mihari 5.5.0 → 5.6.0

data/lib/mihari/emitters/base.rb

@@ -2,7 +2,7 @@
 
 module Mihari
   module Emitters
-    class Base
+    class Base < Mihari::Base
       include Dry::Monads[:result, :try]
 
       include Mixins::Configurable
@@ -14,9 +14,6 @@ module Mihari
       # @return [Mihari::Services::Rule]
       attr_reader :rule
 
-      # @return [Hash]
-      attr_reader :options
-
       #
       # @param [Array<Mihari::Artifact>] artifacts
       # @param [Mihari::Services::RuleProxy] rule
@@ -24,37 +21,10 @@ module Mihari
       # @param [Hash] **_params
       #
       def initialize(artifacts:, rule:, options: nil, **_params)
+        super(options: options)
+
         @artifacts = artifacts
         @rule = rule
-        @options = options || {}
-      end
-
-      #
-      # @return [Integer]
-      #
-      def retry_interval
-        options[:retry_interval] || Mihari.config.retry_interval
-      end
-
-      #
-      # @return [Boolean]
-      #
-      def retry_exponential_backoff
-        options[:retry_exponential_backoff] || Mihari.config.retry_exponential_backoff
-      end
-
-      #
-      # @return [Integer]
-      #
-      def retry_times
-        options[:retry_times] || Mihari.config.retry_times
-      end
-
-      #
-      # @return [Integer, nil]
-      #
-      def timeout
-        options[:timeout]
       end
 
       # @return [Boolean]

data/lib/mihari/emitters/database.rb

@@ -13,7 +13,7 @@ module Mihari
       # @return [Mihari::Alert, nil]
       #
       def emit
-        return nil if artifacts.empty?
+        return if artifacts.empty?
 
         tags = rule.tags.filter_map { |name| Tag.find_or_create_by(name: name) }.uniq
         taggings = tags.map { |tag| Tagging.new(tag_id: tag.id) }

data/lib/mihari/enrichers/base.rb

@@ -2,45 +2,14 @@
 
 module Mihari
   module Enrichers
-    class Base
+    class Base < Mihari::Base
       include Mixins::Configurable
       include Mixins::Retriable
 
       include Dry::Monads[:result, :try]
 
-      # @return [Hash]
-      attr_reader :options
-
       def initialize(options: nil)
-        @options = options || {}
-      end
-
-      #
-      # @return [Integer]
-      #
-      def retry_interval
-        options[:retry_interval] || Mihari.config.retry_interval
-      end
-
-      #
-      # @return [Boolean]
-      #
-      def retry_exponential_backoff
-        options[:retry_exponential_backoff] || Mihari.config.retry_exponential_backoff
-      end
-
-      #
-      # @return [Integer]
-      #
-      def retry_times
-        options[:retry_times] || Mihari.config.retry_times
-      end
-
-      #
-      # @return [Integer, nil]
-      #
-      def timeout
-        options[:timeout]
+        super(options: options)
       end
 
       def query_result(value)

data/lib/mihari/enrichers/google_public_dns.rb

@@ -38,6 +38,15 @@ module Mihari
         nil
       end
 
+      class << self
+        #
+        # @return [String]
+        #
+        def class_key
+          "google_public_dns"
+        end
+      end
+
       private
 
       def http

data/lib/mihari/schemas/analyzer.rb

@@ -2,37 +2,31 @@
 
 module Mihari
   module Schemas
-    AnalyzerOptions = Dry::Schema.Params do
-      optional(:pagination_interval).value(:integer).default(Mihari.config.pagination_interval)
-      optional(:pagination_limit).value(:integer).default(Mihari.config.pagination_limit)
-      optional(:retry_times).value(:integer).default(Mihari.config.retry_times)
-      optional(:retry_interval).value(:integer).default(Mihari.config.retry_interval)
-      optional(:retry_exponential_backoff).value(:bool).default(Mihari.config.retry_exponential_backoff)
-      optional(:ignore_error).value(:bool).default(Mihari.config.ignore_error)
-      optional(:timeout).value(:integer)
-    end
-
-    AnalyzerWithoutAPIKey = Dry::Schema.Params do
-      required(:analyzer).value(Types::String.enum("dnstwister"))
-      required(:query).value(:string)
-      optional(:options).hash(AnalyzerOptions)
-    end
-
-    AnalyzerWithAPIKey = Dry::Schema.Params do
+    AnalyzerAPIKeyPagination = Dry::Schema.Params do
       required(:analyzer).value(
         Types::String.enum(
           "binaryedge",
           "greynoise",
           "onyphe",
+          "shodan",
+          "urlscan",
+          "virustotal_intelligence",
+          "vt_intel"
+        )
+      )
+      required(:query).value(:string)
+      optional(:api_key).value(:string)
+      optional(:options).hash(AnalyzerPaginationOptions)
+    end
+
+    AnalyzerAPIKey = Dry::Schema.Params do
+      required(:analyzer).value(
+        Types::String.enum(
           "otx",
           "pulsedive",
           "securitytrails",
-          "shodan",
           "st",
-          "urlscan",
-          "virustotal_intelligence",
           "virustotal",
-          "vt_intel",
           "vt"
         )
       )
@@ -41,12 +35,18 @@ module Mihari
       optional(:options).hash(AnalyzerOptions)
     end
 
