mihari 5.4.3 → 5.4.5

Sign up to get free protection for your applications and to get access to all the features.
Files changed (108) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +3 -25
  3. data/docs/alternatives.md +5 -0
  4. data/docs/analyzers/binaryedge.md +21 -0
  5. data/docs/analyzers/censys.md +23 -0
  6. data/docs/analyzers/circl.md +29 -0
  7. data/docs/analyzers/crtsh.md +25 -0
  8. data/docs/analyzers/dnstwister.md +23 -0
  9. data/docs/analyzers/feed.md +49 -0
  10. data/docs/analyzers/greynoise.md +21 -0
  11. data/docs/analyzers/hunterhow.md +25 -0
  12. data/docs/analyzers/index.md +79 -0
  13. data/docs/analyzers/onyphe.md +21 -0
  14. data/docs/analyzers/otx.md +23 -0
  15. data/docs/analyzers/passivetotal.md +36 -0
  16. data/docs/analyzers/pulsedive.md +23 -0
  17. data/docs/analyzers/securitytrails.md +32 -0
  18. data/docs/analyzers/shodan.md +21 -0
  19. data/docs/analyzers/urlscan.md +23 -0
  20. data/docs/analyzers/virustotal.md +34 -0
  21. data/docs/analyzers/virustotal_intelligence.md +22 -0
  22. data/docs/analyzers/zoomeye.md +25 -0
  23. data/docs/configuration.md +35 -0
  24. data/docs/emitters/database.md +22 -0
  25. data/docs/emitters/hive.md +18 -0
  26. data/docs/emitters/index.md +7 -0
  27. data/docs/emitters/misp.md +16 -0
  28. data/docs/emitters/slack.md +16 -0
  29. data/docs/emitters/webhook.md +63 -0
  30. data/docs/enrichers/google_public_dns.md +19 -0
  31. data/docs/enrichers/index.md +6 -0
  32. data/docs/enrichers/ipinfo.md +19 -0
  33. data/docs/enrichers/shodan.md +22 -0
  34. data/docs/enrichers/whois.md +17 -0
  35. data/docs/github_actions.md +43 -0
  36. data/docs/index.md +13 -0
  37. data/docs/installation.md +31 -0
  38. data/docs/requirements.md +20 -0
  39. data/docs/rule.md +165 -0
  40. data/docs/tags.md +3 -0
  41. data/docs/usage.md +100 -0
  42. data/frontend/package-lock.json +2414 -1516
  43. data/frontend/package.json +22 -22
  44. data/lib/mihari/analyzers/base.rb +25 -10
  45. data/lib/mihari/analyzers/binaryedge.rb +1 -7
  46. data/lib/mihari/analyzers/circl.rb +1 -1
  47. data/lib/mihari/analyzers/dnstwister.rb +1 -1
  48. data/lib/mihari/analyzers/otx.rb +1 -1
  49. data/lib/mihari/analyzers/passivetotal.rb +1 -1
  50. data/lib/mihari/analyzers/pulsedive.rb +1 -1
  51. data/lib/mihari/analyzers/rule.rb +18 -13
  52. data/lib/mihari/analyzers/securitytrails.rb +1 -1
  53. data/lib/mihari/analyzers/urlscan.rb +1 -1
  54. data/lib/mihari/analyzers/virustotal.rb +1 -1
  55. data/lib/mihari/analyzers/zoomeye.rb +1 -1
  56. data/lib/mihari/clients/binaryedge.rb +4 -7
  57. data/lib/mihari/clients/crtsh.rb +1 -3
  58. data/lib/mihari/clients/publsedive.rb +1 -1
  59. data/lib/mihari/clients/shodan.rb +2 -2
  60. data/lib/mihari/commands/alert.rb +42 -13
  61. data/lib/mihari/commands/rule.rb +11 -7
  62. data/lib/mihari/commands/search.rb +54 -22
  63. data/lib/mihari/config.rb +5 -0
  64. data/lib/mihari/emitters/base.rb +9 -3
  65. data/lib/mihari/emitters/slack.rb +1 -1
  66. data/lib/mihari/enrichers/base.rb +13 -0
  67. data/lib/mihari/enrichers/google_public_dns.rb +16 -1
  68. data/lib/mihari/enrichers/ipinfo.rb +9 -13
  69. data/lib/mihari/enrichers/shodan.rb +1 -2
  70. data/lib/mihari/enrichers/whois.rb +2 -2
  71. data/lib/mihari/errors.rb +16 -10
  72. data/lib/mihari/feed/parser.rb +2 -2
  73. data/lib/mihari/models/artifact.rb +1 -1
  74. data/lib/mihari/models/autonomous_system.rb +11 -5
  75. data/lib/mihari/models/cpe.rb +10 -4
  76. data/lib/mihari/models/dns.rb +11 -16
  77. data/lib/mihari/models/geolocation.rb +11 -5
  78. data/lib/mihari/models/port.rb +10 -4
  79. data/lib/mihari/models/reverse_dns.rb +10 -4
  80. data/lib/mihari/models/whois.rb +4 -1
  81. data/lib/mihari/schemas/analyzer.rb +1 -0
  82. data/lib/mihari/services/alert_builder.rb +43 -0
  83. data/lib/mihari/services/alert_proxy.rb +7 -25
  84. data/lib/mihari/services/alert_runner.rb +9 -0
  85. data/lib/mihari/services/rule_builder.rb +47 -0
  86. data/lib/mihari/services/rule_proxy.rb +5 -61
  87. data/lib/mihari/services/rule_runner.rb +9 -4
  88. data/lib/mihari/structs/binaryedge.rb +89 -0
  89. data/lib/mihari/structs/shodan.rb +2 -1
  90. data/lib/mihari/structs/urlscan.rb +1 -3
  91. data/lib/mihari/structs/virustotal_intelligence.rb +1 -3
  92. data/lib/mihari/type_checker.rb +1 -1
  93. data/lib/mihari/version.rb +1 -1
  94. data/lib/mihari/web/endpoints/alerts.rb +33 -15
  95. data/lib/mihari/web/endpoints/artifacts.rb +53 -25
  96. data/lib/mihari/web/endpoints/configs.rb +2 -2
  97. data/lib/mihari/web/endpoints/ip_addresses.rb +3 -5
  98. data/lib/mihari/web/endpoints/rules.rb +97 -71
  99. data/lib/mihari/web/endpoints/tags.rb +15 -5
  100. data/lib/mihari/web/public/assets/index-0a5a47bf.js +1740 -0
  101. data/lib/mihari/web/public/index.html +1 -1
  102. data/lib/mihari/web/public/redoc-static.html +419 -382
  103. data/lib/mihari.rb +4 -0
  104. data/mihari.gemspec +6 -5
  105. data/mkdocs.yml +35 -0
  106. data/requirements.txt +2 -0
  107. metadata +70 -12
  108. data/lib/mihari/web/public/assets/index-4d7eda9f.js +0 -1738
data/lib/mihari.rb CHANGED
@@ -20,6 +20,7 @@ require "active_record"
20
20
 
