mihari 4.5.2 → 4.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 266aaff37fdb3453ed52ba4391f25e2fc9d26c37996a4d00c462d2c9cb9a2771
-  data.tar.gz: 5d3397886e6c63199f49233668772a38ac508b9e32f3cd64f8925c3bf8d391f7
+  metadata.gz: 491cb9d0477c4101251c1f3e5705328008a196920efb41c239048247937f21f4
+  data.tar.gz: 14bcfd11b8871a759e70f6658cf2773dadc6afe7ffde44dbbffaef99961b8e00
 SHA512:
-  metadata.gz: 6df709c192e0a533d40604ee4fd076eb9d5f776d13165e60fe1687cf2fc2d008decbfd80c48cc809ab6667946e86b7a74490109e2bff9bf6c15d7c5767f490dc
-  data.tar.gz: 3350eeaa0d82da0322d463c30d69cfb2d09378449d37e681c34ec082d1d6505bb8bf1838c201779c3f3e618d716e029c25bbf6e0ac1329ad6c2291eef7c38a3a
+  metadata.gz: d833915545629ade609ec994e6139387fd66247fa1c48fdbe4e3eab01679fb42820e3b07cb95fdbb8cff092753394f1dfa9aaa4459259837c2c0d7d5f2f855ed
+  data.tar.gz: dcbb112faa805b27157ec72d0f3544031c7e7789e855eb082a69a76216d0fcd644013ade95aea28ae138ebfb3bc8eb90d8fb922c83999d292c12b78d15acfe5c

data/lib/mihari/analyzers/rule.rb

@@ -127,9 +127,12 @@ module Mihari
       # @return [Boolean]
       #
       def disallowed_data_value?(value)
-        normalized_disallowed_data_values.any? do |disallowed_data_value|
-          return value == disallowed_data_value if disallowed_data_value.is_a?(String)
-          return disallowed_data_value.match?(value) if disallowed_data_value.is_a?(Regexp)
+        return true if normalized_disallowed_data_values.include?(value)
+
+        normalized_disallowed_data_values.select do |disallowed_data_value|
+          disallowed_data_value.is_a?(Regexp)
+        end.any? do |disallowed_data_value|
+          disallowed_data_value.match?(value)
         end
       end
 

data/lib/mihari/emitters/the_hive.rb

@@ -11,11 +11,15 @@ module Mihari
       # @return [String, nil]
       attr_reader :api_key
 
+      # @return [String, nil]
+      attr_reader :api_version
+
       def initialize(*args, **kwargs)
         super(*args, **kwargs)
 
         @api_endpoint = kwargs[:api_endpoint] || Mihari.config.thehive_api_endpoint
         @api_key = kwargs[:api_key] || Mihari.config.thehive_api_key
+        @api_version = kwargs[:api_version] || Mihari.config.thehive_api_version
       end
 
       # @return [Boolean]
@@ -26,14 +30,28 @@ module Mihari
       def emit(title:, description:, artifacts:, tags: [], **_options)
         return if artifacts.empty?
 
-        api.alert.create(
-          title: title,
-          description: description,
-          artifacts: artifacts.map { |artifact| { data: artifact.data, data_type: artifact.data_type, message: description } },
-          tags: tags,
-          type: "external",
-          source: "mihari"
-        )
+        payload = payload(title: title, description: description, artifacts: artifacts, tags: tags)
+        api.alert.create(**payload)
+      end
+
+      #
+      # Normalize API version for API client
+      #
+      # @param [String] version
+      #
+      # @return [String, nil]
+      #
+      def normalized_api_version
+        @normalized_api_version ||= [].tap do |out|
+          # v4 does not have version prefix in path (/api/)
+          # v5 has version prefix in path (/api/v1/)
+          table = {
+            "" => nil,
+            "v4" => nil,
+            "v5" => "v1"
+          }
+          out << table[api_version.to_s.downcase]
+        end.first
       end
 
       private
@@ -43,7 +61,7 @@ module Mihari
       end
 
       def api
-        @api ||= Hachi::API.new(api_endpoint: api_endpoint, api_key: api_key)
+        @api ||= Hachi::API.new(api_endpoint: api_endpoint, api_key: api_key, api_version: normalized_api_version)
       end
 
