mihari 5.6.1 → 5.6.2
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/frontend/package-lock.json +173 -176
- data/frontend/package.json +9 -9
- data/lib/mihari/{base.rb → actor.rb} +16 -2
- data/lib/mihari/analyzers/base.rb +5 -10
- data/lib/mihari/analyzers/censys.rb +1 -1
- data/lib/mihari/analyzers/hunterhow.rb +1 -1
- data/lib/mihari/analyzers/passivetotal.rb +1 -1
- data/lib/mihari/analyzers/pulsedive.rb +1 -1
- data/lib/mihari/analyzers/securitytrails.rb +1 -1
- data/lib/mihari/analyzers/urlscan.rb +1 -1
- data/lib/mihari/analyzers/virustotal.rb +5 -5
- data/lib/mihari/analyzers/zoomeye.rb +3 -3
- data/lib/mihari/clients/crtsh.rb +2 -2
- data/lib/mihari/clients/passivetotal.rb +4 -4
- data/lib/mihari/clients/securitytrails.rb +3 -3
- data/lib/mihari/commands/rule.rb +2 -11
- data/lib/mihari/commands/search.rb +1 -1
- data/lib/mihari/emitters/base.rb +13 -24
- data/lib/mihari/emitters/database.rb +7 -9
- data/lib/mihari/emitters/misp.rb +14 -38
- data/lib/mihari/emitters/slack.rb +14 -11
- data/lib/mihari/emitters/the_hive.rb +16 -44
- data/lib/mihari/emitters/webhook.rb +31 -21
- data/lib/mihari/enrichers/base.rb +1 -6
- data/lib/mihari/enrichers/whois.rb +1 -1
- data/lib/mihari/models/alert.rb +75 -73
- data/lib/mihari/models/artifact.rb +182 -180
- data/lib/mihari/models/autonomous_system.rb +22 -20
- data/lib/mihari/models/cpe.rb +21 -19
- data/lib/mihari/models/dns.rb +24 -22
- data/lib/mihari/models/geolocation.rb +22 -20
- data/lib/mihari/models/port.rb +21 -19
- data/lib/mihari/models/reverse_dns.rb +21 -19
- data/lib/mihari/models/rule.rb +67 -65
- data/lib/mihari/models/tag.rb +5 -3
- data/lib/mihari/models/tagging.rb +5 -3
- data/lib/mihari/models/whois.rb +18 -16
- data/lib/mihari/rule.rb +352 -0
- data/lib/mihari/schemas/analyzer.rb +94 -87
- data/lib/mihari/schemas/emitter.rb +9 -5
- data/lib/mihari/schemas/enricher.rb +8 -4
- data/lib/mihari/schemas/mixins.rb +15 -0
- data/lib/mihari/schemas/rule.rb +3 -10
- data/lib/mihari/services/alert_builder.rb +1 -1
- data/lib/mihari/services/alert_proxy.rb +10 -6
- data/lib/mihari/services/alert_runner.rb +4 -4
- data/lib/mihari/services/rule_builder.rb +3 -3
- data/lib/mihari/services/rule_runner.rb +5 -5
- data/lib/mihari/structs/binaryedge.rb +1 -1
- data/lib/mihari/structs/censys.rb +6 -6
- data/lib/mihari/structs/config.rb +1 -1
- data/lib/mihari/structs/greynoise.rb +5 -5
- data/lib/mihari/structs/hunterhow.rb +3 -3
- data/lib/mihari/structs/onyphe.rb +5 -5
- data/lib/mihari/structs/shodan.rb +6 -6
- data/lib/mihari/structs/urlscan.rb +3 -3
- data/lib/mihari/structs/virustotal_intelligence.rb +3 -3
- data/lib/mihari/version.rb +1 -1
- data/lib/mihari/web/endpoints/alerts.rb +4 -4
- data/lib/mihari/web/endpoints/artifacts.rb +6 -6
- data/lib/mihari/web/endpoints/rules.rb +10 -17
