mihari 5.5.0 → 5.6.1

data/lib/mihari/clients/otx.rb

@@ -7,12 +7,13 @@ module Mihari
       # @param [String] base_url
       # @param [String, nil] api_key
       # @param [Hash] headers
+      # @param [Integer, nil] timeout
       #
-      def initialize(base_url = "https://otx.alienvault.com", api_key:, headers: {})
-        raise(ArgumentError, "'api_key' argument is required") unless api_key
+      def initialize(base_url = "https://otx.alienvault.com", api_key:, headers: {}, timeout: nil)
+        raise(ArgumentError, "api_key is required") unless api_key
 
         headers["x-otx-api-key"] = api_key
-        super(base_url, headers: headers)
+        super(base_url, headers: headers, timeout: timeout)
       end
 
       #

data/lib/mihari/clients/passivetotal.rb

@@ -10,14 +10,15 @@ module Mihari
       # @param [String, nil] username
       # @param [String, nil] api_key
       # @param [Hash] headers
+      # @param [Integer, nil] timeout
       #
-      def initialize(base_url = "https://api.passivetotal.org", username:, api_key:, headers: {})
-        raise(ArgumentError, "'username' argument is required") if username.nil?
-        raise(ArgumentError, "'api_key' argument is required") if api_key.nil?
+      def initialize(base_url = "https://api.passivetotal.org", username:, api_key:, headers: {}, timeout: nil)
+        raise(ArgumentError, "username is required") if username.nil?
+        raise(ArgumentError, "api_key is required") if api_key.nil?
 
         headers["authorization"] = "Basic #{Base64.strict_encode64("#{username}:#{api_key}")}"
 
-        super(base_url, headers: headers)
+        super(base_url, headers: headers, timeout: timeout)
       end
 
       #

data/lib/mihari/clients/publsedive.rb

@@ -10,13 +10,14 @@ module Mihari
       # @param [String] base_url
       # @param [String, nil] api_key
       # @param [Hash] headers
+      # @param [Integer, nil] timeout
       #
-      def initialize(base_url = "https://pulsedive.com", api_key:, headers: {})
-        super(base_url, headers: headers)
+      def initialize(base_url = "https://pulsedive.com", api_key:, headers: {}, timeout: nil)
+        raise(ArgumentError, "api_key is required") unless api_key
 
         @api_key = api_key
 
-        raise(ArgumentError, "'api_key' argument is required") unless api_key
+        super(base_url, headers: headers, timeout: timeout)
       end
 
       #

data/lib/mihari/clients/securitytrails.rb

@@ -7,12 +7,14 @@ module Mihari
       # @param [String] base_url
       # @param [String, nil] api_key
       # @param [Hash] headers
+      # @param [Integer, nil] timeout
       #
-      def initialize(base_url = "https://api.securitytrails.com", api_key:, headers: {})
-        raise(ArgumentError, "'api_key' argument is required") unless api_key
+      def initialize(base_url = "https://api.securitytrails.com", api_key:, headers: {}, timeout: nil)
+        raise(ArgumentError, "api_key is required") unless api_key
 
         headers["apikey"] = api_key
-        super(base_url, headers: headers)
+
+        super(base_url, headers: headers, timeout: timeout)
       end
 
       #

data/lib/mihari/clients/shodan.rb

@@ -19,10 +19,10 @@ module Mihari
         base_url = "https://api.shodan.io",
         api_key:,
         headers: {},
-        pagination_interval: 0,
+        pagination_interval: Mihari.config.pagination_interval,
         timeout: nil
       )
-        raise(ArgumentError, "'api_key' argument is required") unless api_key
+        raise(ArgumentError, "api_key is required") unless api_key
 
         super(base_url, headers: headers, pagination_interval: pagination_interval, timeout: timeout)
 

