mihari 4.6.1 → 4.7.2

Sign up to get free protection for your applications and to get access to all the features.
Files changed (59) hide show
  1. checksums.yaml +4 -4
  2. data/lib/mihari/analyzers/clients/otx.rb +36 -0
  3. data/lib/mihari/analyzers/otx.rb +19 -11
  4. data/lib/mihari/analyzers/rule.rb +17 -1
  5. data/lib/mihari/commands/init.rb +25 -2
  6. data/lib/mihari/commands/search.rb +2 -7
  7. data/lib/mihari/commands/validator.rb +10 -5
  8. data/lib/mihari/constants.rb +2 -0
  9. data/lib/mihari/enrichers/google_public_dns.rb +36 -0
  10. data/lib/mihari/enrichers/whois.rb +126 -0
  11. data/lib/mihari/errors.rb +2 -0
  12. data/lib/mihari/http.rb +2 -2
  13. data/lib/mihari/models/alert.rb +6 -1
  14. data/lib/mihari/models/artifact.rb +30 -0
  15. data/lib/mihari/models/dns.rb +5 -21
  16. data/lib/mihari/models/geolocation.rb +2 -4
  17. data/lib/mihari/models/port.rb +1 -1
  18. data/lib/mihari/models/rule.rb +7 -2
  19. data/lib/mihari/models/whois.rb +1 -96
  20. data/lib/mihari/schemas/enricher.rb +9 -0
  21. data/lib/mihari/schemas/rule.rb +6 -0
  22. data/lib/mihari/structs/filters.rb +71 -0
  23. data/lib/mihari/structs/google_public_dns.rb +42 -0
  24. data/lib/mihari/structs/ipinfo.rb +4 -4
  25. data/lib/mihari/structs/rule.rb +187 -137
  26. data/lib/mihari/types.rb +7 -0
  27. data/lib/mihari/version.rb +1 -1
  28. data/lib/mihari/web/endpoints/alerts.rb +1 -1
  29. data/lib/mihari/web/endpoints/rules.rb +13 -5
  30. data/lib/mihari/web/public/index.html +1 -1
  31. data/lib/mihari/web/public/redoc-static.html +796 -763
  32. data/lib/mihari/web/public/static/css/chunk-vendors.5013d549.css +7 -0
  33. data/lib/mihari/web/public/static/js/app.3ac3bd7a.js +2 -0
  34. data/lib/mihari/web/public/static/js/app.3ac3bd7a.js.map +1 -0
  35. data/lib/mihari/web/public/static/js/{chunk-vendors.dde2116c.js → chunk-vendors.37b7208e.js} +6 -6
  36. data/lib/mihari/web/public/static/js/chunk-vendors.37b7208e.js.map +1 -0
  37. data/lib/mihari.rb +4 -2
  38. data/mihari.gemspec +8 -9
  39. data/sig/lib/mihari/cli/base.rbs +0 -2
  40. data/sig/lib/mihari/enrichers/google_public_dns.rbs +18 -0
  41. data/sig/lib/mihari/models/alert.rbs +3 -3
  42. data/sig/lib/mihari/models/rule.rbs +2 -2
  43. data/sig/lib/mihari/structs/filters.rbs +40 -0
  44. data/sig/lib/mihari/structs/google_public_dns.rbs +21 -0
  45. data/sig/lib/mihari/structs/ipinfo.rbs +2 -2
  46. data/sig/lib/mihari/structs/rule.rbs +36 -43
  47. metadata +32 -45
  48. data/lib/mihari/mixins/rule.rb +0 -84
  49. data/lib/mihari/structs/alert.rb +0 -44
  50. data/lib/mihari/web/public/static/css/chunk-vendors.06251949.css +0 -7
  51. data/lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js +0 -2
  52. data/lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js.map +0 -1
  53. data/lib/mihari/web/public/static/js/app.823b5af7.js +0 -2
  54. data/lib/mihari/web/public/static/js/app.823b5af7.js.map +0 -1
  55. data/lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js +0 -25
  56. data/lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js.map +0 -1
  57. data/lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js.map +0 -1
  58. data/sig/lib/mihari/mixins/rule.rbs +0 -36
  59. data/sig/lib/mihari/structs/alert.rbs +0 -27
data/lib/mihari.rb CHANGED
@@ -59,7 +59,6 @@ require "mihari/mixins/disallowed_data_value"
59
59
  require "mihari/mixins/error_notification"
60
60
  require "mihari/mixins/refang"
61
61
  require "mihari/mixins/retriable"
62
- require "mihari/mixins/rule"
63
62
 
