mihari 4.6.1 → 4.7.2
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/lib/mihari/analyzers/clients/otx.rb +36 -0
- data/lib/mihari/analyzers/otx.rb +19 -11
- data/lib/mihari/analyzers/rule.rb +17 -1
- data/lib/mihari/commands/init.rb +25 -2
- data/lib/mihari/commands/search.rb +2 -7
- data/lib/mihari/commands/validator.rb +10 -5
- data/lib/mihari/constants.rb +2 -0
- data/lib/mihari/enrichers/google_public_dns.rb +36 -0
- data/lib/mihari/enrichers/whois.rb +126 -0
- data/lib/mihari/errors.rb +2 -0
- data/lib/mihari/http.rb +2 -2
- data/lib/mihari/models/alert.rb +6 -1
- data/lib/mihari/models/artifact.rb +30 -0
- data/lib/mihari/models/dns.rb +5 -21
- data/lib/mihari/models/geolocation.rb +2 -4
- data/lib/mihari/models/port.rb +1 -1
- data/lib/mihari/models/rule.rb +7 -2
- data/lib/mihari/models/whois.rb +1 -96
- data/lib/mihari/schemas/enricher.rb +9 -0
- data/lib/mihari/schemas/rule.rb +6 -0
- data/lib/mihari/structs/filters.rb +71 -0
- data/lib/mihari/structs/google_public_dns.rb +42 -0
- data/lib/mihari/structs/ipinfo.rb +4 -4
- data/lib/mihari/structs/rule.rb +187 -137
- data/lib/mihari/types.rb +7 -0
- data/lib/mihari/version.rb +1 -1
- data/lib/mihari/web/endpoints/alerts.rb +1 -1
- data/lib/mihari/web/endpoints/rules.rb +13 -5
- data/lib/mihari/web/public/index.html +1 -1
- data/lib/mihari/web/public/redoc-static.html +796 -763
- data/lib/mihari/web/public/static/css/chunk-vendors.5013d549.css +7 -0
- data/lib/mihari/web/public/static/js/app.3ac3bd7a.js +2 -0
- data/lib/mihari/web/public/static/js/app.3ac3bd7a.js.map +1 -0
- data/lib/mihari/web/public/static/js/{chunk-vendors.dde2116c.js → chunk-vendors.37b7208e.js} +6 -6
- data/lib/mihari/web/public/static/js/chunk-vendors.37b7208e.js.map +1 -0
- data/lib/mihari.rb +4 -2
- data/mihari.gemspec +8 -9
- data/sig/lib/mihari/cli/base.rbs +0 -2
- data/sig/lib/mihari/enrichers/google_public_dns.rbs +18 -0
- data/sig/lib/mihari/models/alert.rbs +3 -3
- data/sig/lib/mihari/models/rule.rbs +2 -2
- data/sig/lib/mihari/structs/filters.rbs +40 -0
- data/sig/lib/mihari/structs/google_public_dns.rbs +21 -0
- data/sig/lib/mihari/structs/ipinfo.rbs +2 -2
- data/sig/lib/mihari/structs/rule.rbs +36 -43
- metadata +32 -45
- data/lib/mihari/mixins/rule.rb +0 -84
- data/lib/mihari/structs/alert.rb +0 -44
- data/lib/mihari/web/public/static/css/chunk-vendors.06251949.css +0 -7
- data/lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js +0 -2
- data/lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js.map +0 -1
- data/lib/mihari/web/public/static/js/app.823b5af7.js +0 -2
- data/lib/mihari/web/public/static/js/app.823b5af7.js.map +0 -1
- data/lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js +0 -25
- data/lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js.map +0 -1
- data/lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js.map +0 -1
- data/sig/lib/mihari/mixins/rule.rbs +0 -36
- data/sig/lib/mihari/structs/alert.rbs +0 -27
data/lib/mihari.rb
CHANGED
@@ -59,7 +59,6 @@ require "mihari/mixins/disallowed_data_value"
|
|
59
59
|
require "mihari/mixins/error_notification"
|
60
60
|
require "mihari/mixins/refang"
|
61
61
|
require "mihari/mixins/retriable"
|
62
|
-
require "mihari/mixins/rule"
|
63
62
|
|
64
63
|
def truthy?(value)
|
65
64
|
return true if value == "true"
|
@@ -171,8 +170,9 @@ require "mihari/constants"
|
|
171
170
|
require "mihari/types"
|
172
171
|
|
173
172
|
# Structs
|
174
|
-
require "mihari/structs/alert"
|
175
173
|
require "mihari/structs/censys"
|
174
|
+
require "mihari/structs/filters"
|
175
|
+
require "mihari/structs/google_public_dns"
|
176
176
|
require "mihari/structs/greynoise"
|
177
177
|
require "mihari/structs/ipinfo"
|
178
178
|
require "mihari/structs/onyphe"
|
@@ -189,8 +189,10 @@ require "mihari/schemas/rule"
|
|
189
189
|
|
190
190
|
# Enrichers
|
191
191
|
require "mihari/enrichers/base"
|
192
|
+
require "mihari/enrichers/google_public_dns"
|
192
193
|
require "mihari/enrichers/ipinfo"
|
193
194
|
require "mihari/enrichers/shodan"
|
195
|
+
require "mihari/enrichers/whois"
|
194
196
|
|
195
197
|
# Models
|
196
198
|
require "mihari/models/alert"
|
data/mihari.gemspec
CHANGED
@@ -29,18 +29,18 @@ Gem::Specification.new do |spec|
|
|
29
29
|
|
30
30
|
spec.add_development_dependency "bundler", "~> 2.3"
|
31
31
|
spec.add_development_dependency "coveralls_reborn", "~> 0.24"
|
32
|
-
spec.add_development_dependency "fakefs", "~> 1.
