mihari 5.4.3 → 5.4.5
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/README.md +3 -25
- data/docs/alternatives.md +5 -0
- data/docs/analyzers/binaryedge.md +21 -0
- data/docs/analyzers/censys.md +23 -0
- data/docs/analyzers/circl.md +29 -0
- data/docs/analyzers/crtsh.md +25 -0
- data/docs/analyzers/dnstwister.md +23 -0
- data/docs/analyzers/feed.md +49 -0
- data/docs/analyzers/greynoise.md +21 -0
- data/docs/analyzers/hunterhow.md +25 -0
- data/docs/analyzers/index.md +79 -0
- data/docs/analyzers/onyphe.md +21 -0
- data/docs/analyzers/otx.md +23 -0
- data/docs/analyzers/passivetotal.md +36 -0
- data/docs/analyzers/pulsedive.md +23 -0
- data/docs/analyzers/securitytrails.md +32 -0
- data/docs/analyzers/shodan.md +21 -0
- data/docs/analyzers/urlscan.md +23 -0
- data/docs/analyzers/virustotal.md +34 -0
- data/docs/analyzers/virustotal_intelligence.md +22 -0
- data/docs/analyzers/zoomeye.md +25 -0
- data/docs/configuration.md +35 -0
- data/docs/emitters/database.md +22 -0
- data/docs/emitters/hive.md +18 -0
- data/docs/emitters/index.md +7 -0
- data/docs/emitters/misp.md +16 -0
- data/docs/emitters/slack.md +16 -0
- data/docs/emitters/webhook.md +63 -0
- data/docs/enrichers/google_public_dns.md +19 -0
- data/docs/enrichers/index.md +6 -0
- data/docs/enrichers/ipinfo.md +19 -0
- data/docs/enrichers/shodan.md +22 -0
- data/docs/enrichers/whois.md +17 -0
- data/docs/github_actions.md +43 -0
- data/docs/index.md +13 -0
- data/docs/installation.md +31 -0
- data/docs/requirements.md +20 -0
- data/docs/rule.md +165 -0
- data/docs/tags.md +3 -0
- data/docs/usage.md +100 -0
- data/frontend/package-lock.json +2414 -1516
- data/frontend/package.json +22 -22
- data/lib/mihari/analyzers/base.rb +25 -10
- data/lib/mihari/analyzers/binaryedge.rb +1 -7
- data/lib/mihari/analyzers/circl.rb +1 -1
- data/lib/mihari/analyzers/dnstwister.rb +1 -1
- data/lib/mihari/analyzers/otx.rb +1 -1
- data/lib/mihari/analyzers/passivetotal.rb +1 -1
- data/lib/mihari/analyzers/pulsedive.rb +1 -1
- data/lib/mihari/analyzers/rule.rb +18 -13
- data/lib/mihari/analyzers/securitytrails.rb +1 -1
- data/lib/mihari/analyzers/urlscan.rb +1 -1
- data/lib/mihari/analyzers/virustotal.rb +1 -1
- data/lib/mihari/analyzers/zoomeye.rb +1 -1
- data/lib/mihari/clients/binaryedge.rb +4 -7
- data/lib/mihari/clients/crtsh.rb +1 -3
- data/lib/mihari/clients/publsedive.rb +1 -1
- data/lib/mihari/clients/shodan.rb +2 -2
- data/lib/mihari/commands/alert.rb +42 -13
- data/lib/mihari/commands/rule.rb +11 -7
- data/lib/mihari/commands/search.rb +54 -22
- data/lib/mihari/config.rb +5 -0
- data/lib/mihari/emitters/base.rb +9 -3
- data/lib/mihari/emitters/slack.rb +1 -1
- data/lib/mihari/enrichers/base.rb +13 -0
- data/lib/mihari/enrichers/google_public_dns.rb +16 -1
- data/lib/mihari/enrichers/ipinfo.rb +9 -13
- data/lib/mihari/enrichers/shodan.rb +1 -2
- data/lib/mihari/enrichers/whois.rb +2 -2
- data/lib/mihari/errors.rb +16 -10
- data/lib/mihari/feed/parser.rb +2 -2
- data/lib/mihari/models/artifact.rb +1 -1
- data/lib/mihari/models/autonomous_system.rb +11 -5
- data/lib/mihari/models/cpe.rb +10 -4
- data/lib/mihari/models/dns.rb +11 -16
