mihari 5.2.2 → 5.2.4

data/lib/mihari/emitters/slack.rb

@@ -121,11 +121,16 @@ module Mihari
       # @return [String]
       attr_reader :username
 
-      def initialize(*args, **kwargs)
-        super(*args, **kwargs)
+      #
+      # @param [Array<Mihari::Artifact>] artifacts
+      # @param [Mihari::Structs::Rule] rule
+      # @param [Hash] **_options
+      #
+      def initialize(artifacts:, rule:, **options)
+        super(artifacts: artifacts, rule: rule, **options)
 
-        @webhook_url = kwargs[:webhook_url] || Mihari.config.slack_webhook_url
-        @channel = kwargs[:channel] || Mihari.config.slack_channel || DEFAULT_CHANNEL
+        @webhook_url = options[:webhook_url] || Mihari.config.slack_webhook_url
+        @channel = options[:channel] || Mihari.config.slack_channel || DEFAULT_CHANNEL
         @username = DEFAULT_USERNAME
       end
 
@@ -152,13 +157,11 @@ module Mihari
       end
 
       #
-      # Build attachements
-      #
-      # @param [Array<Mihari::Artifact>] artifacts
+      # Build attachments
       #
       # @return [Array<Mihari::Emitters::Attachment>]
       #
-      def to_attachments(artifacts)
+      def attachments
         artifacts.map do |artifact|
           Attachment.new(data: artifact.data, data_type: artifact.data_type).to_a
         end.flatten
@@ -167,11 +170,9 @@ module Mihari
       #
       # Build a text
       #
-      # @param [Mihari::Structs::Rule] rule
-      #
       # @return [String]
       #
-      def to_text(rule)
+      def text
         tags = rule.tags
         tags = ["N/A"] if tags.empty?
 
@@ -182,12 +183,9 @@ module Mihari
         ].join("\n")
       end
 
-      def emit(rule:, artifacts:, **_options)
+      def emit
         return if artifacts.empty?
 
-        attachments = to_attachments(artifacts)
-        text = to_text(rule)
-
         notifier.post(text: text, attachments: attachments, mrkdwn: true)
       end
 

data/lib/mihari/emitters/the_hive.rb

@@ -12,12 +12,17 @@ module Mihari
       # @return [String, nil]
       attr_reader :api_version
 
-      def initialize(*args, **kwargs)
-        super(*args, **kwargs)
+      #
+      # @param [Array<Mihari::Artifact>] artifacts
+      # @param [Mihari::Structs::Rule] rule
+      # @param [Hash] **options
+      #
+      def initialize(artifacts:, rule:, **options)
+        super(artifacts: artifacts, rule: rule, **options)
 
-        @url = kwargs[:url] || Mihari.config.thehive_url
-        @api_key = kwargs[:api_key] || Mihari.config.thehive_api_key
-        @api_version = kwargs[:api_version] || Mihari.config.thehive_api_version
+        @url = options[:url] || Mihari.config.thehive_url
+        @api_key = options[:api_key] || Mihari.config.thehive_api_key
+        @api_version = options[:api_version] || Mihari.config.thehive_api_version
       end
 
       # @return [Boolean]
@@ -39,15 +44,11 @@ module Mihari
       #
       # Create a Hive alert
       #
-      # @param [Arra<Mihari::Artifact>] artifacts
-      # @param [Mihari::Structs::Rule] rule
-      #
       # @return [::MISP::Event]
       #
-      def emit(rule:, artifacts:, **_options)
+      def emit
         return if artifacts.empty?
 
-        payload = payload(rule: rule, artifacts: artifacts)
         client.alert(payload)
       end
 
@@ -102,18 +103,15 @@ module Mihari
       #
       # Build payload for alert
       #
-      # @param [Arra<Mihari::Artifact>] artifacts
-      # @param [Mihari::Structs::Rule] rule
-      #
-      # @return [<Type>] <description>
+      # @return [Hash]
       #
-      def payload(rule:, artifacts:)
-        return v4_payload(rule: rule, artifacts: artifacts) if normalized_api_version.nil?
+      def payload
+        return v4_payload if normalized_api_version.nil?
 
