mihari 5.6.1 → 5.6.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/frontend/package-lock.json +173 -176
- data/frontend/package.json +9 -9
- data/lib/mihari/{base.rb → actor.rb} +16 -2
- data/lib/mihari/analyzers/base.rb +5 -10
- data/lib/mihari/analyzers/censys.rb +1 -1
- data/lib/mihari/analyzers/hunterhow.rb +1 -1
- data/lib/mihari/analyzers/passivetotal.rb +1 -1
- data/lib/mihari/analyzers/pulsedive.rb +1 -1
- data/lib/mihari/analyzers/securitytrails.rb +1 -1
- data/lib/mihari/analyzers/urlscan.rb +1 -1
- data/lib/mihari/analyzers/virustotal.rb +5 -5
- data/lib/mihari/analyzers/zoomeye.rb +3 -3
- data/lib/mihari/clients/crtsh.rb +2 -2
- data/lib/mihari/clients/passivetotal.rb +4 -4
- data/lib/mihari/clients/securitytrails.rb +3 -3
- data/lib/mihari/commands/rule.rb +2 -11
- data/lib/mihari/commands/search.rb +1 -1
- data/lib/mihari/emitters/base.rb +13 -24
- data/lib/mihari/emitters/database.rb +7 -9
- data/lib/mihari/emitters/misp.rb +14 -38
- data/lib/mihari/emitters/slack.rb +14 -11
- data/lib/mihari/emitters/the_hive.rb +16 -44
- data/lib/mihari/emitters/webhook.rb +31 -21
- data/lib/mihari/enrichers/base.rb +1 -6
- data/lib/mihari/enrichers/whois.rb +1 -1
- data/lib/mihari/models/alert.rb +75 -73
- data/lib/mihari/models/artifact.rb +182 -180
- data/lib/mihari/models/autonomous_system.rb +22 -20
- data/lib/mihari/models/cpe.rb +21 -19
- data/lib/mihari/models/dns.rb +24 -22
- data/lib/mihari/models/geolocation.rb +22 -20
- data/lib/mihari/models/port.rb +21 -19
- data/lib/mihari/models/reverse_dns.rb +21 -19
- data/lib/mihari/models/rule.rb +67 -65
- data/lib/mihari/models/tag.rb +5 -3
- data/lib/mihari/models/tagging.rb +5 -3
- data/lib/mihari/models/whois.rb +18 -16
- data/lib/mihari/rule.rb +352 -0
- data/lib/mihari/schemas/analyzer.rb +94 -87
- data/lib/mihari/schemas/emitter.rb +9 -5
- data/lib/mihari/schemas/enricher.rb +8 -4
- data/lib/mihari/schemas/mixins.rb +15 -0
- data/lib/mihari/schemas/rule.rb +3 -10
- data/lib/mihari/services/alert_builder.rb +1 -1
- data/lib/mihari/services/alert_proxy.rb +10 -6
- data/lib/mihari/services/alert_runner.rb +4 -4
- data/lib/mihari/services/rule_builder.rb +3 -3
- data/lib/mihari/services/rule_runner.rb +5 -5
- data/lib/mihari/structs/binaryedge.rb +1 -1
- data/lib/mihari/structs/censys.rb +6 -6
- data/lib/mihari/structs/config.rb +1 -1
- data/lib/mihari/structs/greynoise.rb +5 -5
- data/lib/mihari/structs/hunterhow.rb +3 -3
- data/lib/mihari/structs/onyphe.rb +5 -5
- data/lib/mihari/structs/shodan.rb +6 -6
- data/lib/mihari/structs/urlscan.rb +3 -3
- data/lib/mihari/structs/virustotal_intelligence.rb +3 -3
- data/lib/mihari/version.rb +1 -1
- data/lib/mihari/web/endpoints/alerts.rb +4 -4
- data/lib/mihari/web/endpoints/artifacts.rb +6 -6
- data/lib/mihari/web/endpoints/rules.rb +10 -17
- data/lib/mihari/web/endpoints/tags.rb +2 -2
- data/lib/mihari/web/public/assets/{index-9cc489e6.js → index-28d4c79d.js} +48 -48
