mihari 5.3.1 → 5.3.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (44) hide show
  1. checksums.yaml +4 -4
  2. data/frontend/package-lock.json +538 -581
  3. data/frontend/package.json +21 -21
  4. data/frontend/src/ace-config.ts +6 -0
  5. data/frontend/src/components/alert/Form.vue +2 -2
  6. data/frontend/src/components/rule/EditRule.vue +3 -2
  7. data/frontend/src/components/rule/Form.vue +2 -2
  8. data/frontend/src/components/rule/InputForm.vue +18 -59
  9. data/frontend/src/components/rule/YAML.vue +21 -28
  10. data/frontend/src/views/Artifact.vue +3 -8
  11. data/frontend/src/views/EditRule.vue +2 -7
  12. data/frontend/src/views/Rule.vue +3 -8
  13. data/lib/mihari/analyzers/base.rb +6 -0
  14. data/lib/mihari/analyzers/binaryedge.rb +1 -1
  15. data/lib/mihari/analyzers/censys.rb +1 -1
  16. data/lib/mihari/analyzers/onyphe.rb +1 -1
  17. data/lib/mihari/analyzers/rule.rb +4 -7
  18. data/lib/mihari/analyzers/shodan.rb +1 -1
  19. data/lib/mihari/analyzers/urlscan.rb +1 -1
  20. data/lib/mihari/analyzers/virustotal_intelligence.rb +1 -1
  21. data/lib/mihari/analyzers/zoomeye.rb +2 -2
  22. data/lib/mihari/commands/rule.rb +3 -3
  23. data/lib/mihari/commands/search.rb +3 -3
  24. data/lib/mihari/constants.rb +3 -0
  25. data/lib/mihari/emitters/base.rb +2 -2
  26. data/lib/mihari/emitters/misp.rb +3 -3
  27. data/lib/mihari/emitters/slack.rb +1 -1
  28. data/lib/mihari/emitters/the_hive.rb +1 -1
  29. data/lib/mihari/emitters/webhook.rb +1 -1
  30. data/lib/mihari/mixins/configurable.rb +5 -0
  31. data/lib/mihari/mixins/falsepositive.rb +1 -1
  32. data/lib/mihari/mixins/retriable.rb +0 -2
  33. data/lib/mihari/{structs → services}/rule.rb +16 -16
  34. data/lib/mihari/version.rb +1 -1
  35. data/lib/mihari/web/endpoints/rules.rb +9 -8
  36. data/lib/mihari/web/public/assets/index-116033d0.js +1737 -0
  37. data/lib/mihari/web/public/assets/index-33165282.css +1 -0
  38. data/lib/mihari/web/public/assets/mode-yaml-a21faa53.js +8 -0
  39. data/lib/mihari/web/public/index.html +2 -2
  40. data/lib/mihari.rb +3 -2
  41. data/mihari.gemspec +5 -4
  42. metadata +62 -18
  43. data/lib/mihari/web/public/assets/index-b17c40c6.css +0 -1
  44. data/lib/mihari/web/public/assets/index-f740e4f9.js +0 -799
@@ -0,0 +1,8 @@
1
+ ace.define("ace/mode/yaml_highlight_rules",["require","exports","module","ace/lib/oop","ace/mode/text_highlight_rules"],function(e,t,n){"use strict";var r=e("../lib/oop"),i=e("./text_highlight_rules").TextHighlightRules,s=function(){this.$rules={start:[{token:"comment",regex:"#.*$"},{token:"list.markup",regex:/^(?:-{3}|\.{3})\s*(?=#|$)/},{token:"list.markup",regex:/^\s*[\-?](?:$|\s)/},{token:"constant",regex:"!![\\w//]+"},{token:"constant.language",regex:"[&\\*][a-zA-Z0-9-_]+"},{token:["meta.tag","keyword"],regex:/^(\s*\w[^\s:]*?)(:(?=\s|$))/},{token:["meta.tag","keyword"],regex:/(\w[^\s:]*?)(\s*:(?=\s|$))/},{token:"keyword.operator",regex:"<<\\w*:\\w*"},{token:"keyword.operator",regex:"-\\s*(?=[{])"},{token:"string",regex:'["](?:(?:\\\\.)|(?:[^"\\\\]))*?