mihari 4.7.0 → 4.7.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/lib/mihari/analyzers/clients/otx.rb +36 -0
- data/lib/mihari/analyzers/otx.rb +19 -11
- data/lib/mihari/analyzers/rule.rb +0 -1
- data/lib/mihari/commands/init.rb +25 -2
- data/lib/mihari/commands/search.rb +2 -7
- data/lib/mihari/commands/validator.rb +10 -5
- data/lib/mihari/errors.rb +2 -0
- data/lib/mihari/models/alert.rb +6 -1
- data/lib/mihari/models/geolocation.rb +2 -4
- data/lib/mihari/models/port.rb +1 -1
- data/lib/mihari/models/rule.rb +7 -2
- data/lib/mihari/structs/filters.rb +71 -0
- data/lib/mihari/structs/ipinfo.rb +4 -4
- data/lib/mihari/structs/rule.rb +188 -139
- data/lib/mihari/version.rb +1 -1
- data/lib/mihari/web/endpoints/alerts.rb +1 -1
- data/lib/mihari/web/endpoints/rules.rb +13 -5
- data/lib/mihari/web/public/index.html +1 -1
- data/lib/mihari/web/public/redoc-static.html +796 -763
- data/lib/mihari/web/public/static/css/chunk-vendors.5013d549.css +7 -0
- data/lib/mihari/web/public/static/js/app.524d9ed2.js +2 -0
- data/lib/mihari/web/public/static/js/app.524d9ed2.js.map +1 -0
- data/lib/mihari/web/public/static/js/{chunk-vendors.dde2116c.js → chunk-vendors.64580a1f.js} +7 -7
- data/lib/mihari/web/public/static/js/chunk-vendors.64580a1f.js.map +1 -0
- data/lib/mihari.rb +1 -2
- data/mihari.gemspec +10 -11
- data/sig/lib/mihari/cli/base.rbs +0 -2
- data/sig/lib/mihari/models/alert.rbs +3 -3
- data/sig/lib/mihari/models/rule.rbs +2 -2
- data/sig/lib/mihari/structs/filters.rbs +40 -0
- data/sig/lib/mihari/structs/ipinfo.rbs +2 -2
- data/sig/lib/mihari/structs/rule.rbs +36 -43
- metadata +30 -49
- data/lib/mihari/mixins/rule.rb +0 -84
- data/lib/mihari/structs/alert.rb +0 -44
- data/lib/mihari/web/public/static/css/chunk-vendors.06251949.css +0 -7
- data/lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js +0 -2
- data/lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js.map +0 -1
- data/lib/mihari/web/public/static/js/app.823b5af7.js +0 -2
- data/lib/mihari/web/public/static/js/app.823b5af7.js.map +0 -1
- data/lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js +0 -25
- data/lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js.map +0 -1
- data/lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js.map +0 -1
- data/sig/lib/mihari/mixins/rule.rbs +0 -36
- data/sig/lib/mihari/structs/alert.rbs +0 -27
data/lib/mihari.rb
CHANGED
@@ -59,7 +59,6 @@ require "mihari/mixins/disallowed_data_value"
|
|
59
59
|
require "mihari/mixins/error_notification"
|
60
60
|
require "mihari/mixins/refang"
|
61
61
|
require "mihari/mixins/retriable"
|
62
|
-
require "mihari/mixins/rule"
|
63
62
|
|
64
63
|
def truthy?(value)
|
65
64
|
return true if value == "true"
|
@@ -171,8 +170,8 @@ require "mihari/constants"
|
|
171
170
|
require "mihari/types"
|
172
171
|
|
173
172
|
# Structs
|
174
|
-
require "mihari/structs/alert"
|
175
173
|
require "mihari/structs/censys"
|
174
|
+
require "mihari/structs/filters"
|
176
175
|
require "mihari/structs/google_public_dns"
|
177
176
|
require "mihari/structs/greynoise"
|
178
177
|
require "mihari/structs/ipinfo"
|
data/mihari.gemspec
CHANGED
@@ -29,11 +29,11 @@ Gem::Specification.new do |spec|
|
|
29
29
|
|
30
30
|
spec.add_development_dependency "bundler", "~> 2.3"
|
31
31
|
spec.add_development_dependency "coveralls_reborn", "~> 0.24"
|
32
|
-
spec.add_development_dependency "fakefs", "~> 1.
|
32
|
+
spec.add_development_dependency "fakefs", "~> 1.8"
|
33
33
|
spec.add_development_dependency "mysql2", "~> 0.5"
|
34
34
|
spec.add_development_dependency "overcommit", "~> 0.59"
|
35
|
-
spec.add_development_dependency "pg", "~> 1.