       #
@@ -64,6 +82,35 @@ module Mihari
         !api_key.nil?
       end
 
+      def payload(title:, description:, artifacts:, tags: [])
+        return v4_payload(title: title, description: description, artifacts: artifacts, tags: tags) if normalized_api_version.nil?
+
+        v5_payload(title: title, description: description, artifacts: artifacts, tags: tags)
+      end
+
+      def v4_payload(title:, description:, artifacts:, tags: [])
+        {
+          title: title,
+          description: description,
+          artifacts: artifacts.map { |artifact| { data: artifact.data, data_type: artifact.data_type, message: description } },
+          tags: tags,
+          type: "external",
+          source: "mihari"
+        }
+      end
+
+      def v5_payload(title:, description:, artifacts:, tags: [])
+        {
+          title: title,
+          description: description,
+          observables: artifacts.map { |artifact| { data: artifact.data, data_type: artifact.data_type, message: description } },
+          tags: tags,
+          type: "external",
+          source: "mihari",
+          source_ref: "1"
+        }
+      end
+
       #
       # Check whether an API endpoint is reachable or not
       #
@@ -71,9 +118,21 @@ module Mihari
       #
       def ping?
         base_url = api_endpoint.end_with?("/") ? api_endpoint[0..-2] : api_endpoint
-        url = "#{base_url}/index.html"
+
+        if normalized_api_version.nil?
+          # for v4
+          base_url = api_endpoint.end_with?("/") ? api_endpoint[0..-2] : api_endpoint
+          url = "#{base_url}/index.html"
+        else
+          # for v5
+          url = "#{base_url}/api/v1/status/public"
+        end
 
         http = Net::Ping::HTTP.new(url)
+
+        # use GET for v5
+        http.get_request = true if normalized_api_version
+
         http.ping?
       end
     end

data/lib/mihari/emitters/webhook.rb

@@ -11,7 +11,7 @@ module Mihari
       def emit(title:, description:, artifacts:, source:, tags:)
         return if artifacts.empty?
 
-        headers = { 'content-type': "application/x-www-form-urlencoded" }
+        headers = { "content-type": "application/x-www-form-urlencoded" }
         headers["content-type"] = "application/json" if use_json_body?
 
         emitter = Emitters::HTTP.new(uri: Mihari.config.webhook_url)

data/lib/mihari/models/cpe.rb

@@ -14,7 +14,7 @@ module Mihari
       #
       def build_by_ip(ip)
         res = Enrichers::Shodan.query(ip)
-        return if res.nil?
+        return [] if res.nil?
 
         res.cpes.map { |cpe| new(cpe: cpe) }
       end

data/lib/mihari/models/reverse_dns.rb

@@ -14,7 +14,7 @@ module Mihari
       #
       def build_by_ip(ip)
         res = Enrichers::Shodan.query(ip)
-        return if res.nil?
+        return [] if res.nil?
 
         res.hostnames.map { |name| new(name: name) }
       end

data/lib/mihari/schemas/emitter.rb

@@ -16,6 +16,7 @@ module Mihari
       required(:emitter).value(Types::String.enum("the_hive"))
       optional(:api_endpoint).value(:string)
       optional(:api_key).value(:string)
+      optional(:api_version).value(Types::String.enum("v4", "v5")).default("v4")
     end
 
     Slack = Dry::Schema.Params do

data/lib/mihari/structs/virustotal_intelligence.rb

@@ -4,7 +4,7 @@ module Mihari
   module Structs
     module VirusTotalIntelligence
       class ContextAttributes < Dry::Struct
-        attribute :url, Types.Array(Types::String).optional
+        attribute :url, Types::String.optional
 
         def self.from_dynamic!(d)
           d = Types::Hash[d]
@@ -25,7 +25,7 @@ module Mihari
           when "file"
             id
           when "url"
-            (context_attributes.url || []).first
+            context_attributes&.url
           when "domain"
             id
           when "ip_address"

