mihari 5.4.5 → 5.4.7

Sign up to get free protection for your applications and to get access to all the features.
Files changed (34) hide show
  1. checksums.yaml +4 -4
  2. data/docs/analyzers/binaryedge.md +10 -5
  3. data/docs/analyzers/censys.md +14 -6
  4. data/docs/analyzers/circl.md +13 -5
  5. data/docs/analyzers/crtsh.md +7 -6
  6. data/docs/analyzers/dnstwister.md +5 -3
  7. data/docs/analyzers/feed.md +44 -20
  8. data/docs/analyzers/greynoise.md +10 -5
  9. data/docs/analyzers/hunterhow.md +15 -7
  10. data/docs/analyzers/onyphe.md +9 -4
  11. data/docs/analyzers/otx.md +10 -5
  12. data/docs/analyzers/passivetotal.md +17 -5
  13. data/docs/analyzers/pulsedive.md +9 -4
  14. data/docs/analyzers/securitytrails.md +9 -4
  15. data/docs/analyzers/shodan.md +10 -5
  16. data/docs/analyzers/urlscan.md +10 -5
  17. data/docs/analyzers/virustotal.md +10 -5
  18. data/docs/analyzers/virustotal_intelligence.md +11 -4
  19. data/docs/analyzers/zoomeye.md +14 -6
  20. data/docs/configuration.md +29 -29
  21. data/docs/emitters/hive.md +13 -5
  22. data/docs/emitters/misp.md +10 -5
  23. data/docs/emitters/slack.md +10 -0
  24. data/docs/emitters/webhook.md +19 -19
  25. data/docs/requirements.md +8 -15
  26. data/docs/rule.md +20 -14
  27. data/frontend/package-lock.json +156 -159
  28. data/frontend/package.json +10 -10
  29. data/lib/mihari/analyzers/feed.rb +7 -7
  30. data/lib/mihari/database.rb +2 -2
  31. data/lib/mihari/version.rb +1 -1
  32. data/mihari.gemspec +4 -2
  33. data/requirements.txt +1 -1
  34. metadata +35 -7
data/docs/emitters/webhook.md CHANGED
@@ -10,32 +10,32 @@ headers: ...
10
10
  template: ...
11
11
  ```
12
12
 
13
- | Name | Type | Required? | Default | Desc. |
14
- | -------- | ------ | --------- | ------- | ---------------------------------------------------- |
15
- | url | String | Yes | | URL |
16
- | method | String | No | POST | HTTP request method (GET or POST) |
17
- | headers | Hash | No | | HTTP request headers |
18
- | template | String | No | | ERB template to customize the payload in JSON format |
13
+ ## Components
19
14
 
20
- You can customize the payload by using **template**.
15
+ ### URL
21
16
 
22
- A template is an ERB template. It should generate a valid JSON.
17
+ `url` is a webhook URL.
23
18
 
24
- - [https://github.com/ruby/erb](https://github.com/ruby/erb)
19
+ ### Method
25
20
 
26
- You can use the following variables to build the JSON.
21
+ `method` is an HTTP method. Optional. Defaults to `POST`.
27
22
 
28
- | Name | Type | Default | Desc. |
29
- | ----------- | ----------------------- | ------- | ------------ |
30
- | title | String | | |
31
- | description | String | | |
32
- | source | String | | ID of a rule |
33
- | tags | Array<String> | [] | |
34
- | artifacts | Array<Mihari::Artifact> | | |
23
+ ### Headers
35
24
 
36
- ## Example
25
+ `headers` (hash) is HTTP headers. Optional.
37
26
 
38
- **ThreatFox**
27
+ ### Template
28
+
29
+ `template` is an [ERB](https://github.com/ruby/erb) template to customize the payload to sent. A template should generate a valid JSON.
30
+
31
+ You can use the following parameters inside an ERB template.
32
+
33
+ - `rule`: a rule
34
+ - `artifacts`: a list of artifacts
35
+
36
+ ## Examples
37
+
38
+ ### ThreatFox
39
39
 
40
40
  ```yaml
41
41
  - emitter: webhook
data/docs/requirements.md CHANGED
@@ -1,20 +1,13 @@
1
1
  # Requirements
2
2
 