|
36
|
-
spec.add_development_dependency "rack-test", "~>
|
35
|
+
spec.add_development_dependency "pg", "~> 1.4"
|
36
|
+
spec.add_development_dependency "rack-test", "~> 2.0"
|
37
37
|
spec.add_development_dependency "rake", "~> 13.0"
|
38
38
|
spec.add_development_dependency "rb-fsevent", "~> 0.11"
|
39
39
|
spec.add_development_dependency "rerun", "~> 0.13"
|
@@ -45,7 +45,7 @@ Gem::Specification.new do |spec|
|
|
45
45
|
spec.add_development_dependency "vcr", "~> 6.1"
|
46
46
|
spec.add_development_dependency "webmock", "~> 3.14"
|
47
47
|
|
48
|
-
spec.add_dependency "activerecord", "7.0.3"
|
48
|
+
spec.add_dependency "activerecord", "7.0.3.1"
|
49
49
|
spec.add_dependency "addressable", "2.8.0"
|
50
50
|
spec.add_dependency "awrence", "2.0.1"
|
51
51
|
spec.add_dependency "binaryedge", "0.1.0"
|
@@ -55,13 +55,13 @@ Gem::Specification.new do |spec|
|
|
55
55
|
spec.add_dependency "dnstwister", "0.1.0"
|
56
56
|
spec.add_dependency "dotenv", "2.7.6"
|
57
57
|
spec.add_dependency "dry-configurable", "0.15.0"
|
58
|
-
spec.add_dependency "dry-container", "0.
|
59
|
-
spec.add_dependency "dry-files", "0.
|
58
|
+
spec.add_dependency "dry-container", "0.10.0"
|
59
|
+
spec.add_dependency "dry-files", "0.2.0"
|
60
60
|
spec.add_dependency "dry-initializer", "3.1.1"
|
61
|
-
spec.add_dependency "dry-schema", "1.9.
|
61
|
+
spec.add_dependency "dry-schema", "1.9.3"
|
62
62
|
spec.add_dependency "dry-struct", "1.4.0"
|
63
63
|
spec.add_dependency "dry-validation", "1.8.1"
|
64
|
-
spec.add_dependency "email_address", "0.2.
|
64
|
+
spec.add_dependency "email_address", "0.2.4"
|
65
65
|
spec.add_dependency "grape", "1.6.2"
|
66
66
|
spec.add_dependency "grape-entity", "0.10.1"
|
67
67
|
spec.add_dependency "grape-swagger", "1.4.2"
|
@@ -76,7 +76,6 @@ Gem::Specification.new do |spec|
|
|
76
76
|
spec.add_dependency "net-ping", "2.0.8"
|
77
77
|
spec.add_dependency "normalize_country", "0.3.2"
|
78
78
|
spec.add_dependency "onyphe", "2.0.0"
|
79
|
-
spec.add_dependency "otx_ruby", "0.9.9"
|
80
79
|
spec.add_dependency "parallel", "1.22.1"
|
81
80
|
spec.add_dependency "passive_circl", "0.1.0"
|
82
81
|
spec.add_dependency "passivetotalx", "0.1.1"
|
@@ -84,7 +83,7 @@ Gem::Specification.new do |spec|
|
|
84
83
|
spec.add_dependency "public_suffix", "4.0.7"
|
85
84
|
spec.add_dependency "pulsedive", "0.1.5"
|
86
85
|
spec.add_dependency "puma", "5.6.4"
|
87
|
-
spec.add_dependency "rack", "2.2.
|
86
|
+
spec.add_dependency "rack", "2.2.4"
|
88
87
|
spec.add_dependency "rack-contrib", "2.3.0"
|
89
88
|
spec.add_dependency "rack-cors", "1.1.1"
|
90
89
|
spec.add_dependency "securitytrails", "1.0.0"
|
@@ -93,7 +92,7 @@ Gem::Specification.new do |spec|
|
|
93
92
|
spec.add_dependency "shodanx", "0.2.1"
|
94
93
|
spec.add_dependency "slack-notifier", "2.4.0"
|
95
94
|
spec.add_dependency "spysex", "0.2.0"
|
96
|
-
spec.add_dependency "sqlite3", "1.4.