- data/lib/mihari/web/endpoints/tags.rb +2 -2
- data/lib/mihari/web/public/assets/{index-9cc489e6.js → index-28d4c79d.js} +48 -48
- data/lib/mihari/web/public/index.html +1 -1
- data/lib/mihari.rb +6 -8
- data/mihari.gemspec +1 -2
- data/requirements.txt +1 -1
- metadata +8 -22
- data/lib/mihari/analyzers/rule.rb +0 -232
- data/lib/mihari/services/rule_proxy.rb +0 -182
@@ -81,11 +81,11 @@ module Mihari
|
|
81
81
|
end
|
82
82
|
|
83
83
|
#
|
84
|
-
# @return [Array<Mihari::Artifact>]
|
84
|
+
# @return [Array<Mihari::Models::Artifact>]
|
85
85
|
#
|
86
86
|
def artifacts
|
87
87
|
values = [page.url, page.domain, page.ip].compact
|
88
|
-
values.map { |value| Mihari::Artifact.new(data: value, metadata: metadata) }
|
88
|
+
values.map { |value| Mihari::Models::Artifact.new(data: value, metadata: metadata) }
|
89
89
|
end
|
90
90
|
|
91
91
|
class << self
|
@@ -125,7 +125,7 @@ module Mihari
|
|
125
125
|
end
|
126
126
|
|
127
127
|
#
|
128
|
-
# @return [Array<Mihari::Artifact>]
|
128
|
+
# @return [Array<Mihari::Models::Artifact>]
|
129
129
|
#
|
130
130
|
def artifacts
|
131
131
|
results.map(&:artifacts).flatten
|
@@ -77,10 +77,10 @@ module Mihari
|
|
77
77
|
end
|
78
78
|
|
79
79
|
#
|
80
|
-
# @return [Mihari::Artifact]
|
80
|
+
# @return [Mihari::Models::Artifact]
|
81
81
|
#
|
82
82
|
def artifact
|
83
|
-
Artifact.new(data: value, metadata: metadata)
|
83
|
+
Models::Artifact.new(data: value, metadata: metadata)
|
84
84
|
end
|
85
85
|
|
86
86
|
class << self
|
@@ -151,7 +151,7 @@ module Mihari
|
|
151
151
|
end
|
152
152
|
|
153
153
|
#
|
154
|
-
# @return [Array<Mihari::Artifact>]
|
154
|
+
# @return [Array<Mihari::Models::Artifact>]
|
155
155
|
#
|
156
156
|
def artifacts
|
157
157
|
data.map(&:artifact)
|
data/lib/mihari/version.rb
CHANGED
@@ -31,8 +31,8 @@ module Mihari
|
|
31
31
|
filter = filter.to_h.symbolize_keys
|
32
32
|
|
33
33
|
search_filter_with_pagination = Structs::Filters::Alert::SearchFilterWithPagination.new(**filter)
|
34
|
-
alerts = Mihari::Alert.search(search_filter_with_pagination)
|
35
|
-
total = Mihari::Alert.count(search_filter_with_pagination.without_pagination)
|
34
|
+
alerts = Mihari::Models::Alert.search(search_filter_with_pagination)
|
35
|
+
total = Mihari::Models::Alert.count(search_filter_with_pagination.without_pagination)
|
36
36
|
|
37
37
|
present(
|
38
38
|
{
|
@@ -59,7 +59,7 @@ module Mihari
|
|
59
59
|
id = params["id"].to_i
|
60
60
|
|
61
61
|
result = Try do
|
62
|
-
alert = Mihari::Alert.find(id)
|
62
|
+
alert = Mihari::Models::Alert.find(id)
|
63
63
|
alert.destroy
|
64
64
|
end.to_result
|
65
65
|
|
@@ -89,7 +89,7 @@ module Mihari
|
|
89
89
|
extend Dry::Monads[:result, :try]
|
90
90
|
|
91
91
|
result = Try do
|
92
|
-
proxy = Services::AlertProxy.new(params.to_snake_keys)
|
92
|
+
proxy = Services::AlertProxy.new(**params.to_snake_keys)