["]'},{token:"string",regex:/[|>][-+\d]*(?:$|\s+(?:$|#))/,onMatch:function(e,t,n,r){r=r.replace(/ #.*/,"");var i=/^ *((:\s*)?-(\s*[^|>])?)?/.exec(r)[0].replace(/\S\s*$/,"").length,s=parseInt(/\d+[\s+-]*$/.exec(r));return s?(i+=s-1,this.next="mlString"):this.next="mlStringPre",n.length?(n[0]=this.next,n[1]=i):(n.push(this.next),n.push(i)),this.token},next:"mlString"},{token:"string",regex:"['](?:(?:\\\\.)|(?:[^'\\\\]))*?[']"},{token:"constant.numeric",regex:/(\b|[+\-\.])[\d_]+(?:(?:\.[\d_]*)?(?:[eE][+\-]?[\d_]+)?)(?=[^\d-\w]|$)$/},{token:"constant.numeric",regex:/[+\-]?\.inf\b|NaN\b|0x[\dA-Fa-f_]+|0b[10_]+/},{token:"constant.language.boolean",regex:"\\b(?:true|false|TRUE|FALSE|True|False|yes|no)\\b"},{token:"paren.lparen",regex:"[[({]"},{token:"paren.rparen",regex:"[\\])}]"},{token:"text",regex:/[^\s,:\[\]\{\}]+/}],mlStringPre:[{token:"indent",regex:/^ *$/},{token:"indent",regex:/^ */,onMatch:function(e,t,n){var r=n[1];return r>=e.length?(this.next="start",n.shift(),n.shift()):(n[1]=e.length-1,this.next=n[0]="mlString"),this.token},next:"mlString"},{defaultToken:"string"}],mlString:[{token:"indent",regex:/^ *$/},{token:"indent",regex:/^ */,onMatch:function(e,t,n){var r=n[1];return r>=e.length?(this.next="start",n.splice(0)):this.next="mlString",this.token},next:"mlString"},{token:"string",regex:".+"}]},this.normalizeRules()};r.inherits(s,i),t.YamlHighlightRules=s}),ace.define("ace/mode/matching_brace_outdent",["require","exports","module","ace/range"],function(e,t,n){"use strict";var r=e("../range").Range,i=function(){};(function(){this.checkOutdent=function(e,t){return/^\s+$/.test(e)?/^\s*\}/.test(t):!1},this.autoOutdent=function(e,t){var n=e.getLine(t),i=n.match(/^(\s*\})/);if(!i)return 0;var s=i[1].length,o=e.findMatchingBracket({row:t,column:s});if(!o||o.row==t)return 0;var u=this.$getIndent(e.getLine(o.row));e.replace(new r(t,0,t,s-1),u)},this.$getIndent=function(e){return e.match(/^\s*/)[0]}}).call(i.prototype),t.MatchingBraceOutdent=i}),ace.define("ace/mode/folding/coffee",["require","exports","module","ace/lib/oop","ace/mode/folding/fold_mode","ace/range"],function(e,t,n){"use strict";var r=e("../../lib/oop"),i=e("./fold_mode").FoldMode,s=e("../../range").Range,o=t.FoldMode=function(){};r.inherits(o,i),function(){this.getFoldWidgetRange=function(e,t,n){var r=this.indentationBlock(e,n);if(r)return r;var i=/\S/,o=e.getLine(n),u=o.search(i);if(u==-1||o[u]!="#")return;var a=o.length,f=e.getLength(),l=n,c=n;while(++n<f){o=e.getLine(n);var h=o.search(i);if(h==-1)continue;if(o[h]!="#")break;c=n}if(c>l){var p=e.getLine(c).length;return new s(l,a,c,p)}},this.getFoldWidget=function(e,t,n){var r=e.getLine(n),i=r.search(/\S/),s=e.getLine(n+1),o=e.getLine(n-1),u=o.search(/\S/),a=s.search(/\S/);if(i==-1)return e.foldWidgets[n-1]=u!=-1&&u<a?"start":"","";if(u==-1){if(i==a&&r[i]=="#"&&s[i]=="#")return e.foldWidgets[n-1]="",e.foldWidgets[n+1]="","start"}else if(u==i&&r[i]=="#"&&o[i]=="#"&&e.getLine(n-2).search(/\S/)==-1)return e.foldWidgets[n-1]="start",e.foldWidgets[n+1]="","";return u!