data/lib/mihari/clients/the_hive.rb

@@ -11,7 +11,7 @@ module Mihari
       # @param [Integer, nil] timeout
       #
       def initialize(base_url, api_key:, api_version:, headers: {}, timeout: nil)
-        raise(ArgumentError, "'api_key' argument is required") unless api_key
+        raise(ArgumentError, "api_key is required") unless api_key
 
         base_url += "/#{api_version}" unless api_version.nil?
         headers["authorization"] = "Bearer #{api_key}"

data/lib/mihari/clients/urlscan.rb

@@ -7,17 +7,17 @@ module Mihari
       # @param [String] base_url
       # @param [String, nil] api_key
       # @param [Hash] headers
-      # @param [Interval, nil] interval
-      # @param [Interval, nil] timeout
+      # @param [Integer, nil] interval
+      # @param [Integer, nil] timeout
       #
       def initialize(
         base_url = "https://urlscan.io",
         api_key:,
         headers: {},
-        pagination_interval: 0,
+        pagination_interval: Mihari.config.pagination_interval,
         timeout: nil
       )
-        raise(ArgumentError, "'api_key' argument is required") if api_key.nil?
+        raise(ArgumentError, "api_key is required") if api_key.nil?
 
         headers["api-key"] = api_key
 

data/lib/mihari/clients/virustotal.rb

@@ -14,10 +14,10 @@ module Mihari
         base_url = "https://www.virustotal.com",
         api_key:,
         headers: {},
-        pagination_interval: 0,
+        pagination_interval: Mihari.config.pagination_interval,
         timeout: nil
       )
-        raise(ArgumentError, "'api_key' argument is required") if api_key.nil?
+        raise(ArgumentError, "api_key is required") if api_key.nil?
 
         headers["x-apikey"] = api_key
 

data/lib/mihari/clients/zoomeye.rb

@@ -18,10 +18,10 @@ module Mihari
         base_url = "https://api.zoomeye.org",
         api_key:,
         headers: {},
-        pagination_interval: 0,
+        pagination_interval: Mihari.config.pagination_interval,
         timeout: nil
       )
-        raise(ArgumentError, "'api_key' argument is required") unless api_key
+        raise(ArgumentError, "api_key is required") unless api_key
 
         headers["api-key"] = api_key
         super(base_url, headers: headers, pagination_interval: pagination_interval, timeout: timeout)

data/lib/mihari/commands/alert.rb

@@ -14,30 +14,14 @@ module Mihari
             #
             def add(path)
               Mihari::Database.with_db_connection do
-                builder = Mihari::Services::AlertBuilder.new(path)
+                builder = Services::AlertBuilder.new(path)
 
                 run_proxy_l = ->(proxy) { run_proxy proxy }
-                check_nil_l = ->(alert_or_nil) { check_nil alert_or_nil }
+                result = builder.result.bind(run_proxy_l)
 
-                result = builder.result.bind(run_proxy_l).bind(check_nil_l)
-
-                if result.success?
-                  alert = result.value!
-                  data = Mihari::Entities::Alert.represent(alert)
-                  puts JSON.pretty_generate(data.as_json)
-                  return
-                end
-
-                failure = result.failure
-                case failure
-                when ValidationError
-                  Mihari.logger.error "Failed to parse the input as an alert:"
-                  Mihari.logger.error JSON.pretty_generate(failure.errors.to_h)
-                when StandardError
-                  raise failure
-                else
-                  Mihari.logger.info failure
-                end
+                alert = result.value!
+                data = Entities::Alert.represent(alert)
+                puts JSON.pretty_generate(data.as_json)
               end
             end
 