|
32
|
+
spec.add_development_dependency "fakefs", "~> 1.8"
|
33
33
|
spec.add_development_dependency "mysql2", "~> 0.5"
|
34
34
|
spec.add_development_dependency "overcommit", "~> 0.59"
|
35
|
-
spec.add_development_dependency "pg", "~> 1.
|
36
|
-
spec.add_development_dependency "rack-test", "~>
|
35
|
+
spec.add_development_dependency "pg", "~> 1.4"
|
36
|
+
spec.add_development_dependency "rack-test", "~> 2.0"
|
37
37
|
spec.add_development_dependency "rake", "~> 13.0"
|
38
38
|
spec.add_development_dependency "rb-fsevent", "~> 0.11"
|
39
39
|
spec.add_development_dependency "rerun", "~> 0.13"
|
40
40
|
spec.add_development_dependency "rspec", "~> 3.11"
|
41
41
|
spec.add_development_dependency "simplecov-lcov", "~> 0.8.0"
|
42
42
|
spec.add_development_dependency "standard", "~> 1.12"
|
43
|
-
spec.add_development_dependency "steep", "~> 0
|
43
|
+
spec.add_development_dependency "steep", "~> 1.0"
|
44
44
|
spec.add_development_dependency "timecop", "~> 0.9"
|
45
45
|
spec.add_development_dependency "vcr", "~> 6.1"
|
46
46
|
spec.add_development_dependency "webmock", "~> 3.14"
|
@@ -58,9 +58,9 @@ Gem::Specification.new do |spec|
|
|
58
58
|
spec.add_dependency "dry-container", "0.9.0"
|
59
59
|
spec.add_dependency "dry-files", "0.1.0"
|
60
60
|
spec.add_dependency "dry-initializer", "3.1.1"
|
61
|
-
spec.add_dependency "dry-schema", "1.9.
|
61
|
+
spec.add_dependency "dry-schema", "1.9.3"
|
62
62
|
spec.add_dependency "dry-struct", "1.4.0"
|
63
|
-
spec.add_dependency "dry-validation", "1.8.
|
63
|
+
spec.add_dependency "dry-validation", "1.8.1"
|
64
64
|
spec.add_dependency "email_address", "0.2.3"
|
65
65
|
spec.add_dependency "grape", "1.6.2"
|
66
66
|
spec.add_dependency "grape-entity", "0.10.1"
|
@@ -76,7 +76,6 @@ Gem::Specification.new do |spec|
|
|
76
76
|
spec.add_dependency "net-ping", "2.0.8"
|
77
77
|
spec.add_dependency "normalize_country", "0.3.2"
|
78
78
|
spec.add_dependency "onyphe", "2.0.0"
|
79
|
-
spec.add_dependency "otx_ruby", "0.9.9"
|
80
79
|
spec.add_dependency "parallel", "1.22.1"
|
81
80
|
spec.add_dependency "passive_circl", "0.1.0"
|
82
81
|
spec.add_dependency "passivetotalx", "0.1.1"
|
@@ -84,7 +83,7 @@ Gem::Specification.new do |spec|
|
|
84
83
|
spec.add_dependency "public_suffix", "4.0.7"
|
85
84
|
spec.add_dependency "pulsedive", "0.1.5"
|
86
85
|
spec.add_dependency "puma", "5.6.4"
|
87
|
-
spec.add_dependency "rack", "2.2.3"
|
86
|
+
spec.add_dependency "rack", "2.2.3.1"
|
88
87
|
spec.add_dependency "rack-contrib", "2.3.0"
|
89
88
|
spec.add_dependency "rack-cors", "1.1.1"
|
90
89
|
spec.add_dependency "securitytrails", "1.0.0"
|
@@ -93,7 +92,7 @@ Gem::Specification.new do |spec|
|
|
93
92
|
spec.add_dependency "shodanx", "0.2.1"
|
94
93
|
spec.add_dependency "slack-notifier", "2.4.0"
|
95
94
|
spec.add_dependency "spysex", "0.2.0"
|
96
|
-
spec.add_dependency "sqlite3", "1.4.
