mihari 4.7.1 → 4.7.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/lib/mihari/analyzers/rule.rb +0 -1
- data/lib/mihari/commands/init.rb +25 -2
- data/lib/mihari/commands/search.rb +2 -7
- data/lib/mihari/commands/validator.rb +10 -5
- data/lib/mihari/errors.rb +2 -0
- data/lib/mihari/models/alert.rb +6 -1
- data/lib/mihari/models/geolocation.rb +2 -4
- data/lib/mihari/models/port.rb +1 -1
- data/lib/mihari/models/rule.rb +7 -2
- data/lib/mihari/structs/filters.rb +71 -0
- data/lib/mihari/structs/ipinfo.rb +4 -4
- data/lib/mihari/structs/rule.rb +188 -144
- data/lib/mihari/version.rb +1 -1
- data/lib/mihari/web/endpoints/alerts.rb +1 -1
- data/lib/mihari/web/endpoints/rules.rb +13 -4
- data/lib/mihari/web/public/index.html +1 -1
- data/lib/mihari/web/public/redoc-static.html +796 -763
- data/lib/mihari/web/public/static/css/chunk-vendors.5013d549.css +7 -0
- data/lib/mihari/web/public/static/js/app.3ac3bd7a.js +2 -0
- data/lib/mihari/web/public/static/js/app.3ac3bd7a.js.map +1 -0
- data/lib/mihari/web/public/static/js/{chunk-vendors.dde2116c.js → chunk-vendors.37b7208e.js} +6 -6
- data/lib/mihari/web/public/static/js/chunk-vendors.37b7208e.js.map +1 -0
- data/lib/mihari.rb +1 -2
- data/mihari.gemspec +4 -4
- data/sig/lib/mihari/cli/base.rbs +0 -2
- data/sig/lib/mihari/models/alert.rbs +3 -3
- data/sig/lib/mihari/models/rule.rbs +2 -2
- data/sig/lib/mihari/structs/filters.rbs +40 -0
- data/sig/lib/mihari/structs/ipinfo.rbs +2 -2
- data/sig/lib/mihari/structs/rule.rbs +36 -43
- metadata +17 -23
- data/lib/mihari/mixins/rule.rb +0 -84
- data/lib/mihari/structs/alert.rb +0 -44
- data/lib/mihari/web/public/static/css/chunk-vendors.06251949.css +0 -7
- data/lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js +0 -2
- data/lib/mihari/web/public/static/js/app-legacy.9d5c9c3d.js.map +0 -1
- data/lib/mihari/web/public/static/js/app.823b5af7.js +0 -2
- data/lib/mihari/web/public/static/js/app.823b5af7.js.map +0 -1
- data/lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js +0 -25
- data/lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js.map +0 -1
- data/lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js.map +0 -1
- data/sig/lib/mihari/mixins/rule.rbs +0 -36
- data/sig/lib/mihari/structs/alert.rbs +0 -27
data/lib/mihari.rb
CHANGED
|
@@ -59,7 +59,6 @@ require "mihari/mixins/disallowed_data_value"
|
|
|
59
59
|
require "mihari/mixins/error_notification"
|
|
60
60
|
require "mihari/mixins/refang"
|
|
61
61
|
require "mihari/mixins/retriable"
|
|
62
|
-
require "mihari/mixins/rule"
|
|
63
62
|
|
|
64
63
|
def truthy?(value)
|
|
65
64
|
return true if value == "true"
|
|
@@ -171,8 +170,8 @@ require "mihari/constants"
|
|
|
171
170
|
require "mihari/types"
|
|
172
171
|
|
|
173
172
|
# Structs
|
|
174
|
-
require "mihari/structs/alert"
|
|
175
173
|
require "mihari/structs/censys"
|
|
174
|
+
require "mihari/structs/filters"
|
|
176
175
|
require "mihari/structs/google_public_dns"
|
|
177
176
|
require "mihari/structs/greynoise"
|
|
178
177
|
require "mihari/structs/ipinfo"
|
data/mihari.gemspec
CHANGED
|
@@ -29,11 +29,11 @@ Gem::Specification.new do |spec|
|
|
|
29
29
|
|
|
30
30
|
spec.add_development_dependency "bundler", "~> 2.3"
|
|
31
31
|
spec.add_development_dependency "coveralls_reborn", "~> 0.24"
|
|
32
|
-
spec.add_development_dependency "fakefs", "~> 1.