=-1&&u<i?e.foldWidgets[n-1]="start":e.foldWidgets[n-1]="",i<a?"start":""}}.call(o.prototype)}),ace.define("ace/mode/yaml",["require","exports","module","ace/lib/oop","ace/mode/text","ace/mode/yaml_highlight_rules","ace/mode/matching_brace_outdent","ace/mode/folding/coffee","ace/worker/worker_client"],function(e,t,n){"use strict";var r=e("../lib/oop"),i=e("./text").Mode,s=e("./yaml_highlight_rules").YamlHighlightRules,o=e("./matching_brace_outdent").MatchingBraceOutdent,u=e("./folding/coffee").FoldMode,a=e("../worker/worker_client").WorkerClient,f=function(){this.HighlightRules=s,this.$outdent=new o,this.foldingRules=new u,this.$behaviour=this.$defaultBehaviour};r.inherits(f,i),function(){this.lineCommentStart=["#"],this.getNextLineIndent=function(e,t,n){var r=this.$getIndent(t);if(e=="start"){var i=t.match(/^.*[\{\(\[]\s*$/);i&&(r+=n)}return r},this.checkOutdent=function(e,t,n){return this.$outdent.checkOutdent(t,n)},this.autoOutdent=function(e,t,n){this.$outdent.autoOutdent(t,n)},this.createWorker=function(e){var t=new a(["ace"],"ace/mode/yaml_worker","YamlWorker");return t.attachToDocument(e.getDocument()),t.on("annotate",function(t){e.setAnnotations(t.data)}),t.on("terminate",function(){e.clearAnnotations()}),t},this.$id="ace/mode/yaml"}.call(f.prototype),t.Mode=f}); (function() {
2
+ ace.require(["ace/mode/yaml"], function(m) {
3
+ if (typeof module == "object" && typeof exports == "object" && module) {
4
+ module.exports = m;
5
+ }
6
+ });
7
+ })();
8
+
@@ -6,8 +6,8 @@
6
6
  <meta name="viewport" content="width=device-width,initial-scale=1.0" />
7
7
  <link rel="icon" href="/favicon.ico" />
8
8
  <title>Mihari</title>
9
- <script type="module" crossorigin src="/assets/index-f740e4f9.js"></script>
10
- <link rel="stylesheet" href="/assets/index-b17c40c6.css">
9
+ <script type="module" crossorigin src="/assets/index-116033d0.js"></script>
10
+ <link rel="stylesheet" href="/assets/index-33165282.css">
11
11
  </head>
12
12
  <body>
13
13
  <noscript>
data/lib/mihari.rb CHANGED
@@ -20,7 +20,6 @@ require "active_record"
20
20
 
21
21
  # dry-rb
22
22
  require "dry/files"
23
- require "dry/initializer"
24
23
  require "dry/schema"
25
24
  require "dry/struct"
26
25
  require "dry/types"
@@ -114,6 +113,9 @@ require "mihari/database"
114
113
  require "mihari/type_checker"
115
114
  require "mihari/http"
116
115
 
116
+ # Services
117
+ require "mihari/services/rule"
118
+
117
119
  # Structs
118
120
  require "mihari/structs/censys"
119
121
  require "mihari/structs/config"
@@ -122,7 +124,6 @@ require "mihari/structs/google_public_dns"
122
124
  require "mihari/structs/greynoise"
123
125
  require "mihari/structs/ipinfo"
124
126
  require "mihari/structs/onyphe"
125
- require "mihari/structs/rule"
126
127
  require "mihari/structs/shodan"
127
128
  require "mihari/structs/urlscan"
128
129
  require "mihari/structs/virustotal_intelligence"
data/mihari.gemspec CHANGED
@@ -2,6 +2,7 @@
2
2
 
3
3
  lib = File.expand_path("lib", __dir__)
4
4
  $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
5
+
5
6
  require "mihari/version"
6
7
 
7
8
  def ci_env?
