mihari 4.6.1 → 4.7.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/lib/mihari/analyzers/clients/otx.rb +36 -0
- data/lib/mihari/analyzers/otx.rb +19 -11
- data/lib/mihari/analyzers/rule.rb +17 -1
- data/lib/mihari/commands/init.rb +25 -2
- data/lib/mihari/commands/search.rb +2 -7
- data/lib/mihari/commands/validator.rb +10 -5
- data/lib/mihari/constants.rb +2 -0
- data/lib/mihari/enrichers/google_public_dns.rb +36 -0
- data/lib/mihari/enrichers/whois.rb +126 -0
- data/lib/mihari/errors.rb +2 -0
- data/lib/mihari/http.rb +2 -2
- data/lib/mihari/models/alert.rb +6 -1
- data/lib/mihari/models/artifact.rb +30 -0
- data/lib/mihari/models/dns.rb +5 -21
- data/lib/mihari/models/geolocation.rb +2 -4
- data/lib/mihari/models/port.rb +1 -1
- data/lib/mihari/models/rule.rb +7 -2
- data/lib/mihari/models/whois.rb +1 -96
- data/lib/mihari/schemas/enricher.rb +9 -0
- data/lib/mihari/schemas/rule.rb +6 -0
- data/lib/mihari/structs/filters.rb +71 -0
- data/lib/mihari/structs/google_public_dns.rb +42 -0
- data/lib/mihari/structs/ipinfo.rb +4 -4
- data/lib/mihari/structs/rule.rb +187 -137
- data/lib/mihari/types.rb +7 -0
- data/lib/mihari/version.rb +1 -1
- data/lib/mihari/web/endpoints/alerts.rb +1 -1
- data/lib/mihari/web/endpoints/rules.rb +13 -5
- data/lib/mihari/web/public/index.html +1 -1
- data/lib/mihari/web/public/redoc-static.html +796 -763
- data/lib/mihari/web/public/static/css/chunk-vendors.5013d549.css +7 -0
- data/lib/mihari/web/public/static/js/app.3ac3bd7a.js +2 -0
- data/lib/mihari/web/public/static/js/app.3ac3bd7a.js.map +1 -0
- data/lib/mihari/web/public/static/js/{chunk-vendors.dde2116c.js → chunk-vendors.37b7208e.js} +6 -6
- data/lib/mihari/web/public/static/js/chunk-vendors.37b7208e.js.map +1 -0
- data/lib/mihari.rb +4 -2
- data/mihari.gemspec +8 -9
- data/sig/lib/mihari/cli/base.rbs +0 -2
- data/sig/lib/mihari/enrichers/google_public_dns.rbs +18 -0
- data/sig/lib/mihari/models/alert.rbs +3 -3
- data/sig/lib/mihari/models/rule.rbs +2 -2
- data/sig/lib/mihari/structs/filters.rbs +40 -0
- data/sig/lib/mihari/structs/google_public_dns.rbs +21 -0
- data/sig/lib/mihari/structs/ipinfo.rbs +2 -2
- data/sig/lib/mihari/structs/rule.rbs +36 -43
- metadata +32 -45
- data/lib/mihari/mixins/rule.rb +0 -84
- data/lib/mihari/structs/alert.rb +0 -44
- data/lib/mihari/web/public/static/css/chunk-vendors.06251949.css +0 -7
- data/lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js +0 -2
- data/lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js.map +0 -1
- data/lib/mihari/web/public/static/js/app.823b5af7.js +0 -2
- data/lib/mihari/web/public/static/js/app.823b5af7.js.map +0 -1
- data/lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js +0 -25
- data/lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js.map +0 -1
- data/lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js.map +0 -1
- data/sig/lib/mihari/mixins/rule.rbs +0 -36
- data/sig/lib/mihari/structs/alert.rbs +0 -27
data/lib/mihari.rb
CHANGED
@@ -59,7 +59,6 @@ require "mihari/mixins/disallowed_data_value"
|
|
59
59
|
require "mihari/mixins/error_notification"
|
60
60
|
require "mihari/mixins/refang"
|
61
61
|
require "mihari/mixins/retriable"
|
62
|
-
require "mihari/mixins/rule"
|
63
62
|
|
64
63
|
def truthy?(value)
|
65
64
|
return true if value == "true"
|
@@ -171,8 +170,9 @@ require "mihari/constants"
|
|
171
170
|
require "mihari/types"
|
172
171
|
|
173
172
|
# Structs
|
174
|
-
require "mihari/structs/alert"
|
175
173
|
require "mihari/structs/censys"
|
174
|
+
require "mihari/structs/filters"
|
175
|
+
require "mihari/structs/google_public_dns"
|
176
176
|
require "mihari/structs/greynoise"
|
177
177
|
require "mihari/structs/ipinfo"
|
178
178
|
require "mihari/structs/onyphe"
|
@@ -189,8 +189,10 @@ require "mihari/schemas/rule"
|
|
189
189
|
|
190
190
|
# Enrichers
|
191
191
|
require "mihari/enrichers/base"
|
192
|
+
require "mihari/enrichers/google_public_dns"
|
192
193
|
require "mihari/enrichers/ipinfo"
|
193
194
|
require "mihari/enrichers/shodan"
|
195
|
+
require "mihari/enrichers/whois"
|
194
196
|
|
195
197
|
# Models
|
196
198
|
require "mihari/models/alert"
|
data/mihari.gemspec
CHANGED
@@ -29,18 +29,18 @@ Gem::Specification.new do |spec|
|
|
29
29
|
|
30
30
|
spec.add_development_dependency "bundler", "~> 2.3"
|
31
31
|
spec.add_development_dependency "coveralls_reborn", "~> 0.24"
|
32
|
-
spec.add_development_dependency "fakefs", "~> 1.