64
63
  def truthy?(value)
65
64
  return true if value == "true"
@@ -171,8 +170,9 @@ require "mihari/constants"
171
170
  require "mihari/types"
172
171
 
173
172
  # Structs
174
- require "mihari/structs/alert"
175
173
  require "mihari/structs/censys"
174
+ require "mihari/structs/filters"
175
+ require "mihari/structs/google_public_dns"
176
176
  require "mihari/structs/greynoise"
177
177
  require "mihari/structs/ipinfo"
178
178
  require "mihari/structs/onyphe"
@@ -189,8 +189,10 @@ require "mihari/schemas/rule"
189
189
 
190
190
  # Enrichers
191
191
  require "mihari/enrichers/base"
192
+ require "mihari/enrichers/google_public_dns"
192
193
  require "mihari/enrichers/ipinfo"
193
194
  require "mihari/enrichers/shodan"
195
+ require "mihari/enrichers/whois"
194
196
 
195
197
  # Models
196
198
  require "mihari/models/alert"
data/mihari.gemspec CHANGED
@@ -29,18 +29,18 @@ Gem::Specification.new do |spec|
29
29
 
30
30
  spec.add_development_dependency "bundler", "~> 2.3"
31
31
  spec.add_development_dependency "coveralls_reborn", "~> 0.24"
32
- spec.add_development_dependency "fakefs", "~> 1.4"
32
+ spec.add_development_dependency "fakefs", "~> 1.8"
33
33
  spec.add_development_dependency "mysql2", "~> 0.5"
34
34
  spec.add_development_dependency "overcommit", "~> 0.59"
35
- spec.add_development_dependency "pg", "~> 1.3"
36
- spec.add_development_dependency "rack-test", "~> 1.1"
35
+ spec.add_development_dependency "pg", "~> 1.4"
36
+ spec.add_development_dependency "rack-test", "~> 2.0"
37
37
  spec.add_development_dependency "rake", "~> 13.0"
38
38
  spec.add_development_dependency "rb-fsevent", "~> 0.11"
39
39
  spec.add_development_dependency "rerun", "~> 0.13"
40
40
  spec.add_development_dependency "rspec", "~> 3.11"
41
41
  spec.add_development_dependency "simplecov-lcov", "~> 0.8.0"
42
42
  spec.add_development_dependency "standard", "~> 1.12"
43
- spec.add_development_dependency "steep", "~> 0.52"
43
+ spec.add_development_dependency "steep", "~> 1.0"
44
44
  spec.add_development_dependency "timecop", "~> 0.9"
45
45
  spec.add_development_dependency "vcr", "~> 6.1"
46
46
  spec.add_development_dependency "webmock", "~> 3.14"
@@ -58,9 +58,9 @@ Gem::Specification.new do |spec|
58
58
  spec.add_dependency "dry-container", "0.9.0"
59
59
  spec.add_dependency "dry-files", "0.1.0"
60
60
  spec.add_dependency "dry-initializer", "3.1.1"
61
- spec.add_dependency "dry-schema", "1.9.1"
61
+ spec.add_dependency "dry-schema", "1.9.3"
62
62
  spec.add_dependency "dry-struct", "1.4.0"
63
- spec.add_dependency "dry-validation", "1.8.0"
63
+ spec.add_dependency "dry-validation", "1.8.1"
64
64
  spec.add_dependency "email_address", "0.2.3"
65
65
  spec.add_dependency "grape", "1.6.2"
66
66
  spec.add_dependency "grape-entity", "0.10.1"
@@ -76,7 +76,6 @@ Gem::Specification.new do |spec|
76
76
  spec.add_dependency "net-ping", "2.0.8"
77
77
  spec.add_dependency "normalize_country", "0.3.2"
78
78
  spec.add_dependency "onyphe", "2.0.0"
79
- spec.add_dependency "otx_ruby", "0.9.9"
80
79
  spec.add_dependency "parallel", "1.22.1"
81
80
  spec.add_dependency "passive_circl", "0.1.0"
82
81
  spec.add_dependency "passivetotalx", "0.1.1"
@@ -84,7 +83,7 @@ Gem::Specification.new do |spec|
84
83
  spec.add_dependency "public_suffix", "4.0.7"
85
84
  spec.add_dependency "pulsedive", "0.1.5"
86
85
  spec.add_dependency "puma", "5.6.4"
87
- spec.add_dependency "rack", "2.2.3"
86
+ spec.add_dependency "rack", "2.2.3.1"
88
87
  spec.add_dependency "rack-contrib", "2.3.0"
89
88
  spec.add_dependency "rack-cors", "1.1.1"
90
89
  spec.add_dependency "securitytrails", "1.0.0"
@@ -93,7 +92,7 @@ Gem::Specification.new do |spec|
93
92
  spec.add_dependency "shodanx", "0.2.1"
94
93
  spec.add_dependency "slack-notifier", "2.4.0"
95
94
  spec.add_dependency "spysex", "0.2.0"
96
- spec.add_dependency "sqlite3", "1.4.2"
95
+ spec.add_dependency "sqlite3", "1.4.4"
97
96
  spec.add_dependency "thor", "1.2.1"
98
97
  spec.add_dependency "urlscan", "0.8.0"
99
98
  spec.add_dependency "uuidtools", "2.2.0"
@@ -3,8 +3,6 @@ module Mihari
3
3
  class Base
4
4
  include Mihari::Mixins::Hash
5
5
 
