mihari 5.6.1 → 5.7.0

data/lib/mihari/clients/virustotal.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # VirusTotal API client
+    #
     class VirusTotal < Base
       #
       # @param [String] base_url
@@ -46,7 +49,7 @@ module Mihari
       # @param [String] query
       # @param [String, nil] cursor
       #
-      # @return [Structs::VirusTotalIntelligence::Response]
+      # @return [Mihari::Structs::VirusTotalIntelligence::Response]
       #
       def intel_search(query, cursor: nil)
         params = { query: query, cursor: cursor }.compact
@@ -58,7 +61,7 @@ module Mihari
       # @param [String] query
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::VirusTotalIntelligence::Response>]
+      # @return [Enumerable<Mihari::Structs::VirusTotalIntelligence::Response>]
       #
       def intel_search_with_pagination(query, pagination_limit: Mihari.config.pagination_limit)
         cursor = nil

data/lib/mihari/clients/zoomeye.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # ZoomEye API client
+    #
     class ZoomEye < Base
       PAGE_SIZE = 10
 

data/lib/mihari/commands/alert.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Commands
+    #
+    # Alert sub-commands
+    #
     module Alert
       class << self
         def included(thor)
@@ -16,26 +19,14 @@ module Mihari
               Mihari::Database.with_db_connection do
                 builder = Services::AlertBuilder.new(path)
 
-                run_proxy_l = ->(proxy) { run_proxy proxy }
-                result = builder.result.bind(run_proxy_l)
+                runner_result_l = ->(proxy) { Services::AlertRunner.new(proxy).result }
+                result = builder.result.bind(runner_result_l)
 
                 alert = result.value!
                 data = Entities::Alert.represent(alert)
                 puts JSON.pretty_generate(data.as_json)
               end
             end
-
-            no_commands do
-              #
-              # @param [Mihari::Services::AlertProxy] proxy
-              #
-              def run_proxy(proxy)
-                Dry::Monads::Try[StandardError] do
-                  runner = Services::AlertRunner.new(proxy)
-                  runner.run
-                end.to_result
-              end
-            end
           end
         end
       end

data/lib/mihari/commands/database.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Commands
+    #
+    # Database sub-commands
+    #
     module Database
       class << self
         def included(thor)

data/lib/mihari/commands/rule.rb

@@ -4,6 +4,9 @@ require "pathname"
 
 module Mihari
   module Commands
+    #
+    # Rule sub-commands
+    #
     module Rule
       class << self
         def included(thor)
@@ -17,10 +20,7 @@ module Mihari
             # @param [String] path
             #
             def validate(path)
-              res = Dry::Monads::Try[ValidationError] do
-                Services::RuleProxy.from_yaml File.read(path)
-              end
-
+              res = Dry::Monads::Try[ValidationError] { Mihari::Rule.from_yaml File.read(path) }
               rule = res.value!
               puts rule.data.to_yaml
             end
@@ -42,13 +42,6 @@ module Mihari
             end
 
             no_commands do
-              #
-              # @return [Mihari::Services::Rule]
-              #
-              def rule
-                Services::RuleProxy.from_yaml File.read(File.expand_path("../templates/rule.yml.erb", __dir__))
-              end
-
               #
               # Create a new rule
               #
@@ -58,6 +51,13 @@ module Mihari
               # @return [nil]
               #
               def initialize_rule(path, files = Dry::Files.new)
+                rule = Mihari::Rule.new(
+                  id: SecureRandom.uuid,
+                  title: "Title goes here",
+                  description: "Description goes here",
+                  created_on: Date.today,
+                  queries: []
+                )
                 files.write(path, rule.yaml)
               end
             end

data/lib/mihari/commands/search.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Commands
+    #
+    # Search sub-commands
+    #
     module Search
       class << self
         def included(thor)
@@ -20,9 +23,9 @@ module Mihari
                 builder = Services::RuleBuilder.new(path_or_id)
 
                 check_diff_l = ->(rule) { check_diff rule }
-                update_and_run_l = ->(runner) { update_and_run runner }
+                update_and_call_l = ->(runner) { update_and_call runner }
 
