mihari 4.6.1 → 4.7.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (59) hide show
  1. checksums.yaml +4 -4
  2. data/lib/mihari/analyzers/clients/otx.rb +36 -0
  3. data/lib/mihari/analyzers/otx.rb +19 -11
  4. data/lib/mihari/analyzers/rule.rb +17 -1
  5. data/lib/mihari/commands/init.rb +25 -2
  6. data/lib/mihari/commands/search.rb +2 -7
  7. data/lib/mihari/commands/validator.rb +10 -5
  8. data/lib/mihari/constants.rb +2 -0
  9. data/lib/mihari/enrichers/google_public_dns.rb +36 -0
  10. data/lib/mihari/enrichers/whois.rb +126 -0
  11. data/lib/mihari/errors.rb +2 -0
  12. data/lib/mihari/http.rb +2 -2
  13. data/lib/mihari/models/alert.rb +6 -1
  14. data/lib/mihari/models/artifact.rb +30 -0
  15. data/lib/mihari/models/dns.rb +5 -21
  16. data/lib/mihari/models/geolocation.rb +2 -4
  17. data/lib/mihari/models/port.rb +1 -1
  18. data/lib/mihari/models/rule.rb +7 -2
  19. data/lib/mihari/models/whois.rb +1 -96
  20. data/lib/mihari/schemas/enricher.rb +9 -0
  21. data/lib/mihari/schemas/rule.rb +6 -0
  22. data/lib/mihari/structs/filters.rb +71 -0
  23. data/lib/mihari/structs/google_public_dns.rb +42 -0
  24. data/lib/mihari/structs/ipinfo.rb +4 -4
  25. data/lib/mihari/structs/rule.rb +187 -137
  26. data/lib/mihari/types.rb +7 -0
  27. data/lib/mihari/version.rb +1 -1
  28. data/lib/mihari/web/endpoints/alerts.rb +1 -1
  29. data/lib/mihari/web/endpoints/rules.rb +13 -5
  30. data/lib/mihari/web/public/index.html +1 -1
  31. data/lib/mihari/web/public/redoc-static.html +796 -763
  32. data/lib/mihari/web/public/static/css/chunk-vendors.5013d549.css +7 -0
  33. data/lib/mihari/web/public/static/js/app.3ac3bd7a.js +2 -0
  34. data/lib/mihari/web/public/static/js/app.3ac3bd7a.js.map +1 -0
  35. data/lib/mihari/web/public/static/js/{chunk-vendors.dde2116c.js → chunk-vendors.37b7208e.js} +6 -6
  36. data/lib/mihari/web/public/static/js/chunk-vendors.37b7208e.js.map +1 -0
  37. data/lib/mihari.rb +4 -2
  38. data/mihari.gemspec +8 -9
  39. data/sig/lib/mihari/cli/base.rbs +0 -2
  40. data/sig/lib/mihari/enrichers/google_public_dns.rbs +18 -0
  41. data/sig/lib/mihari/models/alert.rbs +3 -3
  42. data/sig/lib/mihari/models/rule.rbs +2 -2
  43. data/sig/lib/mihari/structs/filters.rbs +40 -0
  44. data/sig/lib/mihari/structs/google_public_dns.rbs +21 -0
  45. data/sig/lib/mihari/structs/ipinfo.rbs +2 -2
  46. data/sig/lib/mihari/structs/rule.rbs +36 -43
  47. metadata +32 -45
  48. data/lib/mihari/mixins/rule.rb +0 -84
  49. data/lib/mihari/structs/alert.rb +0 -44
  50. data/lib/mihari/web/public/static/css/chunk-vendors.06251949.css +0 -7
  51. data/lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js +0 -2
  52. data/lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js.map +0 -1
  53. data/lib/mihari/web/public/static/js/app.823b5af7.js +0 -2
  54. data/lib/mihari/web/public/static/js/app.823b5af7.js.map +0 -1
  55. data/lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js +0 -25
  56. data/lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js.map +0 -1
  57. data/lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js.map +0 -1
  58. data/sig/lib/mihari/mixins/rule.rbs +0 -36
  59. data/sig/lib/mihari/structs/alert.rbs +0 -27
data/lib/mihari.rb CHANGED
@@ -59,7 +59,6 @@ require "mihari/mixins/disallowed_data_value"
59
59
  require "mihari/mixins/error_notification"
60
60
  require "mihari/mixins/refang"
61
61
  require "mihari/mixins/retriable"
62
- require "mihari/mixins/rule"
63
62
 
