mihari 5.1.3 → 5.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dd278975834369b3274b38b590f12d4f2fed97d7626363ff3cfbc9845195b386
-  data.tar.gz: 864ee1deae0bdb0390d9e330eb76c993860c37189dce0d23c9793b012f338275
+  metadata.gz: 0c98bfd494945e88b92bbf939e9ea94d5d4161cc35ae7d7a0d01ead7a30a1f09
+  data.tar.gz: 4794020ea3ad71fe70016030abd52063d523c7bbf7a31d9129fe8a2b76f43bc5
 SHA512:
-  metadata.gz: 258731713400cb40f6da8f24e6ce0213b883eeff98a22a16a88c84568633ad02ad3e18f4e70e6faea428a29bdcdc257b6ec3c86ebea7979065ec2e42ab445c47
-  data.tar.gz: 6c8beea0c3f4aa42f8fb8217a05c6256a6a8ea10daceb05d05ed2884d8b53c86195c765fa70cf35ea19c41d959fd6df114fa2b609893e828def028f5b16b5fc4
+  metadata.gz: aff9062a772dd86fd202e9112d92c923c815dba5d15b83b567c8ff00a72803ece1674201daeffc2934beba54f7d9ff2e929e1d570de9fe21c503bd89c6648c13
+  data.tar.gz: 8ab4db7d0385ac7301c158c95cba0855cc002c9e115911e497011e0705c97fdc5205a6f47e07917d867ba5270f3e4b24f80c38a407c34a2a3db717b9fd5ef732

data/lib/mihari/commands/web.rb

@@ -11,17 +11,14 @@ module Mihari
           method_option :threads, type: :string, default: "0:5", desc: "min:max threads to use"
           method_option :verbose, type: :boolean, default: true, desc: "Report each request"
           method_option :worker_timeout, type: :numeric, default: 60, desc: "Worker timeout value (in seconds)"
+          method_option :hide_config_values, type: :boolean, default: false,
+            desc: "Whether to hide config values or not"
           def web
-            port = options["port"]
-            host = options["host"]
-            threads = options["threads"]
-            verbose = options["verbose"]
-            worker_timeout = options["worker_timeout"]
-
+            Mihari.config.hide_config_values = options["hide_config_values"]
             # set rack env as production
             ENV["RACK_ENV"] ||= "production"
-
-            Mihari::App.run!(port: port, host: host, threads: threads, verbose: verbose, worker_timeout: worker_timeout)
+            Mihari::App.run!(port: options["port"], host: options["host"], threads: options["threads"],
+              verbose: options["verbose"], worker_timeout: options["worker_timeout"])
           end
         end
       end

data/lib/mihari/emitters/misp.rb

@@ -45,10 +45,10 @@ module Mihari
 
         client.create_event({
           Event: {
-            info: rule.title
-          },
-          Attribute: artifacts.map { |artifact| build_attribute(artifact) },
-          Tag: rule.tags.map { |tag| { name: tag } }
+            info: rule.title,
+            Attribute: artifacts.map { |artifact| build_attribute(artifact) },
+            Tag: rule.tags.map { |tag| { name: tag } }
+          }
         })
       end
 

data/lib/mihari/entities/artifact.rb

@@ -12,11 +12,12 @@ module Mihari
       expose :data_type, documentation: { type: String, required: true }, as: :dataType
       expose :source, documentation: { type: String, required: true }
       expose :tags, documentation: { type: String, is_array: true }
-
-      expose :metadata, documentation: { type: Hash }
     end
 
     class Artifact < BaseArtifact
+      # NOTE: do not define metadata in BaseArtifact since metadata can be relatively big
+      expose :metadata, documentation: { type: Hash }
+
       expose :autonomous_system, using: Entities::AutonomousSystem,
         documentation: { type: Entities::AutonomousSystem, required: false }, as: :autonomousSystem
       expose :geolocation, using: Entities::Geolocation, documentation: { type: Entities::Geolocation, required: false }

data/lib/mihari/mixins/configurable.rb

@@ -23,7 +23,9 @@ module Mihari
         return nil if configuration_keys.empty?
 