|
32
|
+
spec.add_development_dependency "fakefs", "~> 1.8"
|
33
33
|
spec.add_development_dependency "mysql2", "~> 0.5"
|
34
34
|
spec.add_development_dependency "overcommit", "~> 0.59"
|
35
|
-
spec.add_development_dependency "pg", "~> 1.
|
36
|
-
spec.add_development_dependency "rack-test", "~>
|
35
|
+
spec.add_development_dependency "pg", "~> 1.4"
|
36
|
+
spec.add_development_dependency "rack-test", "~> 2.0"
|
37
37
|
spec.add_development_dependency "rake", "~> 13.0"
|
38
38
|
spec.add_development_dependency "rb-fsevent", "~> 0.11"
|
39
39
|
spec.add_development_dependency "rerun", "~> 0.13"
|
40
40
|
spec.add_development_dependency "rspec", "~> 3.11"
|
41
41
|
spec.add_development_dependency "simplecov-lcov", "~> 0.8.0"
|
42
42
|
spec.add_development_dependency "standard", "~> 1.12"
|
43
|
-
spec.add_development_dependency "steep", "~> 0
|
43
|
+
spec.add_development_dependency "steep", "~> 1.0"
|
44
44
|
spec.add_development_dependency "timecop", "~> 0.9"
|
45
45
|
spec.add_development_dependency "vcr", "~> 6.1"
|
46
46
|
spec.add_development_dependency "webmock", "~> 3.14"
|
@@ -58,9 +58,9 @@ Gem::Specification.new do |spec|
|
|
58
58
|
spec.add_dependency "dry-container", "0.9.0"
|
59
59
|
spec.add_dependency "dry-files", "0.1.0"
|
60
60
|
spec.add_dependency "dry-initializer", "3.1.1"
|
61
|
-
spec.add_dependency "dry-schema", "1.9.
|
61
|
+
spec.add_dependency "dry-schema", "1.9.3"
|
62
62
|
spec.add_dependency "dry-struct", "1.4.0"
|
63
|
-
spec.add_dependency "dry-validation", "1.8.
|
63
|
+
spec.add_dependency "dry-validation", "1.8.1"
|
64
64
|
spec.add_dependency "email_address", "0.2.3"
|
65
65
|
spec.add_dependency "grape", "1.6.2"
|
66
66
|
spec.add_dependency "grape-entity", "0.10.1"
|
@@ -76,7 +76,6 @@ Gem::Specification.new do |spec|
|
|
76
76
|
spec.add_dependency "net-ping", "2.0.8"
|
77
77
|
spec.add_dependency "normalize_country", "0.3.2"
|
78
78
|
spec.add_dependency "onyphe", "2.0.0"
|
79
|
-
spec.add_dependency "otx_ruby", "0.9.9"
|
80
79
|
spec.add_dependency "parallel", "1.22.1"
|
81
80
|
spec.add_dependency "passive_circl", "0.1.0"
|
82
81
|
spec.add_dependency "passivetotalx", "0.1.1"
|
@@ -84,7 +83,7 @@ Gem::Specification.new do |spec|
|
|
84
83
|
spec.add_dependency "public_suffix", "4.0.7"
|
85
84
|
spec.add_dependency "pulsedive", "0.1.5"
|
86
85
|
spec.add_dependency "puma", "5.6.4"
|
87
|
-
spec.add_dependency "rack", "2.2.3"
|
86
|
+
spec.add_dependency "rack", "2.2.3.1"
|
88
87
|
spec.add_dependency "rack-contrib", "2.3.0"
|
89
88
|
spec.add_dependency "rack-cors", "1.1.1"
|
90
89
|
spec.add_dependency "securitytrails", "1.0.0"
|
@@ -93,7 +92,7 @@ Gem::Specification.new do |spec|
|
|
93
92
|
spec.add_dependency "shodanx", "0.2.1"
|
94
93
|
spec.add_dependency "slack-notifier", "2.4.0"
|
95
94
|
spec.add_dependency "spysex", "0.2.0"
|
96
|
-
spec.add_dependency "sqlite3", "1.4.
