mihari 5.6.1 → 5.7.0

data/lib/mihari/emitters/misp.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Emitters
+    #
+    # MISP emitter
+    #
     class MISP < Base
       # @return [String, nil]
       attr_reader :url
@@ -9,50 +12,39 @@ module Mihari
       # @return [String, nil]
       attr_reader :api_key
 
-      # @return [Array<Mihari::Artifact>]
-      attr_reader :artifacts
-
-      # @return [Mihari::Services::Rule]
+      # @return [Mihari::Rule]
       attr_reader :rule
 
+      # @return [Array<Mihari::Models::Artifact>]
+      attr_accessor :artifacts
+
       #
-      # @param [Array<Mihari::Artifact>] artifacts
-      # @param [Mihari::Services::Rule] rule
+      # @param [Mihari::Rule] rule
       # @param [Hash, nil] options
-      # @param [Hash] **params
+      # @param [Hash, nil] params
       #
-      def initialize(artifacts:, rule:, options: nil, **params)
-        super(artifacts: artifacts, rule: rule, options: options)
+      def initialize(rule:, options: nil, **params)
+        super(rule: rule, options: options)
 
         @url = params[:url] || Mihari.config.misp_url
         @api_key = params[:api_key] || Mihari.config.misp_api_key
+
+        @artifacts = []
       end
 
+      #
       # @return [Boolean]
-      def valid?
-        unless url? && api_key?
-          Mihari.logger.info("MISP URL is not set") unless url?
-          Mihari.logger.info("MISP API key is not set") unless api_key?
-          return false
-        end
-
-        unless ping?
-          Mihari.logger.info("MISP URL (#{url}) is not reachable")
-          return false
-        end
-
-        true
+      #
+      def configured?
+        api_key? && url?
       end
 
       #
       # Create a MISP event
       #
-      # @param [Arra<Mihari::Artifact>] artifacts
-      # @param [Mihari::Services::Rule] rule
+      # @param [Array<Mihari::Models::Artifact>] artifacts
       #
-      # @return [::MISP::Event]
-      #
-      def emit
+      def call(artifacts)
         return if artifacts.empty?
 
         client.create_event({
@@ -77,7 +69,7 @@ module Mihari
       #
       # Build a MISP attribute
       #
-      # @param [Mihari::Artifact] artifact
+      # @param [Mihari::Models::Artifact] artifact
       #
       # @return [Hash]
       #
@@ -143,19 +135,6 @@ module Mihari
       def api_key?
         !api_key.nil? && !api_key.empty?
       end
-
-      #
-      # Check whether a URL is reachable or not
-      #
-      # @return [Boolean]
-      #
-      def ping?
-        base_url = url.end_with?("/") ? url[0..-2] : url
-        login_url = "#{base_url}/users/login"
-
-        http = Net::Ping::HTTP.new(login_url)
-        http.ping?
-      end
     end
   end
 end

data/lib/mihari/emitters/slack.rb

@@ -131,18 +131,22 @@ module Mihari
       # @return [String]
       attr_reader :username
 
+      # @return [Array<Mihari::Models::Artifact>]
+      attr_accessor :artifacts
+
       #
-      # @param [Array<Mihari::Artifact>] artifacts
-      # @param [Mihari::Services::Rule] rule
+      # @param [Mihari::Rule] rule
       # @param [Hash, nil] options
-      # @param [Hash] **params
+      # @param [Hash, nil] params
       #
-      def initialize(artifacts:, rule:, options: nil, **params)
-        super(artifacts: artifacts, rule: rule, options: options)
+      def initialize(rule:, options: nil, **params)
+        super(rule: rule, options: options)
 
         @webhook_url = params[:webhook_url] || Mihari.config.slack_webhook_url
         @channel = params[:channel] || Mihari.config.slack_channel || DEFAULT_CHANNEL
         @username = DEFAULT_USERNAME
+
+        @artifacts = []
       end
 
       #
@@ -154,12 +158,10 @@ module Mihari
         !webhook_url.nil?
       end
 
-      #
-      # Check webhook URL is set. Alias of #webhook_url?
       #
       # @return [Boolean]
       #
-      def valid?
+      def configured?
         webhook_url?
       end
 
@@ -211,19 +213,20 @@ module Mihari
         ].join("\n")
       end
 
-      def emit
+      #
+      # @param [Array<Mihari::Models::Artifact>] artifacts
+      #
+      def call(artifacts)
         return if artifacts.empty?
 
