mihari 5.6.1 → 5.6.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (71) hide show
  1. checksums.yaml +4 -4
  2. data/frontend/package-lock.json +173 -176
  3. data/frontend/package.json +9 -9
  4. data/lib/mihari/{base.rb → actor.rb} +16 -2
  5. data/lib/mihari/analyzers/base.rb +5 -10
  6. data/lib/mihari/analyzers/censys.rb +1 -1
  7. data/lib/mihari/analyzers/hunterhow.rb +1 -1
  8. data/lib/mihari/analyzers/passivetotal.rb +1 -1
  9. data/lib/mihari/analyzers/pulsedive.rb +1 -1
  10. data/lib/mihari/analyzers/securitytrails.rb +1 -1
  11. data/lib/mihari/analyzers/urlscan.rb +1 -1
  12. data/lib/mihari/analyzers/virustotal.rb +5 -5
  13. data/lib/mihari/analyzers/zoomeye.rb +3 -3
  14. data/lib/mihari/clients/crtsh.rb +2 -2
  15. data/lib/mihari/clients/passivetotal.rb +4 -4
  16. data/lib/mihari/clients/securitytrails.rb +3 -3
  17. data/lib/mihari/commands/rule.rb +2 -11
  18. data/lib/mihari/commands/search.rb +1 -1
  19. data/lib/mihari/emitters/base.rb +13 -24
  20. data/lib/mihari/emitters/database.rb +7 -9
  21. data/lib/mihari/emitters/misp.rb +14 -38
  22. data/lib/mihari/emitters/slack.rb +14 -11
  23. data/lib/mihari/emitters/the_hive.rb +16 -44
  24. data/lib/mihari/emitters/webhook.rb +31 -21
  25. data/lib/mihari/enrichers/base.rb +1 -6
  26. data/lib/mihari/enrichers/whois.rb +1 -1
  27. data/lib/mihari/models/alert.rb +75 -73
  28. data/lib/mihari/models/artifact.rb +182 -180
  29. data/lib/mihari/models/autonomous_system.rb +22 -20
  30. data/lib/mihari/models/cpe.rb +21 -19
  31. data/lib/mihari/models/dns.rb +24 -22
  32. data/lib/mihari/models/geolocation.rb +22 -20
  33. data/lib/mihari/models/port.rb +21 -19
  34. data/lib/mihari/models/reverse_dns.rb +21 -19
  35. data/lib/mihari/models/rule.rb +67 -65
  36. data/lib/mihari/models/tag.rb +5 -3
  37. data/lib/mihari/models/tagging.rb +5 -3
  38. data/lib/mihari/models/whois.rb +18 -16
  39. data/lib/mihari/rule.rb +352 -0
  40. data/lib/mihari/schemas/analyzer.rb +94 -87
  41. data/lib/mihari/schemas/emitter.rb +9 -5
  42. data/lib/mihari/schemas/enricher.rb +8 -4
  43. data/lib/mihari/schemas/mixins.rb +15 -0
  44. data/lib/mihari/schemas/rule.rb +3 -10
  45. data/lib/mihari/services/alert_builder.rb +1 -1
  46. data/lib/mihari/services/alert_proxy.rb +10 -6
  47. data/lib/mihari/services/alert_runner.rb +4 -4
  48. data/lib/mihari/services/rule_builder.rb +3 -3
  49. data/lib/mihari/services/rule_runner.rb +5 -5
  50. data/lib/mihari/structs/binaryedge.rb +1 -1
  51. data/lib/mihari/structs/censys.rb +6 -6
  52. data/lib/mihari/structs/config.rb +1 -1
  53. data/lib/mihari/structs/greynoise.rb +5 -5
  54. data/lib/mihari/structs/hunterhow.rb +3 -3
  55. data/lib/mihari/structs/onyphe.rb +5 -5
  56. data/lib/mihari/structs/shodan.rb +6 -6
  57. data/lib/mihari/structs/urlscan.rb +3 -3
  58. data/lib/mihari/structs/virustotal_intelligence.rb +3 -3
  59. data/lib/mihari/version.rb +1 -1
  60. data/lib/mihari/web/endpoints/alerts.rb +4 -4
  61. data/lib/mihari/web/endpoints/artifacts.rb +6 -6
  62. data/lib/mihari/web/endpoints/rules.rb +10 -17
  63. data/lib/mihari/web/endpoints/tags.rb +2 -2
  64. data/lib/mihari/web/public/assets/{index-9cc489e6.js → index-28d4c79d.js} +48 -48
  65. data/lib/mihari/web/public/index.html +1 -1
  66. data/lib/mihari.rb +6 -8
  67. data/mihari.gemspec +1 -2
  68. data/requirements.txt +1 -1
  69. metadata +8 -22
  70. data/lib/mihari/analyzers/rule.rb +0 -232
  71. data/lib/mihari/services/rule_proxy.rb +0 -182
@@ -81,11 +81,11 @@ module Mihari
81
81
  end
82
82
 