|
95
|
+
spec.add_dependency "sqlite3", "1.4.4"
|
97
96
|
spec.add_dependency "thor", "1.2.1"
|
98
97
|
spec.add_dependency "urlscan", "0.8.0"
|
99
98
|
spec.add_dependency "uuidtools", "2.2.0"
|
data/sig/lib/mihari/cli/base.rbs
CHANGED
@@ -0,0 +1,18 @@
|
|
1
|
+
module Mihari
|
2
|
+
module Enrichers
|
3
|
+
class GooglePublicDNS < Base
|
4
|
+
# @return [Boolean]
|
5
|
+
def valid?: () -> true
|
6
|
+
|
7
|
+
#
|
8
|
+
# Query Google Public DNS
|
9
|
+
#
|
10
|
+
# @param [String] name
|
11
|
+
# @param [String] resource_type
|
12
|
+
#
|
13
|
+
# @return [Mihari::Structs::Shodan::GooglePublicDNS::Response, nil]
|
14
|
+
#
|
15
|
+
def self.query: (String name, String resource_type) -> Mihari::Structs::Shodan::GooglePublicDNS::Response?
|
16
|
+
end
|
17
|
+
end
|
18
|
+
end
|
@@ -7,12 +7,12 @@ module Mihari
|
|
7
7
|
attr_accessor artifacts(): Array[Mihari::Artifact]
|
8
8
|
attr_accessor Tags(): Array[Mihari::Tag]
|
9
9
|
|
10
|
-
def self.search: (Mihari::Structs::Alert::SearchFilterWithPagination filter) -> Array[Mihari::Alert]
|
10
|
+
def self.search: (Mihari::Structs::Filters::Alert::SearchFilterWithPagination filter) -> Array[Mihari::Alert]
|
11
11
|
|
12
|
-
def self.count: (Mihari::Structs::Alert::SearchFilter filter) -> Integer
|
12
|
+
def self.count: (Mihari::Structs::Filters::Alert::SearchFilter filter) -> Integer
|
13
13
|
|
14
14
|
private
|
15
15
|
|
16
|
-
def self.build_relation: (Mihari::Structs::Alert::SearchFilter filter) -> Mihari::Alert
|
16
|
+
def self.build_relation: (Mihari::Structs::Filters::Alert::SearchFilter filter) -> Mihari::Alert
|
17
17
|
end
|
18
18
|
end
|
@@ -10,8 +10,8 @@ module Mihari
|
|
10
10
|
|
11
11
|
def to_h: () -> Hash
|
12
12
|
|
13
|
-
def self.search: (Mihari::Structs::Rule::SearchFilterWithPagination filter) -> Array[Mihari::Rule]
|
13
|
+
def self.search: (Mihari::Structs::Filters::Rule::SearchFilterWithPagination filter) -> Array[Mihari::Rule]
|
14
14
|
|
15
|
-
def self.count: (Mihari::Structs::Rule::SearchFilter filter) -> Integer
|
15
|
+
def self.count: (Mihari::Structs::Filters::Rule::SearchFilter filter) -> Integer
|
16
16
|
end
|
17
17
|
end
|
@@ -0,0 +1,40 @@
|
|
1
|
+
module Mihari
|
2
|
+
module Structs
|
3
|
+
module Filters
|
4
|
+
module Alert
|
5
|
+
class SearchFilter < Dry::Struct
|
6
|
+
attr_reader artifact_data: String?
|
7
|
+
attr_reader description: String?
|
8
|
+
attr_reader source: String?
|
9
|
+
attr_reader tag_name: String?
|
10
|
+
attr_reader title: String?
|
11
|
+
attr_reader from_at: DateTime?
|
12
|
+
attr_reader to_at: DateTime?
|
13
|
+
attr_reader asn: Integer?
|
14
|
+
attr_reader dns_record: String?
|
15
|
+
attr_reader reverse_dns_name: String?
|
16
|
+
|
17
|
+
def valid_artifact_filters?: () -> bool
|
18
|
+
end
|
19
|
+
|
20
|
+
class SearchFilterWithPagination < SearchFilter
|
21
|
+
def without_pagination: () -> Mihari::Structs::Filters::Alert::SearchFilter
|
22
|
+
end
|
23
|
+
end
|
24
|
+
|
25
|
+
module Rule
|
26
|
+
class SearchFilter < Dry::Struct
|
27
|
+
attr_reader page: Integer?
|
28
|
+
attr_reader tag: String?
|
29
|
+
attr_reader source: String?