-        v5_payload(rule: rule, artifacts: artifacts)
+        v5_payload
       end
 
-      def v4_payload(rule:, artifacts:)
+      def v4_payload
         {
           title: rule.title,
           description: rule.description,
@@ -130,7 +128,7 @@ module Mihari
         }
       end
 
-      def v5_payload(rule:, artifacts:)
+      def v5_payload
         {
           title: rule.title,
           description: rule.description,

data/lib/mihari/emitters/webhook.rb

@@ -55,30 +55,26 @@ module Mihari
       # @return [String, nil]
       attr_reader :template
 
-      def initialize(*args, **kwargs)
-        super(*args, **kwargs)
-
-        url = kwargs[:url]
-        headers = kwargs[:headers] || {}
-        method = kwargs[:method] || "POST"
-        template = kwargs[:template]
-
-        @url = Addressable::URI.parse(url)
-        @headers = headers
-        @method = method
-        @template = template
+      #
+      # @param [Array<Mihari::Artifact>] artifacts
+      # @param [Mihari::Structs::Rule] rule
+      # @param [Hash] **options
+      #
+      def initialize(artifacts:, rule:, **options)
+        super(artifacts: artifacts, rule: rule, **options)
+
+        @url = Addressable::URI.parse(options[:url])
+        @headers = options[:headers] || {}
+        @method = options[:method] || "POST"
+        @template = options[:template]
       end
 
-      def emit(artifacts:, rule:)
+      def emit
         return if artifacts.empty?
 
-        res = nil
-
-        payload_ = payload_as_string(artifacts: artifacts, rule: rule)
-        payload = JSON.parse(payload_)
-
         client = Mihari::HTTP.new(url, headers: headers)
 
+        res = nil
         case method
         when "GET"
           res = client.get
@@ -100,13 +96,10 @@ module Mihari
       #
       # Convert payload into string
       #
-      # @param [Array<Mihari::Artifact>] artifacts
-      # @param [Mihari::Structs::Rule] rule
-      #
       # @return [String]
       #
-      def payload_as_string(artifacts:, rule:)
-        @payload_as_string ||= [].tap do |out|
+      def payload_as_string
+        [].tap do |out|
           options = {}
           options[:template] = File.read(template) unless template.nil?
 
@@ -118,6 +111,13 @@ module Mihari
           out << payload_template.result
         end.first
       end
+
+      #
+      # @return [Hash]
+      #
+      def payload
+        JSON.parse payload_as_string
+      end
     end
   end
 end

data/lib/mihari/enrichers/whois.rb

@@ -5,6 +5,7 @@ require "whois-parser"
 module Mihari
   module Enrichers
     class Whois < Base
+      # @type [Hash]
       @memo = {}
 
       # @return [Boolean]

data/lib/mihari/entities/rule.rb

@@ -31,7 +31,7 @@ module Mihari
     end
 
     class RuleIDs < Grape::Entity
-      expose :rule_ids, documentation: { type: Array[String], required: true }, as: :ruleIds
+      expose :rule_ids, documentation: { type: [String], required: true }, as: :ruleIds
     end
   end
 end

data/lib/mihari/entities/tag.rb

@@ -7,7 +7,7 @@ module Mihari
     end
 
     class Tags < Grape::Entity
-      expose :tags, documentation: { type: Array[String], required: true }
+      expose :tags, documentation: { type: [String], required: true }
     end
   end
 end

data/lib/mihari/feed/parser.rb

@@ -5,6 +5,7 @@ require "jr/cli/core_ext"
 module Mihari
   module Feed
     class Parser
+      # @return [Array<Hash>, Array<Array<String>>]
       attr_reader :data
 
       #

data/lib/mihari/feed/reader.rb

@@ -6,7 +6,23 @@ require "insensitive_hash"
 module Mihari
   module Feed
     class Reader
-      attr_reader :url, :headers, :params, :json, :data, :method
+      # @return [String]
+      attr_reader :url
+
+      # @return [Hash]
+      attr_reader :headers
+
+      # @return [Hash, nil]
+      attr_reader :params
+
+      # @return [Hash, nil]
+      attr_reader :json
+
+      # @return [Hash, nil]
+      attr_reader :data
+
+      # @return [String]
+      attr_reader :method
 
       def initialize(url, headers: {}, method: "GET", params: nil, json: nil, data: nil)
         @url = Addressable::URI.parse(url)
@@ -20,6 +36,9 @@ module Mihari
         headers["content-type"] = "application/json" unless json.nil?
       end
 
+      #
+      # @return [Array<Hash>]
+      #
       def read
         return read_file(url.path) if url.scheme == "file"
 
@@ -33,11 +52,9 @@ module Mihari
 
         body = res.body
         content_type = res["Content-Type"].to_s
-        if content_type.include?("application/json")
-          convert_as_json(body)
-        else
-          convert_as_csv(body)
-        end
+        return convert_as_json(body) if content_type.include?("application/json")
+
+        convert_as_csv(body)
       end
 