|
|
32
|
+
spec.add_development_dependency "fakefs", "~> 1.8"
|
|
33
33
|
spec.add_development_dependency "mysql2", "~> 0.5"
|
|
34
34
|
spec.add_development_dependency "overcommit", "~> 0.59"
|
|
35
|
-
spec.add_development_dependency "pg", "~> 1.
|
|
36
|
-
spec.add_development_dependency "rack-test", "~>
|
|
35
|
+
spec.add_development_dependency "pg", "~> 1.4"
|
|
36
|
+
spec.add_development_dependency "rack-test", "~> 2.0"
|
|
37
37
|
spec.add_development_dependency "rake", "~> 13.0"
|
|
38
38
|
spec.add_development_dependency "rb-fsevent", "~> 0.11"
|
|
39
39
|
spec.add_development_dependency "rerun", "~> 0.13"
|
|
@@ -58,7 +58,7 @@ Gem::Specification.new do |spec|
|
|
|
58
58
|
spec.add_dependency "dry-container", "0.9.0"
|
|
59
59
|
spec.add_dependency "dry-files", "0.1.0"
|
|
60
60
|
spec.add_dependency "dry-initializer", "3.1.1"
|
|
61
|
-
spec.add_dependency "dry-schema", "1.9.
|
|
61
|
+
spec.add_dependency "dry-schema", "1.9.3"
|
|
62
62
|
spec.add_dependency "dry-struct", "1.4.0"
|
|
63
63
|
spec.add_dependency "dry-validation", "1.8.1"
|
|
64
64
|
spec.add_dependency "email_address", "0.2.3"
|
data/sig/lib/mihari/cli/base.rbs
CHANGED
|
@@ -7,12 +7,12 @@ module Mihari
|
|
|
7
7
|
attr_accessor artifacts(): Array[Mihari::Artifact]
|
|
8
8
|
attr_accessor Tags(): Array[Mihari::Tag]
|
|
9
9
|
|
|
10
|
-
def self.search: (Mihari::Structs::Alert::SearchFilterWithPagination filter) -> Array[Mihari::Alert]
|
|
10
|
+
def self.search: (Mihari::Structs::Filters::Alert::SearchFilterWithPagination filter) -> Array[Mihari::Alert]
|
|
11
11
|
|
|
12
|
-
def self.count: (Mihari::Structs::Alert::SearchFilter filter) -> Integer
|
|
12
|
+
def self.count: (Mihari::Structs::Filters::Alert::SearchFilter filter) -> Integer
|
|
13
13
|
|
|
14
14
|
private
|
|
15
15
|
|
|
16
|
-
def self.build_relation: (Mihari::Structs::Alert::SearchFilter filter) -> Mihari::Alert
|
|
16
|
+
def self.build_relation: (Mihari::Structs::Filters::Alert::SearchFilter filter) -> Mihari::Alert
|
|
17
17
|
end
|
|
18
18
|
end
|
|
@@ -10,8 +10,8 @@ module Mihari
|
|
|
10
10
|
|
|
11
11
|
def to_h: () -> Hash
|
|
12
12
|
|
|
13
|
-
def self.search: (Mihari::Structs::Rule::SearchFilterWithPagination filter) -> Array[Mihari::Rule]
|
|
13
|
+
def self.search: (Mihari::Structs::Filters::Rule::SearchFilterWithPagination filter) -> Array[Mihari::Rule]
|
|
14
14
|
|
|
15
|
-
def self.count: (Mihari::Structs::Rule::SearchFilter filter) -> Integer
|
|
15
|
+
def self.count: (Mihari::Structs::Filters::Rule::SearchFilter filter) -> Integer
|
|
16
16
|
end
|
|
17
17
|
end
|
|
@@ -0,0 +1,40 @@
|
|
|
1
|
+
module Mihari
|
|
2
|
+
module Structs
|
|
3
|
+
module Filters
|
|
4
|
+
module Alert
|
|
5
|
+
class SearchFilter < Dry::Struct
|
|
6
|
+
attr_reader artifact_data: String?