@@ -47,21 +31,10 @@ module Mihari
               #
               def run_proxy(proxy)
                 Dry::Monads::Try[StandardError] do
-                  runner = Mihari::Services::AlertRunner.new(proxy)
+                  runner = Services::AlertRunner.new(proxy)
                   runner.run
                 end.to_result
               end
-
-              #
-              # @param [Mihari::Alert, nil] alert_or_nil
-              #
-              def check_nil(alert_or_nil)
-                if alert_or_nil.nil?
-                  Failure "There is no new artifact found"
-                else
-                  Success alert_or_nil
-                end
-              end
             end
           end
         end

data/lib/mihari/commands/rule.rb

@@ -8,7 +8,7 @@ module Mihari
       class << self
         def included(thor)
           thor.class_eval do
-            include Dry::Monads[:result, :try]
+            include Dry::Monads[:try, :result]
 
             desc "validate [PATH]", "Validate a rule file"
             #
@@ -18,16 +18,11 @@ module Mihari
             #
             def validate(path)
               res = Dry::Monads::Try[ValidationError] do
-                Services::RuleProxy.from_yaml(File.read(path))
-              end.fmap do |rule|
-                Mihari.logger.info "Valid format. The input is parsed as the following:"
-                Mihari.logger.info rule.data.to_yaml
+                Services::RuleProxy.from_yaml File.read(path)
               end
 
-              return unless res.error?
-
-              Mihari.logger.error "Failed to parse the input as a rule:"
-              Mihari.logger.error JSON.pretty_generate(res.exception.errors.to_h)
+              rule = res.value!
+              puts rule.data.to_yaml
             end
 
             desc "init [PATH]", "Initialize a new rule file"
@@ -43,14 +38,14 @@ module Mihari
 
               initialize_rule path
 
-              Mihari.logger.info "A new rule file has been initialized: #{path}."
+              puts "A new rule file has been initialized: #{path}."
             end
 
             no_commands do
               #
               # @return [Mihari::Services::Rule]
               #
-              def rule_template
+              def rule
                 Services::RuleProxy.from_yaml File.read(File.expand_path("../templates/rule.yml.erb", __dir__))
               end
 
@@ -63,7 +58,7 @@ module Mihari
               # @return [nil]
               #
               def initialize_rule(path, files = Dry::Files.new)
-                files.write(path, rule_template.yaml)
+                files.write(path, rule.yaml)
               end
             end
           end

data/lib/mihari/commands/search.rb

@@ -6,10 +6,10 @@ module Mihari
       class << self
         def included(thor)
           thor.class_eval do
-            include Dry::Monads[:result, :try]
+            include Dry::Monads[:try, :result]
 
-            desc "search [PATH_OR_ID]", "Search by a rule"
-            method_option :force_overwrite, type: :boolean, aliases: "-f", desc: "Force an overwrite the rule"
+            desc "search [PATH_OR_ID]", "Search by a rule (Outputs null if there is no new finding)"
+            method_option :force_overwrite, type: :boolean, aliases: "-f", desc: "Force overwriting a rule"
             #
             # Search by a rule
             #
@@ -21,27 +21,12 @@ module Mihari
 
                 check_diff_l = ->(rule) { check_diff rule }
                 update_and_run_l = ->(runner) { update_and_run runner }
-                check_nil_l = ->(alert_or_nil) { check_nil alert_or_nil }
 
-                result = builder.result.bind(check_diff_l).bind(update_and_run_l).bind(check_nil_l)
+                result = builder.result.bind(check_diff_l).bind(update_and_run_l)
 
-                if result.success?
-                  alert = result.value!
-                  data = Mihari::Entities::Alert.represent(alert)
-                  puts JSON.pretty_generate(data.as_json)
-                  return
-                end
-
-                failure = result.failure
-                case failure
-                when ValidationError
-                  Mihari.logger.error "Failed to parse the input as a rule:"
-                  Mihari.logger.error JSON.pretty_generate(failure.errors.to_h)
-                when StandardError
-                  raise failure
-                else
-                  Mihari.logger.info failure
-                end
+                alert = result.value!
+                data = Entities::Alert.represent(alert)
+                puts JSON.pretty_generate(data.as_json)
               end
             end
 
@@ -51,27 +36,14 @@ module Mihari
               #
               def check_diff(rule)
                 force_overwrite = options["force_overwrite"] || false
-                runner = Services::RuleRunner.new(rule, force_overwrite: force_overwrite)
-                message = "There is a diff in the rule (#{rule.id}). Are you sure you want to overwrite the rule? (y/n)"
+                message = "There is a diff in the rule. Are you sure you want to overwrite the rule? (y/n)"
+                runner = Services::RuleRunner.new(rule)
 