       #
@@ -48,10 +65,10 @@ module Mihari
       # @return [Array<Hash>]
       #
       def convert_as_json(text)
-        data = JSON.parse(text, symbolize_names: true)
-        return data if data.is_a?(Array)
+        parsed = JSON.parse(text, symbolize_names: true)
+        return parsed if parsed.is_a?(Array)
 
-        [data]
+        [parsed]
       end
 
       #
@@ -77,11 +94,9 @@ module Mihari
       def read_file(path)
         text = File.read(path)
 
-        if path.end_with?(".json")
-          convert_as_json text
-        else
-          convert_as_csv text
-        end
+        return convert_as_json(text) if path.end_with?(".json")
+
+        convert_as_csv text
       end
     end
   end

data/lib/mihari/mixins/configurable.rb

@@ -4,14 +4,23 @@ module Mihari
   module Mixins
     module Configurable
       #
-      # Check whether it is configured or not
+      # Check whether there are configuration key-values or not
       #
       # @return [Boolean]
       #
-      def configured?
+      def configuration_keys?
         return true if configuration_keys.empty?
 
-        configuration_keys.all? { |key| Mihari.config.send(key) } || api_key?
+        configuration_keys.all? { |key| Mihari.config.send(key) }
+      end
+
+      #
+      # Check whether it is configured or not
+      #
+      # @return [Boolean]
+      #
+      def configured?
+        configuration_keys? || api_key?
       end
 
       #
@@ -32,7 +41,7 @@ module Mihari
       #
       # Configuration keys
       #
-      # @return [Array<String>] A list of cofiguration keys
+      # @return [Array<String>] A list of configuration keys
       #
       def configuration_keys
         []

data/lib/mihari/schemas/analyzer.rb

@@ -7,7 +7,7 @@ module Mihari
     end
 
     AnalyzerWithoutAPIKey = Dry::Schema.Params do
-      required(:analyzer).value(Types::String.enum("crtsh", "dnpedia", "dnstwister"))
+      required(:analyzer).value(Types::String.enum("dnstwister"))
       required(:query).value(:string)
       optional(:options).hash(AnalyzerOptions)
     end
@@ -23,6 +23,7 @@ module Mihari
           "securitytrails",
           "shodan",
           "st",
+          "urlscan",
           "virustotal_intelligence",
           "virustotal",
           "vt_intel",
@@ -72,12 +73,6 @@ module Mihari
       optional(:options).hash(AnalyzerOptions)
     end
 
-    Urlscan = Dry::Schema.Params do
-      required(:analyzer).value(Types::String.enum("urlscan"))
-      required(:query).value(:string)
-      optional(:options).hash(AnalyzerOptions)
-    end
-
     Feed = Dry::Schema.Params do
       required(:analyzer).value(Types::String.enum("feed"))
       required(:query).value(:string)

data/lib/mihari/schemas/rule.rb

@@ -22,7 +22,7 @@ module Mihari
       optional(:updated_on).value(:date)
 
       required(:queries).value(:array).each do
-        AnalyzerWithoutAPIKey | AnalyzerWithAPIKey | Censys | CIRCL | PassiveTotal | ZoomEye | Urlscan | Crtsh | Feed
+        AnalyzerWithoutAPIKey | AnalyzerWithAPIKey | Censys | CIRCL | PassiveTotal | ZoomEye | Crtsh | Feed
       end
 
       optional(:emitters).value(:array).each { Database | MISP | TheHive | Slack | Webhook }.default(DEFAULT_EMITTERS)

data/lib/mihari/structs/censys.rb

@@ -22,16 +22,18 @@ module Mihari
           Mihari::AutonomousSystem.new(asn: normalize_asn(asn))
         end
 
-        #
-        # @param [Hash] d
-        #
-        # @return [AutonomousSystem]
-        #
-        def self.from_dynamic!(d)
-          d = Types::Hash[d]
-          new(
-            asn: d.fetch("asn")
-          )
+        class << self
+          #
+          # @param [Hash] d
+          #
+          # @return [AutonomousSystem]
+          #
+          def from_dynamic!(d)
+            d = Types::Hash[d]
+            new(
+              asn: d.fetch("asn")
+            )
+          end
         end
       end
 