-                result = builder.result.bind(check_diff_l).bind(update_and_run_l)
+                result = builder.result.bind(check_diff_l).bind(update_and_call_l)
 
                 alert = result.value!
                 data = Entities::Alert.represent(alert)
@@ -32,7 +35,7 @@ module Mihari
 
             no_commands do
               #
-              # @param [Mihari::Services::RuleProxy] rule
+              # @param [Mihari::RuleRunner] rule
               #
               def check_diff(rule)
                 force_overwrite = options["force_overwrite"] || false
@@ -45,12 +48,12 @@ module Mihari
               end
 
               #
-              # @param [Mihari::Services::RuleRunner] runner
+              # @param [Mihari::RuleRunner] runner
               #
-              def update_and_run(runner)
+              def update_and_call(runner)
                 Dry::Monads::Try[StandardError] do
                   runner.update_or_create
-                  runner.run
+                  runner.call
                 end.to_result
               end
             end

data/lib/mihari/commands/version.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Commands
+    #
+    # Version sub-commands
+    #
     module Version
       class << self
         def included(thor)

data/lib/mihari/commands/web.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Commands
+    #
+    # Web sub-commands
+    #
     module Web
       class << self
         def included(thor)
@@ -20,7 +23,7 @@ module Mihari
               Mihari.config.hide_config_values = options["hide_config_values"]
               # set rack env as production
               ENV["RACK_ENV"] ||= options["rack_env"]
-              Mihari::App.run!(
+              Mihari::Web::App.run!(
                 port: options["port"],
                 host: options["host"],
                 threads: options["threads"],

data/lib/mihari/config.rb

@@ -1,178 +1,167 @@
-module Mihari
-  class Config
-    # @return [String, nil]
-    attr_reader :binaryedge_api_key
-
-    # @return [String, nil]
-    attr_reader :censys_id
-
-    # @return [String, nil]
-    attr_reader :censys_secret
-
-    # @return [String, nil]
-    attr_reader :circl_passive_password
-
-    # @return [String, nil]
-    attr_reader :circl_passive_username
-
-    # @return [URI]
-    attr_reader :database_url
-
-    # @return [String, nil]
-    attr_reader :greynoise_api_key
-
-    # @return [String, nil]
-    attr_reader :hunterhow_api_key
-
-    # @return [String, nil]
-    attr_reader :ipinfo_api_key
-
-    # @return [String, nil]
-    attr_reader :misp_url
-
-    # @return [String, nil]
-    attr_reader :misp_api_key
-
-    # @return [String, nil]
-    attr_reader :onyphe_api_key
-
-    # @return [String, nil]
-    attr_reader :otx_api_key
-
-    # @return [String, nil]
-    attr_reader :passivetotal_api_key
-
-    # @return [String, nil]
-    attr_reader :passivetotal_username
-
-    # @return [String, nil]
-    attr_reader :pulsedive_api_key
-
-    # @return [String, nil]
-    attr_reader :securitytrails_api_key
-
-    # @return [String, nil]
-    attr_reader :shodan_api_key
-
-    # @return [String, nil]
-    attr_reader :slack_channel
-
-    # @return [String, nil]
-    attr_reader :slack_webhook_url
-
-    # @return [String, nil]
-    attr_reader :thehive_url
+# frozen_string_literal: true
 
-    # @return [String, nil]
-    attr_reader :thehive_api_key
+require "anyway_config"
 