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "4.5.2"
+  VERSION = "4.6.1"
 end

data/lib/mihari/web/app.rb

@@ -53,6 +53,9 @@ module Mihari
 
         Rack::Handler::Puma.run(instance, Port: port, Host: host, Threads: threads, Verbose: verbose) do |_launcher|
           Launchy.open(url) if ENV["RACK_ENV"] != "development"
+        rescue Launchy::CommandNotFoundError
+          # ref. https://github.com/ninoseki/mihari/issues/477
+          # do nothing
         end
       end
     end

data/lib/mihari.rb

@@ -71,34 +71,55 @@ end
 module Mihari
   extend Dry::Configurable
 
-  setting :binaryedge_api_key, default: ENV["BINARYEDGE_API_KEY"]
-  setting :censys_id, default: ENV["CENSYS_ID"]
-  setting :censys_secret, default: ENV["CENSYS_SECRET"]
-  setting :circl_passive_password, default: ENV["CIRCL_PASSIVE_PASSWORD"]
-  setting :circl_passive_username, default: ENV["CIRCL_PASSIVE_USERNAME"]
-  setting :database, default: ENV["DATABASE"] || "mihari.db"
-  setting :greynoise_api_key, default: ENV["GREYNOISE_API_KEY"]
-  setting :ipinfo_api_key, default: ENV["IPINFO_API_KEY"]
-  setting :misp_api_endpoint, default: ENV["MISP_API_ENDPOINT"]
-  setting :misp_api_key, default: ENV["MISP_API_KEY"]
-  setting :onyphe_api_key, default: ENV["ONYPHE_API_KEY"]
-  setting :otx_api_key, default: ENV["OTX_API_KEY"]
-  setting :passivetotal_api_key, default: ENV["PASSIVETOTAL_API_KEY"]
-  setting :passivetotal_username, default: ENV["PASSIVETOTAL_USERNAME"]
-  setting :pulsedive_api_key, default: ENV["PULSEDIVE_API_KEY"]
-  setting :securitytrails_api_key, default: ENV["SECURITYTRAILS_API_KEY"]
-  setting :shodan_api_key, default: ENV["SHODAN_API_KEY"]
-  setting :slack_channel, default: ENV["SLACK_CHANNEL"]
-  setting :slack_webhook_url, default: ENV["SLACK_WEBHOOK_URL"]
-  setting :spyse_api_key, default: ENV["SPYSE_API_KEY"]
-  setting :thehive_api_endpoint, default: ENV["THEHIVE_API_ENDPOINT"]
-  setting :thehive_api_key, default: ENV["THEHIVE_API_KEY"]
-  setting :urlscan_api_key, default: ENV["URLSCAN_API_KEY"]
-  setting :virustotal_api_key, default: ENV["VIRUSTOTAL_API_KEY"]
-  setting :webhook_url, default: ENV["WEBHOOK_URL"]
-  setting :webhook_use_json_body, constructor: ->(value = ENV["WEBHOOK_USE_JSON_BODY"]) { truthy?(value) }