21
21
  # dry-rb
22
22
  require "dry/files"
23
+ require "dry/monads"
23
24
  require "dry/schema"
24
25
  require "dry/struct"
25
26
  require "dry/types"
@@ -114,13 +115,16 @@ require "mihari/type_checker"
114
115
  require "mihari/http"
115
116
 
116
117
  # Services
118
+ require "mihari/services/rule_builder"
117
119
  require "mihari/services/rule_proxy"
118
120
  require "mihari/services/rule_runner"
119
121
 
122
+ require "mihari/services/alert_builder"
120
123
  require "mihari/services/alert_proxy"
121
124
  require "mihari/services/alert_runner"
122
125
 
123
126
  # Structs
127
+ require "mihari/structs/binaryedge"
124
128
  require "mihari/structs/censys"
125
129
  require "mihari/structs/config"
126
130
  require "mihari/structs/filters"
data/mihari.gemspec CHANGED
@@ -16,7 +16,7 @@ Gem::Specification.new do |spec|
16
16
  spec.authors = ["Manabu Niseki"]
17
17
  spec.email = ["manabu.niseki@gmail.com"]
18
18
 
19
- spec.summary = "A framework for continuous OSINT based threat hunting"
19
+ spec.summary = "A query aggregator for OSINT based threat hunting"
20
20
  spec.homepage = "https://github.com/ninoseki/mihari"
21
21
  spec.license = "MIT"
22
22
 
@@ -54,16 +54,17 @@ Gem::Specification.new do |spec|
54
54
  spec.add_development_dependency "webmock", "~> 3.19"
55
55
 
56
56
  unless ci_env?
57
- spec.add_development_dependency "lefthook", "~> 1.4"
57
+ spec.add_development_dependency "lefthook", "~> 1.5"
58
58
  spec.add_development_dependency "solargraph", "~> 0.49"
59
59
  end
60
60
 