|
30
|
+
attr_reader from_at: DateTime?
|
31
|
+
attr_reader to_at: DateTime?
|
32
|
+
end
|
33
|
+
|
34
|
+
class SearchFilterWithPagination < SearchFilter
|
35
|
+
def without_pagination: () -> Mihari::Structs::Filters::Rule::SearchFilter
|
36
|
+
end
|
37
|
+
end
|
38
|
+
end
|
39
|
+
end
|
40
|
+
end
|
@@ -0,0 +1,21 @@
|
|
1
|
+
module Mihari
|
2
|
+
module Structs
|
3
|
+
module GooglePublicDNS
|
4
|
+
INT_TYPE_TO_TYPE: { 1 => "A", 2 => "NS", 5 => "CNAME", 16 => "TXT", 28 => "AAAA" }
|
5
|
+
|
6
|
+
class Answer < Dry::Struct
|
7
|
+
attr_reader name: String
|
8
|
+
attr_reader data: String
|
9
|
+
attr_reader resource_type: String
|
10
|
+
|
11
|
+
def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::GooglePublicDNS::Answer
|
12
|
+
end
|
13
|
+
|
14
|
+
class Response < Dry::Struct
|
15
|
+
attr_reader answers: Array[Mihari::Structs::GooglePublicDNS::Answer]
|
16
|
+
|
17
|
+
def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::GooglePublicDNS::Response
|
18
|
+
end
|
19
|
+
end
|
20
|
+
end
|
21
|
+
end
|
@@ -4,8 +4,8 @@ module Mihari
|
|
4
4
|
class Response
|
5
5
|
attr_reader ip: String
|
6
6
|
attr_reader hostname: String?
|
7
|
-
attr_reader loc: String
|
8
|
-
attr_reader country_code: String
|
7
|
+
attr_reader loc: String?
|
8
|
+
attr_reader country_code: String?
|
9
9
|
attr_reader asn: Integer?
|
10
10
|
|
11
11
|
def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::IPInfo::Response
|
@@ -1,64 +1,57 @@
|
|
1
1
|
module Mihari
|
2
2
|
module Structs
|
3
|
-
|
4
|
-
|
5
|
-
end
|
3
|
+
class Rule
|
4
|
+
attr_reader data: Hash
|
6
5
|
|
7
|
-
|
8
|
-
def without_pagination: () -> SearchFilter
|
9
|
-
end
|
6
|
+
attr_reader yaml: String
|
10
7
|
|
11
|
-
|
12
|
-
attr_reader data: Hash
|
8
|
+
attr_reader errors: Array[untypes]?
|
13
9
|
|
14
|
-
|
10
|
+
def initialize: (Hash data) -> void
|
15
11
|
|
16
|
-
|
12
|
+
#
|
13
|
+
# @return [Boolean]
|
14
|
+
#
|
15
|
+
def errors?: () -> (bool)
|
17
16
|
|
18
|
-
|
17
|
+
#
|
18
|
+
# @return [Array[String]]
|
19
|
+
#
|
20
|
+
def error_messages: () -> (Array[String])
|
19
21
|
|
20
|
-
|
21
|
-
# @return [Boolean]
|
22
|
-
#
|
23
|
-
def errors?: () -> (bool)
|
22
|
+
def validate: () -> void
|
24
23
|
|
25
|
-
|
26
|
-
# @return [Array[String]]
|
27
|
-
#
|
28
|
-
def error_messages: () -> (Array[String])
|
24
|
+
def validate!: () -> void
|
29
25
|
|
30
|
-
|
26
|
+
def []: (untyped key) -> untyped
|
31
27
|
|
32
|
-
|
28
|
+
#
|
29
|
+
# @return [String]
|
30
|
+
#
|
31
|
+
def id: () -> String
|
33
32
|
|
34
|
-
|
33
|
+
#
|
34
|
+
# @return [String]
|
35
|
+
#
|
36
|
+
def title: () -> String
|
35
37
|
|
36
|
-
|
37
|
-
|
38
|
-
|
39
|
-
|
38
|
+
#
|
39
|
+
# @return [String]
|
40
|
+
#
|
41
|
+
def description: () -> String
|
40
42
|
|
41
|
-
|
42
|
-
|
43
|
-
|
44
|
-
|
43
|
+
#
|
44
|
+
# @return [Mihari::Rule]
|
45
|
+
#
|
46
|
+
def to_model: () -> Mihari::Rule
|
45
47
|
|
46
|
-
|
47
|
-
# @return [String]
|
48
|
-
#
|
49
|
-
def description: () -> String
|
48
|
+
def to_analyzer: () -> Mihari::Analyzers::Rule
|
50
49
|
|
51
|
-
|
52
|
-
# @return [Mihari::Rule]
|
53
|
-
#
|
54
|
-
def to_model: () -> Mihari::Rule
|
50
|
+
def self.from_model: (Mihari::Rule model) -> Mihari::Structs::Rule
|
55
51
|
|
56
|
-
|
52
|
+
def self.from_yaml: (String yaml) -> Mihari::Structs::Rule
|
57
53
|
|
58
|
-
|
59
|
-
|
60
|
-
def self.from_yaml: (String yaml) -> Mihari::Structs::Rule::Rule
|
61
|
-
end
|
54
|
+
def self.from_path_or_id: (String path_or_id) -> Mihari::Structs::Rule
|
62
55
|
end
|
63
56
|
end
|
64
57
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: mihari
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 4.