|
93
93
|
runner = Services::AlertRunner.new(proxy)
|
94
94
|
runner.run
|
95
95
|
end.to_result
|
@@ -18,7 +18,7 @@ module Mihari
|
|
18
18
|
id = params[:id].to_i
|
19
19
|
|
20
20
|
result = Try do
|
21
|
-
artifact = Mihari::Artifact.includes(
|
21
|
+
artifact = Mihari::Models::Artifact.includes(
|
22
22
|
:autonomous_system,
|
23
23
|
:geolocation,
|
24
24
|
:whois_record,
|
@@ -26,9 +26,9 @@ module Mihari
|
|
26
26
|
:reverse_dns_names
|
27
27
|
).find(id)
|
28
28
|
# TODO: improve queries
|
29
|
-
alert_ids = Mihari::Artifact.where(data: artifact.data).pluck(:alert_id)
|
30
|
-
tag_ids = Mihari::Tagging.where(alert_id: alert_ids).pluck(:tag_id)
|
31
|
-
tag_names = Mihari::Tag.where(id: tag_ids).distinct.pluck(:name)
|
29
|
+
alert_ids = Mihari::Models::Artifact.where(data: artifact.data).pluck(:alert_id)
|
30
|
+
tag_ids = Mihari::Models::Tagging.where(alert_id: alert_ids).pluck(:tag_id)
|
31
|
+
tag_names = Mihari::Models::Tag.where(id: tag_ids).distinct.pluck(:name)
|
32
32
|
|
33
33
|
artifact.tags = tag_names
|
34
34
|
|
@@ -60,7 +60,7 @@ module Mihari
|
|
60
60
|
id = params["id"].to_i
|
61
61
|
|
62
62
|
result = Try do
|
63
|
-
artifact = Mihari::Artifact.includes(
|
63
|
+
artifact = Mihari::Models::Artifact.includes(
|
64
64
|
:autonomous_system,
|
65
65
|
:geolocation,
|
66
66
|
:whois_record,
|
@@ -102,7 +102,7 @@ module Mihari
|
|
102
102
|
id = params["id"].to_i
|
103
103
|
|
104
104
|
result = Try do
|
105
|
-
alert = Mihari::Artifact.find(id)
|
105
|
+
alert = Mihari::Models::Artifact.find(id)
|
106
106
|
alert.destroy
|
107
107
|
end.to_result
|
108
108
|
|
@@ -10,7 +10,7 @@ module Mihari
|
|
10
10
|
summary: "Get rule IDs"
|
11
11
|
}
|
12
12
|
get "/ids" do
|
13
|
-
rule_ids = Mihari::Rule.distinct.pluck(:id)
|
13
|
+
rule_ids = Mihari::Models::Rule.distinct.pluck(:id)
|
14
14
|
present({ rule_ids: rule_ids }, with: Entities::RuleIDs)
|
15
15
|
end
|
16
16
|
|
@@ -40,8 +40,8 @@ module Mihari
|
|
40
40
|
filter = filter.to_h.symbolize_keys
|
41
41
|
|
42
42
|
search_filter_with_pagenation = Structs::Filters::Rule::SearchFilterWithPagination.new(**filter)
|
43
|
-
rules = Mihari::Rule.search(search_filter_with_pagenation)
|
44
|
-
total = Mihari::Rule.count(search_filter_with_pagenation.without_pagination)
|
43
|
+
rules = Mihari::Models::Rule.search(search_filter_with_pagenation)
|
44
|
+
total = Mihari::Models::Rule.count(search_filter_with_pagenation.without_pagination)
|
45
45
|
|
46
46
|
present(
|
47
47
|
{ rules: rules,
|
@@ -66,7 +66,7 @@ module Mihari
|
|
66
66
|
id = params["id"].to_s
|
67
67
|
|
68
68
|
result = Try do
|
69
|
-
Mihari::Rule.find(id)
|
69
|
+
Mihari::Models::Rule.find(id)
|
70
70
|
end.to_result
|
71
71
|
|
72
72
|
return present(result.value!, with: Entities::Rule) if result.success?