-    # @return [String, nil]
-    attr_reader :thehive_api_version
-
-    # @return [String, nil]
-    attr_reader :urlscan_api_key
-
-    # @return [String, nil]
-    attr_reader :virustotal_api_key
-
-    # @return [String, nil]
-    attr_reader :zoomeye_api_key
-
-    # @return [String, nil]
-    attr_reader :sentry_dsn
-
-    # @return [Boolean]
-    attr_accessor :hide_config_values
-
-    # @return [Integer]
-    attr_reader :retry_interval
-
-    # @return [Integer]
-    attr_reader :retry_times
-
-    # @return [Boolean]
-    attr_reader :retry_exponential_backoff
-
-    # @return [Integer]
-    attr_reader :pagination_interval
-
-    # @return [Integer]
-    attr_reader :pagination_limit
-
-    # @return [Boolean]
-    attr_reader :ignore_error
-
-    def initialize
-      load
-    end
-
-    def load
-      @binaryedge_api_key = ENV.fetch("BINARYEDGE_API_KEY", nil)
-
-      @censys_id = ENV.fetch("CENSYS_ID", nil)
-      @censys_secret = ENV.fetch("CENSYS_SECRET", nil)
-
-      @circl_passive_password = ENV.fetch("CIRCL_PASSIVE_PASSWORD", nil)
-      @circl_passive_username = ENV.fetch("CIRCL_PASSIVE_USERNAME", nil)
-
-      @database_url = URI(ENV.fetch("DATABASE_URL", "sqlite3:///mihari.db"))
-
-      @greynoise_api_key = ENV.fetch("GREYNOISE_API_KEY", nil)
-
-      @ipinfo_api_key = ENV.fetch("IPINFO_API_KEY", nil)
-
-      @hunterhow_api_key = ENV.fetch("HUNTERHOW_API_KEY", nil)
+module Mihari
+  class Config < Anyway::Config
+    config_name :mihari
+    env_prefix ""
+
+    attr_config(
+      # analyzers, emitters & enrichers
+      binaryedge_api_key: nil,
+      censys_id: nil,
+      censys_secret: nil,
+      circl_passive_password: nil,
+      circl_passive_username: nil,
+      database_url: URI("sqlite3:///mihari.db"),
+      fofa_api_key: nil,
+      fofa_email: nil,
+      greynoise_api_key: nil,
+      hunterhow_api_key: nil,
+      ipinfo_api_key: nil,
+      misp_api_key: nil,
+      misp_url: nil,
+      onyphe_api_key: nil,
+      otx_api_key: nil,
+      passivetotal_api_key: nil,
+      passivetotal_username: nil,
+      pulsedive_api_key: nil,
+      securitytrails_api_key: nil,
+      shodan_api_key: nil,
+      slack_channel: nil,
+      slack_webhook_url: nil,
+      thehive_api_key: nil,
+      thehive_api_version: nil,
+      thehive_url: nil,
+      urlscan_api_key: nil,
+      virustotal_api_key: nil,
+      zoomeye_api_key: nil,
+      # others
+      hide_config_values: true,
+      ignore_error: false,
+      pagination_interval: 0,
+      pagination_limit: 100,
+      retry_exponential_backoff: true,
+      retry_interval: 5,
+      retry_times: 3,
+      sentry_dsn: nil
+    )
+
+    # @!attribute [r] binaryedge_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] censys_id
+    #   @return [String, nil]
 
-      @misp_url = ENV.fetch("MISP_URL", nil)
-      @misp_api_key = ENV.fetch("MISP_API_KEY", nil)
+    # @!attribute [r] circl_passive_password
+    #   @return [String, nil]
+
+    # @!attribute [r] circl_passive_username
+    #   @return [String, nil]
+
+    # @!attribute [r] database_url
+    #   @return [String, nil]
+
+    # @!attribute [r] fofa_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] fofa_email
+    #   @return [String, nil]
+
+    # @!attribute [r] greynoise_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] hunterhow_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] ipinfo_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] misp_url
+    #   @return [String, nil]
+
+    # @!attribute [r] misp_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] onyphe_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] otx_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] passivetotal_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] passivetotal_username
+    #   @return [String, nil]
+
+    # @!attribute [r] pulsedive_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] securitytrails_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] shodan_api_key
+    #   @return [String, nil]
 