6
- include Mihari::CLI::Mixins::Utils
7
-
8
6
  def self.exit_on_failure?: () -> ::TrueClass
9
7
  end
10
8
  end
@@ -0,0 +1,18 @@
1
+ module Mihari
2
+ module Enrichers
3
+ class GooglePublicDNS < Base
4
+ # @return [Boolean]
5
+ def valid?: () -> true
6
+
7
+ #
8
+ # Query Google Public DNS
9
+ #
10
+ # @param [String] name
11
+ # @param [String] resource_type
12
+ #
13
+ # @return [Mihari::Structs::Shodan::GooglePublicDNS::Response, nil]
14
+ #
15
+ def self.query: (String name, String resource_type) -> Mihari::Structs::Shodan::GooglePublicDNS::Response?
16
+ end
17
+ end
18
+ end
@@ -7,12 +7,12 @@ module Mihari
7
7
  attr_accessor artifacts(): Array[Mihari::Artifact]
8
8
  attr_accessor Tags(): Array[Mihari::Tag]
9
9
 
10
- def self.search: (Mihari::Structs::Alert::SearchFilterWithPagination filter) -> Array[Mihari::Alert]
10
+ def self.search: (Mihari::Structs::Filters::Alert::SearchFilterWithPagination filter) -> Array[Mihari::Alert]
11
11
 
12
- def self.count: (Mihari::Structs::Alert::SearchFilter filter) -> Integer
12
+ def self.count: (Mihari::Structs::Filters::Alert::SearchFilter filter) -> Integer
13
13
 
14
14
  private
15
15
 
16
- def self.build_relation: (Mihari::Structs::Alert::SearchFilter filter) -> Mihari::Alert
16
+ def self.build_relation: (Mihari::Structs::Filters::Alert::SearchFilter filter) -> Mihari::Alert
17
17
  end
18
18
  end
@@ -10,8 +10,8 @@ module Mihari
10
10
 
11
11
  def to_h: () -> Hash
12
12
 
13
- def self.search: (Mihari::Structs::Rule::SearchFilterWithPagination filter) -> Array[Mihari::Rule]
13
+ def self.search: (Mihari::Structs::Filters::Rule::SearchFilterWithPagination filter) -> Array[Mihari::Rule]
14
14
 