@@ -67,17 +69,19 @@ module Mihari
           )
         end
 
-        #
-        # @param [Hash] d
-        #
-        # @return [Location]
-        #
-        def self.from_dynamic!(d)
-          d = Types::Hash[d]
-          new(
-            country: d["country"],
-            country_code: d["country_code"]
-          )
+        class << self
+          #
+          # @param [Hash] d
+          #
+          # @return [Location]
+          #
+          def from_dynamic!(d)
+            d = Types::Hash[d]
+            new(
+              country: d["country"],
+              country_code: d["country_code"]
+            )
+          end
         end
       end
 
@@ -98,16 +102,18 @@ module Mihari
           Port.new(port: port)
         end
 
-        #
-        # @param [Hash] d
-        #
-        # @return [Service]
-        #
-        def self.from_dynamic!(d)
-          d = Types::Hash[d]
-          new(
-            port: d.fetch("port")
-          )
+        class << self
+          #
+          # @param [Hash] d
+          #
+          # @return [Service]
+          #
+          def from_dynamic!(d)
+            d = Types::Hash[d]
+            new(
+              port: d.fetch("port")
+            )
+          end
         end
       end
 
@@ -173,20 +179,22 @@ module Mihari
           )
         end
 
-        #
-        # @param [Hash] d
-        #
-        # @return [Hit]
-        #
-        def self.from_dynamic!(d)
-          d = Types::Hash[d]
-          new(
-            ip: d.fetch("ip"),
-            location: Location.from_dynamic!(d.fetch("location")),
-            autonomous_system: AutonomousSystem.from_dynamic!(d.fetch("autonomous_system")),
-            metadata: d,
-            services: d.fetch("services", []).map { |x| Service.from_dynamic!(x) }
-          )
+        class << self
+          #
+          # @param [Hash] d
+          #
+          # @return [Hit]
+          #
+          def from_dynamic!(d)
+            d = Types::Hash[d]
+            new(
+              ip: d.fetch("ip"),
+              location: Location.from_dynamic!(d.fetch("location")),
+              autonomous_system: AutonomousSystem.from_dynamic!(d.fetch("autonomous_system")),
+              metadata: d,
+              services: d.fetch("services", []).map { |x| Service.from_dynamic!(x) }
+            )
+          end
         end
       end
 
@@ -208,17 +216,19 @@ module Mihari
           attributes[:prev]
         end
 
-        #
-        # @param [Hash] d
-        #
-        # @return [Links]
-        #
-        def self.from_dynamic!(d)
-          d = Types::Hash[d]
-          new(
-            next: d["next"],
-            prev: d["prev"]
-          )
+        class << self
+          #
+          # @param [Hash] d
+          #
+          # @return [Links]
+          #
+          def from_dynamic!(d)
+            d = Types::Hash[d]
+            new(
+              next: d["next"],
+              prev: d["prev"]
+            )
+          end
         end
       end
 
@@ -260,22 +270,24 @@ module Mihari
         # @return [Array<Mihari::Artifact>]
         #
         def to_artifacts
-          hits.map { |hit| hit.to_artifact }
+          hits.map(&:to_artifact)
         end
 
-        #
-        # @param [Hash] d
-        #
-        # @return [Result]
-        #
-        def self.from_dynamic!(d)
-          d = Types::Hash[d]
-          new(
-            query: d.fetch("query"),
-            total: d.fetch("total"),
-            hits: d.fetch("hits", []).map { |x| Hit.from_dynamic!(x) },
-            links: Links.from_dynamic!(d.fetch("links"))
-          )
+        class << self
+          #
+          # @param [Hash] d
+          #
+          # @return [Result]
+          #
+          def from_dynamic!(d)
+            d = Types::Hash[d]
+            new(
+              query: d.fetch("query"),
+              total: d.fetch("total"),
+              hits: d.fetch("hits", []).map { |x| Hit.from_dynamic!(x) },
+              links: Links.from_dynamic!(d.fetch("links"))
+            )
+          end
         end
       end
 
@@ -305,18 +317,20 @@ module Mihari
           attributes[:result]
         end
 
-        #
-        # @param [Hash] d
-        #
-        # @return [Response]
-        #
-        def self.from_dynamic!(d)
-          d = Types::Hash[d]
-          new(
-            code: d.fetch("code"),
-            status: d.fetch("status"),
-            result: Result.from_dynamic!(d.fetch("result"))
-          )
+        class << self
+          #
+          # @param [Hash] d
+          #
+          # @return [Response]
+          #
+          def from_dynamic!(d)
+            d = Types::Hash[d]
+            new(
+              code: d.fetch("code"),
+              status: d.fetch("status"),
+              result: Result.from_dynamic!(d.fetch("result"))
+            )
+          end
         end
       end
     end