|
95
|
+
spec.add_dependency "sqlite3", "1.4.4"
|
97
96
|
spec.add_dependency "thor", "1.2.1"
|
98
97
|
spec.add_dependency "urlscan", "0.8.0"
|
99
98
|
spec.add_dependency "uuidtools", "2.2.0"
|
data/sig/lib/mihari/cli/base.rbs
CHANGED
@@ -0,0 +1,18 @@
|
|
1
|
+
module Mihari
|
2
|
+
module Enrichers
|
3
|
+
class GooglePublicDNS < Base
|
4
|
+
# @return [Boolean]
|
5
|
+
def valid?: () -> true
|
6
|
+
|
7
|
+
#
|
8
|
+
# Query Google Public DNS
|
9
|
+
#
|
10
|
+
# @param [String] name
|
11
|
+
# @param [String] resource_type
|
12
|
+
#
|
13
|
+
# @return [Mihari::Structs::Shodan::GooglePublicDNS::Response, nil]
|
14
|
+
#
|
15
|
+
def self.query: (String name, String resource_type) -> Mihari::Structs::Shodan::GooglePublicDNS::Response?
|
16
|
+
end
|
17
|
+
end
|
18
|
+
end
|
@@ -7,12 +7,12 @@ module Mihari
|
|
7
7
|
attr_accessor artifacts(): Array[Mihari::Artifact]
|
8
8
|
attr_accessor Tags(): Array[Mihari::Tag]
|
9
9
|
|
10
|
-
def self.search: (Mihari::Structs::Alert::SearchFilterWithPagination filter) -> Array[Mihari::Alert]
|
10
|
+
def self.search: (Mihari::Structs::Filters::Alert::SearchFilterWithPagination filter) -> Array[Mihari::Alert]
|
11
11
|
|
12
|
-
def self.count: (Mihari::Structs::Alert::SearchFilter filter) -> Integer
|
12
|
+
def self.count: (Mihari::Structs::Filters::Alert::SearchFilter filter) -> Integer
|
13
13
|
|
14
14
|
private
|
15
15
|
|
16
|
-
def self.build_relation: (Mihari::Structs::Alert::SearchFilter filter) -> Mihari::Alert
|
16
|
+
def self.build_relation: (Mihari::Structs::Filters::Alert::SearchFilter filter) -> Mihari::Alert
|
17
17
|
end
|
18
18
|
end
|
@@ -10,8 +10,8 @@ module Mihari
|
|
10
10
|
|
11
11
|
def to_h: () -> Hash
|
12
12
|
|
13
|
-
def self.search: (Mihari::Structs::Rule::SearchFilterWithPagination filter) -> Array[Mihari::Rule]
|
13
|
+
def self.search: (Mihari::Structs::Filters::Rule::SearchFilterWithPagination filter) -> Array[Mihari::Rule]
|
14
14
|
|
15
|
-
def self.count: (Mihari::Structs::Rule::SearchFilter filter) -> Integer
|
15
|
+
def self.count: (Mihari::Structs::Filters::Rule::SearchFilter filter) -> Integer
|
16
16
|
end
|
17
17
|
end
|
@@ -0,0 +1,40 @@
|
|
1
|
+
module Mihari
|
2
|
+
module Structs
|
3
|
+
module Filters
|
4
|
+
module Alert
|
5
|
+
class SearchFilter < Dry::Struct
|
6
|
+
attr_reader artifact_data: String?
|
7
|
+
attr_reader description: String?
|
8
|
+
attr_reader source: String?
|
9
|
+
attr_reader tag_name: String?
|
10
|
+
attr_reader title: String?
|
11
|
+
attr_reader from_at: DateTime?
|
12
|
+
attr_reader to_at: DateTime?
|
13
|
+
attr_reader asn: Integer?
|
14
|
+
attr_reader dns_record: String?
|
15
|
+
attr_reader reverse_dns_name: String?
|
16
|
+
|
17
|
+
def valid_artifact_filters?: () -> bool
|
18
|
+
end
|
19
|
+
|
20
|
+
class SearchFilterWithPagination < SearchFilter
|
21
|
+
def without_pagination: () -> Mihari::Structs::Filters::Alert::SearchFilter
|
22
|
+
end
|
23
|
+
end
|
24
|
+
|
25
|
+
module Rule
|
26
|
+
class SearchFilter < Dry::Struct
|
27
|
+
attr_reader page: Integer?
|
28
|
+
attr_reader tag: String?
|
29
|
+
attr_reader source: String?
