
1166
  - lib/mihari/web/public/index.html
1172
1167
  - lib/mihari/web/public/redoc-static.html
1173
1168
  - mihari.gemspec
1174
1169
  - renovate.json
1175
- - sig/lib/mihari.rbs
1176
- - sig/lib/mihari/analyzers/base.rbs
1177
- - sig/lib/mihari/analyzers/binaryedge.rbs
1178
- - sig/lib/mihari/analyzers/censys.rbs
1179
- - sig/lib/mihari/analyzers/circl.rbs
1180
- - sig/lib/mihari/analyzers/crtsh.rbs
1181
- - sig/lib/mihari/analyzers/dnpedia.rbs
1182
- - sig/lib/mihari/analyzers/dnstwister.rbs
1183
- - sig/lib/mihari/analyzers/feed.rbs
1184
- - sig/lib/mihari/analyzers/onyphe.rbs
1185
- - sig/lib/mihari/analyzers/otx.rbs
1186
- - sig/lib/mihari/analyzers/passivetotal.rbs
1187
- - sig/lib/mihari/analyzers/pulsedive.rbs
1188
- - sig/lib/mihari/analyzers/rule.rbs
1189
- - sig/lib/mihari/analyzers/securitytrails.rbs
1190
- - sig/lib/mihari/analyzers/shodan.rbs
1191
- - sig/lib/mihari/analyzers/urlscan.rbs
1192
- - sig/lib/mihari/analyzers/virustotal.rbs
1193
- - sig/lib/mihari/analyzers/virustotal_intelligence.rbs
1194
- - sig/lib/mihari/analyzers/zoomeye.rbs
1195
- - sig/lib/mihari/cli/base.rbs
1196
- - sig/lib/mihari/cli/init.rbs
1197
- - sig/lib/mihari/cli/main.rbs
1198
- - sig/lib/mihari/cli/validator.rbs
1199
- - sig/lib/mihari/commands/init.rbs
1200
- - sig/lib/mihari/commands/json.rbs
1201
- - sig/lib/mihari/commands/search.rbs
1202
- - sig/lib/mihari/commands/validator.rbs
1203
- - sig/lib/mihari/commands/web.rbs
1204
- - sig/lib/mihari/constants.rbs
1205
- - sig/lib/mihari/database.rbs
1206
- - sig/lib/mihari/emitters/base.rbs
1207
- - sig/lib/mihari/emitters/database.rbs
1208
- - sig/lib/mihari/emitters/http.rbs
1209
- - sig/lib/mihari/emitters/misp.rbs
1210
- - sig/lib/mihari/emitters/slack.rbs
1211
- - sig/lib/mihari/emitters/stdout.rbs
1212
- - sig/lib/mihari/emitters/the_hive.rbs
1213
- - sig/lib/mihari/emitters/webhook.rbs
1214
- - sig/lib/mihari/enrichers/base.rbs
1215
- - sig/lib/mihari/enrichers/google_public_dns.rbs
1216
- - sig/lib/mihari/enrichers/ipinfo.rbs
1217
- - sig/lib/mihari/errors.rbs
1218
- - sig/lib/mihari/feed/parser.rbs
1219
- - sig/lib/mihari/feed/reader.rbs
1220
- - sig/lib/mihari/http.rbs
1221
- - sig/lib/mihari/mixins/autonomous_system.rbs
1222
- - sig/lib/mihari/mixins/configurable.rbs
1223
- - sig/lib/mihari/mixins/configuration.rbs
1224
- - sig/lib/mihari/mixins/disallowed_data_value.rbs
1225
- - sig/lib/mihari/mixins/error_notification.rbs
1226
- - sig/lib/mihari/mixins/hash.rbs
1227
- - sig/lib/mihari/mixins/refang.rbs
1228
- - sig/lib/mihari/mixins/retriable.rbs
1229
- - sig/lib/mihari/models/alert.rbs
1230
- - sig/lib/mihari/models/artifact.rbs
1231
- - sig/lib/mihari/models/autonomous_system.rbs
1232
- - sig/lib/mihari/models/cpe.rbs
1233
- - sig/lib/mihari/models/dns.rbs
1234
- - sig/lib/mihari/models/geolocation.rbs
1235
- - sig/lib/mihari/models/port.rbs
1236
- - sig/lib/mihari/models/reverse_dns.rbs
1237
- - sig/lib/mihari/models/rule.rbs
1238
- - sig/lib/mihari/models/tag.rbs
1239
- - sig/lib/mihari/models/tagging.rbs
1240
- - sig/lib/mihari/models/whois.rbs
1241
- - sig/lib/mihari/status.rbs
1242
- - sig/lib/mihari/structs/censys.rbs
1243
- - sig/lib/mihari/structs/filters.rbs
1244