|
|
7
|
+
attr_reader description: String?
|
|
8
|
+
attr_reader source: String?
|
|
9
|
+
attr_reader tag_name: String?
|
|
10
|
+
attr_reader title: String?
|
|
11
|
+
attr_reader from_at: DateTime?
|
|
12
|
+
attr_reader to_at: DateTime?
|
|
13
|
+
attr_reader asn: Integer?
|
|
14
|
+
attr_reader dns_record: String?
|
|
15
|
+
attr_reader reverse_dns_name: String?
|
|
16
|
+
|
|
17
|
+
def valid_artifact_filters?: () -> bool
|
|
18
|
+
end
|
|
19
|
+
|
|
20
|
+
class SearchFilterWithPagination < SearchFilter
|
|
21
|
+
def without_pagination: () -> Mihari::Structs::Filters::Alert::SearchFilter
|
|
22
|
+
end
|
|
23
|
+
end
|
|
24
|
+
|
|
25
|
+
module Rule
|
|
26
|
+
class SearchFilter < Dry::Struct
|
|
27
|
+
attr_reader page: Integer?
|
|
28
|
+
attr_reader tag: String?
|
|
29
|
+
attr_reader source: String?
|
|
30
|
+
attr_reader from_at: DateTime?
|
|
31
|
+
attr_reader to_at: DateTime?
|
|
32
|
+
end
|
|
33
|
+
|
|
34
|
+
class SearchFilterWithPagination < SearchFilter
|
|
35
|
+
def without_pagination: () -> Mihari::Structs::Filters::Rule::SearchFilter
|
|
36
|
+
end
|
|
37
|
+
end
|
|
38
|
+
end
|
|
39
|
+
end
|
|
40
|
+
end
|
|
@@ -4,8 +4,8 @@ module Mihari
|
|
|
4
4
|
class Response
|
|
5
5
|
attr_reader ip: String
|
|
6
6
|
attr_reader hostname: String?
|
|
7
|
-
attr_reader loc: String
|
|
8
|
-
attr_reader country_code: String
|
|
7
|
+
attr_reader loc: String?
|
|
8
|
+
attr_reader country_code: String?
|
|
9
9
|
attr_reader asn: Integer?
|
|
10
10
|
|
|
11
11
|
def self.from_dynamic!: (Hash[(String | Symbol), untyped] d) -> Mihari::Structs::IPInfo::Response
|
|
@@ -1,64 +1,57 @@
|
|
|
1
1
|
module Mihari
|
|
2
2
|
module Structs
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
end
|
|
3
|
+
class Rule
|
|
4
|
+
attr_reader data: Hash
|
|
6
5
|
|
|
7
|
-
|
|
8
|
-
def without_pagination: () -> SearchFilter
|
|
9
|
-
end
|
|
6
|
+
attr_reader yaml: String
|
|
10
7
|
|
|
11
|
-
|
|
12
|
-
attr_reader data: Hash
|
|
8
|
+
attr_reader errors: Array[untypes]?
