mihari 5.6.1 → 5.6.2

data/lib/mihari/emitters/the_hive.rb

@@ -12,45 +12,42 @@ module Mihari
       # @return [String, nil]
       attr_reader :api_version
 
+      # @return [Array<Mihari::Models::Artifact>]
+      attr_accessor :artifacts
+
       #
-      # @param [Array<Mihari::Artifact>] artifacts
       # @param [Mihari::Services::Rule] rule
       # @param [Hash, nil] options
       # @param [Hash] **params
       #
-      def initialize(artifacts:, rule:, options: nil, **params)
-        super(artifacts: artifacts, rule: rule, options: options)
+      def initialize(rule:, options: nil, **params)
+        super(rule: rule, options: options)
 
         @url = params[:url] || Mihari.config.thehive_url
         @api_key = params[:api_key] || Mihari.config.thehive_api_key
         @api_version = params[:api_version] || Mihari.config.thehive_api_version
+
+        @artifacts = []
       end
 
+      #
       # @return [Boolean]
-      def valid?
-        unless url? && api_key?
-          Mihari.logger.info("TheHive URL is not set") unless url?
-          Mihari.logger.info("TheHive API key is not set") unless api_key?
-          return false
-        end
-
-        unless ping?
-          Mihari.logger.info("TheHive URL (#{url}) is not reachable")
-          return false
-        end
-
-        true
+      #
+      def configured?
+        api_key? && url?
       end
 
       #
       # Create a Hive alert
       #
-      # @return [::MISP::Event]
+      # @param [Array<Mihari::Models::Artifact>] artifacts
       #
-      def emit
+      def emit(artifacts)
         return if artifacts.empty?
 
-        client.alert(payload)
+        @artifacts = artifacts
+
+        client.alert payload
       end
 
       #
@@ -146,31 +143,6 @@ module Mihari
           source_ref: "1"
         }
       end
-
-      #
-      # Check whether a URL is reachable or not
-      #
-      # @return [Boolean]
-      #
-      def ping?
-        base_url = url.end_with?("/") ? url[0..-2] : url
-
-        if normalized_api_version.nil?
-          # for v4
-          base_url = url.end_with?("/") ? url[0..-2] : url
-          public_url = "#{base_url}/index.html"
-        else
-          # for v5
-          public_url = "#{base_url}/api/v1/status/public"
-        end
-
-        http = Net::Ping::HTTP.new(public_url)
-
-        # use GET for v5
-        http.get_request = true if normalized_api_version
-
-        http.ping?
-      end
     end
   end
 end

data/lib/mihari/emitters/webhook.rb

@@ -57,23 +57,41 @@ module Mihari
       # @return [String, nil]
       attr_reader :template
 
+      # @return [Array<Mihari::Models::Artifact>]
+      attr_accessor :artifacts
+
       #
-      # @param [Array<Mihari::Artifact>] artifacts
       # @param [Mihari::Services::Rule] rule
       # @param [Hash] **options
       #
-      def initialize(artifacts:, rule:, options: nil, **params)
-        super(artifacts: artifacts, rule: rule, options: options)
+      def initialize(rule:, options: nil, **params)
+        super(rule: rule, options: options)
 
         @url = Addressable::URI.parse(params[:url])
         @headers = params[:headers] || {}
         @method = params[:method] || "POST"
         @template = params[:template]
+
+        @artifacts = []
+      end
+
+      #
+      # @return [Boolean]
+      #
+      def configured?
+        return false if url.nil?
+
+        %w[http https].include? url.scheme.downcase
       end
 
-      def emit
+      #
+      # @param [Array<Mihari::Models::Artifact>] artifacts
+      #
+      def emit(artifacts)
         return if artifacts.empty?
 
+        @artifacts = artifacts
+
         # returns body to prevent Parallel issue (Parallel fails to handle HTTP:Response object)
         case method
         when "GET"
@@ -83,12 +101,6 @@ module Mihari
         end
       end
 
-      def valid?
-        return false if url.nil?
-
-        %w[http https].include? url.scheme.downcase
-      end
-
       private
 
       def http
@@ -101,17 +113,15 @@ module Mihari
       # @return [String]
       #
       def rendered_template
-        [].tap do |out|
-          options = {}
-          options[:template] = File.read(template) unless template.nil?
-
-          payload_template = PayloadTemplate.new(
-            artifacts: artifacts,
-            rule: rule,
-            options: options
-          )
-          out << payload_template.result
-        end.first
+        options = {}
+        options[:template] = File.read(template) unless template.nil?
+
+        payload_template = PayloadTemplate.new(
+          artifacts: artifacts,
+          rule: rule,
+          options: options
+        )
+        payload_template.result
       end
 
       #

data/lib/mihari/enrichers/base.rb

@@ -2,12 +2,7 @@
 
 module Mihari
   module Enrichers
-    class Base < Mihari::Base
-      include Mixins::Configurable
-      include Mixins::Retriable
-
-      include Dry::Monads[:result, :try]
-
+    class Base < Actor
       def initialize(options: nil)
         super(options: options)
       end

data/lib/mihari/enrichers/whois.rb

@@ -34,7 +34,7 @@ module Mihari
         parser = record.parser
         return nil if parser.available?
 