- data/lib/mihari/web/public/index.html +1 -1
- data/lib/mihari.rb +6 -8
- data/mihari.gemspec +1 -2
- data/requirements.txt +1 -1
- metadata +8 -22
- data/lib/mihari/analyzers/rule.rb +0 -232
- data/lib/mihari/services/rule_proxy.rb +0 -182
|
@@ -81,11 +81,11 @@ module Mihari
|
|
|
81
81
|
end
|
|
82
82
|
|
|
83
83
|
#
|
|
84
|
-
# @return [Array<Mihari::Artifact>]
|
|
84
|
+
# @return [Array<Mihari::Models::Artifact>]
|
|
85
85
|
#
|
|
86
86
|
def artifacts
|
|
87
87
|
values = [page.url, page.domain, page.ip].compact
|
|
88
|
-
values.map { |value| Mihari::Artifact.new(data: value, metadata: metadata) }
|
|
88
|
+
values.map { |value| Mihari::Models::Artifact.new(data: value, metadata: metadata) }
|
|
89
89
|
end
|
|
90
90
|
|
|
91
91
|
class << self
|
|
@@ -125,7 +125,7 @@ module Mihari
|
|
|
125
125
|
end
|
|
126
126
|
|
|
127
127
|
#
|
|
128
|
-
# @return [Array<Mihari::Artifact>]
|
|
128
|
+
# @return [Array<Mihari::Models::Artifact>]
|
|
129
129
|
#
|
|
130
130
|
def artifacts
|
|
131
131
|
results.map(&:artifacts).flatten
|
|
@@ -77,10 +77,10 @@ module Mihari
|
|
|
77
77
|
end
|
|
78
78
|
|
|
79
79
|
#
|
|
80
|
-
# @return [Mihari::Artifact]
|
|
80
|
+
# @return [Mihari::Models::Artifact]
|
|
81
81
|
#
|
|
82
82
|
def artifact
|
|
83
|
-
Artifact.new(data: value, metadata: metadata)
|
|
83
|
+
Models::Artifact.new(data: value, metadata: metadata)
|
|
84
84
|
end
|
|
85
85
|
|
|
86
86
|
class << self
|
|
@@ -151,7 +151,7 @@ module Mihari
|
|
|
151
151
|
end
|
|
152
152
|
|
|
153
153
|
#
|
|
154
|
-
# @return [Array<Mihari::Artifact>]
|
|
154
|
+
# @return [Array<Mihari::Models::Artifact>]
|
|
155
155
|
#
|
|
156
156
|
def artifacts
|
|
157
157
|
data.map(&:artifact)
|
data/lib/mihari/version.rb
CHANGED
|
@@ -31,8 +31,8 @@ module Mihari
|
|
|
31
31
|
filter = filter.to_h.symbolize_keys
|
|
32
32
|
|
|
33
33
|
search_filter_with_pagination = Structs::Filters::Alert::SearchFilterWithPagination.new(**filter)
|
|
34
|
-
alerts = Mihari::Alert.search(search_filter_with_pagination)
|
|
35
|
-
total = Mihari::Alert.count(search_filter_with_pagination.without_pagination)
|
|
34
|
+
alerts = Mihari::Models::Alert.search(search_filter_with_pagination)
|
|
35
|
+
total = Mihari::Models::Alert.count(search_filter_with_pagination.without_pagination)
|
|
36
36
|
|
|
37
37
|
present(
|
|
38
38
|
{
|
|
@@ -59,7 +59,7 @@ module Mihari
|
|
|
59
59
|
id = params["id"].to_i
|
|
60
60
|
|
|
61
61
|
result = Try do
|
|
62
|
-
alert = Mihari::Alert.find(id)
|
|
62
|
+
alert = Mihari::Models::Alert.find(id)
|
|
63
63
|
alert.destroy
|
|
64
64
|
end.to_result
|
|
65
65
|
|
|
@@ -89,7 +89,7 @@ module Mihari
|
|
|
89
89
|
extend Dry::Monads[:result, :try]
|
|
90
90
|
|
|
91
91
|
result = Try do
|
|
92
|
-
proxy = Services::AlertProxy.new(params.to_snake_keys)
|
|
92
|
+
proxy = Services::AlertProxy.new(**params.to_snake_keys)
|
|
93
93
|