+    DNSTwister = Dry::Schema.Params do
+      required(:analyzer).value(Types::String.enum("dnstwister"))
+      required(:query).value(:string)
+      optional(:options).hash(AnalyzerOptions)
+    end
+
     Censys = Dry::Schema.Params do
       required(:analyzer).value(Types::String.enum("censys"))
       required(:query).value(:string)
       optional(:id).value(:string)
       optional(:secret).value(:string)
-      optional(:options).hash(AnalyzerOptions)
+      optional(:options).hash(AnalyzerPaginationOptions)
     end
 
     CIRCL = Dry::Schema.Params do
@@ -69,7 +69,7 @@ module Mihari
       required(:analyzer).value(Types::String.enum("zoomeye"))
       required(:query).value(:string)
       required(:type).value(Types::String.enum("host", "web"))
-      optional(:options).hash(AnalyzerOptions)
+      optional(:options).hash(AnalyzerPaginationOptions)
     end
 
     Crtsh = Dry::Schema.Params do
@@ -85,7 +85,7 @@ module Mihari
       required(:start_time).value(:date)
       required(:end_time).value(:date)
       optional(:api_key).value(:string)
-      optional(:options).hash(AnalyzerOptions)
+      optional(:options).hash(AnalyzerPaginationOptions)
     end
 
     Feed = Dry::Schema.Params do

data/lib/mihari/schemas/emitter.rb

@@ -3,38 +3,31 @@
 module Mihari
   module Schemas
     module Emitters
-      EmitterOptions = Dry::Schema.Params do
-        optional(:retry_times).value(:integer).default(Mihari.config.retry_times)
-        optional(:retry_interval).value(:integer).default(Mihari.config.retry_interval)
-        optional(:retry_exponential_backoff).value(:bool).default(Mihari.config.retry_exponential_backoff)
-        optional(:timeout).value(:integer)
-      end
-
       Database = Dry::Schema.Params do
         required(:emitter).value(Types::String.enum("database"))
-        optional(:options).hash(EmitterOptions)
+        optional(:options).hash(Options)
       end
 
       MISP = Dry::Schema.Params do
         required(:emitter).value(Types::String.enum("misp"))
         optional(:url).value(:string)
         optional(:api_key).value(:string)
-        optional(:options).hash(EmitterOptions)
+        optional(:options).hash(Options)
       end
 
       TheHive = Dry::Schema.Params do
-        required(:emitter).value(Types::String.enum("the_hive"))
+        required(:emitter).value(Types::String.enum("thehive"))
         optional(:url).value(:string)
         optional(:api_key).value(:string)
         optional(:api_version).value(Types::String.enum("v4", "v5")).default("v4")
-        optional(:options).hash(EmitterOptions)
+        optional(:options).hash(Options)
       end
 
       Slack = Dry::Schema.Params do
         required(:emitter).value(Types::String.enum("slack"))
         optional(:webhook_url).value(:string)
         optional(:channel).value(:string)
-        optional(:options).hash(EmitterOptions)
+        optional(:options).hash(Options)
       end
 
       Webhook = Dry::Schema.Params do
@@ -43,7 +36,7 @@ module Mihari
         optional(:method).value(Types::HTTPRequestMethods).default("POST")
         optional(:headers).value(:hash).default({})
         optional(:template).value(:string)
-        optional(:options).hash(EmitterOptions)
+        optional(:options).hash(Options)
       end
     end
   end

data/lib/mihari/schemas/enricher.rb

@@ -3,32 +3,25 @@
 module Mihari
   module Schemas
     module Enrichers
-      EnricherOptions = Dry::Schema.Params do
-        optional(:retry_times).value(:integer).default(Mihari.config.retry_times)
-        optional(:retry_interval).value(:integer).default(Mihari.config.retry_interval)
-        optional(:retry_exponential_backoff).value(:bool).default(Mihari.config.retry_exponential_backoff)
-        optional(:timeout).value(:integer)
-      end
-
       IPInfo = Dry::Schema.Params do
         required(:enricher).value(Types::String.enum("ipinfo"))
         optional(:api_key).value(:string)
-        optional(:options).hash(EnricherOptions)
+        optional(:options).hash(Options)
       end
 
