mihari 5.6.1 → 5.6.2

Sign up to get free protection for your applications and to get access to all the features.
Files changed (71) hide show
  1. checksums.yaml +4 -4
  2. data/frontend/package-lock.json +173 -176
  3. data/frontend/package.json +9 -9
  4. data/lib/mihari/{base.rb → actor.rb} +16 -2
  5. data/lib/mihari/analyzers/base.rb +5 -10
  6. data/lib/mihari/analyzers/censys.rb +1 -1
  7. data/lib/mihari/analyzers/hunterhow.rb +1 -1
  8. data/lib/mihari/analyzers/passivetotal.rb +1 -1
  9. data/lib/mihari/analyzers/pulsedive.rb +1 -1
  10. data/lib/mihari/analyzers/securitytrails.rb +1 -1
  11. data/lib/mihari/analyzers/urlscan.rb +1 -1
  12. data/lib/mihari/analyzers/virustotal.rb +5 -5
  13. data/lib/mihari/analyzers/zoomeye.rb +3 -3
  14. data/lib/mihari/clients/crtsh.rb +2 -2
  15. data/lib/mihari/clients/passivetotal.rb +4 -4
  16. data/lib/mihari/clients/securitytrails.rb +3 -3
  17. data/lib/mihari/commands/rule.rb +2 -11
  18. data/lib/mihari/commands/search.rb +1 -1
  19. data/lib/mihari/emitters/base.rb +13 -24
  20. data/lib/mihari/emitters/database.rb +7 -9
  21. data/lib/mihari/emitters/misp.rb +14 -38
  22. data/lib/mihari/emitters/slack.rb +14 -11
  23. data/lib/mihari/emitters/the_hive.rb +16 -44
  24. data/lib/mihari/emitters/webhook.rb +31 -21
  25. data/lib/mihari/enrichers/base.rb +1 -6
  26. data/lib/mihari/enrichers/whois.rb +1 -1
  27. data/lib/mihari/models/alert.rb +75 -73
  28. data/lib/mihari/models/artifact.rb +182 -180
  29. data/lib/mihari/models/autonomous_system.rb +22 -20
  30. data/lib/mihari/models/cpe.rb +21 -19
  31. data/lib/mihari/models/dns.rb +24 -22
  32. data/lib/mihari/models/geolocation.rb +22 -20
  33. data/lib/mihari/models/port.rb +21 -19
  34. data/lib/mihari/models/reverse_dns.rb +21 -19
  35. data/lib/mihari/models/rule.rb +67 -65
  36. data/lib/mihari/models/tag.rb +5 -3
  37. data/lib/mihari/models/tagging.rb +5 -3
  38. data/lib/mihari/models/whois.rb +18 -16
  39. data/lib/mihari/rule.rb +352 -0
  40. data/lib/mihari/schemas/analyzer.rb +94 -87
  41. data/lib/mihari/schemas/emitter.rb +9 -5
  42. data/lib/mihari/schemas/enricher.rb +8 -4
  43. data/lib/mihari/schemas/mixins.rb +15 -0
  44. data/lib/mihari/schemas/rule.rb +3 -10
  45. data/lib/mihari/services/alert_builder.rb +1 -1
  46. data/lib/mihari/services/alert_proxy.rb +10 -6
  47. data/lib/mihari/services/alert_runner.rb +4 -4
  48. data/lib/mihari/services/rule_builder.rb +3 -3
  49. data/lib/mihari/services/rule_runner.rb +5 -5
  50. data/lib/mihari/structs/binaryedge.rb +1 -1
  51. data/lib/mihari/structs/censys.rb +6 -6
  52. data/lib/mihari/structs/config.rb +1 -1
  53. data/lib/mihari/structs/greynoise.rb +5 -5
  54. data/lib/mihari/structs/hunterhow.rb +3 -3
  55. data/lib/mihari/structs/onyphe.rb +5 -5
  56. data/lib/mihari/structs/shodan.rb +6 -6
  57. data/lib/mihari/structs/urlscan.rb +3 -3
  58. data/lib/mihari/structs/virustotal_intelligence.rb +3 -3
  59. data/lib/mihari/version.rb +1 -1
  60. data/lib/mihari/web/endpoints/alerts.rb +4 -4
  61. data/lib/mihari/web/endpoints/artifacts.rb +6 -6
  62. data/lib/mihari/web/endpoints/rules.rb +10 -17
  63. data/lib/mihari/web/endpoints/tags.rb +2 -2
  64. data/lib/mihari/web/public/assets/{index-9cc489e6.js → index-28d4c79d.js} +48 -48
  65. data/lib/mihari/web/public/index.html +1 -1
  66. data/lib/mihari.rb +6 -8
  67. data/mihari.gemspec +1 -2
  68. data/requirements.txt +1 -1
  69. metadata +8 -22
  70. data/lib/mihari/analyzers/rule.rb +0 -232
  71. data/lib/mihari/services/rule_proxy.rb +0 -182
@@ -81,11 +81,11 @@ module Mihari
81
81
  end
82
82
 
