mihari 5.3.1 → 5.3.2
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/frontend/package-lock.json +538 -581
- data/frontend/package.json +21 -21
- data/frontend/src/ace-config.ts +6 -0
- data/frontend/src/components/alert/Form.vue +2 -2
- data/frontend/src/components/rule/EditRule.vue +3 -2
- data/frontend/src/components/rule/Form.vue +2 -2
- data/frontend/src/components/rule/InputForm.vue +18 -59
- data/frontend/src/components/rule/YAML.vue +21 -28
- data/frontend/src/views/Artifact.vue +3 -8
- data/frontend/src/views/EditRule.vue +2 -7
- data/frontend/src/views/Rule.vue +3 -8
- data/lib/mihari/analyzers/base.rb +6 -0
- data/lib/mihari/analyzers/binaryedge.rb +1 -1
- data/lib/mihari/analyzers/censys.rb +1 -1
- data/lib/mihari/analyzers/onyphe.rb +1 -1
- data/lib/mihari/analyzers/rule.rb +4 -7
- data/lib/mihari/analyzers/shodan.rb +1 -1
- data/lib/mihari/analyzers/urlscan.rb +1 -1
- data/lib/mihari/analyzers/virustotal_intelligence.rb +1 -1
- data/lib/mihari/analyzers/zoomeye.rb +2 -2
- data/lib/mihari/commands/rule.rb +3 -3
- data/lib/mihari/commands/search.rb +3 -3
- data/lib/mihari/constants.rb +3 -0
- data/lib/mihari/emitters/base.rb +2 -2
- data/lib/mihari/emitters/misp.rb +3 -3
- data/lib/mihari/emitters/slack.rb +1 -1
- data/lib/mihari/emitters/the_hive.rb +1 -1
- data/lib/mihari/emitters/webhook.rb +1 -1
- data/lib/mihari/mixins/configurable.rb +5 -0
- data/lib/mihari/mixins/falsepositive.rb +1 -1
- data/lib/mihari/mixins/retriable.rb +0 -2
- data/lib/mihari/{structs → services}/rule.rb +16 -16
- data/lib/mihari/version.rb +1 -1
- data/lib/mihari/web/endpoints/rules.rb +9 -8
- data/lib/mihari/web/public/assets/index-116033d0.js +1737 -0
- data/lib/mihari/web/public/assets/index-33165282.css +1 -0
- data/lib/mihari/web/public/assets/mode-yaml-a21faa53.js +8 -0
- data/lib/mihari/web/public/index.html +2 -2
- data/lib/mihari.rb +3 -2
- data/mihari.gemspec +5 -4
- metadata +62 -18
- data/lib/mihari/web/public/assets/index-b17c40c6.css +0 -1
- data/lib/mihari/web/public/assets/index-f740e4f9.js +0 -799
@@ -8,7 +8,7 @@ require "securerandom"
|
|
8
8
|
require "yaml"
|
9
9
|
|
10
10
|
module Mihari
|
11
|
-
module
|
11
|
+
module Services
|
12
12
|
class Rule
|
13
13
|
include Mixins::FalsePositive
|
14
14
|
|
@@ -49,16 +49,16 @@ module Mihari
|
|
49
49
|
end
|
50
50
|
|
51
51
|
def validate!
|
52
|
-
|
53
|
-
|
52
|
+
return unless errors?
|
53
|
+
|
54
54
|
Mihari.logger.error "Failed to parse the input as a rule:"
|
55
55
|
Mihari.logger.error JSON.pretty_generate(errors.to_h)
|
56
56
|
|
57
|
-
raise
|
57
|
+
raise RuleValidationError, errors
|
58
58
|
end
|
59
59
|
|
60
60
|
def [](key)
|
61
|
-
data
|
61
|
+
data key.to_sym
|
62
62
|
end
|
63
63
|
|
64
64
|
#
|
@@ -141,7 +141,7 @@ module Mihari
|
|
141
141
|
#
|
142
142
|
# @return [Mihari::Rule]
|
143
143
|
#
|
144
|
-
def
|
144
|
+
def to_model
|
145
145
|
rule = Mihari::Rule.find(id)
|
146
146
|
|
147
147
|
rule.title = title
|
@@ -161,8 +161,8 @@ module Mihari
|
|
161
161
|
#
|
162
162
|
# @return [Mihari::Analyzers::Rule]
|
163
163
|
#
|
164
|
-
def
|
165
|
-
Mihari::Analyzers::Rule.new
|
164
|
+
def to_analyzer
|
165
|
+
Mihari::Analyzers::Rule.new self
|
166
166
|
end
|
167
167
|
|
168
168
|
class << self
|
@@ -171,10 +171,10 @@ module Mihari
|
|
171
171
|
#
|
172
172
|
# @param [String] yaml
|
173
173
|
#
|
174
|
-
# @return [Mihari::
|
174
|
+
# @return [Mihari::Services::Rule]
|
175
175
|
#
|
176
176
|
def from_yaml(yaml)
|
177
|
-
|
177
|
+
Services::Rule.new YAML.safe_load(ERB.new(yaml).result, permitted_classes: [Date, Symbol])
|
178
178
|
rescue Psych::SyntaxError => e
|
179
179
|
raise YAMLSyntaxError, e.message
|
180
180
|
end
|
@@ -182,10 +182,10 @@ module Mihari
|
|
182
182
|
#
|
183
183
|
# @param [Mihari::Rule] model
|
184
184
|
#
|
185
|
-
# @return [Mihari::
|
185
|
+
# @return [Mihari::Services::Rule]
|
186
186
|
#
|
187
187
|
def from_model(model)
|
188
|
-
|
188
|
+
Services::Rule.new model.data
|
189
189
|
end
|
190
190
|
|
191
191
|
#
|
@@ -193,7 +193,7 @@ module Mihari
|
|
193
193
|
#
|
194
194
|
# @param [String] path
|
195
195
|
#
|
196
|
-
# @return [Mihari::
|
196
|
+
# @return [Mihari::Services::Rule, nil]
|
197
197
|
#
|
198
198
|
def from_path(path)
|
199
199
|
return nil unless Pathname(path).exist?