64
63
  def truthy?(value)
65
64
  return true if value == "true"
@@ -171,8 +170,9 @@ require "mihari/constants"
171
170
  require "mihari/types"
172
171
 
173
172
  # Structs
174
- require "mihari/structs/alert"
175
173
  require "mihari/structs/censys"
174
+ require "mihari/structs/filters"
175
+ require "mihari/structs/google_public_dns"
176
176
  require "mihari/structs/greynoise"
177
177
  require "mihari/structs/ipinfo"
178
178
  require "mihari/structs/onyphe"
@@ -189,8 +189,10 @@ require "mihari/schemas/rule"
189
189
 
190
190
  # Enrichers
191
191
  require "mihari/enrichers/base"
192
+ require "mihari/enrichers/google_public_dns"
192
193
  require "mihari/enrichers/ipinfo"
193
194
  require "mihari/enrichers/shodan"
195
+ require "mihari/enrichers/whois"
194
196
 
195
197
  # Models
196
198
  require "mihari/models/alert"
data/mihari.gemspec CHANGED
@@ -29,18 +29,18 @@ Gem::Specification.new do |spec|
29
29
 
30
30
  spec.add_development_dependency "bundler", "~> 2.3"
31
31
  spec.add_development_dependency "coveralls_reborn", "~> 0.24"
32
- spec.add_development_dependency "fakefs", "~> 1.4"
32
+ spec.add_development_dependency "fakefs", "~> 1.8"
33
33
  spec.add_development_dependency "mysql2", "~> 0.5"
34
34
  spec.add_development_dependency "overcommit", "~> 0.59"
35
- spec.add_development_dependency "pg", "~> 1.3"
36
- spec.add_development_dependency "rack-test", "~> 1.1"
35
+ spec.add_development_dependency "pg", "~> 1.4"
36
+ spec.add_development_dependency "rack-test", "~> 2.0"
37
37
  spec.add_development_dependency "rake", "~> 13.0"
38
38
  spec.add_development_dependency "rb-fsevent", "~> 0.11"
39
39
  spec.add_development_dependency "rerun", "~> 0.13"
40
40
  spec.add_development_dependency "rspec", "~> 3.11"
41
41
  spec.add_development_dependency "simplecov-lcov", "~> 0.8.0"
42
42
  spec.add_development_dependency "standard", "~> 1.12"
43
- spec.add_development_dependency "steep", "~> 0.52"
43
+ spec.add_development_dependency "steep", "~> 1.0"
44
44
  spec.add_development_dependency "timecop", "~> 0.9"
45
45
  spec.add_development_dependency "vcr", "~> 6.1"
46
46
  spec.add_development_dependency "webmock", "~> 3.14"
@@ -58,9 +58,9 @@ Gem::Specification.new do |spec|
58
58
  spec.add_dependency "dry-container", "0.9.0"
59
59
  spec.add_dependency "dry-files", "0.1.0"
60
60
  spec.add_dependency "dry-initializer", "3.1.1"
61
- spec.add_dependency "dry-schema", "1.9.1"
61
+ spec.add_dependency "dry-schema", "1.9.3"
62
62
  spec.add_dependency "dry-struct", "1.4.0"
63
- spec.add_dependency "dry-validation", "1.8.0"
63
+ spec.add_dependency "dry-validation", "1.8.1"
64
64
  spec.add_dependency "email_address", "0.2.3"
65
65
  spec.add_dependency "grape", "1.6.2"
66
66
  spec.add_dependency "grape-entity", "0.10.1"
@@ -76,7 +76,6 @@ Gem::Specification.new do |spec|
76
76
  spec.add_dependency "net-ping", "2.0.8"
77
77
  spec.add_dependency "normalize_country", "0.3.2"
78
78
  spec.add_dependency "onyphe", "2.0.0"
79
- spec.add_dependency "otx_ruby", "0.9.9"
80
79
  spec.add_dependency "parallel", "1.22.1"
81
80
  spec.add_dependency "passive_circl", "0.1.0"
82
81
  spec.add_dependency "passivetotalx", "0.1.1"
@@ -84,7 +83,7 @@ Gem::Specification.new do |spec|
84
83
  spec.add_dependency "public_suffix", "4.0.7"
85
84
  spec.add_dependency "pulsedive", "0.1.5"
86
85
  spec.add_dependency "puma", "5.6.4"
87
- spec.add_dependency "rack", "2.2.3"
86
+ spec.add_dependency "rack", "2.2.3.1"
88
87
  spec.add_dependency "rack-contrib", "2.3.0"
89
88
  spec.add_dependency "rack-cors", "1.1.1"
90
89
  spec.add_dependency "securitytrails", "1.0.0"
@@ -93,7 +92,7 @@ Gem::Specification.new do |spec|
93
92
  spec.add_dependency "shodanx", "0.2.1"
94
93
  spec.add_dependency "slack-notifier", "2.4.0"
95
94
  spec.add_dependency "spysex", "0.2.0"
96
- spec.add_dependency "sqlite3", "1.4.2"
95
+ spec.add_dependency "sqlite3", "1.4.4"
97
96
  spec.add_dependency "thor", "1.2.1"
98
97
  spec.add_dependency "urlscan", "0.8.0"
99
98
  spec.add_dependency "uuidtools", "2.2.0"
@@ -3,8 +3,6 @@ module Mihari
3
3
  class Base
4
4
  include Mihari::Mixins::Hash
5
5
 