-                if runner.diff? && !force_overwrite && !yes?(message)
-                  return Failure("Stop overwriting the rule (#{rule.id})")
-                end
+                exit 0 if runner.diff? && !force_overwrite && !yes?(message)
 
                 Success runner
               end
 
-              #
-              # @param [Mihari::Alert, nil] alert_or_nil
-              #
-              def check_nil(alert_or_nil)
-                if alert_or_nil.nil?
-                  Failure "There is no new artifact found"
-                else
-                  Success alert_or_nil
-                end
-              end
-
               #
               # @param [Mihari::Services::RuleRunner] runner
               #

data/lib/mihari/constants.rb

@@ -2,11 +2,11 @@
 
 module Mihari
   # @return [Array<String>]
-  DEFAULT_DATA_TYPES = %w[hash ip domain url mail].freeze
+  DEFAULT_DATA_TYPES = Types::DataTypes.values.freeze
 
   # @return [Array<Hash>]
-  DEFAULT_EMITTERS = %w[database misp slack the_hive].map { |name| { emitter: name } }.freeze
+  DEFAULT_EMITTERS = %w[database].map { |name| { emitter: name } }.freeze
 
   # @return [Array<Hash>]
-  DEFAULT_ENRICHERS = %w[whois ipinfo shodan google_public_dns].map { |name| { enricher: name } }.freeze
+  DEFAULT_ENRICHERS = Mihari.enricher_to_class.keys.map { |name| { enricher: name.downcase } }.freeze
 end

data/lib/mihari/emitters/base.rb

@@ -2,7 +2,7 @@
 
 module Mihari
   module Emitters
-    class Base
+    class Base < Mihari::Base
       include Dry::Monads[:result, :try]
 
       include Mixins::Configurable
@@ -14,9 +14,6 @@ module Mihari
       # @return [Mihari::Services::Rule]
       attr_reader :rule
 
-      # @return [Hash]
-      attr_reader :options
-
       #
       # @param [Array<Mihari::Artifact>] artifacts
       # @param [Mihari::Services::RuleProxy] rule
@@ -24,37 +21,10 @@ module Mihari
       # @param [Hash] **_params
       #
       def initialize(artifacts:, rule:, options: nil, **_params)
+        super(options: options)
+
         @artifacts = artifacts
         @rule = rule
-        @options = options || {}
-      end
-
-      #
-      # @return [Integer]
-      #
-      def retry_interval
-        options[:retry_interval] || Mihari.config.retry_interval
-      end
-
-      #
-      # @return [Boolean]
-      #
-      def retry_exponential_backoff
-        options[:retry_exponential_backoff] || Mihari.config.retry_exponential_backoff
-      end
-
-      #
-      # @return [Integer]
-      #
-      def retry_times
-        options[:retry_times] || Mihari.config.retry_times
-      end
-
-      #
-      # @return [Integer, nil]
-      #
-      def timeout
-        options[:timeout]
       end
 
       # @return [Boolean]

data/lib/mihari/emitters/database.rb

@@ -13,7 +13,7 @@ module Mihari
       # @return [Mihari::Alert, nil]
       #
       def emit
-        return nil if artifacts.empty?
+        return if artifacts.empty?
 
         tags = rule.tags.filter_map { |name| Tag.find_or_create_by(name: name) }.uniq
         taggings = tags.map { |tag| Tagging.new(tag_id: tag.id) }

data/lib/mihari/enrichers/base.rb

@@ -2,45 +2,14 @@
 
 module Mihari
   module Enrichers
-    class Base
+    class Base < Mihari::Base
       include Mixins::Configurable
       include Mixins::Retriable
 
       include Dry::Monads[:result, :try]
 
