mihari 5.5.0 → 5.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0a0bb32d105b9879fbf87b5bcd5d49a4930cc9e054c42f992bd5c58d883ea8b0
-  data.tar.gz: 0c547d79f1a1950008f4797a743bf84b7bc1b766d693eb9c2e9b93d150ee4cb9
+  metadata.gz: d661d9c83ba421776c4ca19e4a6fe19b980bbcbe86fe5e7628c1c3a15205e8a9
+  data.tar.gz: d3a26407b8f8146b86c70cbc443865ff895390ad6f32816f5873464c3f6b4e9d
 SHA512:
-  metadata.gz: f9d5217d01e12da402ad9edde9dbeb35c14f6b18061807c48e9e0f6b84419b009b0bbdd4848d3df7302ba4c414c0fe004d7e0ee86a3e9fa29dcaea7bb79b6a8e
-  data.tar.gz: aa353778dc0f9eb1d525c828e7e662531ba1318f8c380a93cd1f0bd7eca8da33dba7915de297695223cf53a7c3de35419f152ae6d1c199382e6aa7e870a629f2
+  metadata.gz: 35a3783578b46a62dd3eafada97f27ad1701df53ad2b53179155daf4e9545feca0ba912d35c9ca9e8ccaf1f5ce5a15760850d723d55af51f80388b14fc41d95d
+  data.tar.gz: 8f7b3a5624c0ea5b677b32983e21ca731afb396c1904737b923c2b0082c7d1e3cac141e655eeae441150d01d4a26cd83b50665685211118efe9c4bfad512eeef

data/docs/analyzers/binaryedge.md

@@ -1,6 +1,6 @@
 ---
 tags:
-  - IP address
+  - Artifact:IP
 ---
 
 # BinaryEdge

data/docs/analyzers/censys.md

@@ -1,6 +1,6 @@
 ---
 tags:
-  - IP address
+  - Artifact:IP
 ---
 
 # Censys

data/docs/analyzers/circl.md

@@ -1,6 +1,6 @@
 ---
 tags:
-  - IP address
+  - Artifact:IP
   - Passive DNS
   - Passive SSL
 ---

data/docs/analyzers/crtsh.md

@@ -1,6 +1,6 @@
 ---
 tags:
-  - Domain
+  - Artifact:Domain
 ---
 
 # crt.sh

data/docs/analyzers/dnstwister.md

@@ -1,6 +1,6 @@
 ---
 tags:
-  - Domain
+  - Artifact:Domain
 ---
 
 # dnstwister

data/docs/analyzers/greynoise.md

@@ -1,6 +1,6 @@
 ---
 tags:
-  - IP address
+  - Artifact:IP
 ---
 
 # GreyNoise

data/docs/analyzers/hunterhow.md

@@ -1,6 +1,6 @@
 ---
 tags:
-  - IP address
+  - Artifact:IP
 ---
 
 # Hunter How

data/docs/analyzers/index.md

@@ -26,29 +26,28 @@ All the analyzers can have optional `options`.
 analyzer: ...
 query: ...
 options:
-  timeout: ...
-  pagination_interval: ...
-  pagination_limit: ...
   retry_times: ...
   retry_interval: ...
   retry_exponential_backoff: ...
+  timeout: ...
   ignore_error: ...
 ```
 
-### Timeout
-
-`timeout` (`integer`) is an HTTP timeout in seconds. Optional.
-
-### Pagination Interval
-
-`pagination_interval` (`integer`) is an interval in seconds between pagination. Optional. Defaults to 0.
+Also the following analyzers can have pagination options.
 
-### Pagination Limit
-
-`pagination_limit` (`integer`) is an limit for pagination. Optional. Defaults to 100.
+- [Shodan](./shodan.md)
+- [BinaryEdge](./binaryedge.md)
+- [Censys](./censys.md)
+- [ZoomEye](./zoomeye.md)
+- [urlscan.io](./urlscan.md)
+- [VirusTotal Intelligence](./virustotal_intelligence.md)
+- [HunterHow](./hunterhow.md)
 
-In the worst case, if something wrong with Mihari or a service, Mihari can drain API quota by doing pagination forever.
-`pagination_limit` is a safety valve for that. A number of pagination is limited as `pagination_limit` times.
+```yaml
+options:
+  pagination_interval: ...
+  pagination_limit: ...
+```
 
 ### Retry Times
 
@@ -62,6 +61,10 @@ In the worst case, if something wrong with Mihari or a service, Mihari can drain
 
 `retry_exponential_backoff` (`bool`) controls whether to do exponential backoff. Optional. Defaults to `true`.
 
+### Timeout
+
+`timeout` (`integer`) is an HTTP timeout in seconds. Optional.
+
 ### Ignore Error
 
 `ignore_error` (`bool`) controls whether to ignore an error or not. Optional. Defaults to `false`.
@@ -87,3 +90,14 @@ queries:
   - analyzer: censys
     query: ip:8.8.8.8
 ```
+
+### Pagination Interval
+
+`pagination_interval` (`integer`) is an interval in seconds between pagination. Optional. Defaults to 0.
+
+### Pagination Limit
+
+`pagination_limit` (`integer`) is an limit for pagination. Optional. Defaults to 100.
+
+In the worst case, if something wrong with Mihari or a service, Mihari can drain API quota by doing pagination forever.
+`pagination_limit` is a safety valve for that. A number of pagination is limited as `pagination_limit` times.