|
95
|
+
spec.add_dependency "sqlite3", "1.4.4"
|
97
96
|
spec.add_dependency "thor", "1.2.1"
|
98
97
|
spec.add_dependency "urlscan", "0.8.0"
|
99
98
|
spec.add_dependency "uuidtools", "2.2.0"
|
data/sig/lib/mihari/cli/base.rbs
CHANGED
@@ -7,12 +7,12 @@ module Mihari
|
|
7
7
|
attr_accessor artifacts(): Array[Mihari::Artifact]
|
8
8
|
attr_accessor Tags(): Array[Mihari::Tag]
|
9
9
|
|
10
|
-
def self.search: (Mihari::Structs::Alert::SearchFilterWithPagination filter) -> Array[Mihari::Alert]
|
10
|
+
def self.search: (Mihari::Structs::Filters::Alert::SearchFilterWithPagination filter) -> Array[Mihari::Alert]
|
11
11
|
|
12
|
-
def self.count: (Mihari::Structs::Alert::SearchFilter filter) -> Integer
|
12
|
+
def self.count: (Mihari::Structs::Filters::Alert::SearchFilter filter) -> Integer
|
13
13
|
|
14
14
|
private
|
15
15
|
|
16
|
-
def self.build_relation: (Mihari::Structs::Alert::SearchFilter filter) -> Mihari::Alert
|
16
|
+
def self.build_relation: (Mihari::Structs::Filters::Alert::SearchFilter filter) -> Mihari::Alert
|
17
17
|
end
|
18
18
|
end
|
@@ -10,8 +10,8 @@ module Mihari
|
|
10
10
|
|
11
11
|
def to_h: () -> Hash
|
12
12
|
|
13
|
-
def self.search: (Mihari::Structs::Rule::SearchFilterWithPagination filter) -> Array[Mihari::Rule]
|
13
|
+
def self.search: (Mihari::Structs::Filters::Rule::SearchFilterWithPagination filter) -> Array[Mihari::Rule]
|
14
14
|
|
15
|
-
def self.count: (Mihari::Structs::Rule::SearchFilter filter) -> Integer
|
15
|
+
def self.count: (Mihari::Structs::Filters::Rule::SearchFilter filter) -> Integer
|
16
16
|
end
|
17
17
|
end
|
@@ -0,0 +1,40 @@
|
|
1
|
+
module Mihari
|
2
|
+
module Structs
|
3
|
+
module Filters
|
4
|
+
module Alert
|
5
|
+
class SearchFilter < Dry::Struct
|
6
|
+
attr_reader artifact_data: String?
|
7
|
+
attr_reader description: String?
|
8
|
+
attr_reader source: String?
|
9
|
+
attr_reader tag_name: String?
|
10
|
+
attr_reader title: String?
|
11
|
+
attr_reader from_at: DateTime?
|
12
|
+
attr_reader to_at: DateTime?
|
13
|
+
attr_reader asn: Integer?
|
14
|
+
attr_reader dns_record: String?
|
15
|
+
attr_reader reverse_dns_name: String?
|
16
|
+
|
17
|
+
def valid_artifact_filters?: () -> bool
|
18
|
+
end
|
19
|
+
|
20
|
+
class SearchFilterWithPagination < SearchFilter
|
21
|
+
def without_pagination: () -> Mihari::Structs::Filters::Alert::SearchFilter
|
22
|
+
end
|
23
|
+
end
|
24
|
+
|
25
|
+
module Rule
|
26
|
+
class SearchFilter < Dry::Struct
|
27
|
+
attr_reader page: Integer?
|
28
|
+
attr_reader tag: String?
|
29
|
+
attr_reader source: String?
|
30
|
+
attr_reader from_at: DateTime?
|
31
|
+
attr_reader to_at: DateTime?
|
32
|
+
end
|
33
|
+
|
34
|
+
class SearchFilterWithPagination < SearchFilter
|
35
|
+
def without_pagination: () -> Mihari::Structs::Filters::Rule::SearchFilter
|
36
|
+
end
|
37
|
+
end
|
38
|
+
end
|
39
|
+
end
|
40
|
+
end
|
@@ -4,8 +4,8 @@ module Mihari
|
|
4
4
|
class Response
|
5
5
|
attr_reader ip: String
|
6
6
|
attr_reader hostname: String?
|
7
|
-
attr_reader loc: String
|
8
|
-
attr_reader country_code: String
|
7
|
+
attr_reader loc: String?
|
8
|
+
attr_reader country_code: String?
|
9
9
|
attr_reader asn: Integer?
|
10
10
|
|
11
11
|
def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::IPInfo::Response
|
@@ -1,64 +1,57 @@
|
|
1
1
|
module Mihari
|
2
2
|
module Structs
|
3
|
-
|
4
|
-
|
5
|
-
end
|
3
|
+
class Rule
|
4
|
+
attr_reader data: Hash
|
6
5
|
|
7
|
-
|
8
|
-
def without_pagination: () -> SearchFilter
|
9
|
-
end
|
6
|
+
attr_reader yaml: String
|
10
7
|
|
11
|
-
|
12
|
-
attr_reader data: Hash
|
8
|
+
attr_reader errors: Array[untypes]?