- - sig/lib/mihari/structs/google_public_dns.rbs
1245
- - sig/lib/mihari/structs/greynoise.rbs
1246
- - sig/lib/mihari/structs/ipinfo.rbs
1247
- - sig/lib/mihari/structs/onyphe.rbs
1248
- - sig/lib/mihari/structs/rule.rbs
1249
- - sig/lib/mihari/structs/shodan.rbs
1250
- - sig/lib/mihari/structs/urlscan.rbs
1251
- - sig/lib/mihari/structs/virustotal_intelligence.rbs
1252
- - sig/lib/mihari/type_checker.rbs
1253
- - sig/lib/mihari/types.rbs
1254
- - sig/lib/mihari/version.rbs
1255
- - sig/lib/mihari/web/app.rbs
1256
1170
  homepage: https://github.com/ninoseki/mihari
1257
1171
  licenses:
1258
1172
  - MIT
@@ -1273,7 +1187,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
1273
1187
  - !ruby/object:Gem::Version
1274
1188
  version: '0'
1275
1189
  requirements: []
1276
- rubygems_version: 3.3.26
1190
+ rubygems_version: 3.4.1
1277
1191
  signing_key:
1278
1192
  specification_version: 4
1279
1193
  summary: A framework for continuous OSINT based threat hunting
@@ -1,11 +0,0 @@
1
- # frozen_string_literal: true
2
-
3
- require "mihari/commands/init"
4
-
5
- module Mihari
6
- module CLI
7
- class Initialization < Base
8
- include Mihari::Commands::Initialization
9
- end
10
- end
11
- end
@@ -1,11 +0,0 @@
1
- # frozen_string_literal: true
2
-
3
- require "mihari/commands/validator"
4
-
5
- module Mihari
6
- module CLI
7
- class Validator < Base
8
- include Mihari::Commands::Validator
9
- end
10
- end
11
- end
@@ -1,51 +0,0 @@
1
- # frozen_string_literal: true
2
-
3
- module Mihari
4
- module Commands
5
- module Initialization
6
- def self.included(thor)
7
- thor.class_eval do
8
- desc "rule", "Create a rule file"
9
- method_option :filename, type: :string, default: "rule.yml"
10
- def rule
11
- filename = options["filename"]
12
-
13
- warning = "#{filename} exists. Do you want to overwrite it? (y/n)"
14
- if File.exist?(filename) && !(yes? warning)
15
- return
16
- end
17
-
18
- initialize_rule_yaml filename
19
-
20
- Mihari.logger.info "The rule file is initialized as #{filename}."
21
- end
22
-
23
- no_commands do
24
- #
25
- # Returns a template for rule
26
- #
27
- # @return [String] A template for rule
28
- #
29
- def rule_template
30
- rule = Structs::Rule.from_path_or_id File.expand_path("../templates/rule.yml.erb", __dir__)
31
- rule.yaml
32
- end
33
-
34
- #
35
- # Create (blank) rule file
36
- #
37
- # @param [String] filename
38
- # @param [Dry::Files] files
39
- # @param [String] template
40
- #
41
- # @return [nil]
42
- #
43
- def initialize_rule_yaml(filename, files = Dry::Files.new, template: rule_template)
44
- files.write(filename, template)
45
- end
46
- end
47
- end
48
- end
49
- end
50
- end
51
- end
@@ -1,63 +0,0 @@
1
- # frozen_string_literal: true
2
-
3
- module Mihari
4
- module Commands
5
- module Search
6
- include Mixins::Database
7
- include Mixins::ErrorNotification
8
-
9
- def self.included(thor)
10
- thor.class_eval do
11
- desc "search [RULE]", "Search by a rule"
12
- method_option :yes, type: :boolean, aliases: "-y", desc: "yes to overwrite the rule in the database"
13
- def search_by_rule(path_or_id)
14
- rule = Structs::Rule.from_path_or_id path_or_id
15
-
16
- # validate
17
- begin
18
- rule.validate!