data/docs/analyzers/onyphe.md

@@ -1,6 +1,6 @@
 ---
 tags:
-  - IP address
+  - Artifact:IP
 ---
 
 # ONYPHE

data/docs/analyzers/otx.md

@@ -1,7 +1,7 @@
 ---
 tags:
-  - IP address
-  - Domain
+  - Artifact:IP
+  - Artifact:Domain
   - Passive DNS
 ---
 

data/docs/analyzers/passivetotal.md

@@ -1,7 +1,7 @@
 ---
 tags:
-  - IP address
-  - Domain
+  - Artifact:IP
+  - Artifact:Domain
   - Passive DNS
   - Passive SSL
   - Reverse Whois
@@ -31,6 +31,10 @@ api_key: ...
 
 ## Components
 
+### Analyzer
+
+`analyzer` (`string`) should be either of `passivetotal` and `pt`.
+
 ### Query
 
 `query` (`string`) is a passive DNS/SSL or reverse whois search query. Domain, IP address, mail or SHA1 certificate fingerprint.

data/docs/analyzers/pulsedive.md

@@ -1,7 +1,7 @@
 ---
 tags:
-  - IP address
-  - Domain
+  - Artifact:IP
+  - Artifact:Domain
   - Passive DNS
 ---
 

data/docs/analyzers/securitytrails.md

@@ -1,7 +1,7 @@
 ---
 tags:
-  - IP address
-  - Domain
+  - Artifact:IP
+  - Artifact:Domain
   - Passive DNS
   - Reverse Whois
 ---
@@ -28,6 +28,10 @@ api_key: ...
 
 ## Components
 
+### Analyzer
+
+`analyzer` (`string`) should be either of `securitytrails` and `st`.
+
 ### Query
 
 `query` (`string`) is a passive DNS search/reverse whois query. Domain, IP address or mail.

data/docs/analyzers/shodan.md

@@ -1,6 +1,6 @@
 ---
 tags:
-  - IP address
+  - Artifact:IP
 ---
 
 # Shodan

data/docs/analyzers/urlscan.md

@@ -1,8 +1,8 @@
 ---
 tags:
-  - IP address
-  - Domain
-  - URL
+  - Artifact:IP
+  - Artifact:Domain
+  - Artifact:URL
 ---
 
 # urlscan.io

data/docs/analyzers/virustotal.md

@@ -1,7 +1,7 @@
 ---
 tags:
-  - IP address
-  - Domain
+  - Artifact:IP
+  - Artifact:Domain
   - Passive DNS
 ---
 
@@ -30,6 +30,10 @@ api_key: ...
 
 ## Components
 
+### Analyzer
+
+`analyzer` (`string`) should be either of `virustoal` and `vt`.
+
 ### Query
 
 `query` (`string`) is a passive DNS search query. Domain or IP address.

data/docs/analyzers/virustotal_intelligence.md

@@ -1,9 +1,9 @@
 ---
 tags:
-  - IP address
-  - Domain
-  - URL
-  - Hash
+  - Artifact:IP
+  - Artifact:Domain
+  - Artifact:URL
+  - Artifact:Hash
 ---
 
 # VirusTotal Intelligence
@@ -20,6 +20,10 @@ api_key: ...
 
 ## Components
 
+### Analyzer
+
+`analyzer` (`string`) should be either of `virustotal_intelligence` and ``.
+
 ### Query
 