@@ -36,7 +37,7 @@ Gem::Specification.new do |spec|
36
37
  spec.require_paths = ["lib"]
37
38
 
38
39
  spec.add_development_dependency "bundler", "~> 2.4"
39
- spec.add_development_dependency "coveralls_reborn", "~> 0.27"
40
+ spec.add_development_dependency "coveralls_reborn", "~> 0.28"
40
41
  spec.add_development_dependency "fakefs", "~> 2.5"
41
42
  spec.add_development_dependency "fuubar", "~> 2.5"
42
43
  spec.add_development_dependency "mysql2", "~> 0.5"
@@ -47,7 +48,7 @@ Gem::Specification.new do |spec|
47
48
  spec.add_development_dependency "rerun", "~> 0.14"
48
49
  spec.add_development_dependency "rspec", "~> 3.12"
49
50
  spec.add_development_dependency "simplecov-lcov", "~> 0.8.0"
50
- spec.add_development_dependency "standard", "~> 1.29"
51
+ spec.add_development_dependency "standard", "~> 1.30"
51
52
  spec.add_development_dependency "timecop", "~> 0.9"
52
53
  spec.add_development_dependency "vcr", "~> 6.2"
53
54
  spec.add_development_dependency "webmock", "~> 3.18"
@@ -59,7 +60,7 @@ Gem::Specification.new do |spec|
59
60
  end
60
61
 
61
62
  spec.add_dependency "activerecord", "7.0.6"
62
- spec.add_dependency "addressable", "2.8.4"
63
+ spec.add_dependency "addressable", "2.8.5"
63
64
  spec.add_dependency "awrence", "2.0.1"
64
65
  spec.add_dependency "dotenv", "2.8.1"
65
66
  spec.add_dependency "dry-container", "0.11.0"
@@ -85,7 +86,7 @@ Gem::Specification.new do |spec|
85
86
  spec.add_dependency "rack", "3.0.8"
86
87
  spec.add_dependency "rack-cors", "2.0.1"
87
88
  spec.add_dependency "rackup", "2.1.0"
88
- spec.add_dependency "semantic_logger", "4.13.0"
89
+ spec.add_dependency "semantic_logger", "4.14.0"
89
90
  spec.add_dependency "sentry-ruby", "5.10.0"
90
91
  spec.add_dependency "slack-notifier", "2.4.0"
91
92
  spec.add_dependency "sqlite3", "1.6.3"
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: mihari
3
3
  version: !ruby/object:Gem::Version
4
- version: 5.3.1
4
+ version: 5.3.2
5
5
  platform: ruby
6
6
  authors:
7
7
  - Manabu Niseki
8
- autorequire:
8
+ autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2023-07-16 00:00:00.000000000 Z
11
+ date: 2023-08-07 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: bundler
@@ -30,14 +30,14 @@ dependencies:
30
30
  requirements:
31
31
  - - "~>"
32
32
  - !ruby/object:Gem::Version
33
- version: '0.27'
33
+ version: '0.28'
34
34
  type: :development
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - "~>"
39
39
  - !ruby/object:Gem::Version
40
- version: '0.27'
40
+ version: '0.28'
41
41
  - !ruby/object:Gem::Dependency
42
42
  name: fakefs
43
43
  requirement: !ruby/object:Gem::Requirement
@@ -184,14 +184,14 @@ dependencies:
184
184
  requirements:
185
185
  - - "~>"
186
186
  - !ruby/object:Gem::Version
187
- version: '1.29'
187
+ version: '1.30'
188
188
  type: :development
189
189
  prerelease: false
190
190
  version_requirements: !ruby/object:Gem::Requirement
191
191
  requirements:
192
192
  - - "~>"
193
193
  - !ruby/object:Gem::Version
194
- version: '1.29'
194
+ version: '1.30'
195
195
  - !ruby/object:Gem::Dependency
196
196
  name: timecop
197
197
  requirement: !ruby/object:Gem::Requirement
@@ -234,6 +234,48 @@ dependencies:
234
234
  - - "~>"
235
235
  - !ruby/object:Gem::Version
236
236
  version: '3.18'
237
+ - !ruby/object:Gem::Dependency
238
+ name: lefthook
239
+ requirement: !ruby/object:Gem::Requirement
240
+ requirements:
241
+ - - "~>"
242
+ - !ruby/object:Gem::Version
243
+ version: '1.4'
244
+ type: :development
245
+ prerelease: false
246
+ version_requirements: !ruby/object:Gem::Requirement
247
+ requirements:
248
+ - - "~>"
249
+ - !ruby/object:Gem::Version
250
+ version: '1.4'
251
+ - !ruby/object:Gem::Dependency
252
+ name: solargraph
253
+ requirement: !ruby/object:Gem::Requirement
254
+ requirements:
255
+ - - "~>"
256
+ - !ruby/object:Gem::Version
257
+ version: '0.49'
258
+ type: :development
259
+ prerelease: false
260
+ version_requirements: !ruby/object:Gem::Requirement
261
+ requirements:
262
+ - - "~>"
263
+ - !ruby/object:Gem::Version