-      @onyphe_api_key = ENV.fetch("ONYPHE_API_KEY", nil)
+    # @!attribute [r] slack_channel
+    #   @return [String, nil]
+
+    # @!attribute [r] slack_webhook_url
+    #   @return [String, nil]
 
-      @otx_api_key = ENV.fetch("OTX_API_KEY", nil)
+    # @!attribute [r] thehive_url
+    #   @return [String, nil]
 
-      @passivetotal_api_key = ENV.fetch("PASSIVETOTAL_API_KEY", nil)
-      @passivetotal_username = ENV.fetch("PASSIVETOTAL_USERNAME", nil)
+    # @!attribute [r] thehive_api_key
+    #   @return [String, nil]
 
-      @pulsedive_api_key = ENV.fetch("PULSEDIVE_API_KEY", nil)
+    # @!attribute [r] thehive_api_version
+    #   @return [String, nil]
 
-      @securitytrails_api_key = ENV.fetch("SECURITYTRAILS_API_KEY", nil)
+    # @!attribute [r] urlscan_api_key
+    #   @return [String, nil]
 
-      @shodan_api_key = ENV.fetch("SHODAN_API_KEY", nil)
+    # @!attribute [r] virustotal_api_key
+    #   @return [String, nil]
 
-      @slack_channel = ENV.fetch("SLACK_CHANNEL", nil)
-      @slack_webhook_url = ENV.fetch("SLACK_WEBHOOK_URL", nil)
+    # @!attribute [r] zoomeye_api_key
+    #   @return [String, nil]
 
-      @thehive_url = ENV.fetch("THEHIVE_URL", nil)
-      @thehive_api_key = ENV.fetch("THEHIVE_API_KEY", nil)
-      @thehive_api_version = ENV.fetch("THEHIVE_API_VERSION", nil)
+    # @!attribute [r] sentry_dsn
+    #   @return [String, nil]
 
-      @urlscan_api_key = ENV.fetch("URLSCAN_API_KEY", nil)
+    # @!attribute [r] retry_interval
+    #   @return [Integer]
 
-      @virustotal_api_key = ENV.fetch("VIRUSTOTAL_API_KEY", nil)
+    # @!attribute [r] retry_times
+    #   @return [Integer]
 
-      @zoomeye_api_key = ENV.fetch("ZOOMEYE_API_KEY", nil)
+    # @!attribute [r] retry_exponential_backoff
+    #   @return [Boolean]
 
-      @sentry_dsn = ENV.fetch("SENTRY_DSN", nil)
+    # @!attribute [r] pagination_interval
+    #   @return [Integer]
 
-      @hide_config_values = ENV.fetch("HIDE_CONFIG_VALUES", true)
+    # @!attribute [r] pagination_limit
+    #   @return [Integer]
 
-      @retry_times = ENV.fetch("RETRY_TIMES", 3).to_i
-      @retry_interval = ENV.fetch("RETRY_INTERVAL", 5).to_i
-      @retry_exponential_backoff = ENV.fetch("RETRY_EXPONENTIAL_BACKOFF", true).to_s.downcase == "true"
+    # @!attribute [r] ignore_error
+    #   @return [Boolean]
 
-      @pagination_interval = ENV.fetch("PAGINATION_INTERVAL", 0).to_i
-      @pagination_limit = ENV.fetch("PAGINATION_LIMIT", 100).to_i
+    # @!attribute [rw] hide_config_values
+    #   @return [Boolean]
 
-      @ignore_error = ENV.fetch("IGNORE_ERROR", false)
+    def database_url=(val)
+      super URI(val.to_s)
     end
 
     #
     # @return [Array<String>]
     #
     def keys
-      instance_variables.map do |key|
-        key[1..].to_s.upcase
-      end
+      to_h.keys.map(&:to_s).map(&:upcase)
     end
   end
 end

data/lib/mihari/constants.rb

@@ -5,7 +5,7 @@ module Mihari
   DEFAULT_DATA_TYPES = Types::DataTypes.values.freeze
 