 `query` (`string`) is a search query.

data/docs/analyzers/zoomeye.md

@@ -1,3 +1,8 @@
+---
+tags:
+  - Artifact:IP
+---
+
 # ZoomEye
 
 - [https://zoomeye.org/](https://zoomeye.org/)

data/docs/emitters/hive.md

@@ -5,7 +5,7 @@
 This emitter creates an alert on TheHive. TheHive v4 & v5 are supported.
 
 ```yaml
-emitter: the_hive
+emitter: thehive
 url: ...
 api_key: ...
 api_version: ...

data/docs/emitters/slack.md

@@ -10,11 +10,6 @@ webhook_url: ...
 channel: ...
 ```
 
-| Name        | Type   | Required? | Default                         | Desc.             |
-| ----------- | ------ | --------- | ------------------------------- | ----------------- |
-| webhook_url | String | No        | ENV[SLACK_WEBHOOK_URL]          | Slack webhook URL |
-| channel     | String | No        | ENV[SLACK_CHANNEL] / `#general` | Slack channel     |
-
 ## Components
 
 ### Webhook URL

data/docs/enrichers/google_public_dns.md

@@ -1,6 +1,6 @@
 ---
 tags:
-  - DNS record
+  - Enrichment:DNS_Record
 ---
 
 # Google Public DNS

data/docs/enrichers/ipinfo.md

@@ -1,7 +1,7 @@
 ---
 tags:
-  - Autonomous system
-  - Geolocation
+  - Enrichment:Autonomous_System
+  - Enrichment:Geolocation
 ---
 
 # ipinfo.io

data/docs/enrichers/shodan.md

@@ -1,11 +1,11 @@
 ---
 tags:
-  - Port
-  - CPE
-  - DNS record
+  - Enrichment:Port
+  - Enrichment:CPE
+  - Enrichment:DNS_Record
 ---
 
-# Shodan
+# Shodan (The InternetDB API)
 
 - [https://www.shodan.io/](https://www.shodan.io/dashboard)
 

data/docs/enrichers/whois.md

@@ -1,6 +1,6 @@
 ---
 tags:
-  - Whois
+  - Enrichment:Whois
 ---
 
 # Whois

data/docs/rule.md

@@ -54,7 +54,7 @@ emitters:
   - emitter: database
   - emitter: misp
   - emitter: slack
-  - emitter: the_hive
+  - emitter: thehive
 data_types:
   - hash
   - ip
@@ -124,9 +124,6 @@ See [Emitters](./emitters/index.md) to know details of each emitter.
 Defaults to:
 
 - `database`
-- `misp`
-- `slack`
-- `the_hive`
 
 ### Data Types
 

data/docs/usage.md

@@ -8,8 +8,11 @@ Commands:
   mihari db                   # Sub commands for DB
   mihari help [COMMAND]       # Describe available commands or one specific command
   mihari rule                 # Sub commands for rule
-  mihari search [PATH_OR_ID]  # Search by a rule
+  mihari search [PATH_OR_ID]  # Search by a rule (Outputs null if there is no new finding)
   mihari web                  # Launch the web app
+
+Options:
+  -d, [--debug], [--no-debug]  # Sets up debug mode
 ```
 
 ## `mihari db`
@@ -43,7 +46,7 @@ Mihari asks whether really you want to update a rule if there is a diff by defau
 