|
30
|
+
attr_reader from_at: DateTime?
|
31
|
+
attr_reader to_at: DateTime?
|
32
|
+
end
|
33
|
+
|
34
|
+
class SearchFilterWithPagination < SearchFilter
|
35
|
+
def without_pagination: () -> Mihari::Structs::Filters::Rule::SearchFilter
|
36
|
+
end
|
37
|
+
end
|
38
|
+
end
|
39
|
+
end
|
40
|
+
end
|
@@ -0,0 +1,21 @@
|
|
1
|
+
module Mihari
|
2
|
+
module Structs
|
3
|
+
module GooglePublicDNS
|
4
|
+
INT_TYPE_TO_TYPE: { 1 => "A", 2 => "NS", 5 => "CNAME", 16 => "TXT", 28 => "AAAA" }
|
5
|
+
|
6
|
+
class Answer < Dry::Struct
|
7
|
+
attr_reader name: String
|
8
|
+
attr_reader data: String
|
9
|
+
attr_reader resource_type: String
|
10
|
+
|
11
|
+
def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::GooglePublicDNS::Answer
|
12
|
+
end
|
13
|
+
|
14
|
+
class Response < Dry::Struct
|
15
|
+
attr_reader answers: Array[Mihari::Structs::GooglePublicDNS::Answer]
|
16
|
+
|
17
|
+
def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::GooglePublicDNS::Response
|
18
|
+
end
|
19
|
+
end
|
20
|
+
end
|
21
|
+
end
|
@@ -4,8 +4,8 @@ module Mihari
|
|
4
4
|
class Response
|
5
5
|
attr_reader ip: String
|
6
6
|
attr_reader hostname: String?
|
7
|
-
attr_reader loc: String
|
8
|
-
attr_reader country_code: String
|
7
|
+
attr_reader loc: String?
|
8
|
+
attr_reader country_code: String?
|
9
9
|
attr_reader asn: Integer?
|
10
10
|
|
11
11
|
def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::IPInfo::Response
|
@@ -1,64 +1,57 @@
|
|
1
1
|
module Mihari
|
2
2
|
module Structs
|
3
|
-
|
4
|
-
|
5
|
-
end
|
3
|
+
class Rule
|
4
|
+
attr_reader data: Hash
|
6
5
|
|
7
|
-
|
8
|
-
def without_pagination: () -> SearchFilter
|
9
|
-
end
|
6
|
+
attr_reader yaml: String
|
10
7
|
|
11
|
-
|
12
|
-
attr_reader data: Hash
|
8
|
+
attr_reader errors: Array[untypes]?
|
13
9
|
|
14
|
-
|
10
|
+
def initialize: (Hash data) -> void
|
15
11
|
|
16
|
-
|
12
|
+
#
|
13
|
+
# @return [Boolean]
|
14
|
+
#
|
15
|
+
def errors?: () -> (bool)
|
17
16
|
|
18
|
-
|
17
|
+
#
|
18
|
+
# @return [Array[String]]
|
19
|
+
#
|
20
|
+
def error_messages: () -> (Array[String])
|
19
21
|
|
20
|
-
|
21
|
-
# @return [Boolean]
|
22
|
-
#
|
23
|
-
def errors?: () -> (bool)
|
22
|
+
def validate: () -> void
|
24
23
|
|
25
|
-
|
26
|
-
# @return [Array[String]]
|
27
|
-
#
|
28
|
-
def error_messages: () -> (Array[String])
|
24
|
+
def validate!: () -> void
|
29
25
|
|
30
|
-
|
26
|
+
def []: (untyped key) -> untyped
|
31
27
|
|
32
|
-
|
28
|
+
#
|
29
|
+
# @return [String]
|
30
|
+
#
|
31
|
+
def id: () -> String
|
33
32
|
|
34
|
-
|
33
|
+
#
|
34
|
+
# @return [String]
|
35
|
+
#
|
36
|
+
def title: () -> String
|
35
37
|
|
36
|
-
|
37
|
-
|
38
|
-
|
39
|
-
|
38
|
+
#
|
39
|
+
# @return [String]
|
40
|
+
#
|
41
|
+
def description: () -> String
|
40
42
|
|
41
|
-
|
42
|
-
|
43
|
-
|
44
|
-
|
43
|
+
#
|
44
|
+
# @return [Mihari::Rule]
|
45
|
+
#
|
46
|
+
def to_model: () -> Mihari::Rule
|
45
47
|
|
46
|
-
|
47
|
-
# @return [String]
|
48
|
-
#
|
49
|
-
def description: () -> String
|
48
|
+
def to_analyzer: () -> Mihari::Analyzers::Rule
|
50
49
|
|
51
|
-
|
52
|
-
# @return [Mihari::Rule]
|
53
|
-
#
|
54
|
-
def to_model: () -> Mihari::Rule
|
50
|
+
def self.from_model: (Mihari::Rule model) -> Mihari::Structs::Rule
|
55
51
|
|
56
|
-
|
52
|
+
def self.from_yaml: (String yaml) -> Mihari::Structs::Rule
|
57
53
|
|
58
|
-
|
59
|
-
|
60
|
-
def self.from_yaml: (String yaml) -> Mihari::Structs::Rule::Rule
|
61
|
-
end
|
54
|
+
def self.from_path_or_id: (String path_or_id) -> Mihari::Structs::Rule
|
62
55
|
end
|
63
56
|
end
|
64
57
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: mihari
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 4.