6
- include Mihari::CLI::Mixins::Utils
7
-
8
6
  def self.exit_on_failure?: () -> ::TrueClass
9
7
  end
10
8
  end
@@ -0,0 +1,18 @@
1
+ module Mihari
2
+ module Enrichers
3
+ class GooglePublicDNS < Base
4
+ # @return [Boolean]
5
+ def valid?: () -> true
6
+
7
+ #
8
+ # Query Google Public DNS
9
+ #
10
+ # @param [String] name
11
+ # @param [String] resource_type
12
+ #
13
+ # @return [Mihari::Structs::Shodan::GooglePublicDNS::Response, nil]
14
+ #
15
+ def self.query: (String name, String resource_type) -> Mihari::Structs::Shodan::GooglePublicDNS::Response?
16
+ end
17
+ end
18
+ end
@@ -7,12 +7,12 @@ module Mihari
7
7
  attr_accessor artifacts(): Array[Mihari::Artifact]
8
8
  attr_accessor Tags(): Array[Mihari::Tag]
9
9
 
10
- def self.search: (Mihari::Structs::Alert::SearchFilterWithPagination filter) -> Array[Mihari::Alert]
10
+ def self.search: (Mihari::Structs::Filters::Alert::SearchFilterWithPagination filter) -> Array[Mihari::Alert]
11
11
 
12
- def self.count: (Mihari::Structs::Alert::SearchFilter filter) -> Integer
12
+ def self.count: (Mihari::Structs::Filters::Alert::SearchFilter filter) -> Integer
13
13
 
14
14
  private
15
15
 
16
- def self.build_relation: (Mihari::Structs::Alert::SearchFilter filter) -> Mihari::Alert
16
+ def self.build_relation: (Mihari::Structs::Filters::Alert::SearchFilter filter) -> Mihari::Alert
17
17
  end
18
18
  end
@@ -10,8 +10,8 @@ module Mihari
10
10
 
11
11
  def to_h: () -> Hash
12
12
 
13
- def self.search: (Mihari::Structs::Rule::SearchFilterWithPagination filter) -> Array[Mihari::Rule]
13
+ def self.search: (Mihari::Structs::Filters::Rule::SearchFilterWithPagination filter) -> Array[Mihari::Rule]
14
14
 