83
83
  #
84
- # @return [Array<Mihari::Artifact>]
84
+ # @return [Array<Mihari::Models::Artifact>]
85
85
  #
86
86
  def artifacts
87
87
  values = [page.url, page.domain, page.ip].compact
88
- values.map { |value| Mihari::Artifact.new(data: value, metadata: metadata) }
88
+ values.map { |value| Mihari::Models::Artifact.new(data: value, metadata: metadata) }
89
89
  end
90
90
 
91
91
  class << self
@@ -125,7 +125,7 @@ module Mihari
125
125
  end
126
126
 
127
127
  #
128
- # @return [Array<Mihari::Artifact>]
128
+ # @return [Array<Mihari::Models::Artifact>]
129
129
  #
130
130
  def artifacts
131
131
  results.map(&:artifacts).flatten
@@ -77,10 +77,10 @@ module Mihari
77
77
  end
78
78
 
79
79
  #
80
- # @return [Mihari::Artifact]
80
+ # @return [Mihari::Models::Artifact]
81
81
  #
82
82
  def artifact
83
- Artifact.new(data: value, metadata: metadata)
83
+ Models::Artifact.new(data: value, metadata: metadata)
84
84
  end
85
85
 
86
86
  class << self
@@ -151,7 +151,7 @@ module Mihari
151
151
  end
152
152
 
153
153
  #
154
- # @return [Array<Mihari::Artifact>]
154
+ # @return [Array<Mihari::Models::Artifact>]
155
155
  #
156
156
  def artifacts
157
157
  data.map(&:artifact)
@@ -1,5 +1,5 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  module Mihari
4
- VERSION = "5.6.1"
4
+ VERSION = "5.6.2"
5
5
  end
@@ -31,8 +31,8 @@ module Mihari
31
31
  filter = filter.to_h.symbolize_keys
32
32
 
33
33
  search_filter_with_pagination = Structs::Filters::Alert::SearchFilterWithPagination.new(**filter)
34
- alerts = Mihari::Alert.search(search_filter_with_pagination)
35
- total = Mihari::Alert.count(search_filter_with_pagination.without_pagination)
34
+ alerts = Mihari::Models::Alert.search(search_filter_with_pagination)
35
+ total = Mihari::Models::Alert.count(search_filter_with_pagination.without_pagination)
36
36
 
37
37
  present(
38
38
  {
@@ -59,7 +59,7 @@ module Mihari
59
59
  id = params["id"].to_i
60
60
 
61
61
  result = Try do
62
- alert = Mihari::Alert.find(id)
62
+ alert = Mihari::Models::Alert.find(id)
63
63
  alert.destroy
64
64
  end.to_result
65
65
 
@@ -89,7 +89,7 @@ module Mihari
89
89
  extend Dry::Monads[:result, :try]
90
90
 
91
91
  result = Try do
92
- proxy = Services::AlertProxy.new(params.to_snake_keys)
92
+ proxy = Services::AlertProxy.new(**params.to_snake_keys)
93
93
  runner = Services::AlertRunner.new(proxy)
94
94
  runner.run
95
95
  end.to_result
@@ -18,7 +18,7 @@ module Mihari
18
18
  id = params[:id].to_i
19
19
 
20
20
  result = Try do
21
- artifact = Mihari::Artifact.includes(
21
+ artifact = Mihari::Models::Artifact.includes(
22
22
  :autonomous_system,
23
23
  :geolocation,
24
24
  :whois_record,
@@ -26,9 +26,9 @@ module Mihari
26
26
  :reverse_dns_names
27
27
  ).find(id)
28
28
  # TODO: improve queries
29
- alert_ids = Mihari::Artifact.where(data: artifact.data).pluck(:alert_id)
30
- tag_ids = Mihari::Tagging.where(alert_id: alert_ids).pluck(:tag_id)
31
- tag_names = Mihari::Tag.where(id: tag_ids).distinct.pluck(:name)
29
+ alert_ids = Mihari::Models::Artifact.where(data: artifact.data).pluck(:alert_id)
30
+ tag_ids = Mihari::Models::Tagging.where(alert_id: alert_ids).pluck(:tag_id)
31
+ tag_names = Mihari::Models::Tag.where(id: tag_ids).distinct.pluck(:name)
32
32
 