+        @artifacts = artifacts
+
         notifier.post(text: text, attachments: attachments, mrkdwn: true)
       end
 
       def configuration_keys
         %w[slack_webhook_url slack_channel]
       end
-
-      def configured?
-        valid?
-      end
     end
   end
 end

data/lib/mihari/emitters/the_hive.rb

@@ -12,45 +12,42 @@ module Mihari
       # @return [String, nil]
       attr_reader :api_version
 
+      # @return [Array<Mihari::Models::Artifact>]
+      attr_accessor :artifacts
+
       #
-      # @param [Array<Mihari::Artifact>] artifacts
-      # @param [Mihari::Services::Rule] rule
+      # @param [Mihari::Rule] rule
       # @param [Hash, nil] options
-      # @param [Hash] **params
+      # @param [Hash] params
       #
-      def initialize(artifacts:, rule:, options: nil, **params)
-        super(artifacts: artifacts, rule: rule, options: options)
+      def initialize(rule:, options: nil, **params)
+        super(rule: rule, options: options)
 
         @url = params[:url] || Mihari.config.thehive_url
         @api_key = params[:api_key] || Mihari.config.thehive_api_key
         @api_version = params[:api_version] || Mihari.config.thehive_api_version
+
+        @artifacts = []
       end
 
+      #
       # @return [Boolean]
-      def valid?
-        unless url? && api_key?
-          Mihari.logger.info("TheHive URL is not set") unless url?
-          Mihari.logger.info("TheHive API key is not set") unless api_key?
-          return false
-        end
-
-        unless ping?
-          Mihari.logger.info("TheHive URL (#{url}) is not reachable")
-          return false
-        end
-
-        true
+      #
+      def configured?
+        api_key? && url?
       end
 
       #
       # Create a Hive alert
       #
-      # @return [::MISP::Event]
+      # @param [Array<Mihari::Models::Artifact>] artifacts
       #
-      def emit
+      def call(artifacts)
         return if artifacts.empty?
 
-        client.alert(payload)
+        @artifacts = artifacts
+
+        client.alert payload
       end
 
       #
@@ -146,31 +143,6 @@ module Mihari
           source_ref: "1"
         }
       end
-
-      #
-      # Check whether a URL is reachable or not
-      #
-      # @return [Boolean]
-      #
-      def ping?
-        base_url = url.end_with?("/") ? url[0..-2] : url
-
-        if normalized_api_version.nil?
-          # for v4
-          base_url = url.end_with?("/") ? url[0..-2] : url
-          public_url = "#{base_url}/index.html"
-        else
-          # for v5
-          public_url = "#{base_url}/api/v1/status/public"
-        end
-
-        http = Net::Ping::HTTP.new(public_url)
-
-        # use GET for v5
-        http.get_request = true if normalized_api_version
-
-        http.ping?
-      end
     end
   end
 end

data/lib/mihari/emitters/webhook.rb

@@ -57,23 +57,42 @@ module Mihari
       # @return [String, nil]
       attr_reader :template
 
+      # @return [Array<Mihari::Models::Artifact>]
+      attr_accessor :artifacts
+
       #
-      # @param [Array<Mihari::Artifact>] artifacts
-      # @param [Mihari::Services::Rule] rule
-      # @param [Hash] **options
+      # @param [Mihari::Rule] rule
+      # @param [Hash, nil] options
+      # @param [Hash, nil] params
       #
-      def initialize(artifacts:, rule:, options: nil, **params)
-        super(artifacts: artifacts, rule: rule, options: options)
+      def initialize(rule:, options: nil, **params)
+        super(rule: rule, options: options)
 
         @url = Addressable::URI.parse(params[:url])
         @headers = params[:headers] || {}
         @method = params[:method] || "POST"
         @template = params[:template]
+
+        @artifacts = []
+      end
+
+      #
+      # @return [Boolean]
+      #
+      def configured?
+        return false if url.nil?
+
+        %w[http https].include? url.scheme.downcase
       end
 
-      def emit
+      #
+      # @param [Array<Mihari::Models::Artifact>] artifacts
+      #
+      def call(artifacts)
         return if artifacts.empty?
 