|
13
9
|
|
14
|
-
|
10
|
+
def initialize: (Hash data) -> void
|
15
11
|
|
16
|
-
|
12
|
+
#
|
13
|
+
# @return [Boolean]
|
14
|
+
#
|
15
|
+
def errors?: () -> (bool)
|
17
16
|
|
18
|
-
|
17
|
+
#
|
18
|
+
# @return [Array[String]]
|
19
|
+
#
|
20
|
+
def error_messages: () -> (Array[String])
|
19
21
|
|
20
|
-
|
21
|
-
# @return [Boolean]
|
22
|
-
#
|
23
|
-
def errors?: () -> (bool)
|
22
|
+
def validate: () -> void
|
24
23
|
|
25
|
-
|
26
|
-
# @return [Array[String]]
|
27
|
-
#
|
28
|
-
def error_messages: () -> (Array[String])
|
24
|
+
def validate!: () -> void
|
29
25
|
|
30
|
-
|
26
|
+
def []: (untyped key) -> untyped
|
31
27
|
|
32
|
-
|
28
|
+
#
|
29
|
+
# @return [String]
|
30
|
+
#
|
31
|
+
def id: () -> String
|
33
32
|
|
34
|
-
|
33
|
+
#
|
34
|
+
# @return [String]
|
35
|
+
#
|
36
|
+
def title: () -> String
|
35
37
|
|
36
|
-
|
37
|
-
|
38
|
-
|
39
|
-
|
38
|
+
#
|
39
|
+
# @return [String]
|
40
|
+
#
|
41
|
+
def description: () -> String
|
40
42
|
|
41
|
-
|
42
|
-
|
43
|
-
|
44
|
-
|
43
|
+
#
|
44
|
+
# @return [Mihari::Rule]
|
45
|
+
#
|
46
|
+
def to_model: () -> Mihari::Rule
|
45
47
|
|
46
|
-
|
47
|
-
# @return [String]
|
48
|
-
#
|
49
|
-
def description: () -> String
|
48
|
+
def to_analyzer: () -> Mihari::Analyzers::Rule
|
50
49
|
|
51
|
-
|
52
|
-
# @return [Mihari::Rule]
|
53
|
-
#
|
54
|
-
def to_model: () -> Mihari::Rule
|
50
|
+
def self.from_model: (Mihari::Rule model) -> Mihari::Structs::Rule
|
55
51
|
|
56
|
-
|
52
|
+
def self.from_yaml: (String yaml) -> Mihari::Structs::Rule
|
57
53
|
|
58
|
-
|
59
|
-
|
60
|
-
def self.from_yaml: (String yaml) -> Mihari::Structs::Rule::Rule
|
61
|
-
end
|
54
|
+
def self.from_path_or_id: (String path_or_id) -> Mihari::Structs::Rule
|
62
55
|
end
|
63
56
|
end
|
64
57
|
end
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: mihari
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 4.7.
|
4
|
+
version: 4.7.3
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Manabu Niseki
|
8
8
|
autorequire:
|
9
9
|
bindir: exe
|
10
10
|
cert_chain: []
|
11
|
-
date: 2022-
|
11
|
+
date: 2022-07-18 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: bundler
|
@@ -44,14 +44,14 @@ dependencies:
|
|
44
44
|
requirements:
|
45
45
|
- - "~>"
|
46
46
|
- !ruby/object:Gem::Version
|
47
|
-
version: '1.
|
47
|
+
version: '1.8'
|
48
48
|
type: :development
|
49
49
|
prerelease: false
|
50
50
|
version_requirements: !ruby/object:Gem::Requirement
|
51
51
|
requirements:
|
52
52
|
- - "~>"
|
53
53
|
- !ruby/object:Gem::Version
|
54
|
-
version: '1.
|
54
|
+
version: '1.8'
|
55
55
|
- !ruby/object:Gem::Dependency
|
56
56
|
name: mysql2
|
57
57
|
requirement: !ruby/object:Gem::Requirement
|
@@ -86,28 +86,28 @@ dependencies:
|
|
86
86
|
requirements:
|
87
87
|
- - "~>"
|
88
88
|
- !ruby/object:Gem::Version
|
89
|
-
version: '1.
|
89
|
+
version: '1.4'
|
90
90
|
type: :development
|
91
91
|
prerelease: false
|
92
92
|
version_requirements: !ruby/object:Gem::Requirement
|
93
93
|
requirements:
|
94
94
|
- - "~>"
|
95
95
|
- !ruby/object:Gem::Version
|
96
|
-
version: '1.