|
4
|
+
version: 4.7.2
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Manabu Niseki
|
8
8
|
autorequire:
|
9
9
|
bindir: exe
|
10
10
|
cert_chain: []
|
11
|
-
date: 2022-
|
11
|
+
date: 2022-06-26 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: bundler
|
@@ -44,14 +44,14 @@ dependencies:
|
|
44
44
|
requirements:
|
45
45
|
- - "~>"
|
46
46
|
- !ruby/object:Gem::Version
|
47
|
-
version: '1.
|
47
|
+
version: '1.8'
|
48
48
|
type: :development
|
49
49
|
prerelease: false
|
50
50
|
version_requirements: !ruby/object:Gem::Requirement
|
51
51
|
requirements:
|
52
52
|
- - "~>"
|
53
53
|
- !ruby/object:Gem::Version
|
54
|
-
version: '1.
|
54
|
+
version: '1.8'
|
55
55
|
- !ruby/object:Gem::Dependency
|
56
56
|
name: mysql2
|
57
57
|
requirement: !ruby/object:Gem::Requirement
|
@@ -86,28 +86,28 @@ dependencies:
|
|
86
86
|
requirements:
|
87
87
|
- - "~>"
|
88
88
|
- !ruby/object:Gem::Version
|
89
|
-
version: '1.
|
89
|
+
version: '1.4'
|
90
90
|
type: :development
|
91
91
|
prerelease: false
|
92
92
|
version_requirements: !ruby/object:Gem::Requirement
|
93
93
|
requirements:
|
94
94
|
- - "~>"
|
95
95
|
- !ruby/object:Gem::Version
|
96
|
-
version: '1.
|
96
|
+
version: '1.4'
|
97
97
|
- !ruby/object:Gem::Dependency
|
98
98
|
name: rack-test
|
99
99
|
requirement: !ruby/object:Gem::Requirement
|
100
100
|
requirements:
|
101
101
|
- - "~>"
|
102
102
|
- !ruby/object:Gem::Version
|
103
|
-
version: '
|
103
|
+
version: '2.0'
|
104
104
|
type: :development
|
105
105
|
prerelease: false
|
106
106
|
version_requirements: !ruby/object:Gem::Requirement
|
107
107
|
requirements:
|
108
108
|
- - "~>"
|
109
109
|
- !ruby/object:Gem::Version
|
110
|
-
version: '
|
110
|
+
version: '2.0'
|
111
111
|
- !ruby/object:Gem::Dependency
|
112
112
|
name: rake
|
113
113
|
requirement: !ruby/object:Gem::Requirement
|
@@ -198,14 +198,14 @@ dependencies:
|
|
198
198
|
requirements:
|
199
199
|
- - "~>"
|
200
200
|
- !ruby/object:Gem::Version
|
201
|
-
version: '0
|
201
|
+
version: '1.0'
|
202
202
|
type: :development
|
203
203
|
prerelease: false
|
204
204
|
version_requirements: !ruby/object:Gem::Requirement
|
205
205
|
requirements:
|
206
206
|
- - "~>"
|
207
207
|
- !ruby/object:Gem::Version
|
208
|
-
version: '0
|
208
|
+
version: '1.0'
|
209
209
|
- !ruby/object:Gem::Dependency
|
210
210
|
name: timecop
|
211
211
|
requirement: !ruby/object:Gem::Requirement
|
@@ -436,14 +436,14 @@ dependencies:
|
|
436
436
|
requirements:
|
437
437
|
- - '='
|
438
438
|
- !ruby/object:Gem::Version
|
439
|
-
version: 1.9.
|
439
|
+
version: 1.9.3
|
440
440
|
type: :runtime
|
441
441
|
prerelease: false
|
442
442
|
version_requirements: !ruby/object:Gem::Requirement
|
443
443
|
requirements:
|
444
444
|
- - '='
|
445
445
|
- !ruby/object:Gem::Version
|
446
|
-
version: 1.9.