61
- spec.add_dependency "activerecord", "7.0.7.2"
61
+ spec.add_dependency "activerecord", "7.0.8"
62
62
  spec.add_dependency "addressable", "2.8.5"
63
63
  spec.add_dependency "awrence", "2.0.1"
64
64
  spec.add_dependency "dotenv", "2.8.1"
65
65
  spec.add_dependency "dry-container", "0.11.0"
66
66
  spec.add_dependency "dry-files", "1.0.1"
67
+ spec.add_dependency "dry-monads", "1.6.0"
67
68
  spec.add_dependency "dry-schema", "1.13.3"
68
69
  spec.add_dependency "dry-struct", "1.6.0"
69
70
  spec.add_dependency "dry-validation", "1.10.0"
@@ -81,14 +82,14 @@ Gem::Specification.new do |spec|
81
82
  spec.add_dependency "parallel", "1.23.0"
82
83
  spec.add_dependency "plissken", "2.0.1"
83
84
  spec.add_dependency "public_suffix", "5.0.3"
84
- spec.add_dependency "puma", "6.3.1"
85
+ spec.add_dependency "puma", "6.4.0"
85
86
  spec.add_dependency "rack", "3.0.8"
86
87
  spec.add_dependency "rack-cors", "2.0.1"
87
88
  spec.add_dependency "rackup", "2.1.0"
88
89
  spec.add_dependency "semantic_logger", "4.14.0"
89
90
  spec.add_dependency "sentry-ruby", "5.11.0"
90
91
  spec.add_dependency "slack-notifier", "2.4.0"
91
- spec.add_dependency "sqlite3", "1.6.4"
92
+ spec.add_dependency "sqlite3", "1.6.6"
92
93
  spec.add_dependency "thor", "1.2.2"
93
94
  spec.add_dependency "uuidtools", "2.2.0"
94
95
  spec.add_dependency "whois", "5.1.0"
data/mkdocs.yml ADDED
@@ -0,0 +1,35 @@
1
+ site_name: Mihari
2
+
3
+ theme:
4
+ name: material
5
+
6
+ plugins:
7
+ search:
8
+ tags:
9
+ enabled: true
10
+ tags_file: tags.md
11
+ tags_slugify: !!python/object/apply:pymdownx.slugs.slugify
12
+ kwds:
13
+ case: lower
14
+
15
+ nav:
16
+ - Mihari: index.md
17
+ - Requirements: requirements.md
18
+ - Installation: installation.md
19
+ - How to Write a Rule: rule.md
20
+ - Usage: usage.md
21
+ - Configuration: configuration.md
22
+ - GitHub Actions: github_actions.md
23
+ - Analyzers: "analyzers/index.md"
24
+ - Enrichers: "enrichers/index.md"
25
+ - Emitters: "emitters/index.md"
26
+ - Tags: "./tags.md"
27
+
28
+ markdown_extensions:
29
+ - toc:
30
+ permalink: true
31
+ - admonition
32
+ - pymdownx.details
33
+ - pymdownx.superfences
34
+ - pymdownx.highlight
35
+ - pymdownx.extra
data/requirements.txt ADDED
@@ -0,0 +1,2 @@
1
+ mkdocs==1.5.3
2
+ mkdocs-material==9.4.2
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: mihari
3
3
  version: !ruby/object:Gem::Version
4
- version: 5.4.3
4
+ version: 5.4.5
5
5
  platform: ruby
6
6
  authors:
7
7
  - Manabu Niseki
8
8
  autorequire:
9
9
  bindir: exe
10
10
  cert_chain: []
11
- date: 2023-09-09 00:00:00.000000000 Z
11
+ date: 2023-09-30 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: bundler
@@ -240,14 +240,14 @@ dependencies:
240
240
  requirements:
241
241
  - - "~>"
242
242
  - !ruby/object:Gem::Version
243
- version: '1.4'
243
+ version: '1.5'
244