         configuration_keys.map do |key|
-          { key: key.upcase, value: Mihari.config.send(key) }
+          value = Mihari.config.send(key)
+          value = "REDACTED" if value && Mihari.config.hide_config_values
+          { key: key.upcase, value: value }
         end
       end
 

data/lib/mihari/models/alert.rb

@@ -48,22 +48,29 @@ module Mihari
       #
       # @param [Structs::Filters::Alert::SearchFilter] filter
       #
-      # @return [Mihari::Alert]
+      # @return [Array<Integer>]
       #
-      def build_relation(filter)
+      def get_artifact_ids_by_filter(filter)
         artifact_ids = []
-        artifact = Artifact.includes(:autonomous_system, :dns_records, :reverse_dns_names)
-        artifact = artifact.where(data: filter.artifact_data) if filter.artifact_data
-        artifact = artifact.where(autonomous_system: { asn: filter.asn }) if filter.asn
-        artifact = artifact.where(dns_records: { value: filter.dns_record }) if filter.dns_record
-        artifact = artifact.where(reverse_dns_names: { name: filter.reverse_dns_name }) if filter.reverse_dns_name
-        # get artifact ids if there is any valid filter for artifact
-        if filter.valid_artifact_filters?
+
+        if filter.artifact_data
+          artifact = Artifact.where(data: filter.artifact_data)
           artifact_ids = artifact.pluck(:id)
           # set invalid ID if nothing is matched with the filters
           artifact_ids = [-1] if artifact_ids.empty?
         end
 
+        artifact_ids
+      end
+
+      #
+      # @param [Structs::Filters::Alert::SearchFilter] filter
+      #
+      # @return [Mihari::Alert]
+      #
+      def build_relation(filter)
+        artifact_ids = get_artifact_ids_by_filter(filter)
+
         relation = self
         relation = relation.includes(:artifacts, :tags)
 
@@ -71,9 +78,6 @@ module Mihari
         relation = relation.where(tags: { name: filter.tag_name }) if filter.tag_name
 
         relation = relation.where(rule_id: filter.rule_id) if filter.rule_id
-        relation = relation.where(title: filter.title) if filter.title
-
-        relation = relation.where("description LIKE ?", "%#{filter.description}%") if filter.description
 
         relation = relation.where("alerts.created_at >= ?", filter.from_at) if filter.from_at
         relation = relation.where("alerts.created_at <= ?", filter.to_at) if filter.to_at

data/lib/mihari/models/rule.rb

@@ -67,8 +67,7 @@ module Mihari
 
         relation = relation.where(alerts: { tags: { name: filter.tag_name } }) if filter.tag_name
 
-        relation = relation.where(title: filter.title) if filter.title
-
+        relation = relation.where("rules.title LIKE ?", "%#{filter.title}%") if filter.title
         relation = relation.where("rules.description LIKE ?", "%#{filter.description}%") if filter.description
 
         relation = relation.where("rules.created_at >= ?", filter.from_at) if filter.from_at

data/lib/mihari/schemas/rule.rb

@@ -33,6 +33,7 @@ module Mihari
       optional(:falsepositives).value(array[:string]).default([])
 
       optional(:artifact_lifetime).value(:integer)
+      optional(:artifact_ttl).value(:integer)
 
       before(:key_coercer) do |result|
         # it looks like that dry-schema v1.9.1 has an issue with setting an array of schemas as a default value

data/lib/mihari/structs/filters.rb

@@ -6,19 +6,10 @@ module Mihari
       module Alert
         class SearchFilter < Dry::Struct
           attribute? :artifact_data, Types::String.optional
-          attribute? :description, Types::String.optional
           attribute? :rule_id, Types::String.optional
           attribute? :tag_name, Types::String.optional
-          attribute? :title, Types::String.optional
           attribute? :from_at, Types::DateTime.optional
           attribute? :to_at, Types::DateTime.optional
-          attribute? :asn, Types::Int.optional
-          attribute? :dns_record, Types::String.optional
-          attribute? :reverse_dns_name, Types::String.optional
-
-          def valid_artifact_filters?
-            !(artifact_data || asn || dns_record || reverse_dns_name).nil?
-          end
         end
 
         class SearchFilterWithPagination < SearchFilter
@@ -28,15 +19,10 @@ module Mihari
           def without_pagination
             SearchFilter.new(
               artifact_data: artifact_data,
-              description: description,
               from_at: from_at,
               rule_id: rule_id,
               tag_name: tag_name,
-              title: title,
-              to_at: to_at,
-              asn: asn,
-              dns_record: dns_record,
-              reverse_dns_name: reverse_dns_name
+              to_at: to_at
             )
           end
         end

data/lib/mihari/structs/rule.rb

@@ -133,7 +133,7 @@ module Mihari
       # @return [Integer, nil]
       #
       def artifact_lifetime
-        @artifact_lifetime ||= data[:artifact_lifetime]
+        @artifact_lifetime ||= data[:artifact_lifetime] || data[:artifact_ttl]
       end
 