15
- def self.count: (Mihari::Structs::Rule::SearchFilter filter) -> Integer
15
+ def self.count: (Mihari::Structs::Filters::Rule::SearchFilter filter) -> Integer
16
16
  end
17
17
  end
@@ -0,0 +1,40 @@
1
+ module Mihari
2
+ module Structs
3
+ module Filters
4
+ module Alert
5
+ class SearchFilter < Dry::Struct
6
+ attr_reader artifact_data: String?
7
+ attr_reader description: String?
8
+ attr_reader source: String?
9
+ attr_reader tag_name: String?
10
+ attr_reader title: String?
11
+ attr_reader from_at: DateTime?
12
+ attr_reader to_at: DateTime?
13
+ attr_reader asn: Integer?
14
+ attr_reader dns_record: String?
15
+ attr_reader reverse_dns_name: String?
16
+
17
+ def valid_artifact_filters?: () -> bool
18
+ end
19
+
20
+ class SearchFilterWithPagination < SearchFilter
21
+ def without_pagination: () -> Mihari::Structs::Filters::Alert::SearchFilter
22
+ end
23
+ end
24
+
25
+ module Rule
26
+ class SearchFilter < Dry::Struct
27
+ attr_reader page: Integer?
28
+ attr_reader tag: String?
29
+ attr_reader source: String?
30
+ attr_reader from_at: DateTime?
31
+ attr_reader to_at: DateTime?
32
+ end
33
+
34
+ class SearchFilterWithPagination < SearchFilter
35
+ def without_pagination: () -> Mihari::Structs::Filters::Rule::SearchFilter
36
+ end
37
+ end
38
+ end
39
+ end
40
+ end
@@ -0,0 +1,21 @@
1
+ module Mihari
2
+ module Structs
3
+ module GooglePublicDNS
4
+ INT_TYPE_TO_TYPE: { 1 => "A", 2 => "NS", 5 => "CNAME", 16 => "TXT", 28 => "AAAA" }
5
+
6
+ class Answer < Dry::Struct
7
+ attr_reader name: String
8
+ attr_reader data: String
9
+ attr_reader resource_type: String
10
+
11
+ def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::GooglePublicDNS::Answer
12
+ end
13
+
14
+ class Response < Dry::Struct
15
+ attr_reader answers: Array[Mihari::Structs::GooglePublicDNS::Answer]
16
+
17
+ def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::GooglePublicDNS::Response
18
+ end
19
+ end
20
+ end
21
+ end
@@ -4,8 +4,8 @@ module Mihari
4
4
  class Response
5
5
  attr_reader ip: String
6
6
  attr_reader hostname: String?
7
- attr_reader loc: String
8
- attr_reader country_code: String
7
+ attr_reader loc: String?
8
+ attr_reader country_code: String?
9
9
  attr_reader asn: Integer?
10
10
 
11
11
  def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::IPInfo::Response
@@ -1,64 +1,57 @@
1
1
  module Mihari
2
2
  module Structs
3
- module Rule
4
- class SearchFilter < Dry::Struct
5
- end
3
+ class Rule
4
+ attr_reader data: Hash
6
5
 
7
- class SearchFilterWithPagination < SearchFilter
8
- def without_pagination: () -> SearchFilter
9
- end
6
+ attr_reader yaml: String
10
7
 
11
- class Rule
12
- attr_reader data: Hash
8
+ attr_reader errors: Array[untypes]?
13
9
 
14
- attr_reader yaml: String
10
+ def initialize: (Hash data) -> void
15
11
 
16
- attr_reader errors: Array[untypes]?
12
+ #
13
+ # @return [Boolean]
14
+ #
15
+ def errors?: () -> (bool)
17
16
 
18
- def initialize: (Hash data) -> void
17
+ #
18
+ # @return [Array[String]]
19
+ #
20
+ def error_messages: () -> (Array[String])
19
21
 
20
- #
21
- # @return [Boolean]
22
- #
23
- def errors?: () -> (bool)
22
+ def validate: () -> void
24
23
 
25
- #
26
- # @return [Array[String]]
27
- #
28
- def error_messages: () -> (Array[String])
24
+ def validate!: () -> void
29
25
 
30
- def validate: () -> void
26
+ def []: (untyped key) -> untyped
31
27
 
32
- def validate!: () -> void
28
+ #
29
+ # @return [String]
30
+ #
31
+ def id: () -> String
33
32
 
34
- def []: (untyped key) -> untyped
33
+ #
34
+ # @return [String]
35
+ #
36
+ def title: () -> String
35
37
 