runner = Services::AlertRunner.new(proxy)
|
|
94
94
|
runner.run
|
|
95
95
|
end.to_result
|
|
@@ -18,7 +18,7 @@ module Mihari
|
|
|
18
18
|
id = params[:id].to_i
|
|
19
19
|
|
|
20
20
|
result = Try do
|
|
21
|
-
artifact = Mihari::Artifact.includes(
|
|
21
|
+
artifact = Mihari::Models::Artifact.includes(
|
|
22
22
|
:autonomous_system,
|
|
23
23
|
:geolocation,
|
|
24
24
|
:whois_record,
|
|
@@ -26,9 +26,9 @@ module Mihari
|
|
|
26
26
|
:reverse_dns_names
|
|
27
27
|
).find(id)
|
|
28
28
|
# TODO: improve queries
|
|
29
|
-
alert_ids = Mihari::Artifact.where(data: artifact.data).pluck(:alert_id)
|
|
30
|
-
tag_ids = Mihari::Tagging.where(alert_id: alert_ids).pluck(:tag_id)
|
|
31
|
-
tag_names = Mihari::Tag.where(id: tag_ids).distinct.pluck(:name)
|
|
29
|
+
alert_ids = Mihari::Models::Artifact.where(data: artifact.data).pluck(:alert_id)
|
|
30
|
+
tag_ids = Mihari::Models::Tagging.where(alert_id: alert_ids).pluck(:tag_id)
|
|
31
|
+
tag_names = Mihari::Models::Tag.where(id: tag_ids).distinct.pluck(:name)
|
|
32
32
|
|
|
33
33
|
artifact.tags = tag_names
|
|
34
34
|
|
|
@@ -60,7 +60,7 @@ module Mihari
|
|
|
60
60
|
id = params["id"].to_i
|
|
61
61
|
|
|
62
62
|
result = Try do
|
|
63
|
-
artifact = Mihari::Artifact.includes(
|
|
63
|
+
artifact = Mihari::Models::Artifact.includes(
|
|
64
64
|
:autonomous_system,
|
|
65
65
|
:geolocation,
|
|
66
66
|
:whois_record,
|
|
@@ -102,7 +102,7 @@ module Mihari
|
|
|
102
102
|
id = params["id"].to_i
|
|
103
103
|
|
|
104
104
|
result = Try do
|
|
105
|
-
alert = Mihari::Artifact.find(id)
|
|
105
|
+
alert = Mihari::Models::Artifact.find(id)
|
|
106
106
|
alert.destroy
|
|
107
107
|
end.to_result
|
|
108
108
|
|
|
@@ -10,7 +10,7 @@ module Mihari
|
|
|
10
10
|
summary: "Get rule IDs"
|
|
11
11
|
}
|
|
12
12
|
get "/ids" do
|
|
13
|
-
rule_ids = Mihari::Rule.distinct.pluck(:id)
|
|
13
|
+
rule_ids = Mihari::Models::Rule.distinct.pluck(:id)
|
|
14
14
|
present({ rule_ids: rule_ids }, with: Entities::RuleIDs)
|
|
15
15
|
end
|
|
16
16
|
|
|
@@ -40,8 +40,8 @@ module Mihari
|
|
|
40
40
|
filter = filter.to_h.symbolize_keys
|
|
41
41
|
|
|
42
42
|
search_filter_with_pagenation = Structs::Filters::Rule::SearchFilterWithPagination.new(**filter)
|
|
43
|
-
rules = Mihari::Rule.search(search_filter_with_pagenation)
|
|
44
|
-
total = Mihari::Rule.count(search_filter_with_pagenation.without_pagination)
|
|
43
|
+
rules = Mihari::Models::Rule.search(search_filter_with_pagenation)
|
|
44
|
+
total = Mihari::Models::Rule.count(search_filter_with_pagenation.without_pagination)
|
|
45
45
|
|
|
46
46
|
present(
|
|
47
47
|
{ rules: rules,
|
|
@@ -66,7 +66,7 @@ module Mihari
|
|
|
66
66
|
id = params["id"].to_s
|
|
67
67
|
|
|
68
68
|
result = Try do
|
|
69
|
-
Mihari::Rule.find(id)
|
|
69
|
+
Mihari::Models::Rule.find(id)
|
|
70
70
|
end.to_result
|
|
71
71
|
|
|
72
72
|
return present(result.value!, with: Entities::Rule) if result.success?