   # @return [Array<Hash>]
-  DEFAULT_EMITTERS = %w[database].map { |name| { emitter: name } }.freeze
+  DEFAULT_EMITTERS = Emitters::Database.class_keys.map { |name| { emitter: name } }.freeze
 
   # @return [Array<Hash>]
   DEFAULT_ENRICHERS = Mihari.enricher_to_class.keys.map { |name| { enricher: name.downcase } }.freeze

data/lib/mihari/database.rb

@@ -13,6 +13,9 @@ def development_env?
   env == "development"
 end
 
+#
+# Mihari v5 DB schema
+#
 class V5Schema < ActiveRecord::Migration[7.1]
   def change
     create_table :rules, id: :string, if_not_exists: true do |t|
@@ -125,6 +128,9 @@ def schemas
 end
 
 module Mihari
+  #
+  # Database
+  #
   class Database
     class << self
       #

data/lib/mihari/emitters/base.rb

@@ -2,52 +2,43 @@
 
 module Mihari
   module Emitters
-    class Base < Mihari::Base
-      include Dry::Monads[:result, :try]
-
-      include Mixins::Configurable
-      include Mixins::Retriable
-
-      # @return [Array<Mihari::Artifact>]
-      attr_reader :artifacts
-
-      # @return [Mihari::Services::Rule]
+    #
+    # Base class for emitters
+    #
+    class Base < Actor
+      # @return [Mihari::Rule]
       attr_reader :rule
 
       #
-      # @param [Array<Mihari::Artifact>] artifacts
-      # @param [Mihari::Services::RuleProxy] rule
+      # @param [Mihari::Rule] rule
       # @param [Hash, nil] options
-      # @param [Hash] **_params
       #
-      def initialize(artifacts:, rule:, options: nil, **_params)
+      def initialize(rule:, options: nil)
         super(options: options)
 
-        @artifacts = artifacts
         @rule = rule
       end
 
-      # @return [Boolean]
-      def valid?
+      #
+      # @param [Array<Mihari::Models::Artifact>] artifacts
+      #
+      def call(artifacts)
         raise NotImplementedError, "You must implement #{self.class}##{__method__}"
       end
 
-      def result
+      #
+      # @return [Dry::Monads::Result::Success<Object>, Dry::Monads::Result::Failure]
+      #
+      def result(artifacts)
         Try[StandardError] do
           retry_on_error(
             times: retry_times,
             interval: retry_interval,
             exponential_backoff: retry_exponential_backoff
-          ) do
-            emit
-          end
+          ) { call(artifacts) }
         end.to_result
       end
 
-      def emit
-        raise NotImplementedError, "You must implement #{self.class}##{__method__}"
-      end
-
       class << self
         def inherited(child)
           super

data/lib/mihari/emitters/database.rb

@@ -2,23 +2,24 @@
 
 module Mihari
   module Emitters
+    #
+    # Database emitter
+    #
     class Database < Base
-      def valid?
-        configured?
-      end
-
       #
       # Create an alert
       #
-      # @return [Mihari::Alert, nil]
+      # @param [Array<Mihari::Models::Artifact>] artifacts
+      #
+      # @return [Mihari::Models::Alert, nil]
       #
-      def emit
+      def call(artifacts)
         return if artifacts.empty?
 
-        tags = rule.tags.filter_map { |name| Tag.find_or_create_by(name: name) }.uniq
-        taggings = tags.map { |tag| Tagging.new(tag_id: tag.id) }
+        tags = rule.tags.filter_map { |name| Models::Tag.find_or_create_by(name: name) }.uniq
+        taggings = tags.map { |tag| Models::Tagging.new(tag_id: tag.id) }
 
-        alert = Alert.new(artifacts: artifacts, taggings: taggings, rule_id: rule.id)
+        alert = Models::Alert.new(artifacts: artifacts, taggings: taggings, rule_id: rule.id)
         alert.save
         alert
       end