|
|
13
9
|
|
|
14
|
-
|
|
10
|
+
def initialize: (Hash data) -> void
|
|
15
11
|
|
|
16
|
-
|
|
12
|
+
#
|
|
13
|
+
# @return [Boolean]
|
|
14
|
+
#
|
|
15
|
+
def errors?: () -> (bool)
|
|
17
16
|
|
|
18
|
-
|
|
17
|
+
#
|
|
18
|
+
# @return [Array[String]]
|
|
19
|
+
#
|
|
20
|
+
def error_messages: () -> (Array[String])
|
|
19
21
|
|
|
20
|
-
|
|
21
|
-
# @return [Boolean]
|
|
22
|
-
#
|
|
23
|
-
def errors?: () -> (bool)
|
|
22
|
+
def validate: () -> void
|
|
24
23
|
|
|
25
|
-
|
|
26
|
-
# @return [Array[String]]
|
|
27
|
-
#
|
|
28
|
-
def error_messages: () -> (Array[String])
|
|
24
|
+
def validate!: () -> void
|
|
29
25
|
|
|
30
|
-
|
|
26
|
+
def []: (untyped key) -> untyped
|
|
31
27
|
|
|
32
|
-
|
|
28
|
+
#
|
|
29
|
+
# @return [String]
|
|
30
|
+
#
|
|
31
|
+
def id: () -> String
|
|
33
32
|
|
|
34
|
-
|
|
33
|
+
#
|
|
34
|
+
# @return [String]
|
|
35
|
+
#
|
|
36
|
+
def title: () -> String
|
|
35
37
|
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
38
|
+
#
|
|
39
|
+
# @return [String]
|
|
40
|
+
#
|
|
41
|
+
def description: () -> String
|
|
40
42
|
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
43
|
+
#
|
|
44
|
+
# @return [Mihari::Rule]
|
|
45
|
+
#
|
|
46
|
+
def to_model: () -> Mihari::Rule
|
|
45
47
|
|
|
46
|
-
|
|
47
|
-
# @return [String]
|
|
48
|
-
#
|
|
49
|
-
def description: () -> String
|
|
48
|
+
def to_analyzer: () -> Mihari::Analyzers::Rule
|
|
50
49
|
|
|
51
|
-
|
|
52
|
-
# @return [Mihari::Rule]
|
|
53
|
-
#
|
|
54
|
-
def to_model: () -> Mihari::Rule
|
|
50
|
+
def self.from_model: (Mihari::Rule model) -> Mihari::Structs::Rule
|
|
55
51
|
|
|
56
|
-
|
|
52
|
+
def self.from_yaml: (String yaml) -> Mihari::Structs::Rule
|
|
57
53
|
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
def self.from_yaml: (String yaml) -> Mihari::Structs::Rule::Rule
|
|
61
|
-
end
|
|
54
|
+
def self.from_path_or_id: (String path_or_id) -> Mihari::Structs::Rule
|
|
62
55
|
end
|
|
63
56
|
end
|
|
64
57
|
end
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: mihari
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 4.7.
|
|
4
|
+
version: 4.7.2
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Manabu Niseki
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2022-06-
|
|
11
|
+
date: 2022-06-26 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: bundler
|
|
@@ -44,14 +44,14 @@ dependencies:
|
|
|
44
44
|
requirements:
|
|
45
45
|
- - "~>"
|
|
46
46
|
- !ruby/object:Gem::Version
|
|
47
|
-
version: '1.
|
|
47
|
+
version: '1.8'
|
|
48
48
|
type: :development
|
|
49
49
|
prerelease: false
|
|
50
50
|
version_requirements: !ruby/object:Gem::Requirement
|
|
51
51
|
requirements:
|
|
52
52
|
- - "~>"
|
|
53
53
|
- !ruby/object:Gem::Version
|
|
54
|
-
version: '1.
|
|
54
|
+
version: '1.8'
|
|
55
55
|
- !ruby/object:Gem::Dependency
|
|
56
56
|
name: mysql2
|
|
57
57
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -86,28 +86,28 @@ dependencies:
|
|
|
86
86
|
requirements:
|
|
87
87
|
- - "~>"
|
|
88
88
|
- !ruby/object:Gem::Version
|
|
89
|
-
version: '1.
|
|
89
|
+
version: '1.4'
|
|
90
90
|
type: :development
|
|
91
91
|
prerelease: false
|
|
92
92
|
version_requirements: !ruby/object:Gem::Requirement
|
|
93
93
|
requirements:
|
|
94
94
|
- - "~>"
|
|
95
95
|
- !ruby/object:Gem::Version
|
|
96
|
-
version: '1.
|
|
96
|
+
version: '1.4'
|
|
97
97
|
- !ruby/object:Gem::Dependency
|
|
98
98
|
name: rack-test
|
|
99
99
|
requirement: !ruby/object:Gem::Requirement
|
|
100
100
|
requirements:
|
|
101
101
|
- - "~>"
|
|
102
102
|
- !ruby/object:Gem::Version
|
|
103
|
-
version: '
|
|
103
|
+
version: '2.0'
|
|
104
104
|
type: :development
|
|
105
105
|
prerelease: false
|
|
106
106
|
version_requirements: !ruby/object:Gem::Requirement
|
|
107
107
|
requirements:
|
|
108
108
|
- - "~>"
|
|
109
109
|
- !ruby/object:Gem::Version
|
|
110
|
-
version: '
|
|
110
|
+
version: '2.0'
|
|
111
111
|
- !ruby/object:Gem::Dependency
|
|
112
112
|
name: rake
|
|
113
113
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -436,14 +436,14 @@ dependencies:
|
|
|
436
436
|
requirements:
|
|
437
437
|
- - '='
|
|
438
438
|
- !ruby/object:Gem::Version
|
|
439
|
-
version: 1.9.