244
  type: :development
245
245
  prerelease: false
246
246
  version_requirements: !ruby/object:Gem::Requirement
247
247
  requirements:
248
248
  - - "~>"
249
249
  - !ruby/object:Gem::Version
250
- version: '1.4'
250
+ version: '1.5'
251
251
  - !ruby/object:Gem::Dependency
252
252
  name: solargraph
253
253
  requirement: !ruby/object:Gem::Requirement
@@ -268,14 +268,14 @@ dependencies:
268
268
  requirements:
269
269
  - - '='
270
270
  - !ruby/object:Gem::Version
271
- version: 7.0.7.2
271
+ version: 7.0.8
272
272
  type: :runtime
273
273
  prerelease: false
274
274
  version_requirements: !ruby/object:Gem::Requirement
275
275
  requirements:
276
276
  - - '='
277
277
  - !ruby/object:Gem::Version
278
- version: 7.0.7.2
278
+ version: 7.0.8
279
279
  - !ruby/object:Gem::Dependency
280
280
  name: addressable
281
281
  requirement: !ruby/object:Gem::Requirement
@@ -346,6 +346,20 @@ dependencies:
346
346
  - - '='
347
347
  - !ruby/object:Gem::Version
348
348
  version: 1.0.1
349
+ - !ruby/object:Gem::Dependency
350
+ name: dry-monads
351
+ requirement: !ruby/object:Gem::Requirement
352
+ requirements:
353
+ - - '='
354
+ - !ruby/object:Gem::Version
355
+ version: 1.6.0
356
+ type: :runtime
357
+ prerelease: false
358
+ version_requirements: !ruby/object:Gem::Requirement
359
+ requirements:
360
+ - - '='
361
+ - !ruby/object:Gem::Version
362
+ version: 1.6.0
349
363
  - !ruby/object:Gem::Dependency
350
364
  name: dry-schema
351
365
  requirement: !ruby/object:Gem::Requirement
@@ -590,14 +604,14 @@ dependencies:
590
604
  requirements:
591
605
  - - '='
592
606
  - !ruby/object:Gem::Version
593
- version: 6.3.1
607
+ version: 6.4.0
594
608
  type: :runtime
595
609
  prerelease: false
596
610
  version_requirements: !ruby/object:Gem::Requirement
597
611
  requirements:
598
612
  - - '='
599
613
  - !ruby/object:Gem::Version
600
- version: 6.3.1
614
+ version: 6.4.0
601
615
  - !ruby/object:Gem::Dependency
602
616
  name: rack
603
617
  requirement: !ruby/object:Gem::Requirement
@@ -688,14 +702,14 @@ dependencies:
688
702
  requirements:
689
703
  - - '='
690
704
  - !ruby/object:Gem::Version
691
- version: 1.6.4
705
+ version: 1.6.6
692
706
  type: :runtime
693
707
  prerelease: false
694
708
  version_requirements: !ruby/object:Gem::Requirement
695
709
  requirements:
696
710
  - - '='
697
711
  - !ruby/object:Gem::Version
698
- version: 1.6.4
712
+ version: 1.6.6
699
713
  - !ruby/object:Gem::Dependency
700
714
  name: thor
701
715
  requirement: !ruby/object:Gem::Requirement
@@ -772,6 +786,45 @@ files:
772
786
  - bin/setup
773
787
  - build_frontend.sh
774
788
  - config.ru
789
+ - docs/alternatives.md
790
+ - docs/analyzers/binaryedge.md
791
+ - docs/analyzers/censys.md
792
+ - docs/analyzers/circl.md
793
+ - docs/analyzers/crtsh.md
794
+ - docs/analyzers/dnstwister.md
795