|
96
|
+
version: '1.4'
|
97
97
|
- !ruby/object:Gem::Dependency
|
98
98
|
name: rack-test
|
99
99
|
requirement: !ruby/object:Gem::Requirement
|
100
100
|
requirements:
|
101
101
|
- - "~>"
|
102
102
|
- !ruby/object:Gem::Version
|
103
|
-
version: '
|
103
|
+
version: '2.0'
|
104
104
|
type: :development
|
105
105
|
prerelease: false
|
106
106
|
version_requirements: !ruby/object:Gem::Requirement
|
107
107
|
requirements:
|
108
108
|
- - "~>"
|
109
109
|
- !ruby/object:Gem::Version
|
110
|
-
version: '
|
110
|
+
version: '2.0'
|
111
111
|
- !ruby/object:Gem::Dependency
|
112
112
|
name: rake
|
113
113
|
requirement: !ruby/object:Gem::Requirement
|
@@ -254,14 +254,14 @@ dependencies:
|
|
254
254
|
requirements:
|
255
255
|
- - '='
|
256
256
|
- !ruby/object:Gem::Version
|
257
|
-
version: 7.0.3
|
257
|
+
version: 7.0.3.1
|
258
258
|
type: :runtime
|
259
259
|
prerelease: false
|
260
260
|
version_requirements: !ruby/object:Gem::Requirement
|
261
261
|
requirements:
|
262
262
|
- - '='
|
263
263
|
- !ruby/object:Gem::Version
|
264
|
-
version: 7.0.3
|
264
|
+
version: 7.0.3.1
|
265
265
|
- !ruby/object:Gem::Dependency
|
266
266
|
name: addressable
|
267
267
|
requirement: !ruby/object:Gem::Requirement
|
@@ -394,28 +394,28 @@ dependencies:
|
|
394
394
|
requirements:
|
395
395
|
- - '='
|
396
396
|
- !ruby/object:Gem::Version
|
397
|
-
version: 0.
|
397
|
+
version: 0.10.0
|
398
398
|
type: :runtime
|
399
399
|
prerelease: false
|
400
400
|
version_requirements: !ruby/object:Gem::Requirement
|
401
401
|
requirements:
|
402
402
|
- - '='
|
403
403
|
- !ruby/object:Gem::Version
|
404
|
-
version: 0.
|
404
|
+
version: 0.10.0
|
405
405
|
- !ruby/object:Gem::Dependency
|
406
406
|
name: dry-files
|
407
407
|
requirement: !ruby/object:Gem::Requirement
|
408
408
|
requirements:
|
409
409
|
- - '='
|
410
410
|
- !ruby/object:Gem::Version
|
411
|
-
version: 0.
|
411
|
+
version: 0.2.0
|
412
412
|
type: :runtime
|
413
413
|
prerelease: false
|
414
414
|
version_requirements: !ruby/object:Gem::Requirement
|
415
415
|
requirements:
|
416
416
|
- - '='
|
417
417
|
- !ruby/object:Gem::Version
|
418
|
-
version: 0.
|
418
|
+
version: 0.2.0
|
419
419
|
- !ruby/object:Gem::Dependency
|
420
420
|
name: dry-initializer
|
421
421
|
requirement: !ruby/object:Gem::Requirement
|
@@ -436,14 +436,14 @@ dependencies:
|
|
436
436
|
requirements:
|
437
437
|
- - '='
|
438
438
|
- !ruby/object:Gem::Version
|
439
|
-
version: 1.9.
|
439
|
+
version: 1.9.3
|
440
440
|
type: :runtime
|
441
441
|
prerelease: false
|
442
442
|
version_requirements: !ruby/object:Gem::Requirement
|
443
443
|
requirements:
|
444
444
|
- - '='
|
445
445
|
- !ruby/object:Gem::Version
|
446
|
-
version: 1.9.
|
446
|
+
version: 1.9.3
|
447
447
|
- !ruby/object:Gem::Dependency
|
448
448
|
name: dry-struct
|
449
449
|
requirement: !ruby/object:Gem::Requirement
|
@@ -478,14 +478,14 @@ dependencies:
|
|
478
478
|
requirements:
|
479
479
|
- - '='
|
480
480
|
- !ruby/object:Gem::Version
|
481
|
-
version: 0.2.
|
481
|
+
version: 0.2.4
|
482
482
|
type: :runtime
|
483
483
|
prerelease: false
|
484
484
|
version_requirements: !ruby/object:Gem::Requirement
|
485
485
|
requirements:
|
486
486
|
- - '='
|
487
487
|
- !ruby/object:Gem::Version
|
488
|
-
version: 0.2.