-      # @return [Hash]
-      attr_reader :options
-
       def initialize(options: nil)
-        @options = options || {}
-      end
-
-      #
-      # @return [Integer]
-      #
-      def retry_interval
-        options[:retry_interval] || Mihari.config.retry_interval
-      end
-
-      #
-      # @return [Boolean]
-      #
-      def retry_exponential_backoff
-        options[:retry_exponential_backoff] || Mihari.config.retry_exponential_backoff
-      end
-
-      #
-      # @return [Integer]
-      #
-      def retry_times
-        options[:retry_times] || Mihari.config.retry_times
-      end
-
-      #
-      # @return [Integer, nil]
-      #
-      def timeout
-        options[:timeout]
+        super(options: options)
       end
 
       def query_result(value)

data/lib/mihari/enrichers/google_public_dns.rb

@@ -38,6 +38,15 @@ module Mihari
         nil
       end
 
+      class << self
+        #
+        # @return [String]
+        #
+        def class_key
+          "google_public_dns"
+        end
+      end
+
       private
 
       def http

data/lib/mihari/schemas/analyzer.rb

@@ -2,37 +2,31 @@
 
 module Mihari
   module Schemas
-    AnalyzerOptions = Dry::Schema.Params do
-      optional(:pagination_interval).value(:integer).default(Mihari.config.pagination_interval)
-      optional(:pagination_limit).value(:integer).default(Mihari.config.pagination_limit)
-      optional(:retry_times).value(:integer).default(Mihari.config.retry_times)
-      optional(:retry_interval).value(:integer).default(Mihari.config.retry_interval)
-      optional(:retry_exponential_backoff).value(:bool).default(Mihari.config.retry_exponential_backoff)
-      optional(:ignore_error).value(:bool).default(Mihari.config.ignore_error)
-      optional(:timeout).value(:integer)
-    end
-
-    AnalyzerWithoutAPIKey = Dry::Schema.Params do
-      required(:analyzer).value(Types::String.enum("dnstwister"))
-      required(:query).value(:string)
-      optional(:options).hash(AnalyzerOptions)
-    end
-
-    AnalyzerWithAPIKey = Dry::Schema.Params do
+    AnalyzerAPIKeyPagination = Dry::Schema.Params do
       required(:analyzer).value(
         Types::String.enum(
           "binaryedge",
           "greynoise",
           "onyphe",
+          "shodan",
+          "urlscan",
+          "virustotal_intelligence",
+          "vt_intel"
+        )
+      )
+      required(:query).value(:string)
+      optional(:api_key).value(:string)
+      optional(:options).hash(AnalyzerPaginationOptions)
+    end
+
+    AnalyzerAPIKey = Dry::Schema.Params do
+      required(:analyzer).value(
+        Types::String.enum(
           "otx",
           "pulsedive",
           "securitytrails",
-          "shodan",
           "st",
-          "urlscan",
-          "virustotal_intelligence",
           "virustotal",
-          "vt_intel",
           "vt"
         )
       )
@@ -41,12 +35,18 @@ module Mihari
       optional(:options).hash(AnalyzerOptions)
     end
 
+    DNSTwister = Dry::Schema.Params do
+      required(:analyzer).value(Types::String.enum("dnstwister"))
+      required(:query).value(:string)
+      optional(:options).hash(AnalyzerOptions)
+    end
+
     Censys = Dry::Schema.Params do
       required(:analyzer).value(Types::String.enum("censys"))
       required(:query).value(:string)
       optional(:id).value(:string)
       optional(:secret).value(:string)
-      optional(:options).hash(AnalyzerOptions)
+      optional(:options).hash(AnalyzerPaginationOptions)
     end
 
     CIRCL = Dry::Schema.Params do
@@ -69,7 +69,7 @@ module Mihari
       required(:analyzer).value(Types::String.enum("zoomeye"))
       required(:query).value(:string)
       required(:type).value(Types::String.enum("host", "web"))
-      optional(:options).hash(AnalyzerOptions)
+      optional(:options).hash(AnalyzerPaginationOptions)
     end
 