15
- def self.count: (Mihari::Structs::Rule::SearchFilter filter) -> Integer
15
+ def self.count: (Mihari::Structs::Filters::Rule::SearchFilter filter) -> Integer
16
16
  end
17
17
  end
@@ -0,0 +1,40 @@
1
+ module Mihari
2
+ module Structs
3
+ module Filters
4
+ module Alert
5
+ class SearchFilter < Dry::Struct
6
+ attr_reader artifact_data: String?
7
+ attr_reader description: String?
8
+ attr_reader source: String?
9
+ attr_reader tag_name: String?
10
+ attr_reader title: String?
11
+ attr_reader from_at: DateTime?
12
+ attr_reader to_at: DateTime?
13
+ attr_reader asn: Integer?
14
+ attr_reader dns_record: String?
15
+ attr_reader reverse_dns_name: String?
16
+
17
+ def valid_artifact_filters?: () -> bool
18
+ end
19
+
20
+ class SearchFilterWithPagination < SearchFilter
21
+ def without_pagination: () -> Mihari::Structs::Filters::Alert::SearchFilter
22
+ end
23
+ end
24
+
25
+ module Rule
26
+ class SearchFilter < Dry::Struct
27
+ attr_reader page: Integer?
28
+ attr_reader tag: String?
29
+ attr_reader source: String?
30
+ attr_reader from_at: DateTime?
31
+ attr_reader to_at: DateTime?
32
+ end
33
+
34
+ class SearchFilterWithPagination < SearchFilter
35
+ def without_pagination: () -> Mihari::Structs::Filters::Rule::SearchFilter
36
+ end
37
+ end
38
+ end
39
+ end
40
+ end
@@ -0,0 +1,21 @@
1
+ module Mihari
2
+ module Structs
3
+ module GooglePublicDNS
4
+ INT_TYPE_TO_TYPE: { 1 => "A", 2 => "NS", 5 => "CNAME", 16 => "TXT", 28 => "AAAA" }
5
+
6
+ class Answer < Dry::Struct
7
+ attr_reader name: String
8
+ attr_reader data: String
9
+ attr_reader resource_type: String
10
+
11
+ def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::GooglePublicDNS::Answer
12
+ end
13
+
14
+ class Response < Dry::Struct
15
+ attr_reader answers: Array[Mihari::Structs::GooglePublicDNS::Answer]
16
+
17
+ def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::GooglePublicDNS::Response
18
+ end
19
+ end
20
+ end
21
+ end
@@ -4,8 +4,8 @@ module Mihari
4
4
  class Response
5
5
  attr_reader ip: String
6
6
  attr_reader hostname: String?
7
- attr_reader loc: String
8
- attr_reader country_code: String
7
+ attr_reader loc: String?
8
+ attr_reader country_code: String?
9
9
  attr_reader asn: Integer?
10
10
 
11
11
  def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::IPInfo::Response
@@ -1,64 +1,57 @@
1
1
  module Mihari
2
2
  module Structs
3
- module Rule
4
- class SearchFilter < Dry::Struct
5
- end
3
+ class Rule
4
+ attr_reader data: Hash
6
5
 
7
- class SearchFilterWithPagination < SearchFilter
8
- def without_pagination: () -> SearchFilter
9
- end
6
+ attr_reader yaml: String
10
7
 
11
- class Rule
12
- attr_reader data: Hash
8
+ attr_reader errors: Array[untypes]?
13
9
 
14
- attr_reader yaml: String
10
+ def initialize: (Hash data) -> void
15
11
 
16
- attr_reader errors: Array[untypes]?
12
+ #
13
+ # @return [Boolean]
14
+ #
15
+ def errors?: () -> (bool)
17
16
 
18
- def initialize: (Hash data) -> void
17
+ #
18
+ # @return [Array[String]]
19
+ #
20
+ def error_messages: () -> (Array[String])
19
21
 
20
- #
21
- # @return [Boolean]
22
- #
23
- def errors?: () -> (bool)
22
+ def validate: () -> void
24
23
 
25
- #
26
- # @return [Array[String]]
27
- #
28
- def error_messages: () -> (Array[String])
24
+ def validate!: () -> void
29
25
 
30
- def validate: () -> void
26
+ def []: (untyped key) -> untyped
31
27
 
32
- def validate!: () -> void
28
+ #
29
+ # @return [String]
30
+ #
31
+ def id: () -> String
33
32
 
34
- def []: (untyped key) -> untyped
33
+ #
34
+ # @return [String]
35
+ #
36
+ def title: () -> String
35
37
 