36
- #
37
- # @return [String]
38
- #
39
- def id: () -> String
38
+ #
39
+ # @return [String]
40
+ #
41
+ def description: () -> String
40
42
 
41
- #
42
- # @return [String]
43
- #
44
- def title: () -> String
43
+ #
44
+ # @return [Mihari::Rule]
45
+ #
46
+ def to_model: () -> Mihari::Rule
45
47
 
46
- #
47
- # @return [String]
48
- #
49
- def description: () -> String
48
+ def to_analyzer: () -> Mihari::Analyzers::Rule
50
49
 
51
- #
52
- # @return [Mihari::Rule]
53
- #
54
- def to_model: () -> Mihari::Rule
50
+ def self.from_model: (Mihari::Rule model) -> Mihari::Structs::Rule
55
51
 
56
- def to_analyzer: () -> Mihari::Analyzers::Rule
52
+ def self.from_yaml: (String yaml) -> Mihari::Structs::Rule
57
53
 
58
- def self.from_model: (Mihari::Rule model) -> Mihari::Structs::Rule::Rule
59
-
60
- def self.from_yaml: (String yaml) -> Mihari::Structs::Rule::Rule
61
- end
54
+ def self.from_path_or_id: (String path_or_id) -> Mihari::Structs::Rule
62
55
  end
63
56
  end
64
57
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: mihari
3
3
  version: !ruby/object:Gem::Version
4
- version: 4.6.1
4
+ version: 4.7.2
5
5
  platform: ruby
6
6
  authors:
7
7
  - Manabu Niseki
8
8
  autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2022-05-19 00:00:00.000000000 Z
11
+ date: 2022-06-26 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: bundler
@@ -44,14 +44,14 @@ dependencies:
44
44
  requirements:
45
45
  - - "~>"
46
46
  - !ruby/object:Gem::Version
47
- version: '1.4'
47
+ version: '1.8'
48
48
  type: :development
49
49
  prerelease: false
50
50
  version_requirements: !ruby/object:Gem::Requirement
51
51
  requirements:
52
52
  - - "~>"
53
53
  - !ruby/object:Gem::Version
54
- version: '1.4'
54
+ version: '1.8'
55
55
  - !ruby/object:Gem::Dependency
56
56
  name: mysql2
57
57
  requirement: !ruby/object:Gem::Requirement
@@ -86,28 +86,28 @@ dependencies:
86
86
  requirements:
87
87
  - - "~>"
88
88
  - !ruby/object:Gem::Version
89
- version: '1.3'
89
+ version: '1.4'
90
90
  type: :development
91
91
  prerelease: false
92
92
  version_requirements: !ruby/object:Gem::Requirement
93
93
  requirements:
94
94
  - - "~>"
95
95
  - !ruby/object:Gem::Version
96
- version: '1.3'
96
+ version: '1.4'
97
97
  - !ruby/object:Gem::Dependency
98
98
  name: rack-test
99
99
  requirement: !ruby/object:Gem::Requirement
100
100
  requirements:
101
101
  - - "~>"
102
102
  - !ruby/object:Gem::Version
103
- version: '1.1'
103
+ version: '2.0'
104
104
  type: :development
105
105
  prerelease: false
106
106
  version_requirements: !ruby/object:Gem::Requirement
107
107
  requirements:
108
108
  - - "~>"
109
109
  - !ruby/object:Gem::Version
110
- version: '1.1'
110
+ version: '2.0'
111
111
  - !ruby/object:Gem::Dependency
112
112
  name: rake
113
113
  requirement: !ruby/object:Gem::Requirement
@@ -198,14 +198,14 @@ dependencies:
198
198
  requirements:
199
199
  - - "~>"
200
200
  - !ruby/object:Gem::Version
201
- version: '0.52'
201
+ version: '1.0'
202
202
  type: :development
203
203
  prerelease: false
204
204
  version_requirements: !ruby/object:Gem::Requirement
205
205
  requirements:
206
206
  - - "~>"
207
207
  - !ruby/object:Gem::Version
208