|
4
|
+
version: 4.7.2
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Manabu Niseki
|
8
8
|
autorequire:
|
9
9
|
bindir: exe
|
10
10
|
cert_chain: []
|
11
|
-
date: 2022-
|
11
|
+
date: 2022-06-26 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: bundler
|
@@ -44,14 +44,14 @@ dependencies:
|
|
44
44
|
requirements:
|
45
45
|
- - "~>"
|
46
46
|
- !ruby/object:Gem::Version
|
47
|
-
version: '1.
|
47
|
+
version: '1.8'
|
48
48
|
type: :development
|
49
49
|
prerelease: false
|
50
50
|
version_requirements: !ruby/object:Gem::Requirement
|
51
51
|
requirements:
|
52
52
|
- - "~>"
|
53
53
|
- !ruby/object:Gem::Version
|
54
|
-
version: '1.
|
54
|
+
version: '1.8'
|
55
55
|
- !ruby/object:Gem::Dependency
|
56
56
|
name: mysql2
|
57
57
|
requirement: !ruby/object:Gem::Requirement
|
@@ -86,28 +86,28 @@ dependencies:
|
|
86
86
|
requirements:
|
87
87
|
- - "~>"
|
88
88
|
- !ruby/object:Gem::Version
|
89
|
-
version: '1.
|
89
|
+
version: '1.4'
|
90
90
|
type: :development
|
91
91
|
prerelease: false
|
92
92
|
version_requirements: !ruby/object:Gem::Requirement
|
93
93
|
requirements:
|
94
94
|
- - "~>"
|
95
95
|
- !ruby/object:Gem::Version
|
96
|
-
version: '1.
|
96
|
+
version: '1.4'
|
97
97
|
- !ruby/object:Gem::Dependency
|
98
98
|
name: rack-test
|
99
99
|
requirement: !ruby/object:Gem::Requirement
|
100
100
|
requirements:
|
101
101
|
- - "~>"
|
102
102
|
- !ruby/object:Gem::Version
|
103
|
-
version: '
|
103
|
+
version: '2.0'
|
104
104
|
type: :development
|
105
105
|
prerelease: false
|
106
106
|
version_requirements: !ruby/object:Gem::Requirement
|
107
107
|
requirements:
|
108
108
|
- - "~>"
|
109
109
|
- !ruby/object:Gem::Version
|
110
|
-
version: '
|
110
|
+
version: '2.0'
|
111
111
|
- !ruby/object:Gem::Dependency
|
112
112
|
name: rake
|
113
113
|
requirement: !ruby/object:Gem::Requirement
|
@@ -198,14 +198,14 @@ dependencies:
|
|
198
198
|
requirements:
|
199
199
|
- - "~>"
|
200
200
|
- !ruby/object:Gem::Version
|
201
|
-
version: '0
|
201
|
+
version: '1.0'
|
202
202
|
type: :development
|
203
203
|
prerelease: false
|
204
204
|
version_requirements: !ruby/object:Gem::Requirement
|
205
205
|
requirements:
|
206
206
|
- - "~>"
|
207
207
|
- !ruby/object:Gem::Version
|
208
|
-
version: '0
|
208
|
+
version: '1.0'
|
209
209
|
- !ruby/object:Gem::Dependency
|
210
210
|
name: timecop
|
211
211
|
requirement: !ruby/object:Gem::Requirement
|
@@ -436,14 +436,14 @@ dependencies:
|
|
436
436
|
requirements:
|
437
437
|
- - '='
|
438
438
|
- !ruby/object:Gem::Version
|
439
|
-
version: 1.9.
|
439
|
+
version: 1.9.3
|
440
440
|
type: :runtime
|
441
441
|
prerelease: false
|
442
442
|
version_requirements: !ruby/object:Gem::Requirement
|
443
443
|
requirements:
|
444
444
|
- - '='
|
445
445
|
- !ruby/object:Gem::Version
|
446
|
-
version: 1.9.