36
- #
37
- # @return [String]
38
- #
39
- def id: () -> String
38
+ #
39
+ # @return [String]
40
+ #
41
+ def description: () -> String
40
42
 
41
- #
42
- # @return [String]
43
- #
44
- def title: () -> String
43
+ #
44
+ # @return [Mihari::Rule]
45
+ #
46
+ def to_model: () -> Mihari::Rule
45
47
 
46
- #
47
- # @return [String]
48
- #
49
- def description: () -> String
48
+ def to_analyzer: () -> Mihari::Analyzers::Rule
50
49
 
51
- #
52
- # @return [Mihari::Rule]
53
- #
54
- def to_model: () -> Mihari::Rule
50
+ def self.from_model: (Mihari::Rule model) -> Mihari::Structs::Rule
55
51
 
56
- def to_analyzer: () -> Mihari::Analyzers::Rule
52
+ def self.from_yaml: (String yaml) -> Mihari::Structs::Rule
57
53
 
58
- def self.from_model: (Mihari::Rule model) -> Mihari::Structs::Rule::Rule
59
-
60
- def self.from_yaml: (String yaml) -> Mihari::Structs::Rule::Rule
61
- end
54
+ def self.from_path_or_id: (String path_or_id) -> Mihari::Structs::Rule
62
55
  end
63
56
  end
64
57
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: mihari
3
3
  version: !ruby/object:Gem::Version
4
- version: 4.6.1
4
+ version: 4.7.2
5
5
  platform: ruby
6
6
  authors:
7
7
  - Manabu Niseki
8
8
  autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2022-05-19 00:00:00.000000000 Z
11
+ date: 2022-06-26 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: bundler
@@ -44,14 +44,14 @@ dependencies:
44
44
  requirements:
45
45
  - - "~>"
46
46
  - !ruby/object:Gem::Version
47
- version: '1.4'
47
+ version: '1.8'
48
48
  type: :development
49
49
  prerelease: false
50
50
  version_requirements: !ruby/object:Gem::Requirement
51
51
  requirements:
52
52
  - - "~>"
53
53
  - !ruby/object:Gem::Version
54
- version: '1.4'
54
+ version: '1.8'
55
55
  - !ruby/object:Gem::Dependency
56
56
  name: mysql2
57
57
  requirement: !ruby/object:Gem::Requirement
@@ -86,28 +86,28 @@ dependencies:
86
86
  requirements:
87
87
  - - "~>"
88
88
  - !ruby/object:Gem::Version
89
- version: '1.3'
89
+ version: '1.4'
90
90
  type: :development
91
91
  prerelease: false
92
92
  version_requirements: !ruby/object:Gem::Requirement
93
93
  requirements:
94
94
  - - "~>"
95
95
  - !ruby/object:Gem::Version
96
- version: '1.3'
96
+ version: '1.4'
97
97
  - !ruby/object:Gem::Dependency
98
98
  name: rack-test
99
99
  requirement: !ruby/object:Gem::Requirement
100
100
  requirements:
101
101
  - - "~>"
102
102
  - !ruby/object:Gem::Version
103
- version: '1.1'
103
+ version: '2.0'
104
104
  type: :development
105
105
  prerelease: false
106
106
  version_requirements: !ruby/object:Gem::Requirement
107
107
  requirements:
108
108
  - - "~>"
109
109
  - !ruby/object:Gem::Version
110
- version: '1.1'
110
+ version: '2.0'
111
111
  - !ruby/object:Gem::Dependency
112
112
  name: rake
113
113
  requirement: !ruby/object:Gem::Requirement
@@ -198,14 +198,14 @@ dependencies:
198
198
  requirements:
199
199
  - - "~>"
200
200
  - !ruby/object:Gem::Version
201
- version: '0.52'
201
+ version: '1.0'
202
202
  type: :development
203
203
  prerelease: false
204
204
  version_requirements: !ruby/object:Gem::Requirement
205
205
  requirements:
206
206
  - - "~>"
207
207
  - !ruby/object:Gem::Version
208