- version: '0.52'
208
+ version: '1.0'
209
209
  - !ruby/object:Gem::Dependency
210
210
  name: timecop
211
211
  requirement: !ruby/object:Gem::Requirement
@@ -436,14 +436,14 @@ dependencies:
436
436
  requirements:
437
437
  - - '='
438
438
  - !ruby/object:Gem::Version
439
- version: 1.9.1
439
+ version: 1.9.3
440
440
  type: :runtime
441
441
  prerelease: false
442
442
  version_requirements: !ruby/object:Gem::Requirement
443
443
  requirements:
444
444
  - - '='
445
445
  - !ruby/object:Gem::Version
446
- version: 1.9.1
446
+ version: 1.9.3
447
447
  - !ruby/object:Gem::Dependency
448
448
  name: dry-struct
449
449
  requirement: !ruby/object:Gem::Requirement
@@ -464,14 +464,14 @@ dependencies:
464
464
  requirements:
465
465
  - - '='
466
466
  - !ruby/object:Gem::Version
467
- version: 1.8.0
467
+ version: 1.8.1
468
468
  type: :runtime
469
469
  prerelease: false
470
470
  version_requirements: !ruby/object:Gem::Requirement
471
471
  requirements:
472
472
  - - '='
473
473
  - !ruby/object:Gem::Version
474
- version: 1.8.0
474
+ version: 1.8.1
475
475
  - !ruby/object:Gem::Dependency
476
476
  name: email_address
477
477
  requirement: !ruby/object:Gem::Requirement
@@ -682,20 +682,6 @@ dependencies:
682
682
  - - '='
683
683
  - !ruby/object:Gem::Version
684
684
  version: 2.0.0
685
- - !ruby/object:Gem::Dependency
686
- name: otx_ruby
687
- requirement: !ruby/object:Gem::Requirement
688
- requirements:
689
- - - '='
690
- - !ruby/object:Gem::Version
691
- version: 0.9.9
692
- type: :runtime
693
- prerelease: false
694
- version_requirements: !ruby/object:Gem::Requirement
695
- requirements:
696
- - - '='
697
- - !ruby/object:Gem::Version
698
- version: 0.9.9
699
685
  - !ruby/object:Gem::Dependency
700
686
  name: parallel
701
687
  requirement: !ruby/object:Gem::Requirement
@@ -800,14 +786,14 @@ dependencies:
800
786
  requirements:
801
787
  - - '='
802
788
  - !ruby/object:Gem::Version
803
- version: 2.2.3
789
+ version: 2.2.3.1
804
790
  type: :runtime
805
791
  prerelease: false
806
792
  version_requirements: !ruby/object:Gem::Requirement
807
793
  requirements:
808
794
  - - '='
809
795
  - !ruby/object:Gem::Version
810
- version: 2.2.3
796
+ version: 2.2.3.1
811
797
  - !ruby/object:Gem::Dependency
812
798
  name: rack-contrib
813
799
  requirement: !ruby/object:Gem::Requirement
@@ -926,14 +912,14 @@ dependencies:
926
912
  requirements:
927
913
  - - '='
928
914
  - !ruby/object:Gem::Version
929
- version: 1.4.2
915
+ version: 1.4.4
930
916
  type: :runtime
931
917
  prerelease: false
932
918
  version_requirements: !ruby/object:Gem::Requirement
933
919
  requirements:
934
920
  - - '='
935
921
  - !ruby/object:Gem::Version
936
- version: 1.4.2
922
+ version: 1.4.4
937
923
  - !ruby/object:Gem::Dependency
938
924
  name: thor
939
925
  requirement: !ruby/object:Gem::Requirement
@@ -1074,6 +1060,7 @@ files:
1074
1060
  - lib/mihari/analyzers/binaryedge.rb
1075
1061
  - lib/mihari/analyzers/censys.rb
1076
1062
  - lib/mihari/analyzers/circl.rb
1063
+ - lib/mihari/analyzers/clients/otx.rb
1077
1064
  - lib/mihari/analyzers/crtsh.rb
1078
1065
  - lib/mihari/analyzers/dnpedia.rb
1079
1066
  - lib/mihari/analyzers/dnstwister.rb