|
|
@@ -92,10 +92,7 @@ module Mihari
|
|
|
92
92
|
|
|
93
93
|
id = params["id"].to_s
|
|
94
94
|
|
|
95
|
-
result = Try
|
|
96
|
-
Mihari::Services::RuleProxy.from_model(Mihari::Rule.find(id))
|
|
97
|
-
end.to_result
|
|
98
|
-
|
|
95
|
+
result = Try { Rule.from_model(Mihari::Models::Rule.find(id)) }.to_result
|
|
99
96
|
if result.success?
|
|
100
97
|
result.value!.analyzer.run
|
|
101
98
|
status 201
|
|
@@ -122,11 +119,9 @@ module Mihari
|
|
|
122
119
|
extend Dry::Monads[:result, :try]
|
|
123
120
|
|
|
124
121
|
yaml = params[:yaml]
|
|
125
|
-
result = Try do
|
|
126
|
-
Services::RuleProxy.from_yaml(yaml)
|
|
127
|
-
end.to_result.bind do |rule|
|
|
122
|
+
result = Try { Rule.from_yaml(yaml) }.to_result.bind do |rule|
|
|
128
123
|
Try do
|
|
129
|
-
found = Mihari::Rule.find_by_id(rule.id)
|
|
124
|
+
found = Mihari::Models::Rule.find_by_id(rule.id)
|
|
130
125
|
error!({ message: "ID:#{rule.id} is already registered" }, 400) unless found.nil?
|
|
131
126
|
rule
|
|
132
127
|
end.to_result
|
|
@@ -168,11 +163,9 @@ module Mihari
|
|
|
168
163
|
yaml = params[:yaml]
|
|
169
164
|
|
|
170
165
|
result = Try do
|
|
171
|
-
Mihari::Rule.find(id)
|
|
166
|
+
Mihari::Models::Rule.find(id)
|
|
172
167
|
end.to_result.bind do |_|
|
|
173
|
-
Try
|
|
174
|
-
Services::RuleProxy.from_yaml(yaml)
|
|
175
|
-
end.to_result
|
|
168
|
+
Try { Rule.from_yaml(yaml) }.to_result
|
|
176
169
|
end.bind do |rule|
|
|
177
170
|
Try do
|
|
178
171
|
rule.model.save
|
|
@@ -212,7 +205,7 @@ module Mihari
|
|
|
212
205
|
id = params["id"].to_s
|
|
213
206
|
|
|
214
207
|
result = Try do
|
|
215
|
-
rule = Mihari::Rule.find(id)
|
|
208
|
+
rule = Mihari::Models::Rule.find(id)
|
|
216
209
|
rule.destroy
|
|
217
210
|
end.to_result
|
|
218
211
|
|
|
@@ -10,7 +10,7 @@ module Mihari
|
|
|
10
10
|
summary: "Get tags"
|
|
11
11
|
}
|
|
12
12
|
get "/" do
|
|
13
|
-
tags = Mihari::Tag.distinct.pluck(:name)
|
|
13
|
+
tags = Mihari::Models::Tag.distinct.pluck(:name)
|
|
14
14
|
present({ tags: tags }, with: Entities::Tags)
|
|
15
15
|
end
|
|
16
16
|
|
|
@@ -28,7 +28,7 @@ module Mihari
|
|
|
28
28
|
name = params[:name].to_s
|
|
29
29
|
|
|
30
30
|
result = Try do
|
|
31
|
-
Mihari::Tag.where(name: name).destroy_all
|
|
31
|
+
Mihari::Models::Tag.where(name: name).destroy_all
|
|
32
32
|
end.to_result
|
|
33
33
|
|
|
34
34
|
if result.success?
|