     Crtsh = Dry::Schema.Params do
@@ -85,7 +85,7 @@ module Mihari
       required(:start_time).value(:date)
       required(:end_time).value(:date)
       optional(:api_key).value(:string)
-      optional(:options).hash(AnalyzerOptions)
+      optional(:options).hash(AnalyzerPaginationOptions)
     end
 
     Feed = Dry::Schema.Params do

data/lib/mihari/schemas/emitter.rb

@@ -3,38 +3,31 @@
 module Mihari
   module Schemas
     module Emitters
-      EmitterOptions = Dry::Schema.Params do
-        optional(:retry_times).value(:integer).default(Mihari.config.retry_times)
-        optional(:retry_interval).value(:integer).default(Mihari.config.retry_interval)
-        optional(:retry_exponential_backoff).value(:bool).default(Mihari.config.retry_exponential_backoff)
-        optional(:timeout).value(:integer)
-      end
-
       Database = Dry::Schema.Params do
         required(:emitter).value(Types::String.enum("database"))
-        optional(:options).hash(EmitterOptions)
+        optional(:options).hash(Options)
       end
 
       MISP = Dry::Schema.Params do
         required(:emitter).value(Types::String.enum("misp"))
         optional(:url).value(:string)
         optional(:api_key).value(:string)
-        optional(:options).hash(EmitterOptions)
+        optional(:options).hash(Options)
       end
 
       TheHive = Dry::Schema.Params do
-        required(:emitter).value(Types::String.enum("the_hive"))
+        required(:emitter).value(Types::String.enum("thehive"))
         optional(:url).value(:string)
         optional(:api_key).value(:string)
         optional(:api_version).value(Types::String.enum("v4", "v5")).default("v4")
-        optional(:options).hash(EmitterOptions)
+        optional(:options).hash(Options)
       end
 
       Slack = Dry::Schema.Params do
         required(:emitter).value(Types::String.enum("slack"))
         optional(:webhook_url).value(:string)
         optional(:channel).value(:string)
-        optional(:options).hash(EmitterOptions)
+        optional(:options).hash(Options)
       end
 
       Webhook = Dry::Schema.Params do
@@ -43,7 +36,7 @@ module Mihari
         optional(:method).value(Types::HTTPRequestMethods).default("POST")
         optional(:headers).value(:hash).default({})
         optional(:template).value(:string)
-        optional(:options).hash(EmitterOptions)
+        optional(:options).hash(Options)
       end
     end
   end

data/lib/mihari/schemas/enricher.rb

@@ -3,32 +3,25 @@
 module Mihari
   module Schemas
     module Enrichers
-      EnricherOptions = Dry::Schema.Params do
-        optional(:retry_times).value(:integer).default(Mihari.config.retry_times)
-        optional(:retry_interval).value(:integer).default(Mihari.config.retry_interval)
-        optional(:retry_exponential_backoff).value(:bool).default(Mihari.config.retry_exponential_backoff)
-        optional(:timeout).value(:integer)
-      end
-
       IPInfo = Dry::Schema.Params do
         required(:enricher).value(Types::String.enum("ipinfo"))
         optional(:api_key).value(:string)
-        optional(:options).hash(EnricherOptions)
+        optional(:options).hash(Options)
       end
 
       Whois = Dry::Schema.Params do
         required(:enricher).value(Types::String.enum("whois"))
-        optional(:options).hash(EnricherOptions)
+        optional(:options).hash(Options)
       end
 
       Shodan = Dry::Schema.Params do
         required(:enricher).value(Types::String.enum("shodan"))
-        optional(:options).hash(EnricherOptions)
+        optional(:options).hash(Options)
       end
 
       GooglePublicDNS = Dry::Schema.Params do
         required(:enricher).value(Types::String.enum("google_public_dns"))
-        optional(:options).hash(EnricherOptions)
+        optional(:options).hash(Options)
       end
     end
   end