|
@@ -92,10 +92,7 @@ module Mihari
|
|
92
92
|
|
93
93
|
id = params["id"].to_s
|
94
94
|
|
95
|
-
result = Try
|
96
|
-
Mihari::Services::RuleProxy.from_model(Mihari::Rule.find(id))
|
97
|
-
end.to_result
|
98
|
-
|
95
|
+
result = Try { Rule.from_model(Mihari::Models::Rule.find(id)) }.to_result
|
99
96
|
if result.success?
|
100
97
|
result.value!.analyzer.run
|
101
98
|
status 201
|
@@ -122,11 +119,9 @@ module Mihari
|
|
122
119
|
extend Dry::Monads[:result, :try]
|
123
120
|
|
124
121
|
yaml = params[:yaml]
|
125
|
-
result = Try do
|
126
|
-
Services::RuleProxy.from_yaml(yaml)
|
127
|
-
end.to_result.bind do |rule|
|
122
|
+
result = Try { Rule.from_yaml(yaml) }.to_result.bind do |rule|
|
128
123
|
Try do
|
129
|
-
found = Mihari::Rule.find_by_id(rule.id)
|
124
|
+
found = Mihari::Models::Rule.find_by_id(rule.id)
|
130
125
|
error!({ message: "ID:#{rule.id} is already registered" }, 400) unless found.nil?
|
131
126
|
rule
|
132
127
|
end.to_result
|
@@ -168,11 +163,9 @@ module Mihari
|
|
168
163
|
yaml = params[:yaml]
|
169
164
|
|
170
165
|
result = Try do
|
171
|
-
Mihari::Rule.find(id)
|
166
|
+
Mihari::Models::Rule.find(id)
|
172
167
|
end.to_result.bind do |_|
|
173
|
-
Try
|
174
|
-
Services::RuleProxy.from_yaml(yaml)
|
175
|
-
end.to_result
|
168
|
+
Try { Rule.from_yaml(yaml) }.to_result
|
176
169
|
end.bind do |rule|
|
177
170
|
Try do
|
178
171
|
rule.model.save
|
@@ -212,7 +205,7 @@ module Mihari
|
|
212
205
|
id = params["id"].to_s
|
213
206
|
|
214
207
|
result = Try do
|
215
|
-
rule = Mihari::Rule.find(id)
|
208
|
+
rule = Mihari::Models::Rule.find(id)
|
216
209
|
rule.destroy
|
217
210
|
end.to_result
|
218
211
|
|
@@ -10,7 +10,7 @@ module Mihari
|
|
10
10
|
summary: "Get tags"
|
11
11
|
}
|
12
12
|
get "/" do
|
13
|
-
tags = Mihari::Tag.distinct.pluck(:name)
|
13
|
+
tags = Mihari::Models::Tag.distinct.pluck(:name)
|
14
14
|
present({ tags: tags }, with: Entities::Tags)
|
15
15
|
end
|
16
16
|
|
@@ -28,7 +28,7 @@ module Mihari
|
|
28
28
|
name = params[:name].to_s
|
29
29
|
|
30
30
|
result = Try do
|
31
|
-
Mihari::Tag.where(name: name).destroy_all
|
31
|
+
Mihari::Models::Tag.where(name: name).destroy_all
|
32
32
|
end.to_result
|
33
33
|
|
34
34
|
if result.success?
|