- version: '0.52'
208
+ version: '1.0'
209
209
  - !ruby/object:Gem::Dependency
210
210
  name: timecop
211
211
  requirement: !ruby/object:Gem::Requirement
@@ -436,14 +436,14 @@ dependencies:
436
436
  requirements:
437
437
  - - '='
438
438
  - !ruby/object:Gem::Version
439
- version: 1.9.1
439
+ version: 1.9.3
440
440
  type: :runtime
441
441
  prerelease: false
442
442
  version_requirements: !ruby/object:Gem::Requirement
443
443
  requirements:
444
444
  - - '='
445
445
  - !ruby/object:Gem::Version
446
- version: 1.9.1
446
+ version: 1.9.3
447
447
  - !ruby/object:Gem::Dependency
448
448
  name: dry-struct
449
449
  requirement: !ruby/object:Gem::Requirement
@@ -464,14 +464,14 @@ dependencies:
464
464
  requirements:
465
465
  - - '='
466
466
  - !ruby/object:Gem::Version
467
- version: 1.8.0
467
+ version: 1.8.1
468
468
  type: :runtime
469
469
  prerelease: false
470
470
  version_requirements: !ruby/object:Gem::Requirement
471
471
  requirements:
472
472
  - - '='
473
473
  - !ruby/object:Gem::Version
474
- version: 1.8.0
474
+ version: 1.8.1
475
475
  - !ruby/object:Gem::Dependency
476
476
  name: email_address
477
477
  requirement: !ruby/object:Gem::Requirement
@@ -682,20 +682,6 @@ dependencies:
682
682
  - - '='
683
683
  - !ruby/object:Gem::Version
684
684
  version: 2.0.0
685
- - !ruby/object:Gem::Dependency
686
- name: otx_ruby
687
- requirement: !ruby/object:Gem::Requirement
688
- requirements:
689
- - - '='
690
- - !ruby/object:Gem::Version
691
- version: 0.9.9
692
- type: :runtime
693
- prerelease: false
694
- version_requirements: !ruby/object:Gem::Requirement
695
- requirements:
696
- - - '='
697
- - !ruby/object:Gem::Version
698
- version: 0.9.9
699
685
  - !ruby/object:Gem::Dependency
700
686
  name: parallel
701
687
  requirement: !ruby/object:Gem::Requirement
@@ -800,14 +786,14 @@ dependencies:
800
786
  requirements:
801
787
  - - '='
802
788
  - !ruby/object:Gem::Version
803
- version: 2.2.3
789
+ version: 2.2.3.1
804
790
  type: :runtime
805
791
  prerelease: false
806
792
  version_requirements: !ruby/object:Gem::Requirement
807
793
  requirements:
808
794
  - - '='
809
795
  - !ruby/object:Gem::Version
810
- version: 2.2.3
796
+ version: 2.2.3.1
811
797
  - !ruby/object:Gem::Dependency
812
798
  name: rack-contrib
813
799
  requirement: !ruby/object:Gem::Requirement
@@ -926,14 +912,14 @@ dependencies:
926
912
  requirements:
927
913
  - - '='
928
914
  - !ruby/object:Gem::Version
929
- version: 1.4.2
915
+ version: 1.4.4
930
916
  type: :runtime
931
917
  prerelease: false
932
918
  version_requirements: !ruby/object:Gem::Requirement
933
919
  requirements:
934
920
  - - '='
935
921
  - !ruby/object:Gem::Version
936
- version: 1.4.2
922
+ version: 1.4.4
937
923
  - !ruby/object:Gem::Dependency
938
924
  name: thor
939
925
  requirement: !ruby/object:Gem::Requirement
@@ -1074,6 +1060,7 @@ files:
1074
1060
  - lib/mihari/analyzers/binaryedge.rb
1075
1061
  - lib/mihari/analyzers/censys.rb
1076
1062
  - lib/mihari/analyzers/circl.rb
1063
+ - lib/mihari/analyzers/clients/otx.rb
1077
1064
  - lib/mihari/analyzers/crtsh.rb
1078
1065
  - lib/mihari/analyzers/dnpedia.rb
1079
1066
  - lib/mihari/analyzers/dnstwister.rb