264
+ version: '0.49'
265
+ - !ruby/object:Gem::Dependency
266
+ name: steep
267
+ requirement: !ruby/object:Gem::Requirement
268
+ requirements:
269
+ - - "~>"
270
+ - !ruby/object:Gem::Version
271
+ version: '1.4'
272
+ type: :development
273
+ prerelease: false
274
+ version_requirements: !ruby/object:Gem::Requirement
275
+ requirements:
276
+ - - "~>"
277
+ - !ruby/object:Gem::Version
278
+ version: '1.4'
237
279
  - !ruby/object:Gem::Dependency
238
280
  name: activerecord
239
281
  requirement: !ruby/object:Gem::Requirement
@@ -254,14 +296,14 @@ dependencies:
254
296
  requirements:
255
297
  - - '='
256
298
  - !ruby/object:Gem::Version
257
- version: 2.8.4
299
+ version: 2.8.5
258
300
  type: :runtime
259
301
  prerelease: false
260
302
  version_requirements: !ruby/object:Gem::Requirement
261
303
  requirements:
262
304
  - - '='
263
305
  - !ruby/object:Gem::Version
264
- version: 2.8.4
306
+ version: 2.8.5
265
307
  - !ruby/object:Gem::Dependency
266
308
  name: awrence
267
309
  requirement: !ruby/object:Gem::Requirement
@@ -618,14 +660,14 @@ dependencies:
618
660
  requirements:
619
661
  - - '='
620
662
  - !ruby/object:Gem::Version
621
- version: 4.13.0
663
+ version: 4.14.0
622
664
  type: :runtime
623
665
  prerelease: false
624
666
  version_requirements: !ruby/object:Gem::Requirement
625
667
  requirements:
626
668
  - - '='
627
669
  - !ruby/object:Gem::Version
628
- version: 4.13.0
670
+ version: 4.14.0
629
671
  - !ruby/object:Gem::Dependency
630
672
  name: sentry-ruby
631
673
  requirement: !ruby/object:Gem::Requirement
@@ -724,7 +766,7 @@ dependencies:
724
766
  - - '='
725
767
  - !ruby/object:Gem::Version
726
768
  version: 2.0.0
727
- description:
769
+ description:
728
770
  email:
729
771
  - manabu.niseki@gmail.com
730
772
  executables:
@@ -757,6 +799,7 @@ files:
757
799
  - frontend/public/favicon.ico
758
800
  - frontend/scripts/swagger_doc_to_yaml.rb
759
801
  - frontend/src/App.vue
802
+ - frontend/src/ace-config.ts
760
803
  - frontend/src/api-helper.ts
761
804
  - frontend/src/api.ts
762
805
  - frontend/src/components/ErrorMessage.vue
@@ -934,6 +977,7 @@ files:
934
977
  - lib/mihari/schemas/enricher.rb
935
978
  - lib/mihari/schemas/macros.rb
936
979
  - lib/mihari/schemas/rule.rb
980
+ - lib/mihari/services/rule.rb
937
981
  - lib/mihari/structs/censys.rb
938
982
  - lib/mihari/structs/config.rb
939
983
  - lib/mihari/structs/filters.rb
@@ -941,7 +985,6 @@ files:
941
985
  - lib/mihari/structs/greynoise.rb
942
986
  - lib/mihari/structs/ipinfo.rb
943
987
  - lib/mihari/structs/onyphe.rb
944
- - lib/mihari/structs/rule.rb
945
988
  - lib/mihari/structs/shodan.rb
946
989
  - lib/mihari/structs/urlscan.rb
947
990
  - lib/mihari/structs/virustotal_intelligence.rb
@@ -959,8 +1002,9 @@ files:
959
1002
  - lib/mihari/web/endpoints/tags.rb
960
1003
  - lib/mihari/web/middleware/connection_adapter.rb
961
1004
  - lib/mihari/web/middleware/error_notification_adapter.rb
962
- - lib/mihari/web/public/assets/index-b17c40c6.css
963
- - lib/mihari/web/public/assets/index-f740e4f9.js
1005
+ - lib/mihari/web/public/assets/index-116033d0.js
1006
+ - lib/mihari/web/public/assets/index-33165282.css
1007
+ - lib/mihari/web/public/assets/mode-yaml-a21faa53.js
964
1008
  - lib/mihari/web/public/favicon.ico
965
1009
  - lib/mihari/web/public/index.html
966
1010
  - lib/mihari/web/public/redoc-static.html
@@ -971,7 +1015,7 @@ licenses:
971
1015
  - MIT
972
1016
  metadata:
973
1017
  rubygems_mfa_required: 'true'
974
- post_install_message:
1018
+ post_install_message:
975
1019
  rdoc_options: []
976
1020
  require_paths:
977
1021
  - lib
@@ -986,8 +1030,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
986
1030
  - !ruby/object:Gem::Version
987
1031
  version: '0'
988
1032
  requirements: []
989
- rubygems_version: 3.4.10
990
- signing_key:
1033
+ rubygems_version: 3.4.1
1034
+ signing_key:
991
1035
  specification_version: 4
992
1036
  summary: A framework for continuous OSINT based threat hunting
993
1037
  test_files: []