|
446
|
+
version: 1.9.3
|
447
447
|
- !ruby/object:Gem::Dependency
|
448
448
|
name: dry-struct
|
449
449
|
requirement: !ruby/object:Gem::Requirement
|
@@ -464,14 +464,14 @@ dependencies:
|
|
464
464
|
requirements:
|
465
465
|
- - '='
|
466
466
|
- !ruby/object:Gem::Version
|
467
|
-
version: 1.8.
|
467
|
+
version: 1.8.1
|
468
468
|
type: :runtime
|
469
469
|
prerelease: false
|
470
470
|
version_requirements: !ruby/object:Gem::Requirement
|
471
471
|
requirements:
|
472
472
|
- - '='
|
473
473
|
- !ruby/object:Gem::Version
|
474
|
-
version: 1.8.
|
474
|
+
version: 1.8.1
|
475
475
|
- !ruby/object:Gem::Dependency
|
476
476
|
name: email_address
|
477
477
|
requirement: !ruby/object:Gem::Requirement
|
@@ -682,20 +682,6 @@ dependencies:
|
|
682
682
|
- - '='
|
683
683
|
- !ruby/object:Gem::Version
|
684
684
|
version: 2.0.0
|
685
|
-
- !ruby/object:Gem::Dependency
|
686
|
-
name: otx_ruby
|
687
|
-
requirement: !ruby/object:Gem::Requirement
|
688
|
-
requirements:
|
689
|
-
- - '='
|
690
|
-
- !ruby/object:Gem::Version
|
691
|
-
version: 0.9.9
|
692
|
-
type: :runtime
|
693
|
-
prerelease: false
|
694
|
-
version_requirements: !ruby/object:Gem::Requirement
|
695
|
-
requirements:
|
696
|
-
- - '='
|
697
|
-
- !ruby/object:Gem::Version
|
698
|
-
version: 0.9.9
|
699
685
|
- !ruby/object:Gem::Dependency
|
700
686
|
name: parallel
|
701
687
|
requirement: !ruby/object:Gem::Requirement
|
@@ -800,14 +786,14 @@ dependencies:
|
|
800
786
|
requirements:
|
801
787
|
- - '='
|
802
788
|
- !ruby/object:Gem::Version
|
803
|
-
version: 2.2.3
|
789
|
+
version: 2.2.3.1
|
804
790
|
type: :runtime
|
805
791
|
prerelease: false
|
806
792
|
version_requirements: !ruby/object:Gem::Requirement
|
807
793
|
requirements:
|
808
794
|
- - '='
|
809
795
|
- !ruby/object:Gem::Version
|
810
|
-
version: 2.2.3
|
796
|
+
version: 2.2.3.1
|
811
797
|
- !ruby/object:Gem::Dependency
|
812
798
|
name: rack-contrib
|
813
799
|
requirement: !ruby/object:Gem::Requirement
|
@@ -926,14 +912,14 @@ dependencies:
|
|
926
912
|
requirements:
|
927
913
|
- - '='
|
928
914
|
- !ruby/object:Gem::Version
|
929
|
-
version: 1.4.
|
915
|
+
version: 1.4.4
|
930
916
|
type: :runtime
|
931
917
|
prerelease: false
|
932
918
|
version_requirements: !ruby/object:Gem::Requirement
|
933
919
|
requirements:
|
934
920
|
- - '='
|
935
921
|
- !ruby/object:Gem::Version
|
936
|
-
version: 1.4.
|
922
|
+
version: 1.4.4
|
937
923
|
- !ruby/object:Gem::Dependency
|
938
924
|
name: thor
|
939
925
|
requirement: !ruby/object:Gem::Requirement
|
@@ -1074,6 +1060,7 @@ files:
|
|
1074
1060
|
- lib/mihari/analyzers/binaryedge.rb
|
1075
1061
|
- lib/mihari/analyzers/censys.rb
|
1076
1062
|
- lib/mihari/analyzers/circl.rb
|
1063
|
+
- lib/mihari/analyzers/clients/otx.rb
|
1077
1064
|
- lib/mihari/analyzers/crtsh.rb
|
1078
1065
|
- lib/mihari/analyzers/dnpedia.rb
|
1079
1066
|
- lib/mihari/analyzers/dnstwister.rb
|
@@ -1110,8 +1097,10 @@ files:
|
|
1110
1097
|
- lib/mihari/emitters/the_hive.rb
|
1111
1098
|
- lib/mihari/emitters/webhook.rb
|
1112
1099
|
- lib/mihari/enrichers/base.rb
|
1100
|
+
- lib/mihari/enrichers/google_public_dns.rb
|
1113
1101
|
- lib/mihari/enrichers/ipinfo.rb
|
1114
1102
|
- lib/mihari/enrichers/shodan.rb
|
1103
|
+
- lib/mihari/enrichers/whois.rb
|
1115
1104