|
446
|
+
version: 1.9.3
|
447
447
|
- !ruby/object:Gem::Dependency
|
448
448
|
name: dry-struct
|
449
449
|
requirement: !ruby/object:Gem::Requirement
|
@@ -464,14 +464,14 @@ dependencies:
|
|
464
464
|
requirements:
|
465
465
|
- - '='
|
466
466
|
- !ruby/object:Gem::Version
|
467
|
-
version: 1.8.
|
467
|
+
version: 1.8.1
|
468
468
|
type: :runtime
|
469
469
|
prerelease: false
|
470
470
|
version_requirements: !ruby/object:Gem::Requirement
|
471
471
|
requirements:
|
472
472
|
- - '='
|
473
473
|
- !ruby/object:Gem::Version
|
474
|
-
version: 1.8.
|
474
|
+
version: 1.8.1
|
475
475
|
- !ruby/object:Gem::Dependency
|
476
476
|
name: email_address
|
477
477
|
requirement: !ruby/object:Gem::Requirement
|
@@ -682,20 +682,6 @@ dependencies:
|
|
682
682
|
- - '='
|
683
683
|
- !ruby/object:Gem::Version
|
684
684
|
version: 2.0.0
|
685
|
-
- !ruby/object:Gem::Dependency
|
686
|
-
name: otx_ruby
|
687
|
-
requirement: !ruby/object:Gem::Requirement
|
688
|
-
requirements:
|
689
|
-
- - '='
|
690
|
-
- !ruby/object:Gem::Version
|
691
|
-
version: 0.9.9
|
692
|
-
type: :runtime
|
693
|
-
prerelease: false
|
694
|
-
version_requirements: !ruby/object:Gem::Requirement
|
695
|
-
requirements:
|
696
|
-
- - '='
|
697
|
-
- !ruby/object:Gem::Version
|
698
|
-
version: 0.9.9
|
699
685
|
- !ruby/object:Gem::Dependency
|
700
686
|
name: parallel
|
701
687
|
requirement: !ruby/object:Gem::Requirement
|
@@ -800,14 +786,14 @@ dependencies:
|
|
800
786
|
requirements:
|
801
787
|
- - '='
|
802
788
|
- !ruby/object:Gem::Version
|
803
|
-
version: 2.2.3
|
789
|
+
version: 2.2.3.1
|
804
790
|
type: :runtime
|
805
791
|
prerelease: false
|
806
792
|
version_requirements: !ruby/object:Gem::Requirement
|
807
793
|
requirements:
|
808
794
|
- - '='
|
809
795
|
- !ruby/object:Gem::Version
|
810
|
-
version: 2.2.3
|
796
|
+
version: 2.2.3.1
|
811
797
|
- !ruby/object:Gem::Dependency
|
812
798
|
name: rack-contrib
|
813
799
|
requirement: !ruby/object:Gem::Requirement
|
@@ -926,14 +912,14 @@ dependencies:
|
|
926
912
|
requirements:
|
927
913
|
- - '='
|
928
914
|
- !ruby/object:Gem::Version
|
929
|
-
version: 1.4.
|
915
|
+
version: 1.4.4
|
930
916
|
type: :runtime
|
931
917
|
prerelease: false
|
932
918
|
version_requirements: !ruby/object:Gem::Requirement
|
933
919
|
requirements:
|
934
920
|
- - '='
|
935
921
|
- !ruby/object:Gem::Version
|
936
|
-
version: 1.4.
|
922
|
+
version: 1.4.4
|
937
923
|
- !ruby/object:Gem::Dependency
|
938
924
|
name: thor
|
939
925
|
requirement: !ruby/object:Gem::Requirement
|
@@ -1074,6 +1060,7 @@ files:
|
|
1074
1060
|
- lib/mihari/analyzers/binaryedge.rb
|
1075
1061
|
- lib/mihari/analyzers/censys.rb
|
1076
1062
|
- lib/mihari/analyzers/circl.rb
|
1063
|
+
- lib/mihari/analyzers/clients/otx.rb
|
1077
1064
|
- lib/mihari/analyzers/crtsh.rb
|
1078
1065
|
- lib/mihari/analyzers/dnpedia.rb
|
1079
1066
|
- lib/mihari/analyzers/dnstwister.rb
|
@@ -1110,8 +1097,10 @@ files:
|
|
1110
1097
|
- lib/mihari/emitters/the_hive.rb
|
1111
1098
|
- lib/mihari/emitters/webhook.rb
|
1112
1099
|
- lib/mihari/enrichers/base.rb
|
1100
|
+
- lib/mihari/enrichers/google_public_dns.rb
|
1113
1101
|
- lib/mihari/enrichers/ipinfo.rb
|
1114
1102
|
- lib/mihari/enrichers/shodan.rb
|
1103
|
+
- lib/mihari/enrichers/whois.rb
|
1115
1104