+ - docs/analyzers/feed.md
796
+ - docs/analyzers/greynoise.md
797
+ - docs/analyzers/hunterhow.md
798
+ - docs/analyzers/index.md
799
+ - docs/analyzers/onyphe.md
800
+ - docs/analyzers/otx.md
801
+ - docs/analyzers/passivetotal.md
802
+ - docs/analyzers/pulsedive.md
803
+ - docs/analyzers/securitytrails.md
804
+ - docs/analyzers/shodan.md
805
+ - docs/analyzers/urlscan.md
806
+ - docs/analyzers/virustotal.md
807
+ - docs/analyzers/virustotal_intelligence.md
808
+ - docs/analyzers/zoomeye.md
809
+ - docs/configuration.md
810
+ - docs/emitters/database.md
811
+ - docs/emitters/hive.md
812
+ - docs/emitters/index.md
813
+ - docs/emitters/misp.md
814
+ - docs/emitters/slack.md
815
+ - docs/emitters/webhook.md
816
+ - docs/enrichers/google_public_dns.md
817
+ - docs/enrichers/index.md
818
+ - docs/enrichers/ipinfo.md
819
+ - docs/enrichers/shodan.md
820
+ - docs/enrichers/whois.md
821
+ - docs/github_actions.md
822
+ - docs/index.md
823
+ - docs/installation.md
824
+ - docs/requirements.md
825
+ - docs/rule.md
826
+ - docs/tags.md
827
+ - docs/usage.md
775
828
  - exe/mihari
776
829
  - frontend/.eslintrc.cjs
777
830
  - frontend/.gitignore
@@ -967,10 +1020,13 @@ files:
967
1020
  - lib/mihari/schemas/enricher.rb
968
1021
  - lib/mihari/schemas/macros.rb
969
1022
  - lib/mihari/schemas/rule.rb
1023
+ - lib/mihari/services/alert_builder.rb
970
1024
  - lib/mihari/services/alert_proxy.rb
971
1025
  - lib/mihari/services/alert_runner.rb
1026
+ - lib/mihari/services/rule_builder.rb
972
1027
  - lib/mihari/services/rule_proxy.rb
973
1028
  - lib/mihari/services/rule_runner.rb
1029
+ - lib/mihari/structs/binaryedge.rb
974
1030
  - lib/mihari/structs/censys.rb
975
1031
  - lib/mihari/structs/config.rb
976
1032
  - lib/mihari/structs/filters.rb
@@ -996,14 +1052,16 @@ files:
996
1052
  - lib/mihari/web/endpoints/tags.rb
997
1053
  - lib/mihari/web/middleware/connection_adapter.rb
998
1054
  - lib/mihari/web/middleware/error_notification_adapter.rb
1055
+ - lib/mihari/web/public/assets/index-0a5a47bf.js
999
1056
  - lib/mihari/web/public/assets/index-33165282.css
1000
- - lib/mihari/web/public/assets/index-4d7eda9f.js
1001
1057
  - lib/mihari/web/public/assets/mode-yaml-a21faa53.js
1002
1058
  - lib/mihari/web/public/favicon.ico
1003
1059
  - lib/mihari/web/public/index.html
1004
1060
  - lib/mihari/web/public/redoc-static.html
1005
1061
  - mihari.gemspec
1062
+ - mkdocs.yml
1006
1063
  - renovate.json
1064
+ - requirements.txt
1007
1065
  homepage: https://github.com/ninoseki/mihari
1008
1066
  licenses:
1009
1067
  - MIT
@@ -1027,5 +1085,5 @@ requirements: []
1027
1085
  rubygems_version: 3.4.1
1028
1086
  signing_key:
1029
1087
  specification_version: 4
1030
- summary: A framework for continuous OSINT based threat hunting
1088
+ summary: A query aggregator for OSINT based threat hunting
1031
1089
  test_files: []