|
- lib/mihari/entities/alert.rb
|
1116
1105
|
- lib/mihari/entities/artifact.rb
|
1117
1106
|
- lib/mihari/entities/autonomous_system.rb
|
@@ -1138,7 +1127,6 @@ files:
|
|
1138
1127
|
- lib/mihari/mixins/error_notification.rb
|
1139
1128
|
- lib/mihari/mixins/refang.rb
|
1140
1129
|
- lib/mihari/mixins/retriable.rb
|
1141
|
-
- lib/mihari/mixins/rule.rb
|
1142
1130
|
- lib/mihari/models/alert.rb
|
1143
1131
|
- lib/mihari/models/artifact.rb
|
1144
1132
|
- lib/mihari/models/autonomous_system.rb
|
@@ -1153,11 +1141,13 @@ files:
|
|
1153
1141
|
- lib/mihari/models/whois.rb
|
1154
1142
|
- lib/mihari/schemas/analyzer.rb
|
1155
1143
|
- lib/mihari/schemas/emitter.rb
|
1144
|
+
- lib/mihari/schemas/enricher.rb
|
1156
1145
|
- lib/mihari/schemas/macros.rb
|
1157
1146
|
- lib/mihari/schemas/rule.rb
|
1158
1147
|
- lib/mihari/status.rb
|
1159
|
-
- lib/mihari/structs/alert.rb
|
1160
1148
|
- lib/mihari/structs/censys.rb
|
1149
|
+
- lib/mihari/structs/filters.rb
|
1150
|
+
- lib/mihari/structs/google_public_dns.rb
|
1161
1151
|
- lib/mihari/structs/greynoise.rb
|
1162
1152
|
- lib/mihari/structs/ipinfo.rb
|
1163
1153
|
- lib/mihari/structs/onyphe.rb
|
@@ -1183,7 +1173,7 @@ files:
|
|
1183
1173
|
- lib/mihari/web/public/index.html
|
1184
1174
|
- lib/mihari/web/public/redoc-static.html
|
1185
1175
|
- lib/mihari/web/public/static/css/app.2a5d3d21.css
|
1186
|
-
- lib/mihari/web/public/static/css/chunk-vendors.
|
1176
|
+
- lib/mihari/web/public/static/css/chunk-vendors.5013d549.css
|
1187
1177
|
- lib/mihari/web/public/static/favicon.ico
|
1188
1178
|
- lib/mihari/web/public/static/fonts/fa-brands-400.7fa789ab.ttf
|
1189
1179
|
- lib/mihari/web/public/static/fonts/fa-brands-400.859fc388.woff2
|
@@ -1192,14 +1182,10 @@ files:
|
|
1192
1182
|
- lib/mihari/web/public/static/fonts/fa-solid-900.3a463ec3.ttf
|
1193
1183
|
- lib/mihari/web/public/static/fonts/fa-solid-900.40ddefd7.woff2
|
1194
1184
|
- lib/mihari/web/public/static/fonts/fa-v4compatibility.924588dc.ttf
|
1195
|
-
- lib/mihari/web/public/static/js/app
|
1196
|
-
- lib/mihari/web/public/static/js/app
|
1197
|
-
- lib/mihari/web/public/static/js/
|
1198
|
-
- lib/mihari/web/public/static/js/
|
1199
|
-
- lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js
|
1200
|
-
- lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js.map
|
1201
|
-
- lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js
|
1202
|
-
- lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js.map
|
1185
|
+
- lib/mihari/web/public/static/js/app.3ac3bd7a.js
|
1186
|
+
- lib/mihari/web/public/static/js/app.3ac3bd7a.js.map
|
1187
|
+
- lib/mihari/web/public/static/js/chunk-vendors.37b7208e.js
|
1188
|
+
- lib/mihari/web/public/static/js/chunk-vendors.37b7208e.js.map
|
1203
1189
|
- mihari.gemspec
|
1204
1190
|
- renovate.json
|
1205
1191
|
- sig/lib/mihari.rbs
|
@@ -1243,6 +1229,7 @@ files:
|
|
1243
1229
|
- sig/lib/mihari/emitters/the_hive.rbs
|
1244
1230
|
- sig/lib/mihari/emitters/webhook.rbs
|
1245
1231
|
- sig/lib/mihari/enrichers/base.rbs
|
1232
|
+
- sig/lib/mihari/enrichers/google_public_dns.rbs
|
1246
1233
|
- sig/lib/mihari/enrichers/ipinfo.rbs
|
1247
1234
|
- sig/lib/mihari/errors.rbs
|
1248
1235
|
- sig/lib/mihari/feed/parser.rbs
|
@@ -1256,7 +1243,6 @@ files:
|
|
1256
1243
|