 ```bash
 $ mihari search /path/to/rule.yml
-There is a diff in the rule (6254bb74-5e5d-42ad-bc1e-231da0293b0f). Are you sure you want to overwrite the rule? (y/n)
+There is a diff in the rule. Are you sure you want to overwrite the rule? (y/n)
 ```
 
 It can be suppressed by providing `-f`.

data/frontend/package-lock.json

@@ -6925,9 +6925,9 @@
       }
     },
     "node_modules/vue-template-compiler": {
-      "version": "2.7.14",
-      "resolved": "https://registry.npmjs.org/vue-template-compiler/-/vue-template-compiler-2.7.14.tgz",
-      "integrity": "sha512-zyA5Y3ArvVG0NacJDkkzJuPQDF8RFeRlzV2vLeSnhSpieO6LK2OVbdLPi5MPPs09Ii+gMO8nY4S3iKQxBxDmWQ==",
+      "version": "2.7.15",
+      "resolved": "https://registry.npmjs.org/vue-template-compiler/-/vue-template-compiler-2.7.15.tgz",
+      "integrity": "sha512-yQxjxMptBL7UAog00O8sANud99C6wJF+7kgbcwqkvA38vCGF7HWE66w0ZFnS/kX5gSoJr/PQ4/oS3Ne2pW37Og==",
       "dev": true,
       "dependencies": {
         "de-indent": "^1.0.2",

data/frontend/src/components/ErrorMessage.vue

@@ -3,7 +3,6 @@
     <p v-if="error.response.data?.message">{{ error.response.data.message }}</p>
     <p v-else>{{ error }}</p>
   </div>
-
   <article class="message" v-if="error.response.data?.details">
     <div class="message-body">
       <VueJsonPretty :data="error.response.data.details"></VueJsonPretty>

data/frontend/src/components/alert/Alerts.vue

@@ -6,7 +6,6 @@
     @refresh-page="refreshPage"
     @update-tag="updateTag"
   ></Alert>
-
   <Pagination
     :total="alerts.total"
     :currentPage="alerts.currentPage"

data/frontend/src/components/alert/AlertsWithPagination.vue

@@ -1,6 +1,5 @@
 <template>
   <Loading v-if="getAlertsTask.isRunning"></Loading>
-
   <Alerts
     :alerts="getAlertsTask.last.value"
     v-if="getAlertsTask.last?.value"

data/frontend/src/components/alert/AlertsWrapper.vue

@@ -7,9 +7,7 @@
       :page="page"
       :tag="tag"
     ></FormComponent>
-
     <hr />
-
     <div class="columns">
       <div class="column">
         <div class="field is-grouped is-grouped-centered">
@@ -25,14 +23,10 @@
       </div>
     </div>
   </div>
-
   <div v-if="getAlertsTask.performCount > 0">
     <hr />
-
     <Loading v-if="getAlertsTask.isRunning"></Loading>
-
     <ErrorMessage v-if="getAlertsTask.isError" :error="getAlertsTask.last?.error"></ErrorMessage>
-
     <AlertsComponent
       :alerts="getAlertsTask.last.value"
       v-if="getAlertsTask.last?.value"

data/frontend/src/components/alert/Form.vue

@@ -36,7 +36,6 @@
       </div>
     </div>
   </div>
-
   <div class="columns">
     <div class="column">
       <div class="field is-horizontal">
@@ -61,7 +60,6 @@
     </div>
     <div class="column"></div>
   </div>
-
   <div class="columns">
     <div class="column">
       <div class="field is-horizontal">
@@ -95,7 +93,7 @@
 </template>
 
 <script lang="ts">
-import { defineComponent, type PropType, ref, toRef,watch } from "vue"
+import { defineComponent, type PropType, ref, toRef, watch } from "vue"
 import { useRoute } from "vue-router"
 
 import type { AlertSearchParams } from "@/types"

data/frontend/src/components/artifact/Artifact.vue

@@ -4,9 +4,7 @@
       <Loading></Loading>
       <hr />
     </div>
-
     <h2 class="is-size-2 mb-4">Artifact</h2>
-
     <div class="columns">
       <div
         class="column is-half"
@@ -21,7 +19,6 @@
           </h4>
           <iframe class="mb-4" :src="googleMapSrc" width="100%" height="240px"></iframe>
         </div>
-
         <div v-if="urlscanLiveshotSrc">
           <h4 class="is-size-4 mb-2">
             Live screenshot
@@ -30,11 +27,9 @@
           <img :src="urlscanLiveshotSrc" class="liveshot" alt="liveshot" />
         </div>
       </div>
-
       <div class="column">
         <div class="block">
           <h4 class="is-size-4 mb-2">Information</h4>
-
           <table class="table is-fullwidth is-completely-borderless">
             <tr>
               <th>ID</th>
@@ -47,7 +42,6 @@
                       <font-awesome-icon icon="lightbulb"></font-awesome-icon>
                     </span>
                   </button>
-
                   <button