-  setting :zoomeye_api_key, default: ENV["ZOOMEYE_API_KEY"]
-  setting :sentry_dsn, default: ENV["SENTRY_DSN"]
+  setting :binaryedge_api_key, default: ENV.fetch("BINARYEDGE_API_KEY", nil)
+
+  setting :censys_id, default: ENV.fetch("CENSYS_ID", nil)
+  setting :censys_secret, default: ENV.fetch("CENSYS_SECRET", nil)
+
+  setting :circl_passive_password, default: ENV.fetch("CIRCL_PASSIVE_PASSWORD", nil)
+  setting :circl_passive_username, default: ENV.fetch("CIRCL_PASSIVE_USERNAME", nil)
+
+  setting :database, default: ENV.fetch("DATABASE", "mihari.db")
+
+  setting :greynoise_api_key, default: ENV.fetch("GREYNOISE_API_KEY", nil)
+
+  setting :ipinfo_api_key, default: ENV.fetch("IPINFO_API_KEY", nil)
+
+  setting :misp_api_endpoint, default: ENV.fetch("MISP_API_ENDPOINT", nil)
+  setting :misp_api_key, default: ENV.fetch("MISP_API_KEY", nil)
+
+  setting :onyphe_api_key, default: ENV.fetch("ONYPHE_API_KEY", nil)
+
+  setting :otx_api_key, default: ENV.fetch("OTX_API_KEY", nil)
+
+  setting :passivetotal_api_key, default: ENV.fetch("PASSIVETOTAL_API_KEY", nil)
+  setting :passivetotal_username, default: ENV.fetch("PASSIVETOTAL_USERNAME", nil)
+
+  setting :pulsedive_api_key, default: ENV.fetch("PULSEDIVE_API_KEY", nil)
+
+  setting :securitytrails_api_key, default: ENV.fetch("SECURITYTRAILS_API_KEY", nil)
+
+  setting :shodan_api_key, default: ENV.fetch("SHODAN_API_KEY", nil)
+
+  setting :slack_channel, default: ENV.fetch("SLACK_CHANNEL", nil)
+  setting :slack_webhook_url, default: ENV.fetch("SLACK_WEBHOOK_URL", nil)
+
+  setting :spyse_api_key, default: ENV.fetch("SPYSE_API_KEY", nil)
+
+  setting :thehive_api_endpoint, default: ENV.fetch("THEHIVE_API_ENDPOINT", nil)
+  setting :thehive_api_key, default: ENV.fetch("THEHIVE_API_KEY", nil)
+  setting :thehive_api_version, default: ENV.fetch("THEHIVE_API_VERSION", nil)
+
+  setting :urlscan_api_key, default: ENV.fetch("URLSCAN_API_KEY", nil)
+
+  setting :virustotal_api_key, default: ENV.fetch("VIRUSTOTAL_API_KEY", nil)
+
+  setting :webhook_url, default: ENV.fetch("WEBHOOK_URL", nil)
+  setting :webhook_use_json_body, constructor: ->(value = ENV.fetch("WEBHOOK_USE_JSON_BODY", nil)) { truthy?(value) }
+
+  setting :zoomeye_api_key, default: ENV.fetch("ZOOMEYE_API_KEY", nil)
+
+  setting :sentry_dsn, default: ENV.fetch("SENTRY_DSN", nil)
 