- sig/lib/mihari/mixins/hash.rbs
|
1257
1244
|
- sig/lib/mihari/mixins/refang.rbs
|
1258
1245
|
- sig/lib/mihari/mixins/retriable.rbs
|
1259
|
-
- sig/lib/mihari/mixins/rule.rbs
|
1260
1246
|
- sig/lib/mihari/models/alert.rbs
|
1261
1247
|
- sig/lib/mihari/models/artifact.rbs
|
1262
1248
|
- sig/lib/mihari/models/autonomous_system.rbs
|
@@ -1270,8 +1256,9 @@ files:
|
|
1270
1256
|
- sig/lib/mihari/models/tagging.rbs
|
1271
1257
|
- sig/lib/mihari/models/whois.rbs
|
1272
1258
|
- sig/lib/mihari/status.rbs
|
1273
|
-
- sig/lib/mihari/structs/alert.rbs
|
1274
1259
|
- sig/lib/mihari/structs/censys.rbs
|
1260
|
+
- sig/lib/mihari/structs/filters.rbs
|
1261
|
+
- sig/lib/mihari/structs/google_public_dns.rbs
|
1275
1262
|
- sig/lib/mihari/structs/greynoise.rbs
|
1276
1263
|
- sig/lib/mihari/structs/ipinfo.rbs
|
1277
1264
|
- sig/lib/mihari/structs/onyphe.rbs
|
data/lib/mihari/mixins/rule.rb
DELETED
@@ -1,84 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
require "date"
|
4
|
-
require "erb"
|
5
|
-
require "pathname"
|
6
|
-
|
7
|
-
module Mihari
|
8
|
-
module Mixins
|
9
|
-
module Rule
|
10
|
-
include Mixins::Database
|
11
|
-
|
12
|
-
def load_erb_yaml(yaml)
|
13
|
-
YAML.safe_load(ERB.new(yaml).result, permitted_classes: [Date], symbolize_names: true)
|
14
|
-
end
|
15
|
-
|
16
|
-
#
|
17
|
-
# Load rule into hash
|
18
|
-
#
|
19
|
-
# @param [String] path_or_id Path to YAML file or YAML string or ID of a rule in the database
|
20
|
-
#
|
21
|
-
# @return [Mihari::Structs::Rule::Rule]
|
22
|
-
#
|
23
|
-
def load_rule(path_or_id)
|
24
|
-
yaml = nil
|
25
|
-
|
26
|
-
yaml = load_yaml_from_file(path_or_id) if File.exist?(path_or_id)
|
27
|
-
yaml = load_yaml_from_db(path_or_id) if yaml.nil?
|
28
|
-
|
29
|
-
Structs::Rule::Rule.from_yaml yaml
|
30
|
-
end
|
31
|
-
|
32
|
-
def load_yaml_from_file(path)
|
33
|
-
return nil unless Pathname(path).exist?
|
34
|
-
|
35
|
-
File.read path
|
36
|
-
end
|
37
|
-
|
38
|
-
def load_yaml_from_db(id)
|
39
|
-
with_db_connection do
|
40
|
-
rule = Mihari::Rule.find(id)
|
41
|
-
rule.yaml || rule.symbolized_data.to_yaml
|
42
|
-
rescue ActiveRecord::RecordNotFound
|
43
|
-
raise ArgumentError, "ID:#{id} is not found in the database"
|
44
|
-
end
|
45
|
-
end
|
46
|
-
|
47
|
-
#
|
48
|
-
# Validate a rule
|
49
|
-
#
|
50
|
-
# @param [Mihari::Structs::Rule::Rule] rule
|
51
|
-
#
|
52
|
-
def validate_rule!(rule)
|
53
|
-
rule.validate!
|
54
|
-
rescue RuleValidationError => e
|
55
|
-
Mihari.logger.error "Failed to parse the input as a rule"
|
56
|
-
raise e
|
57
|
-
end
|
58
|
-
|
59
|
-
#
|
60
|
-
# Returns a template for rule
|
61
|
-
#
|
62
|
-
# @return [String] A template for rule
|
63
|
-
#
|
64
|
-
def rule_template
|
65
|
-
yaml = File.read(File.expand_path("../templates/rule.yml.erb", __dir__))
|
66
|
-
Structs::Rule::Rule.from_yaml yaml
|
67
|
-
yaml
|
68
|
-
end
|
69
|
-
|
70
|
-
#
|
71
|
-
# Create (blank) rule file
|
72
|
-
#
|
73
|
-
# @param [String] filename
|
74
|
-
# @param [Dry::Files] files
|
75
|
-
# @param [String] template
|
76
|
-
#
|
77
|
-
# @return [nil]
|
78
|
-
#
|
79
|
-
def initialize_rule_yaml(filename, files = Dry::Files.new, template: rule_template)
|
80
|
-
files.write(filename, template)
|
81
|
-
end
|
82
|
-
end
|
83
|
-
end
|
84
|
-
end
|