|
@@ -206,18 +206,18 @@ module Mihari
|
|
206
206
|
#
|
207
207
|
# @param [String] id
|
208
208
|
#
|
209
|
-
# @return [Mihari::
|
209
|
+
# @return [Mihari::Services::Rule, nil]
|
210
210
|
#
|
211
211
|
def from_id(id)
|
212
212
|
return nil unless Mihari::Rule.exists?(id)
|
213
213
|
|
214
|
-
|
214
|
+
Services::Rule.from_model Mihari::Rule.find(id)
|
215
215
|
end
|
216
216
|
|
217
217
|
#
|
218
218
|
# @param [String] path_or_id Path to YAML file or YAML string or ID of a rule in the database
|
219
219
|
#
|
220
|
-
# @return [Mihari::
|
220
|
+
# @return [Mihari::Services::Rule]
|
221
221
|
#
|
222
222
|
def from_path_or_id(path_or_id)
|
223
223
|
rule = from_path(path_or_id)
|
data/lib/mihari/version.rb
CHANGED
@@ -83,12 +83,13 @@ module Mihari
|
|
83
83
|
id = params["id"].to_s
|
84
84
|
|
85
85
|
begin
|
86
|
-
rule = Mihari::
|
86
|
+
rule = Mihari::Services::Rule.from_model(Mihari::Rule.find(id))
|
87
87
|
rescue ActiveRecord::RecordNotFound
|
88
88
|
error!({ message: "ID:#{id} is not found" }, 404)
|
89
89
|
end
|
90
90
|
|
91
|
-
rule.
|
91
|
+
analyzer = rule.to_analyzer
|
92
|
+
analyzer.run
|
92
93
|
|
93
94
|
status 201
|
94
95
|
present({ message: "ID:#{id} is ran successfully" }, with: Entities::Message)
|
@@ -105,7 +106,7 @@ module Mihari
|
|
105
106
|
yaml = params[:yaml]
|
106
107
|
|
107
108
|
begin
|
108
|
-
rule =
|
109
|
+
rule = Services::Rule.from_yaml(yaml)
|
109
110
|
rescue YAMLSyntaxError => e
|
110
111
|
error!({ message: e.message }, 400)
|
111
112
|
end
|
@@ -128,13 +129,13 @@ module Mihari
|
|
128
129
|
end
|
129
130
|
|
130
131
|
begin
|
131
|
-
rule.
|
132
|
+
rule.to_model.save
|
132
133
|
rescue ActiveRecord::RecordNotUnique
|
133
134
|
error!({ message: "ID:#{rule.id} is already registered" }, 400)
|
134
135
|
end
|
135
136
|
|
136
137
|
status 201
|
137
|
-
present rule.
|
138
|
+
present rule.to_model, with: Entities::Rule
|
138
139
|
end
|
139
140
|
|
140
141
|
desc "Update a rule", {
|
@@ -156,7 +157,7 @@ module Mihari
|
|
156
157
|
end
|
157
158
|
|
158
159
|
begin
|
159
|
-
rule =
|
160
|
+
rule = Services::Rule.from_yaml(yaml)
|
160
161
|
rescue YAMLSyntaxError => e
|
161
162
|
error!({ message: e.message }, 400)
|
162
163
|
end
|
@@ -171,13 +172,13 @@ module Mihari
|
|
171
172
|
end
|
172
173
|
|
173
174
|
begin
|
174
|
-
rule.
|
175
|
+
rule.to_model.save
|
175
176
|
rescue ActiveRecord::RecordNotUnique
|
176
177
|
error!({ message: "ID:#{id} is already registered" }, 400)
|
177
178
|
end
|
178
179
|
|
179
180
|
status 201
|
180
|
-
present rule.
|
181
|
+
present rule.to_model, with: Entities::Rule
|
181
182
|
end
|
182
183
|
|
183
184
|
desc "Delete a rule", {
|