@@ -1110,8 +1097,10 @@ files:
1110
1097
  - lib/mihari/emitters/the_hive.rb
1111
1098
  - lib/mihari/emitters/webhook.rb
1112
1099
  - lib/mihari/enrichers/base.rb
1100
+ - lib/mihari/enrichers/google_public_dns.rb
1113
1101
  - lib/mihari/enrichers/ipinfo.rb
1114
1102
  - lib/mihari/enrichers/shodan.rb
1103
+ - lib/mihari/enrichers/whois.rb
1115
1104
  - lib/mihari/entities/alert.rb
1116
1105
  - lib/mihari/entities/artifact.rb
1117
1106
  - lib/mihari/entities/autonomous_system.rb
@@ -1138,7 +1127,6 @@ files:
1138
1127
  - lib/mihari/mixins/error_notification.rb
1139
1128
  - lib/mihari/mixins/refang.rb
1140
1129
  - lib/mihari/mixins/retriable.rb
1141
- - lib/mihari/mixins/rule.rb
1142
1130
  - lib/mihari/models/alert.rb
1143
1131
  - lib/mihari/models/artifact.rb
1144
1132
  - lib/mihari/models/autonomous_system.rb
@@ -1153,11 +1141,13 @@ files:
1153
1141
  - lib/mihari/models/whois.rb
1154
1142
  - lib/mihari/schemas/analyzer.rb
1155
1143
  - lib/mihari/schemas/emitter.rb
1144
+ - lib/mihari/schemas/enricher.rb
1156
1145
  - lib/mihari/schemas/macros.rb
1157
1146
  - lib/mihari/schemas/rule.rb
1158
1147
  - lib/mihari/status.rb
1159
- - lib/mihari/structs/alert.rb
1160
1148
  - lib/mihari/structs/censys.rb
1149
+ - lib/mihari/structs/filters.rb
1150
+ - lib/mihari/structs/google_public_dns.rb
1161
1151
  - lib/mihari/structs/greynoise.rb
1162
1152
  - lib/mihari/structs/ipinfo.rb
1163
1153
  - lib/mihari/structs/onyphe.rb
@@ -1183,7 +1173,7 @@ files:
1183
1173
  - lib/mihari/web/public/index.html
1184
1174
  - lib/mihari/web/public/redoc-static.html
1185
1175
  - lib/mihari/web/public/static/css/app.2a5d3d21.css
1186
- - lib/mihari/web/public/static/css/chunk-vendors.06251949.css
1176
+ - lib/mihari/web/public/static/css/chunk-vendors.5013d549.css
1187
1177
  - lib/mihari/web/public/static/favicon.ico
1188
1178
  - lib/mihari/web/public/static/fonts/fa-brands-400.7fa789ab.ttf
1189
1179
  - lib/mihari/web/public/static/fonts/fa-brands-400.859fc388.woff2
@@ -1192,14 +1182,10 @@ files:
1192
1182
  - lib/mihari/web/public/static/fonts/fa-solid-900.3a463ec3.ttf
1193
1183
  - lib/mihari/web/public/static/fonts/fa-solid-900.40ddefd7.woff2
1194
1184
  - lib/mihari/web/public/static/fonts/fa-v4compatibility.924588dc.ttf
1195
- - lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js
1196
- - lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js.map
1197
- - lib/mihari/web/public/static/js/app.823b5af7.js
1198
- - lib/mihari/web/public/static/js/app.823b5af7.js.map
1199
- - lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js
1200
- - lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js.map
1201
- - lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js
1202
- - lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js.map
1185
+ - lib/mihari/web/public/static/js/app.3ac3bd7a.js
1186
+ - lib/mihari/web/public/static/js/app.3ac3bd7a.js.map
1187
+ - lib/mihari/web/public/static/js/chunk-vendors.37b7208e.js
1188
+ - lib/mihari/web/public/static/js/chunk-vendors.37b7208e.js.map
1203
1189
  - mihari.gemspec
1204
1190
  - renovate.json
1205
1191
  - sig/lib/mihari.rbs
@@ -1243,6 +1229,7 @@ files:
1243
1229
  - sig/lib/mihari/emitters/the_hive.rbs