@@ -1110,8 +1097,10 @@ files:
1110
1097
  - lib/mihari/emitters/the_hive.rb
1111
1098
  - lib/mihari/emitters/webhook.rb
1112
1099
  - lib/mihari/enrichers/base.rb
1100
+ - lib/mihari/enrichers/google_public_dns.rb
1113
1101
  - lib/mihari/enrichers/ipinfo.rb
1114
1102
  - lib/mihari/enrichers/shodan.rb
1103
+ - lib/mihari/enrichers/whois.rb
1115
1104
  - lib/mihari/entities/alert.rb
1116
1105
  - lib/mihari/entities/artifact.rb
1117
1106
  - lib/mihari/entities/autonomous_system.rb
@@ -1138,7 +1127,6 @@ files:
1138
1127
  - lib/mihari/mixins/error_notification.rb
1139
1128
  - lib/mihari/mixins/refang.rb
1140
1129
  - lib/mihari/mixins/retriable.rb
1141
- - lib/mihari/mixins/rule.rb
1142
1130
  - lib/mihari/models/alert.rb
1143
1131
  - lib/mihari/models/artifact.rb
1144
1132
  - lib/mihari/models/autonomous_system.rb
@@ -1153,11 +1141,13 @@ files:
1153
1141
  - lib/mihari/models/whois.rb
1154
1142
  - lib/mihari/schemas/analyzer.rb
1155
1143
  - lib/mihari/schemas/emitter.rb
1144
+ - lib/mihari/schemas/enricher.rb
1156
1145
  - lib/mihari/schemas/macros.rb
1157
1146
  - lib/mihari/schemas/rule.rb
1158
1147
  - lib/mihari/status.rb
1159
- - lib/mihari/structs/alert.rb
1160
1148
  - lib/mihari/structs/censys.rb
1149
+ - lib/mihari/structs/filters.rb
1150
+ - lib/mihari/structs/google_public_dns.rb
1161
1151
  - lib/mihari/structs/greynoise.rb
1162
1152
  - lib/mihari/structs/ipinfo.rb
1163
1153
  - lib/mihari/structs/onyphe.rb
@@ -1183,7 +1173,7 @@ files:
1183
1173
  - lib/mihari/web/public/index.html
1184
1174
  - lib/mihari/web/public/redoc-static.html
1185
1175
  - lib/mihari/web/public/static/css/app.2a5d3d21.css
1186
- - lib/mihari/web/public/static/css/chunk-vendors.06251949.css
1176
+ - lib/mihari/web/public/static/css/chunk-vendors.5013d549.css
1187
1177
  - lib/mihari/web/public/static/favicon.ico
1188
1178
  - lib/mihari/web/public/static/fonts/fa-brands-400.7fa789ab.ttf
1189
1179
  - lib/mihari/web/public/static/fonts/fa-brands-400.859fc388.woff2
@@ -1192,14 +1182,10 @@ files:
1192
1182
  - lib/mihari/web/public/static/fonts/fa-solid-900.3a463ec3.ttf
1193
1183
  - lib/mihari/web/public/static/fonts/fa-solid-900.40ddefd7.woff2
1194
1184
  - lib/mihari/web/public/static/fonts/fa-v4compatibility.924588dc.ttf
1195
- - lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js
1196
- - lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js.map
1197
- - lib/mihari/web/public/static/js/app.823b5af7.js
1198
- - lib/mihari/web/public/static/js/app.823b5af7.js.map
1199
- - lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js
1200
- - lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js.map
1201
- - lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js
1202
- - lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js.map
1185
+ - lib/mihari/web/public/static/js/app.3ac3bd7a.js
1186
+ - lib/mihari/web/public/static/js/app.3ac3bd7a.js.map
1187
+ - lib/mihari/web/public/static/js/chunk-vendors.37b7208e.js
1188
+ - lib/mihari/web/public/static/js/chunk-vendors.37b7208e.js.map
1203
1189
  - mihari.gemspec
1204
1190
  - renovate.json
1205
1191
  - sig/lib/mihari.rbs
@@ -1243,6 +1229,7 @@ files:
1243
1229
  - sig/lib/mihari/emitters/the_hive.rbs