- data/lib/mihari/models/geolocation.rb +11 -5
- data/lib/mihari/models/port.rb +10 -4
- data/lib/mihari/models/reverse_dns.rb +10 -4
- data/lib/mihari/models/whois.rb +4 -1
- data/lib/mihari/schemas/analyzer.rb +1 -0
- data/lib/mihari/services/alert_builder.rb +43 -0
- data/lib/mihari/services/alert_proxy.rb +7 -25
- data/lib/mihari/services/alert_runner.rb +9 -0
- data/lib/mihari/services/rule_builder.rb +47 -0
- data/lib/mihari/services/rule_proxy.rb +5 -61
- data/lib/mihari/services/rule_runner.rb +9 -4
- data/lib/mihari/structs/binaryedge.rb +89 -0
- data/lib/mihari/structs/shodan.rb +2 -1
- data/lib/mihari/structs/urlscan.rb +1 -3
- data/lib/mihari/structs/virustotal_intelligence.rb +1 -3
- data/lib/mihari/type_checker.rb +1 -1
- data/lib/mihari/version.rb +1 -1
- data/lib/mihari/web/endpoints/alerts.rb +33 -15
- data/lib/mihari/web/endpoints/artifacts.rb +53 -25
- data/lib/mihari/web/endpoints/configs.rb +2 -2
- data/lib/mihari/web/endpoints/ip_addresses.rb +3 -5
- data/lib/mihari/web/endpoints/rules.rb +97 -71
- data/lib/mihari/web/endpoints/tags.rb +15 -5
- data/lib/mihari/web/public/assets/index-0a5a47bf.js +1740 -0
- data/lib/mihari/web/public/index.html +1 -1
- data/lib/mihari/web/public/redoc-static.html +419 -382
- data/lib/mihari.rb +4 -0
- data/mihari.gemspec +6 -5
- data/mkdocs.yml +35 -0
- data/requirements.txt +2 -0
- metadata +70 -12
- data/lib/mihari/web/public/assets/index-4d7eda9f.js +0 -1738
data/lib/mihari.rb
CHANGED
@@ -20,6 +20,7 @@ require "active_record"
|
|
20
20
|
|
21
21
|
# dry-rb
|
22
22
|
require "dry/files"
|
23
|
+
require "dry/monads"
|
23
24
|
require "dry/schema"
|
24
25
|
require "dry/struct"
|
25
26
|
require "dry/types"
|
@@ -114,13 +115,16 @@ require "mihari/type_checker"
|
|
114
115
|
require "mihari/http"
|
115
116
|
|
116
117
|
# Services
|
118
|
+
require "mihari/services/rule_builder"
|
117
119
|
require "mihari/services/rule_proxy"
|
118
120
|
require "mihari/services/rule_runner"
|
119
121
|
|
122
|
+
require "mihari/services/alert_builder"
|
120
123
|
require "mihari/services/alert_proxy"
|
121
124
|
require "mihari/services/alert_runner"
|
122
125
|
|
123
126
|
# Structs
|
127
|
+
require "mihari/structs/binaryedge"
|
124
128
|
require "mihari/structs/censys"
|
125
129
|
require "mihari/structs/config"
|
126
130
|
require "mihari/structs/filters"
|
data/mihari.gemspec
CHANGED
@@ -16,7 +16,7 @@ Gem::Specification.new do |spec|
|
|
16
16
|
spec.authors = ["Manabu Niseki"]
|
17
17
|
spec.email = ["manabu.niseki@gmail.com"]
|
18
18
|
|
19
|
-
spec.summary = "A
|
19
|
+
spec.summary = "A query aggregator for OSINT based threat hunting"
|
20
20
|
spec.homepage = "https://github.com/ninoseki/mihari"
|
21
21
|
spec.license = "MIT"
|
22
22
|
|
@@ -54,16 +54,17 @@ Gem::Specification.new do |spec|
|
|
54
54
|
spec.add_development_dependency "webmock", "~> 3.19"
|
55
55
|
|
56
56
|
unless ci_env?
|
57
|
-
spec.add_development_dependency "lefthook", "~> 1.
|
57
|
+
spec.add_development_dependency "lefthook", "~> 1.5"
|
58
58
|
spec.add_development_dependency "solargraph", "~> 0.49"
|
59
59
|
end
|
60
60
|
|
61
|
-
spec.add_dependency "activerecord", "7.0.