|
488
|
+
version: 0.2.4
|
489
489
|
- !ruby/object:Gem::Dependency
|
490
490
|
name: grape
|
491
491
|
requirement: !ruby/object:Gem::Requirement
|
@@ -682,20 +682,6 @@ dependencies:
|
|
682
682
|
- - '='
|
683
683
|
- !ruby/object:Gem::Version
|
684
684
|
version: 2.0.0
|
685
|
-
- !ruby/object:Gem::Dependency
|
686
|
-
name: otx_ruby
|
687
|
-
requirement: !ruby/object:Gem::Requirement
|
688
|
-
requirements:
|
689
|
-
- - '='
|
690
|
-
- !ruby/object:Gem::Version
|
691
|
-
version: 0.9.9
|
692
|
-
type: :runtime
|
693
|
-
prerelease: false
|
694
|
-
version_requirements: !ruby/object:Gem::Requirement
|
695
|
-
requirements:
|
696
|
-
- - '='
|
697
|
-
- !ruby/object:Gem::Version
|
698
|
-
version: 0.9.9
|
699
685
|
- !ruby/object:Gem::Dependency
|
700
686
|
name: parallel
|
701
687
|
requirement: !ruby/object:Gem::Requirement
|
@@ -800,14 +786,14 @@ dependencies:
|
|
800
786
|
requirements:
|
801
787
|
- - '='
|
802
788
|
- !ruby/object:Gem::Version
|
803
|
-
version: 2.2.
|
789
|
+
version: 2.2.4
|
804
790
|
type: :runtime
|
805
791
|
prerelease: false
|
806
792
|
version_requirements: !ruby/object:Gem::Requirement
|
807
793
|
requirements:
|
808
794
|
- - '='
|
809
795
|
- !ruby/object:Gem::Version
|
810
|
-
version: 2.2.
|
796
|
+
version: 2.2.4
|
811
797
|
- !ruby/object:Gem::Dependency
|
812
798
|
name: rack-contrib
|
813
799
|
requirement: !ruby/object:Gem::Requirement
|
@@ -926,14 +912,14 @@ dependencies:
|
|
926
912
|
requirements:
|
927
913
|
- - '='
|
928
914
|
- !ruby/object:Gem::Version
|
929
|
-
version: 1.4.
|
915
|
+
version: 1.4.4
|
930
916
|
type: :runtime
|
931
917
|
prerelease: false
|
932
918
|
version_requirements: !ruby/object:Gem::Requirement
|
933
919
|
requirements:
|
934
920
|
- - '='
|
935
921
|
- !ruby/object:Gem::Version
|
936
|
-
version: 1.4.
|
922
|
+
version: 1.4.4
|
937
923
|
- !ruby/object:Gem::Dependency
|
938
924
|
name: thor
|
939
925
|
requirement: !ruby/object:Gem::Requirement
|
@@ -1074,6 +1060,7 @@ files:
|
|
1074
1060
|
- lib/mihari/analyzers/binaryedge.rb
|
1075
1061
|
- lib/mihari/analyzers/censys.rb
|
1076
1062
|
- lib/mihari/analyzers/circl.rb
|
1063
|
+
- lib/mihari/analyzers/clients/otx.rb
|
1077
1064
|
- lib/mihari/analyzers/crtsh.rb
|
1078
1065
|
- lib/mihari/analyzers/dnpedia.rb
|
1079
1066
|
- lib/mihari/analyzers/dnstwister.rb
|
@@ -1140,7 +1127,6 @@ files:
|
|
1140
1127
|
- lib/mihari/mixins/error_notification.rb
|
1141
1128
|
- lib/mihari/mixins/refang.rb
|
1142
1129
|
- lib/mihari/mixins/retriable.rb
|
1143
|
-
- lib/mihari/mixins/rule.rb
|
1144
1130
|
- lib/mihari/models/alert.rb
|
1145
1131
|
- lib/mihari/models/artifact.rb
|
1146
1132
|
- lib/mihari/models/autonomous_system.rb
|
@@ -1159,8 +1145,8 @@ files:
|
|
1159
1145
|
- lib/mihari/schemas/macros.rb
|
1160
1146
|
- lib/mihari/schemas/rule.rb
|
1161
1147
|
- lib/mihari/status.rb
|
1162
|
-
- lib/mihari/structs/alert.rb
|
1163
1148
|
- lib/mihari/structs/censys.rb
|
1149
|
+
- lib/mihari/structs/filters.rb
|
1164
1150
|
- lib/mihari/structs/google_public_dns.rb
|
1165
1151
|
- lib/mihari/structs/greynoise.rb
|
1166
1152
|
- lib/mihari/structs/ipinfo.rb
|
@@ -1187,7 +1173,7 @@ files:
|
|
1187
1173
|
- lib/mihari/web/public/index.html
|
1188
1174
|
- lib/mihari/web/public/redoc-static.html
|
1189
1175
|
- lib/mihari/web/public/static/css/app.2a5d3d21.css
|
1190
|
-
- lib/mihari/web/public/static/css/chunk-vendors.