1244
1230
  - sig/lib/mihari/emitters/webhook.rbs
1245
1231
  - sig/lib/mihari/enrichers/base.rbs
1232
+ - sig/lib/mihari/enrichers/google_public_dns.rbs
1246
1233
  - sig/lib/mihari/enrichers/ipinfo.rbs
1247
1234
  - sig/lib/mihari/errors.rbs
1248
1235
  - sig/lib/mihari/feed/parser.rbs
@@ -1256,7 +1243,6 @@ files:
1256
1243
  - sig/lib/mihari/mixins/hash.rbs
1257
1244
  - sig/lib/mihari/mixins/refang.rbs
1258
1245
  - sig/lib/mihari/mixins/retriable.rbs
1259
- - sig/lib/mihari/mixins/rule.rbs
1260
1246
  - sig/lib/mihari/models/alert.rbs
1261
1247
  - sig/lib/mihari/models/artifact.rbs
1262
1248
  - sig/lib/mihari/models/autonomous_system.rbs
@@ -1270,8 +1256,9 @@ files:
1270
1256
  - sig/lib/mihari/models/tagging.rbs
1271
1257
  - sig/lib/mihari/models/whois.rbs
1272
1258
  - sig/lib/mihari/status.rbs
1273
- - sig/lib/mihari/structs/alert.rbs
1274
1259
  - sig/lib/mihari/structs/censys.rbs
1260
+ - sig/lib/mihari/structs/filters.rbs
1261
+ - sig/lib/mihari/structs/google_public_dns.rbs
1275
1262
  - sig/lib/mihari/structs/greynoise.rbs
1276
1263
  - sig/lib/mihari/structs/ipinfo.rbs
1277
1264
  - sig/lib/mihari/structs/onyphe.rbs
@@ -1,84 +0,0 @@
1
- # frozen_string_literal: true
2
-
3
- require "date"
4
- require "erb"
5
- require "pathname"
6
-
7
- module Mihari
8
- module Mixins
9
- module Rule
10
- include Mixins::Database
11
-
12
- def load_erb_yaml(yaml)
13
- YAML.safe_load(ERB.new(yaml).result, permitted_classes: [Date], symbolize_names: true)
14
- end
15
-
16
- #
17
- # Load rule into hash
18
- #
19
- # @param [String] path_or_id Path to YAML file or YAML string or ID of a rule in the database
20
- #
21
- # @return [Mihari::Structs::Rule::Rule]
22
- #
23
- def load_rule(path_or_id)
24
- yaml = nil
25
-
26
- yaml = load_yaml_from_file(path_or_id) if File.exist?(path_or_id)
27
- yaml = load_yaml_from_db(path_or_id) if yaml.nil?
28
-
29
- Structs::Rule::Rule.from_yaml yaml
30
- end
31
-
32
- def load_yaml_from_file(path)
33
- return nil unless Pathname(path).exist?
34
-
35
- File.read path
36
- end
37
-
38
- def load_yaml_from_db(id)
39
- with_db_connection do
40
- rule = Mihari::Rule.find(id)
41
- rule.yaml || rule.symbolized_data.to_yaml
42
- rescue ActiveRecord::RecordNotFound
43
- raise ArgumentError, "ID:#{id} is not found in the database"
44
- end
45
- end
46
-
47
- #
48
- # Validate a rule
49
- #
50
- # @param [Mihari::Structs::Rule::Rule] rule
51
- #
52
- def validate_rule!(rule)
53
- rule.validate!
54
- rescue RuleValidationError => e
55
- Mihari.logger.error "Failed to parse the input as a rule"
56
- raise e
57
- end
58
-
59
- #
60
- # Returns a template for rule
61
- #
62
- # @return [String] A template for rule
63
- #
64
- def rule_template
65
- yaml = File.read(File.expand_path("../templates/rule.yml.erb", __dir__))
66
- Structs::Rule::Rule.from_yaml yaml
67
- yaml
68
- end
69
-
70
- #
71
- # Create (blank) rule file
72
- #
73
- # @param [String] filename
74
- # @param [Dry::Files] files
75
- # @param [String] template
76
- #
77
- # @return [nil]
78
- #
79
- def initialize_rule_yaml(filename, files = Dry::Files.new, template: rule_template)
80
- files.write(filename, template)
81
- end
82
- end
83
- end
84
- end