|
61
|
+
spec.add_dependency "activerecord", "7.0.8"
|
62
62
|
spec.add_dependency "addressable", "2.8.5"
|
63
63
|
spec.add_dependency "awrence", "2.0.1"
|
64
64
|
spec.add_dependency "dotenv", "2.8.1"
|
65
65
|
spec.add_dependency "dry-container", "0.11.0"
|
66
66
|
spec.add_dependency "dry-files", "1.0.1"
|
67
|
+
spec.add_dependency "dry-monads", "1.6.0"
|
67
68
|
spec.add_dependency "dry-schema", "1.13.3"
|
68
69
|
spec.add_dependency "dry-struct", "1.6.0"
|
69
70
|
spec.add_dependency "dry-validation", "1.10.0"
|
@@ -81,14 +82,14 @@ Gem::Specification.new do |spec|
|
|
81
82
|
spec.add_dependency "parallel", "1.23.0"
|
82
83
|
spec.add_dependency "plissken", "2.0.1"
|
83
84
|
spec.add_dependency "public_suffix", "5.0.3"
|
84
|
-
spec.add_dependency "puma", "6.
|
85
|
+
spec.add_dependency "puma", "6.4.0"
|
85
86
|
spec.add_dependency "rack", "3.0.8"
|
86
87
|
spec.add_dependency "rack-cors", "2.0.1"
|
87
88
|
spec.add_dependency "rackup", "2.1.0"
|
88
89
|
spec.add_dependency "semantic_logger", "4.14.0"
|
89
90
|
spec.add_dependency "sentry-ruby", "5.11.0"
|
90
91
|
spec.add_dependency "slack-notifier", "2.4.0"
|
91
|
-
spec.add_dependency "sqlite3", "1.6.
|
92
|
+
spec.add_dependency "sqlite3", "1.6.6"
|
92
93
|
spec.add_dependency "thor", "1.2.2"
|
93
94
|
spec.add_dependency "uuidtools", "2.2.0"
|
94
95
|
spec.add_dependency "whois", "5.1.0"
|
data/mkdocs.yml
ADDED
@@ -0,0 +1,35 @@
|
|
1
|
+
site_name: Mihari
|
2
|
+
|
3
|
+
theme:
|
4
|
+
name: material
|
5
|
+
|
6
|
+
plugins:
|
7
|
+
search:
|
8
|
+
tags:
|
9
|
+
enabled: true
|
10
|
+
tags_file: tags.md
|
11
|
+
tags_slugify: !!python/object/apply:pymdownx.slugs.slugify
|
12
|
+
kwds:
|
13
|
+
case: lower
|
14
|
+
|
15
|
+
nav:
|
16
|
+
- Mihari: index.md
|
17
|
+
- Requirements: requirements.md
|
18
|
+
- Installation: installation.md
|
19
|
+
- How to Write a Rule: rule.md
|
20
|
+
- Usage: usage.md
|
21
|
+
- Configuration: configuration.md
|
22
|
+
- GitHub Actions: github_actions.md
|
23
|
+
- Analyzers: "analyzers/index.md"
|
24
|
+
- Enrichers: "enrichers/index.md"
|
25
|
+
- Emitters: "emitters/index.md"
|
26
|
+
- Tags: "./tags.md"
|
27
|
+
|
28
|
+
markdown_extensions:
|
29
|
+
- toc:
|
30
|
+
permalink: true
|
31
|
+
- admonition
|
32
|
+
- pymdownx.details
|
33
|
+
- pymdownx.superfences
|
34
|
+
- pymdownx.highlight
|
35
|
+
- pymdownx.extra
|
data/requirements.txt
ADDED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: mihari
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 5.4.
|
4
|
+
version: 5.4.5
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Manabu Niseki
|
8
8
|
autorequire:
|
9
9
|
bindir: exe
|
10
10
|
cert_chain: []
|
11
|
-
date: 2023-09-
|
11
|
+
date: 2023-09-30 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: bundler
|
@@ -240,14 +240,14 @@ dependencies:
|
|
240
240
|
requirements:
|
241
241
|
- - "~>"
|
242
242
|
- !ruby/object:Gem::Version
|
243
|
-
version: '1.
|
243
|
+
version: '1.5'
|
244
244
|
type: :development
|
245
245
|
prerelease: false
|
246
246
|
version_requirements: !ruby/object:Gem::Requirement
|
247
247
|
requirements:
|
248
248
|
- - "~>"
|
249
249
|
- !ruby/object:Gem::Version
|
250
|
-
version: '1.