|
- lib/mihari/entities/alert.rb
|
1116
1105
|
- lib/mihari/entities/artifact.rb
|
1117
1106
|
- lib/mihari/entities/autonomous_system.rb
|
@@ -1138,7 +1127,6 @@ files:
|
|
1138
1127
|
- lib/mihari/mixins/error_notification.rb
|
1139
1128
|
- lib/mihari/mixins/refang.rb
|
1140
1129
|
- lib/mihari/mixins/retriable.rb
|
1141
|
-
- lib/mihari/mixins/rule.rb
|
1142
1130
|
- lib/mihari/models/alert.rb
|
1143
1131
|
- lib/mihari/models/artifact.rb
|
1144
1132
|
- lib/mihari/models/autonomous_system.rb
|
@@ -1153,11 +1141,13 @@ files:
|
|
1153
1141
|
- lib/mihari/models/whois.rb
|
1154
1142
|
- lib/mihari/schemas/analyzer.rb
|
1155
1143
|
- lib/mihari/schemas/emitter.rb
|
1144
|
+
- lib/mihari/schemas/enricher.rb
|
1156
1145
|
- lib/mihari/schemas/macros.rb
|
1157
1146
|
- lib/mihari/schemas/rule.rb
|
1158
1147
|
- lib/mihari/status.rb
|
1159
|
-
- lib/mihari/structs/alert.rb
|
1160
1148
|
- lib/mihari/structs/censys.rb
|
1149
|
+
- lib/mihari/structs/filters.rb
|
1150
|
+
- lib/mihari/structs/google_public_dns.rb
|
1161
1151
|
- lib/mihari/structs/greynoise.rb
|
1162
1152
|
- lib/mihari/structs/ipinfo.rb
|
1163
1153
|
- lib/mihari/structs/onyphe.rb
|
@@ -1183,7 +1173,7 @@ files:
|
|
1183
1173
|
- lib/mihari/web/public/index.html
|
1184
1174
|
- lib/mihari/web/public/redoc-static.html
|
1185
1175
|
- lib/mihari/web/public/static/css/app.2a5d3d21.css
|
1186
|
-
- lib/mihari/web/public/static/css/chunk-vendors.
|
1176
|
+
- lib/mihari/web/public/static/css/chunk-vendors.5013d549.css
|
1187
1177
|
- lib/mihari/web/public/static/favicon.ico
|
1188
1178
|
- lib/mihari/web/public/static/fonts/fa-brands-400.7fa789ab.ttf
|
1189
1179
|
- lib/mihari/web/public/static/fonts/fa-brands-400.859fc388.woff2
|
@@ -1192,14 +1182,10 @@ files:
|
|
1192
1182
|
- lib/mihari/web/public/static/fonts/fa-solid-900.3a463ec3.ttf
|
1193
1183
|
- lib/mihari/web/public/static/fonts/fa-solid-900.40ddefd7.woff2
|
1194
1184
|
- lib/mihari/web/public/static/fonts/fa-v4compatibility.924588dc.ttf
|
1195
|
-
- lib/mihari/web/public/static/js/app
|
1196
|
-
- lib/mihari/web/public/static/js/app
|
1197
|
-
- lib/mihari/web/public/static/js/
|
1198
|
-
- lib/mihari/web/public/static/js/
|
1199
|
-
- lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js
|
1200
|
-
- lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js.map
|
1201
|
-
- lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js
|
1202
|
-
- lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js.map
|
1185
|
+
- lib/mihari/web/public/static/js/app.3ac3bd7a.js
|
1186
|
+
- lib/mihari/web/public/static/js/app.3ac3bd7a.js.map
|
1187
|
+
- lib/mihari/web/public/static/js/chunk-vendors.37b7208e.js
|
1188
|
+
- lib/mihari/web/public/static/js/chunk-vendors.37b7208e.js.map
|
1203
1189
|
- mihari.gemspec
|
1204
1190
|
- renovate.json
|
1205
1191
|
- sig/lib/mihari.rbs
|
@@ -1243,6 +1229,7 @@ files:
|
|
1243
1229
|
- sig/lib/mihari/emitters/the_hive.rbs
|
1244
1230
|
- sig/lib/mihari/emitters/webhook.rbs
|
1245
1231
|
- sig/lib/mihari/enrichers/base.rbs
|
1232
|
+
- sig/lib/mihari/enrichers/google_public_dns.rbs
|
1246
1233
|
- sig/lib/mihari/enrichers/ipinfo.rbs
|
1247
1234
|
- sig/lib/mihari/errors.rbs
|
1248
1235
|
- sig/lib/mihari/feed/parser.rbs
|
@@ -1256,7 +1243,6 @@ files:
|
|
1256
1243
|