   class << self
     include Memist::Memoizable

data/mihari.gemspec

@@ -39,13 +39,13 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rerun", "~> 0.13"
   spec.add_development_dependency "rspec", "~> 3.11"
   spec.add_development_dependency "simplecov-lcov", "~> 0.8.0"
-  spec.add_development_dependency "standard", "~> 1.11"
+  spec.add_development_dependency "standard", "~> 1.12"
   spec.add_development_dependency "steep", "~> 0.52"
   spec.add_development_dependency "timecop", "~> 0.9"
   spec.add_development_dependency "vcr", "~> 6.1"
   spec.add_development_dependency "webmock", "~> 3.14"
 
-  spec.add_dependency "activerecord", "7.0.2.4"
+  spec.add_dependency "activerecord", "7.0.3"
   spec.add_dependency "addressable", "2.8.0"
   spec.add_dependency "awrence", "2.0.1"
   spec.add_dependency "binaryedge", "0.1.0"
@@ -61,13 +61,13 @@ Gem::Specification.new do |spec|
   spec.add_dependency "dry-schema", "1.9.1"
   spec.add_dependency "dry-struct", "1.4.0"
   spec.add_dependency "dry-validation", "1.8.0"
-  spec.add_dependency "email_address", "0.2.2"
+  spec.add_dependency "email_address", "0.2.3"
   spec.add_dependency "grape", "1.6.2"
   spec.add_dependency "grape-entity", "0.10.1"
   spec.add_dependency "grape-swagger", "1.4.2"
   spec.add_dependency "grape-swagger-entity", "0.5.1"
   spec.add_dependency "greynoise", "0.1.1"
-  spec.add_dependency "hachi", "1.0.0"
+  spec.add_dependency "hachi", "2.0.0"
   spec.add_dependency "insensitive_hash", "0.3.3"
   spec.add_dependency "jr-cli", "0.5.1"
   spec.add_dependency "launchy", "2.5.0"
@@ -88,8 +88,8 @@ Gem::Specification.new do |spec|
   spec.add_dependency "rack-contrib", "2.3.0"
   spec.add_dependency "rack-cors", "1.1.1"
   spec.add_dependency "securitytrails", "1.0.0"
-  spec.add_dependency "semantic_logger", "4.10.0"
-  spec.add_dependency "sentry-ruby", "5.3.0"
+  spec.add_dependency "semantic_logger", "4.11.0"
+  spec.add_dependency "sentry-ruby", "5.3.1"
   spec.add_dependency "shodanx", "0.2.1"
   spec.add_dependency "slack-notifier", "2.4.0"
   spec.add_dependency "spysex", "0.2.0"

data/sig/lib/mihari/emitters/the_hive.rbs

@@ -5,11 +5,15 @@ module Mihari
 
       attr_reader api_key: String?
 
+      attr_reader api_version: String?
+
       # @return [true, false]
       def valid?: () -> bool
 
       def emit: (title: untyped title, description: untyped description, artifacts: untyped artifacts, ?tags: untyped tags, **untyped _options) -> (nil | untyped)
 
+      def normalized_api_version: () -> String?
+
       private
 
       def configuration_keys: () -> ::Array["thehive_api_endpoint" | "thehive_api_key"]

data/sig/lib/mihari.rbs

@@ -19,6 +19,7 @@ class Configuration
   attr_accessor spyse_api_key (): String?
   attr_accessor thehive_api_endpoint (): String?
   attr_accessor thehive_api_key (): String?
+  attr_accessor thehive_api_version (): String?
   attr_accessor urlscan_api_key (): String?
   attr_accessor virustotal_api_key (): String?
   attr_accessor zoomeye_api_key (): String?

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mihari
 version: !ruby/object:Gem::Version
-  version: 4.5.2
+  version: 4.6.1
 platform: ruby
 authors:
 - Manabu Niseki
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2022-05-08 00:00:00.000000000 Z
+date: 2022-05-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -184,14 +184,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.11'
+        version: '1.12'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.11'
+        version: '1.12'
 - !ruby/object:Gem::Dependency
   name: steep
   requirement: !ruby/object:Gem::Requirement
@@ -254,14 +254,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.2.4
+        version: 7.0.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.2.4
+        version: 7.0.3
 - !ruby/object:Gem::Dependency
   name: addressable
   requirement: !ruby/object:Gem::Requirement
@@ -478,14 +478,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.2
+        version: 0.2.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.2
+        version: 0.2.3
 - !ruby/object:Gem::Dependency
   name: grape
   requirement: !ruby/object:Gem::Requirement
@@ -562,14 +562,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: 2.0.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: 2.0.0
 - !ruby/object:Gem::Dependency
   name: insensitive_hash
   requirement: !ruby/object:Gem::Requirement
@@ -856,28 +856,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.10.0
+        version: 4.11.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.10.0
+        version: 4.11.0
 - !ruby/object:Gem::Dependency
   name: sentry-ruby
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.3.0
+        version: 5.3.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.3.0
+        version: 5.3.1
 - !ruby/object:Gem::Dependency
   name: shodanx
   requirement: !ruby/object:Gem::Requirement