|
1176
|
+
- lib/mihari/web/public/static/css/chunk-vendors.5013d549.css
|
1191
1177
|
- lib/mihari/web/public/static/favicon.ico
|
1192
1178
|
- lib/mihari/web/public/static/fonts/fa-brands-400.7fa789ab.ttf
|
1193
1179
|
- lib/mihari/web/public/static/fonts/fa-brands-400.859fc388.woff2
|
@@ -1196,14 +1182,10 @@ files:
|
|
1196
1182
|
- lib/mihari/web/public/static/fonts/fa-solid-900.3a463ec3.ttf
|
1197
1183
|
- lib/mihari/web/public/static/fonts/fa-solid-900.40ddefd7.woff2
|
1198
1184
|
- lib/mihari/web/public/static/fonts/fa-v4compatibility.924588dc.ttf
|
1199
|
-
- lib/mihari/web/public/static/js/app
|
1200
|
-
- lib/mihari/web/public/static/js/app
|
1201
|
-
- lib/mihari/web/public/static/js/
|
1202
|
-
- lib/mihari/web/public/static/js/
|
1203
|
-
- lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js
|
1204
|
-
- lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js.map
|
1205
|
-
- lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js
|
1206
|
-
- lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js.map
|
1185
|
+
- lib/mihari/web/public/static/js/app.524d9ed2.js
|
1186
|
+
- lib/mihari/web/public/static/js/app.524d9ed2.js.map
|
1187
|
+
- lib/mihari/web/public/static/js/chunk-vendors.64580a1f.js
|
1188
|
+
- lib/mihari/web/public/static/js/chunk-vendors.64580a1f.js.map
|
1207
1189
|
- mihari.gemspec
|
1208
1190
|
- renovate.json
|
1209
1191
|
- sig/lib/mihari.rbs
|
@@ -1261,7 +1243,6 @@ files:
|
|
1261
1243
|
- sig/lib/mihari/mixins/hash.rbs
|
1262
1244
|
- sig/lib/mihari/mixins/refang.rbs
|
1263
1245
|
- sig/lib/mihari/mixins/retriable.rbs
|
1264
|
-
- sig/lib/mihari/mixins/rule.rbs
|
1265
1246
|
- sig/lib/mihari/models/alert.rbs
|
1266
1247
|
- sig/lib/mihari/models/artifact.rbs
|
1267
1248
|
- sig/lib/mihari/models/autonomous_system.rbs
|
@@ -1275,8 +1256,8 @@ files:
|
|
1275
1256
|
- sig/lib/mihari/models/tagging.rbs
|
1276
1257
|
- sig/lib/mihari/models/whois.rbs
|
1277
1258
|
- sig/lib/mihari/status.rbs
|
1278
|
-
- sig/lib/mihari/structs/alert.rbs
|
1279
1259
|
- sig/lib/mihari/structs/censys.rbs
|
1260
|
+
- sig/lib/mihari/structs/filters.rbs
|
1280
1261
|
- sig/lib/mihari/structs/google_public_dns.rbs
|
1281
1262
|
- sig/lib/mihari/structs/greynoise.rbs
|
1282
1263
|
- sig/lib/mihari/structs/ipinfo.rbs
|
data/lib/mihari/mixins/rule.rb
DELETED
@@ -1,84 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
require "date"
|
4
|
-
require "erb"
|
5
|
-
require "pathname"
|
6
|
-
|
7
|
-
module Mihari
|
8
|
-
module Mixins
|
9
|
-
module Rule
|
10
|
-
include Mixins::Database
|
11
|
-
|
12
|
-
def load_erb_yaml(yaml)
|
13
|
-
YAML.safe_load(ERB.new(yaml).result, permitted_classes: [Date], symbolize_names: true)
|
14
|
-
end
|
15
|
-
|
16
|
-
#
|
17
|
-
# Load rule into hash
|
18
|
-
#
|
19
|
-
# @param [String] path_or_id Path to YAML file or YAML string or ID of a rule in the database
|
20
|
-
#
|
21
|
-
# @return [Mihari::Structs::Rule::Rule]
|
22
|
-
#
|
23
|
-
def load_rule(path_or_id)
|
24
|
-
yaml = nil
|
25
|
-
|
26
|
-
yaml = load_yaml_from_file(path_or_id) if File.exist?(path_or_id)
|
27
|
-
yaml = load_yaml_from_db(path_or_id) if yaml.nil?