|
|
439
|
+
version: 1.9.3
|
|
440
440
|
type: :runtime
|
|
441
441
|
prerelease: false
|
|
442
442
|
version_requirements: !ruby/object:Gem::Requirement
|
|
443
443
|
requirements:
|
|
444
444
|
- - '='
|
|
445
445
|
- !ruby/object:Gem::Version
|
|
446
|
-
version: 1.9.
|
|
446
|
+
version: 1.9.3
|
|
447
447
|
- !ruby/object:Gem::Dependency
|
|
448
448
|
name: dry-struct
|
|
449
449
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -1127,7 +1127,6 @@ files:
|
|
|
1127
1127
|
- lib/mihari/mixins/error_notification.rb
|
|
1128
1128
|
- lib/mihari/mixins/refang.rb
|
|
1129
1129
|
- lib/mihari/mixins/retriable.rb
|
|
1130
|
-
- lib/mihari/mixins/rule.rb
|
|
1131
1130
|
- lib/mihari/models/alert.rb
|
|
1132
1131
|
- lib/mihari/models/artifact.rb
|
|
1133
1132
|
- lib/mihari/models/autonomous_system.rb
|
|
@@ -1146,8 +1145,8 @@ files:
|
|
|
1146
1145
|
- lib/mihari/schemas/macros.rb
|
|
1147
1146
|
- lib/mihari/schemas/rule.rb
|
|
1148
1147
|
- lib/mihari/status.rb
|
|
1149
|
-
- lib/mihari/structs/alert.rb
|
|
1150
1148
|
- lib/mihari/structs/censys.rb
|
|
1149
|
+
- lib/mihari/structs/filters.rb
|
|
1151
1150
|
- lib/mihari/structs/google_public_dns.rb
|
|
1152
1151
|
- lib/mihari/structs/greynoise.rb
|
|
1153
1152
|
- lib/mihari/structs/ipinfo.rb
|
|
@@ -1174,7 +1173,7 @@ files:
|
|
|
1174
1173
|
- lib/mihari/web/public/index.html
|
|
1175
1174
|
- lib/mihari/web/public/redoc-static.html
|
|
1176
1175
|
- lib/mihari/web/public/static/css/app.2a5d3d21.css
|
|
1177
|
-
- lib/mihari/web/public/static/css/chunk-vendors.
|
|
1176
|
+
- lib/mihari/web/public/static/css/chunk-vendors.5013d549.css
|
|
1178
1177
|
- lib/mihari/web/public/static/favicon.ico
|
|
1179
1178
|
- lib/mihari/web/public/static/fonts/fa-brands-400.7fa789ab.ttf
|
|
1180
1179
|
- lib/mihari/web/public/static/fonts/fa-brands-400.859fc388.woff2
|
|
@@ -1183,14 +1182,10 @@ files:
|
|
|
1183
1182
|
- lib/mihari/web/public/static/fonts/fa-solid-900.3a463ec3.ttf
|
|
1184
1183
|
- lib/mihari/web/public/static/fonts/fa-solid-900.40ddefd7.woff2
|
|
1185
1184
|
- lib/mihari/web/public/static/fonts/fa-v4compatibility.924588dc.ttf
|
|
1186
|
-
- lib/mihari/web/public/static/js/app
|
|
1187
|
-
- lib/mihari/web/public/static/js/app
|
|
1188
|
-
- lib/mihari/web/public/static/js/
|
|
1189
|
-
- lib/mihari/web/public/static/js/
|
|
1190
|
-
- lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js
|
|
1191
|
-
- lib/mihari/web/public/static/js/chunk-vendors-legacy.b110c129.js.map
|
|
1192
|
-
- lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js
|
|
1193
|
-
- lib/mihari/web/public/static/js/chunk-vendors.dde2116c.js.map
|
|
1185
|
+
- lib/mihari/web/public/static/js/app.3ac3bd7a.js
|
|
1186
|
+
- lib/mihari/web/public/static/js/app.3ac3bd7a.js.map
|
|
1187
|
+
- lib/mihari/web/public/static/js/chunk-vendors.37b7208e.js
|
|
1188
|
+
- lib/mihari/web/public/static/js/chunk-vendors.37b7208e.js.map
|
|
1194
1189
|
- mihari.gemspec
|
|
1195
1190
|
- renovate.json
|
|
1196
1191
|
- sig/lib/mihari.rbs
|
|
@@ -1248,7 +1243,6 @@ files:
|
|
|
1248
1243
|
- sig/lib/mihari/mixins/hash.rbs
|
|
1249
1244
|
- sig/lib/mihari/mixins/refang.rbs
|
|
1250
1245
|
- sig/lib/mihari/mixins/retriable.rbs
|
|
1251
|
-
- sig/lib/mihari/mixins/rule.rbs
|
|
1252
1246
|
- sig/lib/mihari/models/alert.rbs
|
|
1253
1247
|
- sig/lib/mihari/models/artifact.rbs
|
|
1254
1248
|
- sig/lib/mihari/models/autonomous_system.rbs
|
|
@@ -1262,8 +1256,8 @@ files:
|
|
|
1262
1256
|
- sig/lib/mihari/models/tagging.rbs
|
|
1263
1257
|
- sig/lib/mihari/models/whois.rbs
|
|
1264
1258
|
- sig/lib/mihari/status.rbs
|
|
1265
|
-
- sig/lib/mihari/structs/alert.rbs
|
|
1266
1259
|
- sig/lib/mihari/structs/censys.rbs
|
|
1260
|
+
- sig/lib/mihari/structs/filters.rbs
|
|
1267
1261
|
- sig/lib/mihari/structs/google_public_dns.rbs
|
|
1268
1262
|
- sig/lib/mihari/structs/greynoise.rbs
|
|
1269
1263
|
- sig/lib/mihari/structs/ipinfo.rbs
|
data/lib/mihari/mixins/rule.rb
DELETED
|
@@ -1,84 +0,0 @@
|
|
|
1
|
-
# frozen_string_literal: true
|
|
2
|
-
|
|
3
|
-
require "date"
|
|
4
|
-
require "erb"
|
|
5
|
-
require "pathname"
|
|
6
|
-
|
|
7
|
-
module Mihari
|
|
8
|
-
module Mixins
|
|
9
|
-
module Rule
|
|
10
|
-
include Mixins::Database
|
|
11
|
-
|
|
12
|
-
def load_erb_yaml(yaml)
|
|
13
|
-
YAML.safe_load(ERB.new(yaml).result, permitted_classes: [Date], symbolize_names: true)
|
|
14
|
-
end
|
|
15
|
-
|
|
16
|
-
#
|
|
17
|
-
# Load rule into hash
|
|
18
|
-
#
|
|
19
|
-
# @param [String] path_or_id Path to YAML file or YAML string or ID of a rule in the database
|
|
20
|
-
#
|
|
21
|
-
# @return [Mihari::Structs::Rule::Rule]
|
|
22
|
-
#
|
|
23
|
-
def load_rule(path_or_id)
|
|
24
|
-
yaml = nil
|
|
25
|
-
|
|
26
|
-
yaml = load_yaml_from_file(path_or_id) if File.exist?(path_or_id)
|
|
27
|
-
yaml = load_yaml_from_db(path_or_id) if yaml.nil?
|
|
28
|
-
|
|
29
|
-
Structs::Rule::Rule.from_yaml yaml
|
|
30
|
-
end
|
|
31
|
-
|
|
32
|
-
def load_yaml_from_file(path)
|
|
33
|
-
return nil unless Pathname(path).exist?