       Whois = Dry::Schema.Params do
         required(:enricher).value(Types::String.enum("whois"))
-        optional(:options).hash(EnricherOptions)
+        optional(:options).hash(Options)
       end
 
       Shodan = Dry::Schema.Params do
         required(:enricher).value(Types::String.enum("shodan"))
-        optional(:options).hash(EnricherOptions)
+        optional(:options).hash(Options)
       end
 
       GooglePublicDNS = Dry::Schema.Params do
         required(:enricher).value(Types::String.enum("google_public_dns"))
-        optional(:options).hash(EnricherOptions)
+        optional(:options).hash(Options)
       end
     end
   end

data/lib/mihari/schemas/options.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require "dry/schema"
+
+module Mihari
+  module Schemas
+    Options = Dry::Schema.Params do
+      optional(:retry_times).value(:integer).default(Mihari.config.retry_times)
+      optional(:retry_interval).value(:integer).default(Mihari.config.retry_interval)
+      optional(:retry_exponential_backoff).value(:bool).default(Mihari.config.retry_exponential_backoff)
+      optional(:timeout).value(:integer)
+    end
+
+    IgnoreErrorOptions = Dry::Schema.Params do
+      optional(:ignore_error).value(:bool).default(Mihari.config.ignore_error)
+    end
+
+    AnalyzerOptions = Options | IgnoreErrorOptions
+
+    PaginationOptions = Dry::Schema.Params do
+      optional(:pagination_interval).value(:integer).default(Mihari.config.pagination_interval)
+      optional(:pagination_limit).value(:integer).default(Mihari.config.pagination_limit)
+    end
+
+    AnalyzerPaginationOptions = AnalyzerOptions | PaginationOptions
+  end
+end

data/lib/mihari/schemas/rule.rb

@@ -22,7 +22,7 @@ module Mihari
       optional(:updated_on).value(:date)
 
       required(:queries).value(:array).each do
-        AnalyzerWithoutAPIKey | AnalyzerWithAPIKey | Censys | CIRCL | PassiveTotal | ZoomEye | Crtsh | Feed | HunterHow
+        AnalyzerAPIKey | AnalyzerAPIKeyPagination | Censys | CIRCL | PassiveTotal | ZoomEye | Crtsh | Feed | HunterHow | DNSTwister
       end
 
       optional(:emitters).value(:array).each do
@@ -33,7 +33,7 @@ module Mihari
         Enrichers::Whois | Enrichers::IPInfo | Enrichers::Shodan | Enrichers::GooglePublicDNS
       end.default(DEFAULT_ENRICHERS)
 
-      optional(:data_types).value(array[Types::DataTypes]).default(DEFAULT_DATA_TYPES)
+      optional(:data_types).value(array[Types::DataTypes]).default(Mihari::Types::DataTypes.values)
       optional(:falsepositives).value(array[:string]).default([])
 
       optional(:artifact_lifetime).value(:integer)

data/lib/mihari/services/alert_runner.rb

@@ -16,7 +16,7 @@ module Mihari
       # @return [Mihari::Alert]
       #
       def run
-        emitter = Mihari::Emitters::Database.new(artifacts: alert.artifacts, rule: alert.rule)
+        emitter = Emitters::Database.new(artifacts: alert.artifacts, rule: alert.rule)
         emitter.emit
       end
 

data/lib/mihari/services/rule_runner.rb

@@ -5,21 +5,11 @@ module Mihari
     class RuleRunner
       include Dry::Monads[:result, :try]
 
-      include Mixins::ErrorNotification
-
       # @return [Mihari::Services::RuleProxy]
       attr_reader :rule
 
-      # @return [Boolean]
-      attr_reader :force_overwrite
-
-      def initialize(rule, force_overwrite:)
+      def initialize(rule)
         @rule = rule
-        @force_overwrite = force_overwrite
-      end
-
-      def force_overwrite?
-        force_overwrite
       end
 
       #

data/lib/mihari/types.rb

@@ -12,21 +12,8 @@ module Mihari
     Double = Strict::Float | Strict::Integer
     DateTime = Strict::DateTime
 
-    DataTypes = Types::String.enum(*DEFAULT_DATA_TYPES)
+    DataTypes = Types::String.enum("hash", "ip", "domain", "url", "mail")
 
     HTTPRequestMethods = Types::String.enum("GET", "POST")
-    HTTPRequestPayloadTypes = Types::String.enum("application/json", "application/x-www-form-urlencoded")
-
-    EmitterTypes = Types::String.enum(
-      "database",
-      "webhook"
-    )
-
-    EnricherTypes = Types::String.enum(
-      "whois",
-      "ipinfo",
-      "shodan",
-      "google_public_dns"
-    )
   end
 end

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "5.5.0"
+  VERSION = "5.6.0"
 end