       #

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "5.1.3"
+  VERSION = "5.2.0"
 end

data/lib/mihari/web/app.rb

@@ -1,11 +1,13 @@
 # frozen_string_literal: true
 
 require "launchy"
+
 require "rack"
-require "rack/contrib"
-require "rack/handler/puma"
+require "rackup"
 require "rack/cors"
 
+require "rack/handler/puma"
+
 require "grape-swagger"
 require "grape-swagger-entity"
 
@@ -18,7 +20,7 @@ module Mihari
   class App
     def initialize
       @filenames = ["", ".html", "index.html", "/index.html"]
-      @rack_static = ::Rack::Static.new(
+      @rack_static = Rack::Static.new(
         -> { [404, {}, []] },
         root: File.expand_path("./public", __dir__),
         urls: ["/"]
@@ -50,14 +52,14 @@ module Mihari
         # TODO: is this the best way?
         _min_thread, max_thread = threads.split(":")
         ENV["PARALLEL_PROCESSOR_COUNT"] = max_thread if ENV["PARALLEL_PROCESSOR_COUNT"].nil?
-        Rack::Handler::Puma.run(
+        Rackup::Handler::Puma.run(
           instance,
           Port: port,
           Host: host,
           Threads: threads,
           Verbose: verbose,
           worker_timeout: worker_timeout
-        ) do |_launcher|
+        ) do |_|
           Launchy.open(url) if ENV["RACK_ENV"] != "development"
         rescue Launchy::CommandNotFoundError
           # ref. https://github.com/ninoseki/mihari/issues/477

data/lib/mihari/web/endpoints/alerts.rb

@@ -11,48 +11,35 @@ module Mihari
           summary: "Search alerts"
         }
         params do
-          optional :page, type: Integer
+          optional :page, type: Integer, default: 1
+          optional :limit, type: Integer, default: 10
 
           optional :artifact, type: String
-          optional :description, type: String
           optional :rule_id, type: String
           optional :tag, type: String
-          optional :title, type: String
 
           optional :fromAt, type: DateTime
           optional :toAt, type: DateTime
-
-          optional :asn, type: Integer
-          optional :dnsRecord, type: String
-          optional :reverseDnsName, type: String
         end
         get "/" do
           filter = params.to_h.to_snake_keys
 
-          # set page & limit
-          page = filter["page"] || 1
-          filter["page"] = page.to_i
-
-          limit = 10
-          filter["limit"] = 10
-
           # normalize keys
           filter["artifact_data"] = filter["artifact"]
           filter["tag_name"] = filter["tag"]
-
           # symbolize hash keys
           filter = filter.to_h.symbolize_keys
 
-          search_filter_with_pagenation = Structs::Filters::Alert::SearchFilterWithPagination.new(**filter)
-          alerts = Mihari::Alert.search(search_filter_with_pagenation)
-          total = Mihari::Alert.count(search_filter_with_pagenation.without_pagination)
+          search_filter_with_pagination = Structs::Filters::Alert::SearchFilterWithPagination.new(**filter)
+          alerts = Mihari::Alert.search(search_filter_with_pagination)
+          total = Mihari::Alert.count(search_filter_with_pagination.without_pagination)
 
           present(
             {
               alerts: alerts,
               total: total,
-              current_page: page,
-              page_size: limit
+              current_page: filter[:page].to_i,
+              page_size: filter[:limit].to_i
             },
             with: Entities::AlertsWithPagination
           )

data/lib/mihari/web/endpoints/rules.rb

@@ -21,7 +21,8 @@ module Mihari
           summary: "Search rules"
         }
         params do
-          optional :page, type: Integer
+          optional :page, type: Integer, default: 1
+          optional :limit, type: Integer, default: 10
 
           optional :title, type: String
           optional :description, type: String
@@ -33,16 +34,8 @@ module Mihari
         get "/" do
           filter = params.to_h.to_snake_keys
 
-          # set page & limit
-          page = filter["page"] || 1
-          filter["page"] = page.to_i
-
-          limit = 10
-          filter["limit"] = 10
-
           # normalize keys
           filter["tag_name"] = filter["tag"]
-
           # symbolize hash keys
           filter = filter.to_h.symbolize_keys
 
@@ -53,8 +46,8 @@ module Mihari
           present(
             { rules: rules,
               total: total,
-              current_page: page,
-              page_size: limit },
+              current_page: filter[:page].to_i,
+              page_size: filter[:limit].to_i },
             with: Entities::RulesWithPagination
           )
         end