|
|
34
|
-
|
|
35
|
-
File.read path
|
|
36
|
-
end
|
|
37
|
-
|
|
38
|
-
def load_yaml_from_db(id)
|
|
39
|
-
with_db_connection do
|
|
40
|
-
rule = Mihari::Rule.find(id)
|
|
41
|
-
rule.yaml || rule.symbolized_data.to_yaml
|
|
42
|
-
rescue ActiveRecord::RecordNotFound
|
|
43
|
-
raise ArgumentError, "ID:#{id} is not found in the database"
|
|
44
|
-
end
|
|
45
|
-
end
|
|
46
|
-
|
|
47
|
-
#
|
|
48
|
-
# Validate a rule
|
|
49
|
-
#
|
|
50
|
-
# @param [Mihari::Structs::Rule::Rule] rule
|
|
51
|
-
#
|
|
52
|
-
def validate_rule!(rule)
|
|
53
|
-
rule.validate!
|
|
54
|
-
rescue RuleValidationError => e
|
|
55
|
-
Mihari.logger.error "Failed to parse the input as a rule"
|
|
56
|
-
raise e
|
|
57
|
-
end
|
|
58
|
-
|
|
59
|
-
#
|
|
60
|
-
# Returns a template for rule
|
|
61
|
-
#
|
|
62
|
-
# @return [String] A template for rule
|
|
63
|
-
#
|
|
64
|
-
def rule_template
|
|
65
|
-
yaml = File.read(File.expand_path("../templates/rule.yml.erb", __dir__))
|
|
66
|
-
Structs::Rule::Rule.from_yaml yaml
|
|
67
|
-
yaml
|
|
68
|
-
end
|
|
69
|
-
|
|
70
|
-
#
|
|
71
|
-
# Create (blank) rule file
|
|
72
|
-
#
|
|
73
|
-
# @param [String] filename
|
|
74
|
-
# @param [Dry::Files] files
|
|
75
|
-
# @param [String] template
|
|
76
|
-
#
|
|
77
|
-
# @return [nil]
|
|
78
|
-
#
|
|
79
|
-
def initialize_rule_yaml(filename, files = Dry::Files.new, template: rule_template)
|
|
80
|
-
files.write(filename, template)
|
|
81
|
-
end
|
|
82
|
-
end
|
|
83
|
-
end
|
|
84
|
-
end
|
data/lib/mihari/structs/alert.rb
DELETED
|
@@ -1,44 +0,0 @@
|
|
|
1
|
-
# frozen_string_literal: true
|
|
2
|
-
|
|
3
|
-
module Mihari
|
|
4
|
-
module Structs
|
|
5
|
-
module Alert
|
|
6
|
-
class SearchFilter < Dry::Struct
|
|
7
|
-
attribute? :artifact_data, Types::String.optional
|
|
8
|
-
attribute? :description, Types::String.optional
|
|
9
|
-
attribute? :source, Types::String.optional
|
|
10
|
-
attribute? :tag_name, Types::String.optional
|
|
11
|
-
attribute? :title, Types::String.optional
|
|
12
|
-
attribute? :from_at, Types::DateTime.optional
|
|
13
|
-
attribute? :to_at, Types::DateTime.optional
|
|
14
|
-
attribute? :asn, Types::Int.optional
|
|
15
|
-
attribute? :dns_record, Types::String.optional
|
|
16
|
-
attribute? :reverse_dns_name, Types::String.optional
|
|
17
|
-
|
|
18
|
-
def valid_artifact_filters?
|
|
19
|
-
!(artifact_data || asn || dns_record || reverse_dns_name).nil?
|
|
20
|
-
end
|
|
21
|
-
end
|
|
22
|
-
|
|
23
|
-
class SearchFilterWithPagination < SearchFilter
|
|
24
|
-
attribute? :page, Types::Int.default(1)
|
|
25
|
-
attribute? :limit, Types::Int.default(10)
|
|
26
|
-
|
|
27
|
-
def without_pagination
|
|
28
|
-
SearchFilter.new(
|
|
29
|
-
artifact_data: artifact_data,
|
|
30
|
-
description: description,
|
|
31
|
-
from_at: from_at,
|
|
32
|
-
source: source,
|
|
33
|
-
tag_name: tag_name,
|
|
34
|
-
title: title,
|
|
35
|
-
to_at: to_at,
|
|
36
|
-
asn: asn,
|
|
37
|
-
dns_record: dns_record,
|
|
38
|
-
reverse_dns_name: reverse_dns_name
|
|
39
|
-
)
|
|
40
|
-
end
|
|
41
|
-
end
|
|
42
|
-
end
|
|
43
|
-
end
|
|
44
|
-
end
|