|
28
|
-
|
29
|
-
Structs::Rule::Rule.from_yaml yaml
|
30
|
-
end
|
31
|
-
|
32
|
-
def load_yaml_from_file(path)
|
33
|
-
return nil unless Pathname(path).exist?
|
34
|
-
|
35
|
-
File.read path
|
36
|
-
end
|
37
|
-
|
38
|
-
def load_yaml_from_db(id)
|
39
|
-
with_db_connection do
|
40
|
-
rule = Mihari::Rule.find(id)
|
41
|
-
rule.yaml || rule.symbolized_data.to_yaml
|
42
|
-
rescue ActiveRecord::RecordNotFound
|
43
|
-
raise ArgumentError, "ID:#{id} is not found in the database"
|
44
|
-
end
|
45
|
-
end
|
46
|
-
|
47
|
-
#
|
48
|
-
# Validate a rule
|
49
|
-
#
|
50
|
-
# @param [Mihari::Structs::Rule::Rule] rule
|
51
|
-
#
|
52
|
-
def validate_rule!(rule)
|
53
|
-
rule.validate!
|
54
|
-
rescue RuleValidationError => e
|
55
|
-
Mihari.logger.error "Failed to parse the input as a rule"
|
56
|
-
raise e
|
57
|
-
end
|
58
|
-
|
59
|
-
#
|
60
|
-
# Returns a template for rule
|
61
|
-
#
|
62
|
-
# @return [String] A template for rule
|
63
|
-
#
|
64
|
-
def rule_template
|
65
|
-
yaml = File.read(File.expand_path("../templates/rule.yml.erb", __dir__))
|
66
|
-
Structs::Rule::Rule.from_yaml yaml
|
67
|
-
yaml
|
68
|
-
end
|
69
|
-
|
70
|
-
#
|
71
|
-
# Create (blank) rule file
|
72
|
-
#
|
73
|
-
# @param [String] filename
|
74
|
-
# @param [Dry::Files] files
|
75
|
-
# @param [String] template
|
76
|
-
#
|
77
|
-
# @return [nil]
|
78
|
-
#
|
79
|
-
def initialize_rule_yaml(filename, files = Dry::Files.new, template: rule_template)
|
80
|
-
files.write(filename, template)
|
81
|
-
end
|
82
|
-
end
|
83
|
-
end
|
84
|
-
end
|
data/lib/mihari/structs/alert.rb
DELETED
@@ -1,44 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
module Mihari
|
4
|
-
module Structs
|
5
|
-
module Alert
|
6
|
-
class SearchFilter < Dry::Struct
|
7
|
-
attribute? :artifact_data, Types::String.optional
|
8
|
-
attribute? :description, Types::String.optional
|
9
|
-
attribute? :source, Types::String.optional
|
10
|
-
attribute? :tag_name, Types::String.optional
|
11
|
-
attribute? :title, Types::String.optional
|
12
|
-
attribute? :from_at, Types::DateTime.optional
|
13
|
-
attribute? :to_at, Types::DateTime.optional
|
14
|
-
attribute? :asn, Types::Int.optional
|
15
|
-
attribute? :dns_record, Types::String.optional
|
16
|
-
attribute? :reverse_dns_name, Types::String.optional
|
17
|
-
|
18
|
-
def valid_artifact_filters?
|
19
|
-
!(artifact_data || asn || dns_record || reverse_dns_name).nil?
|
20
|
-
end
|
21
|
-
end
|
22
|
-
|
23
|
-
class SearchFilterWithPagination < SearchFilter
|
24
|
-
attribute? :page, Types::Int.default(1)
|
25
|
-
attribute? :limit, Types::Int.default(10)
|
26
|
-
|
27
|
-
def without_pagination
|
28
|
-
SearchFilter.new(
|
29
|
-
artifact_data: artifact_data,
|
30
|
-
description: description,
|
31
|
-
from_at: from_at,
|
32
|
-
source: source,
|
33
|
-
tag_name: tag_name,
|
34
|
-
title: title,
|
35
|
-
to_at: to_at,
|
36
|
-
asn: asn,
|
37
|
-
dns_record: dns_record,
|
38
|
-
reverse_dns_name: reverse_dns_name
|
39
|
-
)
|
40
|
-
end
|
41
|
-
end
|
42
|
-
end
|
43
|
-
end
|
44
|
-
end
|