|
250
|
+
version: '1.5'
|
251
251
|
- !ruby/object:Gem::Dependency
|
252
252
|
name: solargraph
|
253
253
|
requirement: !ruby/object:Gem::Requirement
|
@@ -268,14 +268,14 @@ dependencies:
|
|
268
268
|
requirements:
|
269
269
|
- - '='
|
270
270
|
- !ruby/object:Gem::Version
|
271
|
-
version: 7.0.
|
271
|
+
version: 7.0.8
|
272
272
|
type: :runtime
|
273
273
|
prerelease: false
|
274
274
|
version_requirements: !ruby/object:Gem::Requirement
|
275
275
|
requirements:
|
276
276
|
- - '='
|
277
277
|
- !ruby/object:Gem::Version
|
278
|
-
version: 7.0.
|
278
|
+
version: 7.0.8
|
279
279
|
- !ruby/object:Gem::Dependency
|
280
280
|
name: addressable
|
281
281
|
requirement: !ruby/object:Gem::Requirement
|
@@ -346,6 +346,20 @@ dependencies:
|
|
346
346
|
- - '='
|
347
347
|
- !ruby/object:Gem::Version
|
348
348
|
version: 1.0.1
|
349
|
+
- !ruby/object:Gem::Dependency
|
350
|
+
name: dry-monads
|
351
|
+
requirement: !ruby/object:Gem::Requirement
|
352
|
+
requirements:
|
353
|
+
- - '='
|
354
|
+
- !ruby/object:Gem::Version
|
355
|
+
version: 1.6.0
|
356
|
+
type: :runtime
|
357
|
+
prerelease: false
|
358
|
+
version_requirements: !ruby/object:Gem::Requirement
|
359
|
+
requirements:
|
360
|
+
- - '='
|
361
|
+
- !ruby/object:Gem::Version
|
362
|
+
version: 1.6.0
|
349
363
|
- !ruby/object:Gem::Dependency
|
350
364
|
name: dry-schema
|
351
365
|
requirement: !ruby/object:Gem::Requirement
|
@@ -590,14 +604,14 @@ dependencies:
|
|
590
604
|
requirements:
|
591
605
|
- - '='
|
592
606
|
- !ruby/object:Gem::Version
|
593
|
-
version: 6.
|
607
|
+
version: 6.4.0
|
594
608
|
type: :runtime
|
595
609
|
prerelease: false
|
596
610
|
version_requirements: !ruby/object:Gem::Requirement
|
597
611
|
requirements:
|
598
612
|
- - '='
|
599
613
|
- !ruby/object:Gem::Version
|
600
|
-
version: 6.
|
614
|
+
version: 6.4.0
|
601
615
|
- !ruby/object:Gem::Dependency
|
602
616
|
name: rack
|
603
617
|
requirement: !ruby/object:Gem::Requirement
|
@@ -688,14 +702,14 @@ dependencies:
|
|
688
702
|
requirements:
|
689
703
|
- - '='
|
690
704
|
- !ruby/object:Gem::Version
|
691
|
-
version: 1.6.
|
705
|
+
version: 1.6.6
|
692
706
|
type: :runtime
|
693
707
|
prerelease: false
|
694
708
|
version_requirements: !ruby/object:Gem::Requirement
|
695
709
|
requirements:
|
696
710
|
- - '='
|
697
711
|
- !ruby/object:Gem::Version
|
698
|
-
version: 1.6.