                     class="button is-info is-light is-small"
                     @click="flipShowMetadata"
@@ -58,7 +52,6 @@
                       <font-awesome-icon icon="info-circle"></font-awesome-icon>
                     </span>
                   </button>
-
                   <button class="button is-light is-small" @click="deleteArtifact">
                     <span>Delete</span>
                     <span class="icon is-small">
@@ -86,7 +79,6 @@
             </tr>
           </table>
         </div>
-
         <div v-if="artifact.metadata && showMetadata">
           <div class="modal is-active">
             <div class="modal-background" @click="flipShowMetadata"></div>
@@ -103,45 +95,36 @@
         </div>
       </div>
     </div>
-
     <div class="block" v-if="artifact.autonomousSystem">
       <h4 class="is-size-4 mb-2">AS</h4>
       <AS :autonomousSystem="artifact.autonomousSystem"></AS>
     </div>
-
     <div class="block" v-if="artifact.reverseDnsNames">
       <h4 class="is-size-4 mb-2">Reverse DNS</h4>
       <ReverseDnsNames :reverseDnsNames="artifact.reverseDnsNames"></ReverseDnsNames>
     </div>
-
     <div class="block" v-if="artifact.dnsRecords">
       <h4 class="is-size-4 mb-2">DNS records</h4>
       <DnsRecords :dnsRecords="artifact.dnsRecords"></DnsRecords>
     </div>
-
     <div class="block" v-if="artifact.cpes">
       <h4 class="is-size-4 mb-2">CPEs</h4>
       <CPEs :cpes="artifact.cpes"></CPEs>
     </div>
-
     <div class="block" v-if="artifact.ports">
       <h4 class="is-size-4 mb-2">Ports</h4>
       <Ports :ports="artifact.ports"></Ports>
     </div>
-
     <div class="block" v-if="artifact.whoisRecord">
       <h4 class="is-size-4 mb-2">Whois record</h4>
       <WhoisRecord :whoisRecord="artifact.whoisRecord"></WhoisRecord>
     </div>
-
     <div class="block">
       <h4 class="is-size-4 mb-2">Links</h4>
       <Links :data="artifact.data" :type="artifact.dataType"></Links>
     </div>
   </div>
-
   <hr />
-
   <div class="column">
     <h2 class="is-size-2 mb-4">Related alerts</h2>
     <Alerts :artifact="artifact.data"></Alerts>

data/frontend/src/components/artifact/ArtifactWrapper.vue

@@ -1,8 +1,6 @@
 <template>
   <Loading v-if="getArtifactTask.isRunning"></Loading>
-
   <ErrorMessage v-if="getArtifactTask.isError" :error="getArtifactTask.last?.error"></ErrorMessage>
-
   <ArtifactComponent
     :artifact="getArtifactTask.last.value"
     @refresh="refresh"

data/frontend/src/components/artifact/WhoisRecord.vue

@@ -6,21 +6,18 @@
         <span class="tag is-light">{{ whoisRecord.registrar?.name || "N/A" }}</span>
       </div>
     </div>
-
     <div class="control">
       <div class="tags has-addons are-medium">
         <span class="tag is-dark">Created on</span>
         <span class="tag is-light">{{ whoisRecord.createdOn || "N/A" }}</span>
       </div>
     </div>
-
     <div class="control">
       <div class="tags has-addons are-medium">
         <span class="tag is-dark">Updated on</span>
         <span class="tag is-light">{{ whoisRecord.updatedOn || "N/A" }}</span>
       </div>
     </div>
-
     <div class="control">
       <div class="tags has-addons are-medium">
         <span class="tag is-dark">Exipres on</span>

data/frontend/src/components/config/ConfigsWrapper.vue

@@ -1,8 +1,6 @@
 <template>
   <Loading v-if="getConfigsTask.isRunning"></Loading>
-
   <ErrorMessage v-if="getConfigsTask.isError" :error="getConfigsTask.last?.error"></ErrorMessage>
-
   <Configs :configs="getConfigsTask.last.value" v-if="getConfigsTask.last?.value"></Configs>
 </template>
 

data/frontend/src/components/rule/EditRule.vue

@@ -1,9 +1,7 @@
 <template>
   <div class="column">
     <h2 class="is-size-2 mb-4">Edit rule: {{ rule.id }}</h2>
-
     <InputForm v-model:yaml="yaml" @update-yaml="updateYAML"></InputForm>
-
     <div class="field is-grouped is-grouped-centered">
       <p class="control">
         <a class="button is-primary" @click="edit">
@@ -14,7 +12,6 @@
         </a>
       </p>
     </div>
-
     <div v-if="updateRuleTask.last?.error">
       <hr />
       <ErrorMessage :error="updateRuleTask.last?.error"></ErrorMessage>