83
83
  #
84
- # @return [Array<Mihari::Artifact>]
84
+ # @return [Array<Mihari::Models::Artifact>]
85
85
  #
86
86
  def artifacts
87
87
  values = [page.url, page.domain, page.ip].compact
88
- values.map { |value| Mihari::Artifact.new(data: value, metadata: metadata) }
88
+ values.map { |value| Mihari::Models::Artifact.new(data: value, metadata: metadata) }
89
89
  end
90
90
 
91
91
  class << self
@@ -125,7 +125,7 @@ module Mihari
125
125
  end
126
126
 
127
127
  #
128
- # @return [Array<Mihari::Artifact>]
128
+ # @return [Array<Mihari::Models::Artifact>]
129
129
  #
130
130
  def artifacts
131
131
  results.map(&:artifacts).flatten
@@ -77,10 +77,10 @@ module Mihari
77
77
  end
78
78
 
79
79
  #
80
- # @return [Mihari::Artifact]
80
+ # @return [Mihari::Models::Artifact]
81
81
  #
82
82
  def artifact
83
- Artifact.new(data: value, metadata: metadata)
83
+ Models::Artifact.new(data: value, metadata: metadata)
84
84
  end
85
85
 
86
86
  class << self
@@ -151,7 +151,7 @@ module Mihari
151
151
  end
152
152
 
153
153
  #
154
- # @return [Array<Mihari::Artifact>]
154
+ # @return [Array<Mihari::Models::Artifact>]
155
155
  #
156
156
  def artifacts
157
157
  data.map(&:artifact)
@@ -1,5 +1,5 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  module Mihari
4
- VERSION = "5.6.1"
4
+ VERSION = "5.6.2"
5
5
  end
@@ -31,8 +31,8 @@ module Mihari
31
31
  filter = filter.to_h.symbolize_keys
32
32
 
33
33
  search_filter_with_pagination = Structs::Filters::Alert::SearchFilterWithPagination.new(**filter)
34
- alerts = Mihari::Alert.search(search_filter_with_pagination)
35
- total = Mihari::Alert.count(search_filter_with_pagination.without_pagination)
34
+ alerts = Mihari::Models::Alert.search(search_filter_with_pagination)
35
+ total = Mihari::Models::Alert.count(search_filter_with_pagination.without_pagination)
36
36
 
37
37
  present(
38
38
  {
@@ -59,7 +59,7 @@ module Mihari
59
59
  id = params["id"].to_i
60
60
 
61
61
  result = Try do
62
- alert = Mihari::Alert.find(id)
62
+ alert = Mihari::Models::Alert.find(id)
63
63
  alert.destroy
64
64
  end.to_result
65
65
 
@@ -89,7 +89,7 @@ module Mihari
89
89
  extend Dry::Monads[:result, :try]
90
90
 
91
91
  result = Try do
92
- proxy = Services::AlertProxy.new(params.to_snake_keys)
92
+ proxy = Services::AlertProxy.new(**params.to_snake_keys)
93
93
  runner = Services::AlertRunner.new(proxy)
94
94
  runner.run
95
95
  end.to_result
@@ -18,7 +18,7 @@ module Mihari
18
18
  id = params[:id].to_i
19
19
 
20
20
  result = Try do
21
- artifact = Mihari::Artifact.includes(
21
+ artifact = Mihari::Models::Artifact.includes(
22
22
  :autonomous_system,
23
23
  :geolocation,
24
24
  :whois_record,
@@ -26,9 +26,9 @@ module Mihari
26
26
  :reverse_dns_names
27
27
  ).find(id)
28
28
  # TODO: improve queries
29
- alert_ids = Mihari::Artifact.where(data: artifact.data).pluck(:alert_id)
30
- tag_ids = Mihari::Tagging.where(alert_id: alert_ids).pluck(:tag_id)
31
- tag_names = Mihari::Tag.where(id: tag_ids).distinct.pluck(:name)
29
+ alert_ids = Mihari::Models::Artifact.where(data: artifact.data).pluck(:alert_id)
30
+ tag_ids = Mihari::Models::Tagging.where(alert_id: alert_ids).pluck(:tag_id)
31
+ tag_names = Mihari::Models::Tag.where(id: tag_ids).distinct.pluck(:name)
32
32
 