1244
1230
  - sig/lib/mihari/emitters/webhook.rbs
1245
1231
  - sig/lib/mihari/enrichers/base.rbs
1232
+ - sig/lib/mihari/enrichers/google_public_dns.rbs
1246
1233
  - sig/lib/mihari/enrichers/ipinfo.rbs
1247
1234
  - sig/lib/mihari/errors.rbs
1248
1235
  - sig/lib/mihari/feed/parser.rbs
@@ -1256,7 +1243,6 @@ files:
1256
1243
  - sig/lib/mihari/mixins/hash.rbs
1257
1244
  - sig/lib/mihari/mixins/refang.rbs
1258
1245
  - sig/lib/mihari/mixins/retriable.rbs
1259
- - sig/lib/mihari/mixins/rule.rbs
1260
1246
  - sig/lib/mihari/models/alert.rbs
1261
1247
  - sig/lib/mihari/models/artifact.rbs
1262
1248
  - sig/lib/mihari/models/autonomous_system.rbs
@@ -1270,8 +1256,9 @@ files:
1270
1256
  - sig/lib/mihari/models/tagging.rbs
1271
1257
  - sig/lib/mihari/models/whois.rbs
1272
1258
  - sig/lib/mihari/status.rbs
1273
- - sig/lib/mihari/structs/alert.rbs
1274
1259
  - sig/lib/mihari/structs/censys.rbs
1260
+ - sig/lib/mihari/structs/filters.rbs
1261
+ - sig/lib/mihari/structs/google_public_dns.rbs
1275
1262
  - sig/lib/mihari/structs/greynoise.rbs
1276
1263
  - sig/lib/mihari/structs/ipinfo.rbs
1277
1264
  - sig/lib/mihari/structs/onyphe.rbs
@@ -1,84 +0,0 @@
1
- # frozen_string_literal: true
2
-
3
- require "date"
4
- require "erb"
5
- require "pathname"
6
-
7
- module Mihari
8
- module Mixins
9
- module Rule
10
- include Mixins::Database
11
-
12
- def load_erb_yaml(yaml)
13
- YAML.safe_load(ERB.new(yaml).result, permitted_classes: [Date], symbolize_names: true)
14
- end
15
-
16
- #
17
- # Load rule into hash
18
- #
19
- # @param [String] path_or_id Path to YAML file or YAML string or ID of a rule in the database
20
- #
21
- # @return [Mihari::Structs::Rule::Rule]
22
- #
23
- def load_rule(path_or_id)
24
- yaml = nil
25
-
26
- yaml = load_yaml_from_file(path_or_id) if File.exist?(path_or_id)
27
- yaml = load_yaml_from_db(path_or_id) if yaml.nil?
28
-
29
- Structs::Rule::Rule.from_yaml yaml
30
- end
31
-
32
- def load_yaml_from_file(path)
33
- return nil unless Pathname(path).exist?
34
-
35
- File.read path
36
- end
37
-
38
- def load_yaml_from_db(id)
39
- with_db_connection do
40
- rule = Mihari::Rule.find(id)
41
- rule.yaml || rule.symbolized_data.to_yaml
42
- rescue ActiveRecord::RecordNotFound
43
- raise ArgumentError, "ID:#{id} is not found in the database"
44
- end
45
- end
46
-
47
- #
48
- # Validate a rule
49
- #
50
- # @param [Mihari::Structs::Rule::Rule] rule
51
- #
52
- def validate_rule!(rule)
53
- rule.validate!
54
- rescue RuleValidationError => e
55
- Mihari.logger.error "Failed to parse the input as a rule"
56
- raise e
57
- end
58
-
59
- #
60
- # Returns a template for rule
61
- #
62
- # @return [String] A template for rule
63
- #
64
- def rule_template
65
- yaml = File.read(File.expand_path("../templates/rule.yml.erb", __dir__))
66
- Structs::Rule::Rule.from_yaml yaml
67
- yaml
68
- end
69
-
70
- #
71
- # Create (blank) rule file
72
- #
73
- # @param [String] filename
74
- # @param [Dry::Files] files
75
- # @param [String] template
76
- #
77
- # @return [nil]
78
- #
79
- def initialize_rule_yaml(filename, files = Dry::Files.new, template: rule_template)
80
- files.write(filename, template)
81
- end
82
- end
83
- end
84
- end