33
33
  artifact.tags = tag_names
34
34
 
@@ -60,7 +60,7 @@ module Mihari
60
60
  id = params["id"].to_i
61
61
 
62
62
  result = Try do
63
- artifact = Mihari::Artifact.includes(
63
+ artifact = Mihari::Models::Artifact.includes(
64
64
  :autonomous_system,
65
65
  :geolocation,
66
66
  :whois_record,
@@ -102,7 +102,7 @@ module Mihari
102
102
  id = params["id"].to_i
103
103
 
104
104
  result = Try do
105
- alert = Mihari::Artifact.find(id)
105
+ alert = Mihari::Models::Artifact.find(id)
106
106
  alert.destroy
107
107
  end.to_result
108
108
 
@@ -10,7 +10,7 @@ module Mihari
10
10
  summary: "Get rule IDs"
11
11
  }
12
12
  get "/ids" do
13
- rule_ids = Mihari::Rule.distinct.pluck(:id)
13
+ rule_ids = Mihari::Models::Rule.distinct.pluck(:id)
14
14
  present({ rule_ids: rule_ids }, with: Entities::RuleIDs)
15
15
  end
16
16
 
@@ -40,8 +40,8 @@ module Mihari
40
40
  filter = filter.to_h.symbolize_keys
41
41
 
42
42
  search_filter_with_pagenation = Structs::Filters::Rule::SearchFilterWithPagination.new(**filter)
43
- rules = Mihari::Rule.search(search_filter_with_pagenation)
44
- total = Mihari::Rule.count(search_filter_with_pagenation.without_pagination)
43
+ rules = Mihari::Models::Rule.search(search_filter_with_pagenation)
44
+ total = Mihari::Models::Rule.count(search_filter_with_pagenation.without_pagination)
45
45
 
46
46
  present(
47
47
  { rules: rules,
@@ -66,7 +66,7 @@ module Mihari
66
66
  id = params["id"].to_s
67
67
 
68
68
  result = Try do
69
- Mihari::Rule.find(id)
69
+ Mihari::Models::Rule.find(id)
70
70
  end.to_result
71
71
 
72
72
  return present(result.value!, with: Entities::Rule) if result.success?
@@ -92,10 +92,7 @@ module Mihari
92
92
 
93
93
  id = params["id"].to_s
94
94
 
95
- result = Try do
96
- Mihari::Services::RuleProxy.from_model(Mihari::Rule.find(id))
97
- end.to_result
98
-
95
+ result = Try { Rule.from_model(Mihari::Models::Rule.find(id)) }.to_result
99
96
  if result.success?
100
97
  result.value!.analyzer.run
101
98
  status 201
@@ -122,11 +119,9 @@ module Mihari
122
119
  extend Dry::Monads[:result, :try]
123
120
 
124
121
  yaml = params[:yaml]
125
- result = Try do
126
- Services::RuleProxy.from_yaml(yaml)
127
- end.to_result.bind do |rule|
122
+ result = Try { Rule.from_yaml(yaml) }.to_result.bind do |rule|
128
123
  Try do
129
- found = Mihari::Rule.find_by_id(rule.id)
124
+ found = Mihari::Models::Rule.find_by_id(rule.id)
130
125
  error!({ message: "ID:#{rule.id} is already registered" }, 400) unless found.nil?
131
126
  rule
132
127
  end.to_result
@@ -168,11 +163,9 @@ module Mihari
168
163
  yaml = params[:yaml]
169
164
 
170
165
  result = Try do
171
- Mihari::Rule.find(id)
166
+ Mihari::Models::Rule.find(id)
172
167
  end.to_result.bind do |_|
173
- Try do
174
- Services::RuleProxy.from_yaml(yaml)
175
- end.to_result
168
+ Try { Rule.from_yaml(yaml) }.to_result
176
169
  end.bind do |rule|
177
170
  Try do
178
171
  rule.model.save
@@ -212,7 +205,7 @@ module Mihari
212
205
  id = params["id"].to_s
213
206
 
214
207
  result = Try do
215
- rule = Mihari::Rule.find(id)
208
+ rule = Mihari::Models::Rule.find(id)
216
209
  rule.destroy
217
210
  end.to_result
218
211
 
@@ -10,7 +10,7 @@ module Mihari
10
10
  summary: "Get tags"
11
11
  }
12
12
  get "/" do
13
- tags = Mihari::Tag.distinct.pluck(:name)
13
+ tags = Mihari::Models::Tag.distinct.pluck(:name)
14
14
  present({ tags: tags }, with: Entities::Tags)
15
15
  end
16
16
 
@@ -28,7 +28,7 @@ module Mihari
28
28
  name = params[:name].to_s
29
29
 
30
30
  result = Try do
31
- Mihari::Tag.where(name: name).destroy_all
31
+ Mihari::Models::Tag.where(name: name).destroy_all
32
32
  end.to_result
33
33
 
34
34
  if result.success?