19
- rescue RuleValidationError
20
- return
21
- end
22
-
23
- # check update
24
- id = rule.id
25
- yes = options["yes"] || false
26
- unless yes
27
- with_db_connection do
28
- rule_ = Mihari::Rule.find(id)
29
- next if rule.yaml == rule_.yaml
30
- unless yes?("This operation will overwrite the rule in the database (Rule ID: #{id}). Are you sure you want to update the rule? (yes/no)")
31
- return
32
- end
33
- rescue ActiveRecord::RecordNotFound
34
- next
35
- end
36
- end
37
-
38
- analyzer = rule.to_analyzer
39
-
40
- with_error_notification do
41
- alert = analyzer.run
42
-
43
- if alert
44
- data = Mihari::Entities::Alert.represent(alert)
45
- puts JSON.pretty_generate(data.as_json)
46
- else
47
- Mihari.logger.info "No new alert created in the database"
48
- end
49
-
50
- # record a rule
51
- with_db_connection do
52
- model = rule.to_model
53
- model.save
54
- rescue ActiveRecord::RecordNotUnique
55
- nil
56
- end
57
- end
58
- end
59
- end
60
- end
61
- end
62
- end
63
- end
@@ -1,127 +0,0 @@
1
- # frozen_string_literal: true
2
-
3
- require "erb"
4
-
5
- module Mihari
6
- module Emitters
7
- class PayloadTemplate < ERB
8
- def self.template
9
- %{
10
- {
11
- "title": "<%= @title %>",
12
- "description": "<%= @description %>",
13
- "source": "<%= @source %>",
14
- "artifacts": [
15
- <% @artifacts.each_with_index do |artifact, idx| %>
16
- "<%= artifact.data %>"
17
- <%= ',' if idx < (@artifacts.length - 1) %>
18
- <% end %>
19
- ],
20
- "tags": [
21
- <% @tags.each_with_index do |tag, idx| %>
22
- "<%= tag %>"
23
- <%= ',' if idx < (@tags.length - 1) %>
24
- <% end %>
25
- ]
26
- }
27
- }
28
- end
29
-
30
- def initialize(title:, description:, artifacts:, source:, tags:, options: {})
31
- @title = title
32
- @description = description
33
- @artifacts = artifacts
34
- @source = source
35
- @tags = tags
36
-
37
- @template = options.fetch(:template, self.class.template)
38
- super(@template)
39
- end
40
-
41
- def result
42
- super(binding)
43
- end
44
- end
45
-
46
- class HTTP < Base
47
- # @return [Addressable::URI, nil]
48
- attr_reader :uri
49
-
50
- # @return [Hash]
51
- attr_reader :http_request_headers
52
-
53
- # @return [String]
54
- attr_reader :http_request_method
55
-
56
- # @return [String, nil]
57
- attr_reader :template
58
-
59
- def initialize(*args, **kwargs)
60
- super(*args, **kwargs)
61
-
62
- uri = kwargs[:url] || kwargs[:uri]
63
- http_request_headers = kwargs[:http_request_headers] || {}
64
- http_request_method = kwargs[:http_request_method] || "POST"
65
- template = kwargs[:template]
66
-
67
- @uri = Addressable::URI.parse(uri) if uri
68
- @http_request_headers = http_request_headers
69
- @http_request_method = http_request_method
70
- @template = template
71
- end
72
-
73
- def emit(title:, description:, artifacts:, source:, tags:)
74
- return if artifacts.empty?
75
-
76
- res = nil
77
-
78
- payload_ = payload_as_string(
79
- title: title,
80
- description: description,
81
- artifacts: artifacts,
82
- source: source,
83
- tags: tags
84
- )
85
- payload = JSON.parse(payload_)
86
-
87
- client = Mihari::HTTP.new(uri, headers: http_request_headers, payload: payload)
88
-
89
- case http_request_method
90
- when "GET"
91
- res = client.get
92
- when "POST"
93
- res = client.post
94
- end
95
-
96
- res
97
- end
98
-
99
- def valid?
100
- return false if uri.nil?
101
-
102
- ["http", "https"].include? uri.scheme.downcase
103
- end
104
-
105
- private
106
-
107
- def payload_as_string(title:, description:, artifacts:, source:, tags:)
108
- @payload_as_string ||= [].tap do |out|
109
- options = {}
110
- unless template.nil?
111
- options[:template] = File.read(template)
112
- end
113
-
114
- payload_template = PayloadTemplate.new(
115
- title: title,
116
- description: description,
117
- artifacts: artifacts,
118
- source: source,
119
- tags: tags,
120
- options: options
121
- )
122
- out << payload_template.result
123
- end.first
124
- end
125
- end
126
- end
127
- end
@@ -1,9 +0,0 @@
1
- # frozen_string_literal: true
2
-
3
- module Mihari
4
- module Entities
5
- class Sources < Grape::Entity
6
- expose :sources, documentation: { type: Array[String], required: true }
7
- end
8
- end
9
- end