|
712
|
+
version: 1.6.6
|
699
713
|
- !ruby/object:Gem::Dependency
|
700
714
|
name: thor
|
701
715
|
requirement: !ruby/object:Gem::Requirement
|
@@ -772,6 +786,45 @@ files:
|
|
772
786
|
- bin/setup
|
773
787
|
- build_frontend.sh
|
774
788
|
- config.ru
|
789
|
+
- docs/alternatives.md
|
790
|
+
- docs/analyzers/binaryedge.md
|
791
|
+
- docs/analyzers/censys.md
|
792
|
+
- docs/analyzers/circl.md
|
793
|
+
- docs/analyzers/crtsh.md
|
794
|
+
- docs/analyzers/dnstwister.md
|
795
|
+
- docs/analyzers/feed.md
|
796
|
+
- docs/analyzers/greynoise.md
|
797
|
+
- docs/analyzers/hunterhow.md
|
798
|
+
- docs/analyzers/index.md
|
799
|
+
- docs/analyzers/onyphe.md
|
800
|
+
- docs/analyzers/otx.md
|
801
|
+
- docs/analyzers/passivetotal.md
|
802
|
+
- docs/analyzers/pulsedive.md
|
803
|
+
- docs/analyzers/securitytrails.md
|
804
|
+
- docs/analyzers/shodan.md
|
805
|
+
- docs/analyzers/urlscan.md
|
806
|
+
- docs/analyzers/virustotal.md
|
807
|
+
- docs/analyzers/virustotal_intelligence.md
|
808
|
+
- docs/analyzers/zoomeye.md
|
809
|
+
- docs/configuration.md
|
810
|
+
- docs/emitters/database.md
|
811
|
+
- docs/emitters/hive.md
|
812
|
+
- docs/emitters/index.md
|
813
|
+
- docs/emitters/misp.md
|
814
|
+
- docs/emitters/slack.md
|
815
|
+
- docs/emitters/webhook.md
|
816
|
+
- docs/enrichers/google_public_dns.md
|
817
|
+
- docs/enrichers/index.md
|
818
|
+
- docs/enrichers/ipinfo.md
|
819
|
+
- docs/enrichers/shodan.md
|
820
|
+
- docs/enrichers/whois.md
|
821
|
+
- docs/github_actions.md
|
822
|
+
- docs/index.md
|
823
|
+
- docs/installation.md
|
824
|
+
- docs/requirements.md
|
825
|
+
- docs/rule.md
|
826
|
+
- docs/tags.md
|
827
|
+
- docs/usage.md
|
775
828
|
- exe/mihari
|
776
829
|
- frontend/.eslintrc.cjs
|
777
830
|
- frontend/.gitignore
|
@@ -967,10 +1020,13 @@ files:
|
|
967
1020
|
- lib/mihari/schemas/enricher.rb
|
968
1021
|
- lib/mihari/schemas/macros.rb
|
969
1022
|
- lib/mihari/schemas/rule.rb
|
1023
|
+
- lib/mihari/services/alert_builder.rb
|
970
1024
|
- lib/mihari/services/alert_proxy.rb
|
971
1025
|
- lib/mihari/services/alert_runner.rb
|
1026
|
+
- lib/mihari/services/rule_builder.rb
|
972
1027
|
- lib/mihari/services/rule_proxy.rb
|
973
1028
|
- lib/mihari/services/rule_runner.rb
|
1029
|
+
- lib/mihari/structs/binaryedge.rb
|
974
1030
|
- lib/mihari/structs/censys.rb
|
975
1031
|
- lib/mihari/structs/config.rb
|
976
1032
|
- lib/mihari/structs/filters.rb
|
@@ -996,14 +1052,16 @@ files:
|
|
996
1052
|
- lib/mihari/web/endpoints/tags.rb
|
997
1053
|
- lib/mihari/web/middleware/connection_adapter.rb
|
998
1054
|
- lib/mihari/web/middleware/error_notification_adapter.rb
|
1055
|
+
- lib/mihari/web/public/assets/index-0a5a47bf.js
|
999
1056
|
- lib/mihari/web/public/assets/index-33165282.css
|
1000
|
-
- lib/mihari/web/public/assets/index-4d7eda9f.js
|
1001
1057
|
- lib/mihari/web/public/assets/mode-yaml-a21faa53.js
|
1002
1058
|
- lib/mihari/web/public/favicon.ico
|
1003
1059
|
- lib/mihari/web/public/index.html
|
1004
1060
|
- lib/mihari/web/public/redoc-static.html
|
1005
1061
|
- mihari.gemspec
|
1062
|
+
- mkdocs.yml
|
1006
1063
|
- renovate.json
|
1064
|
+
- requirements.txt
|
1007
1065
|
homepage: https://github.com/ninoseki/mihari
|
1008
1066
|
licenses:
|
1009
1067
|
- MIT
|
@@ -1027,5 +1085,5 @@ requirements: []
|
|
1027
1085
|
rubygems_version: 3.4.1
|
1028
1086
|
signing_key:
|
1029
1087
|
specification_version: 4
|
1030
|
-
summary: A
|
1088
|
+
summary: A query aggregator for OSINT based threat hunting
|
1031
1089
|
test_files: []
|