3
- - Runtime:
4
- - Ruby 2.7+ / 3.0+ (tested with 2.7, 3.0, 3.1 and 3.2)
5
- - Database:
6
- - SQLite3, PostgreSQL and MySQL
7
- - Others:
8
- - MISP
9
- - TheHive
3
+ ## Runtime
10
4
 
11
- | Name | Supported versions |
12
- | ---------- | ----------------------- |
13
- | Ruby | v2.7, v3.0, v3.1 & v3.2 |
14
- | PostgreSQL | v15 |
15
- | SQLite | v3 |
16
- | MySQL | v8 |
17
- | MISP | v2.4 |
18
- | TheHive | v3 & v4 |
5
+ Ruby 2.7+ / 3.0+ (tested with 2.7, 3.0, 3.1 and 3.2)
6
+
7
+ ## Database
8
+
9
+ - SQLite3
10
+ - PostgreSQL
11
+ - MySQL
19
12
 
20
13
  You need to have a database to persistent the data. See [Database](./emitters/database.md) for details.
data/docs/rule.md CHANGED
@@ -20,6 +20,10 @@ An artifact has five types:
20
20
 
21
21
  An alert can have multiple artifacts bundled by a rule.
22
22
 
23
+ !!! note
24
+
25
+ A rule is assumed to be executed multiple times continuously. An alert generated by a rule will only have new findings at that time.
26
+
23
27
  Let's break down the following example:
24
28
 
25
29
  ```yaml
@@ -60,45 +64,47 @@ data_types:
60
64
  falsepositives: []
61
65
  ```
62
66
 
63
- ## ID
67
+ ## Components
68
+
69
+ ### ID
64
70
 
65
71
  `id` is an unique ID of a rule. UUID v4 is recommended.
66
72
 
67
- ## Title
73
+ ### Title
68
74
 
69
75
  `title` is a title of a rule.
70
76
 
71
- ## Description
77
+ ### Description
72
78
 
73
79
  `description` is a short description of a rule.
74
80
 
75
- ## Created/Updated On
81
+ ### Created/Updated On
76
82
 
77
83
  `created_on` is a date of a rule creation. Optional.
78
84
  Also a rule can have `updated_on` that is a date of a rule modification. Optional.
79
85
 
80
- ## Tags
86
+ ### Tags
81
87
 
82
88
  `tags` is a list of tags of a rule.
83
89
 
84
- ## Author
90
+ ### Author
85
91
 
86
92
  `author` is an author of a rule. Optional.
87
93
 
88
- ## References
94
+ ### References
89
95
 
90
96
  `references` is a list of a references of a rule. Optional.
91
97
 
92
- ## Related
98
+ ### Related
93
99
 
94
100
  `related` is a list of related rule IDs. Optional.
95
101
 
96
- ## Queries
102
+ ### Queries
97
103
 
98
104
  `queries` is a list of queries/analyzers.
99
105
  See [Analyzers](./analyzers/index.md) to know details of each analyzer.
100
106
 
101
- ## Enrichers
107
+ ### Enrichers
102
108
 
103
109
  `enrichers` is a list of enrichers.
104
110
  See [Enrichers](./enrichers/index.md) to know details of each enricher.
@@ -110,7 +116,7 @@ Defaults to:
110
116
  - `shodan`
111
117
  - `whois`
112
118
 
113
- ## Emitters
119
+ ### Emitters
114
120
 
115
121
  `emitters` is a list of emitters.
116
122
  See [Emitters](./emitters/index.md) to know details of each emitter.
@@ -122,7 +128,7 @@ Defaults to:
122
128
  - `slack`
123
129
  - `the_hive`
124
130
 
125
- ## Data Types
131
+ ### Data Types
126
132
 
127
133
  `data_types` is a list of data (artifact) types to allow by a rule. Types not defined in here will be automatically rejected.
128
134
 
@@ -134,11 +140,11 @@ Defaults to:
134
140
  - `mail`
135
141
  - `hash`
136
142
 
137
- ## False positives
143
+ ### False positives
138
144
 
139
145
  `falsepositives` is a list of false positive values. A string or regexp can be used in here.
140
146
 
141
- ## Artifact TTL
147
+ ### Artifact TTL
142
148
 
143
149
  `artifact_ttl` (alias: `artifact_lifetime`) is an integer value of artifact TTL (Time-To-Live) in seconds.
144
150