- sig/lib/mihari/mixins/hash.rbs
|
1257
1244
|
- sig/lib/mihari/mixins/refang.rbs
|
1258
1245
|
- sig/lib/mihari/mixins/retriable.rbs
|
1259
|
-
- sig/lib/mihari/mixins/rule.rbs
|
1260
1246
|
- sig/lib/mihari/models/alert.rbs
|
1261
1247
|
- sig/lib/mihari/models/artifact.rbs
|
1262
1248
|
- sig/lib/mihari/models/autonomous_system.rbs
|
@@ -1270,8 +1256,9 @@ files:
|
|
1270
1256
|
- sig/lib/mihari/models/tagging.rbs
|
1271
1257
|
- sig/lib/mihari/models/whois.rbs
|
1272
1258
|
- sig/lib/mihari/status.rbs
|
1273
|
-
- sig/lib/mihari/structs/alert.rbs
|
1274
1259
|
- sig/lib/mihari/structs/censys.rbs
|
1260
|
+
- sig/lib/mihari/structs/filters.rbs
|
1261
|
+
- sig/lib/mihari/structs/google_public_dns.rbs
|
1275
1262
|
- sig/lib/mihari/structs/greynoise.rbs
|
1276
1263
|
- sig/lib/mihari/structs/ipinfo.rbs
|
1277
1264
|
- sig/lib/mihari/structs/onyphe.rbs
|
data/lib/mihari/mixins/rule.rb
DELETED
@@ -1,84 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
require "date"
|
4
|
-
require "erb"
|
5
|
-
require "pathname"
|
6
|
-
|
7
|
-
module Mihari
|
8
|
-
module Mixins
|
9
|
-
module Rule
|
10
|
-
include Mixins::Database
|
11
|
-
|
12
|
-
def load_erb_yaml(yaml)
|
13
|
-
YAML.safe_load(ERB.new(yaml).result, permitted_classes: [Date], symbolize_names: true)
|
14
|
-
end
|
15
|
-
|
16
|
-
#
|
17
|
-
# Load rule into hash
|
18
|
-
#
|
19
|
-
# @param [String] path_or_id Path to YAML file or YAML string or ID of a rule in the database
|
20
|
-
#
|
21
|
-
# @return [Mihari::Structs::Rule::Rule]
|
22
|
-
#
|
23
|
-
def load_rule(path_or_id)
|
24
|
-
yaml = nil
|
25
|
-
|
26
|
-
yaml = load_yaml_from_file(path_or_id) if File.exist?(path_or_id)
|
27
|
-
yaml = load_yaml_from_db(path_or_id) if yaml.nil?
|
28
|
-
|
29
|
-
Structs::Rule::Rule.from_yaml yaml
|
30
|
-
end
|
31
|
-
|
32
|
-
def load_yaml_from_file(path)
|
33
|
-
return nil unless Pathname(path).exist?
|
34
|
-
|
35
|
-
File.read path
|
36
|
-
end
|
37
|
-
|
38
|
-
def load_yaml_from_db(id)
|
39
|
-
with_db_connection do
|
40
|
-
rule = Mihari::Rule.find(id)
|
41
|
-
rule.yaml || rule.symbolized_data.to_yaml
|
42
|
-
rescue ActiveRecord::RecordNotFound
|
43
|
-
raise ArgumentError, "ID:#{id} is not found in the database"
|
44
|
-
end
|
45
|
-
end
|
46
|
-
|
47
|
-
#
|
48
|
-
# Validate a rule
|
49
|
-
#
|
50
|
-
# @param [Mihari::Structs::Rule::Rule] rule
|
51
|
-
#
|
52
|
-
def validate_rule!(rule)
|
53
|
-
rule.validate!
|
54
|
-
rescue RuleValidationError => e
|
55
|
-
Mihari.logger.error "Failed to parse the input as a rule"
|
56
|
-
raise e
|
57
|
-
end
|
58
|
-
|
59
|
-
#
|
60
|
-
# Returns a template for rule
|
61
|
-
#
|
62
|
-
# @return [String] A template for rule
|
63
|
-
#
|
64
|
-
def rule_template
|
65
|
-
yaml = File.read(File.expand_path("../templates/rule.yml.erb", __dir__))
|
66
|
-
Structs::Rule::Rule.from_yaml yaml
|
67
|
-
yaml
|
68
|
-
end
|
69
|
-
|
70
|
-
#
|
71
|
-
# Create (blank) rule file
|
72
|
-
#
|
73
|
-
# @param [String] filename
|
74
|
-
# @param [Dry::Files] files
|
75
|
-
# @param [String] template
|
76
|
-
#
|
77
|
-
# @return [nil]
|
78
|
-
#
|
79
|
-
def initialize_rule_yaml(filename, files = Dry::Files.new, template: rule_template)
|
80
|
-
files.write(filename, template)
|
81
|
-
end
|
82
|
-
end
|
83
|
-
end
|
84
|
-
end
|