-        whois_record = WhoisRecord.new(
+        whois_record = Models::WhoisRecord.new(
           domain: domain,
           created_on: get_created_on(parser),
           updated_on: get_updated_on(parser),

data/lib/mihari/models/alert.rb

@@ -1,88 +1,90 @@
 # frozen_string_literal: true
 
 module Mihari
-  class Alert < ActiveRecord::Base
-    has_many :taggings, dependent: :destroy
-    has_many :artifacts, dependent: :destroy
-    has_many :tags, through: :taggings
-
-    belongs_to :rule
-
-    class << self
-      #
-      # Search alerts
-      #
-      # @param [Structs::Filters::Alert::SearchFilterWithPagination] filter
-      #
-      # @return [Array<Alert>]
-      #
-      def search(filter)
-        limit = filter.limit.to_i
-        raise ArgumentError, "limit should be bigger than zero" unless limit.positive?
-
-        page = filter.page.to_i
-        raise ArgumentError, "page should be bigger than zero" unless page.positive?
-
-        offset = (page - 1) * limit
-
-        relation = build_relation(filter.without_pagination)
-
-        alert_ids = relation.limit(limit).offset(offset).order(id: :desc).pluck(:id).uniq
-        eager_load(:artifacts, :tags).where(id: [alert_ids]).order(id: :desc)
-      end
-
-      #
-      # Count alerts
-      #
-      # @param [String, nil] artifact_data
-      #
-      # @return [Integer]
-      #
-      def count(filter)
-        relation = build_relation(filter)
-        relation.distinct("alerts.id").count
-      end
+  module Models
+    class Alert < ActiveRecord::Base
+      has_many :taggings, dependent: :destroy
+      has_many :artifacts, dependent: :destroy
+      has_many :tags, through: :taggings
+
+      belongs_to :rule
+
+      class << self
+        #
+        # Search alerts
+        #
+        # @param [Structs::Filters::Alert::SearchFilterWithPagination] filter
+        #
+        # @return [Array<Alert>]
+        #
+        def search(filter)
+          limit = filter.limit.to_i
+          raise ArgumentError, "limit should be bigger than zero" unless limit.positive?
+
+          page = filter.page.to_i
+          raise ArgumentError, "page should be bigger than zero" unless page.positive?
+
+          offset = (page - 1) * limit
+
+          relation = build_relation(filter.without_pagination)
+
+          alert_ids = relation.limit(limit).offset(offset).order(id: :desc).pluck(:id).uniq
+          eager_load(:artifacts, :tags).where(id: [alert_ids]).order(id: :desc)
+        end
 
-      private
-
-      #
-      # @param [Structs::Filters::Alert::SearchFilter] filter
-      #
-      # @return [Array<Integer>]
-      #
-      def get_artifact_ids_by_filter(filter)
-        artifact_ids = []
-
-        if filter.artifact_data
-          artifact = Artifact.where(data: filter.artifact_data)
-          artifact_ids = artifact.pluck(:id)
-          # set invalid ID if nothing is matched with the filters
-          artifact_ids = [-1] if artifact_ids.empty?
+        #
+        # Count alerts
+        #
+        # @param [String, nil] artifact_data
+        #
+        # @return [Integer]
+        #
+        def count(filter)
+          relation = build_relation(filter)
+          relation.distinct("alerts.id").count
         end
 
-        artifact_ids
-      end
+        private
 
-      #
-      # @param [Structs::Filters::Alert::SearchFilter] filter
-      #
-      # @return [Mihari::Alert]
-      #
-      def build_relation(filter)
-        artifact_ids = get_artifact_ids_by_filter(filter)
+        #
+        # @param [Structs::Filters::Alert::SearchFilter] filter
+        #
+        # @return [Array<Integer>]
+        #
+        def get_artifact_ids_by_filter(filter)
+          artifact_ids = []
 
-        relation = self
-        relation = relation.includes(:artifacts, :tags)
+          if filter.artifact_data
+            artifact = Artifact.where(data: filter.artifact_data)
+            artifact_ids = artifact.pluck(:id)
+            # set invalid ID if nothing is matched with the filters
+            artifact_ids = [-1] if artifact_ids.empty?
+          end
 
-        relation = relation.where(artifacts: { id: artifact_ids }) unless artifact_ids.empty?
-        relation = relation.where(tags: { name: filter.tag_name }) if filter.tag_name
+          artifact_ids
+        end
+
+        #
+        # @param [Structs::Filters::Alert::SearchFilter] filter
+        #
+        # @return [Mihari::Models::Alert]
+        #
+        def build_relation(filter)
+          artifact_ids = get_artifact_ids_by_filter(filter)
+
+          relation = self
+          relation = relation.includes(:artifacts, :tags)
 
-        relation = relation.where(rule_id: filter.rule_id) if filter.rule_id
+          relation = relation.where(artifacts: { id: artifact_ids }) unless artifact_ids.empty?
+          relation = relation.where(tags: { name: filter.tag_name }) if filter.tag_name
 
-        relation = relation.where("alerts.created_at >= ?", filter.from_at) if filter.from_at
-        relation = relation.where("alerts.created_at <= ?", filter.to_at) if filter.to_at
+          relation = relation.where(rule_id: filter.rule_id) if filter.rule_id
 
-        relation
+          relation = relation.where("alerts.created_at >= ?", filter.from_at) if filter.from_at
+          relation = relation.where("alerts.created_at <= ?", filter.to_at) if filter.to_at
+
+          relation
+        end
       end
     end
   end