33
33
  artifact.tags = tag_names
34
34
 
@@ -60,7 +60,7 @@ module Mihari
60
60
  id = params["id"].to_i
61
61
 
62
62
  result = Try do
63
- artifact = Mihari::Artifact.includes(
63
+ artifact = Mihari::Models::Artifact.includes(
64
64
  :autonomous_system,
65
65
  :geolocation,
66
66
  :whois_record,
@@ -102,7 +102,7 @@ module Mihari
102
102
  id = params["id"].to_i
103
103
 
104
104
  result = Try do
105
- alert = Mihari::Artifact.find(id)
105
+ alert = Mihari::Models::Artifact.find(id)
106
106
  alert.destroy
107
107
  end.to_result
108
108
 
@@ -10,7 +10,7 @@ module Mihari
10
10
  summary: "Get rule IDs"
11
11
  }
12
12
  get "/ids" do
13
- rule_ids = Mihari::Rule.distinct.pluck(:id)
13
+ rule_ids = Mihari::Models::Rule.distinct.pluck(:id)
14
14
  present({ rule_ids: rule_ids }, with: Entities::RuleIDs)
15
15
  end
16
16
 
@@ -40,8 +40,8 @@ module Mihari
40
40
  filter = filter.to_h.symbolize_keys
41
41
 
42
42
  search_filter_with_pagenation = Structs::Filters::Rule::SearchFilterWithPagination.new(**filter)
43
- rules = Mihari::Rule.search(search_filter_with_pagenation)
44
- total = Mihari::Rule.count(search_filter_with_pagenation.without_pagination)
43
+ rules = Mihari::Models::Rule.search(search_filter_with_pagenation)
44
+ total = Mihari::Models::Rule.count(search_filter_with_pagenation.without_pagination)
45
45
 
46
46
  present(
47
47
  { rules: rules,
@@ -66,7 +66,7 @@ module Mihari
66
66
  id = params["id"].to_s
67
67
 
68
68
  result = Try do
69
- Mihari::Rule.find(id)
69
+ Mihari::Models::Rule.find(id)
70
70
  end.to_result
71
71
 
72
72
  return present(result.value!, with: Entities::Rule) if result.success?
@@ -92,10 +92,7 @@ module Mihari
92
92
 
93
93
  id = params["id"].to_s
94
94
 
95
- result = Try do
96
- Mihari::Services::RuleProxy.from_model(Mihari::Rule.find(id))
97
- end.to_result
98
-
95
+ result = Try { Rule.from_model(Mihari::Models::Rule.find(id)) }.to_result
99
96
  if result.success?
100
97
  result.value!.analyzer.run
101
98
  status 201
@@ -122,11 +119,9 @@ module Mihari
122
119
  extend Dry::Monads[:result, :try]
123
120
 
124
121
  yaml = params[:yaml]
125
- result = Try do
126
- Services::RuleProxy.from_yaml(yaml)
127
- end.to_result.bind do |rule|
122
+ result = Try { Rule.from_yaml(yaml) }.to_result.bind do |rule|
128
123
  Try do
129
- found = Mihari::Rule.find_by_id(rule.id)
124
+ found = Mihari::Models::Rule.find_by_id(rule.id)
130
125
  error!({ message: "ID:#{rule.id} is already registered" }, 400) unless found.nil?
131
126
  rule
132
127
  end.to_result
@@ -168,11 +163,9 @@ module Mihari
168
163
  yaml = params[:yaml]
169
164
 
170
165
  result = Try do
171
- Mihari::Rule.find(id)
166
+ Mihari::Models::Rule.find(id)
172
167
  end.to_result.bind do |_|
173
- Try do
174
- Services::RuleProxy.from_yaml(yaml)
175
- end.to_result
168
+ Try { Rule.from_yaml(yaml) }.to_result
176
169
  end.bind do |rule|
177
170
  Try do
178
171
  rule.model.save
@@ -212,7 +205,7 @@ module Mihari
212
205
  id = params["id"].to_s
213
206
 
214
207
  result = Try do
215
- rule = Mihari::Rule.find(id)
208
+ rule = Mihari::Models::Rule.find(id)
216
209
  rule.destroy
217
210
  end.to_result
218
211
 
@@ -10,7 +10,7 @@ module Mihari
10
10
  summary: "Get tags"
11
11
  }
12
12
  get "/" do
13
- tags = Mihari::Tag.distinct.pluck(:name)
13
+ tags = Mihari::Models::Tag.distinct.pluck(:name)
14
14
  present({ tags: tags }, with: Entities::Tags)
15
15
  end
16
16
 
@@ -28,7 +28,7 @@ module Mihari
28
28
  name = params[:name].to_s
29
29
 
30
30
  result = Try do
31
- Mihari::Tag.where(name: name).destroy_all
31
+ Mihari::Models::Tag.where(name: name).destroy_all
32
32
  end.to_result
33
33
 
34
34
  if result.success?