+        @artifacts = artifacts
+
         # returns body to prevent Parallel issue (Parallel fails to handle HTTP:Response object)
         case method
         when "GET"
@@ -83,12 +102,6 @@ module Mihari
         end
       end
 
-      def valid?
-        return false if url.nil?
-
-        %w[http https].include? url.scheme.downcase
-      end
-
       private
 
       def http
@@ -101,17 +114,15 @@ module Mihari
       # @return [String]
       #
       def rendered_template
-        [].tap do |out|
-          options = {}
-          options[:template] = File.read(template) unless template.nil?
-
-          payload_template = PayloadTemplate.new(
-            artifacts: artifacts,
-            rule: rule,
-            options: options
-          )
-          out << payload_template.result
-        end.first
+        options = {}
+        options[:template] = File.read(template) unless template.nil?
+
+        payload_template = PayloadTemplate.new(
+          artifacts: artifacts,
+          rule: rule,
+          options: options
+        )
+        payload_template.result
       end
 
       #

data/lib/mihari/enrichers/base.rb

@@ -2,33 +2,34 @@
 
 module Mihari
   module Enrichers
-    class Base < Mihari::Base
-      include Mixins::Configurable
-      include Mixins::Retriable
-
-      include Dry::Monads[:result, :try]
-
+    #
+    # Base class for enrichers
+    #
+    class Base < Actor
       def initialize(options: nil)
         super(options: options)
       end
 
-      def query_result(value)
+      #
+      # @param [String] value
+      #
+      def call(value)
+        raise NotImplementedError, "You must implement #{self.class}##{__method__}"
+      end
+
+      #
+      # @return [Dry::Monads::Result::Success<Object>, Dry::Monads::Result::Failure]
+      #
+      def result(value)
         Try[StandardError] do
           retry_on_error(
             times: retry_times,
             interval: retry_interval,
             exponential_backoff: retry_exponential_backoff
-          ) { query value }
+          ) { call value }
         end.to_result
       end
 
-      #
-      # @param [String] value
-      #
-      def query(value)
-        raise NotImplementedError, "You must implement #{self.class}##{__method__}"
-      end
-
       class << self
         def inherited(child)
           super

data/lib/mihari/enrichers/google_public_dns.rb

@@ -1,18 +1,19 @@
 # frozen_string_literal: true
 
-require "net/https"
-
 module Mihari
   module Enrichers
+    #
+    # Google Public DNS enricher
+    #
     class GooglePublicDNS < Base
       #
       # Query Google Public DNS
       #
       # @param [String] name
       #
-      # @return [Array<Mihari::Structs::Shodan::GooglePublicDNS::Response>]
+      # @return [Array<Mihari::Structs::GooglePublicDNS::Response>]
       #
-      def query(name)
+      def call(name)
         %w[A AAAA CNAME TXT NS].filter_map do |resource_type|
           query_by_type(name, resource_type)
         end
@@ -24,7 +25,7 @@ module Mihari
       # @param [String] name
       # @param [String] resource_type
       #
-      # @return [Mihari::Structs::Shodan::GooglePublicDNS::Response, nil]
+      # @return [Mihari::Structs::GooglePublicDNS::Response, nil]
       #
       def query_by_type(name, resource_type)
         url = "https://dns.google/resolve"

data/lib/mihari/enrichers/ipinfo.rb

@@ -1,23 +1,24 @@
 # frozen_string_literal: true
 
-require "net/https"
-
 module Mihari
   module Enrichers
+    #
+    # IPInfo enricher
+    #
     class IPInfo < Base
-      include Memist::Memoizable
-
       # @return [String, nil]
       attr_reader :api_key
 
+      #
+      # @param [Hash, nil] options
+      # @param [String, nil] api_key
+      #
       def initialize(options: nil, api_key: nil)
         @api_key = api_key || Mihari.config.ipinfo_api_key
 
         super(options: options)
       end
 
-      private
-
       def configuration_keys
         %w[ipinfo_api_key]
       end
@@ -29,14 +30,15 @@ module Mihari
       #
       # @return [Mihari::Structs::IPInfo::Response, nil]
       #
-      def query(ip)
+      def call(ip)
         url = "https://ipinfo.io/#{ip}/json"
         res = http.get(url)
         data = JSON.parse(res.body.to_s)
 
         Structs::IPInfo::Response.from_dynamic! data
       end
-      memoize :query
+
+      private
 
       def headers
         authorization = api_key.nil? ? nil : "Bearer #{api_key}"

data/lib/mihari/enrichers/shodan.rb

@@ -1,12 +1,11 @@
 # frozen_string_literal: true
 
-require "net/https"
-
 module Mihari
   module Enrichers
+    #
+    # Shodan enricher
+    #
     class Shodan < Base
-      include Memist::Memoizable
-
       #
       # Query Shodan Internet DB
       #
@@ -14,14 +13,13 @@ module Mihari
       #
       # @return [Mihari::Structs::Shodan::InternetDBResponse, nil]
       #
-      def query(ip)
+      def call(ip)
         url = "https://internetdb.shodan.io/#{ip}"
         res = http.get(url)
         data = JSON.parse(res.body.to_s)
 
         Structs::Shodan::InternetDBResponse.from_dynamic! data
       end
-      memoize :query
 
       private
 

data/lib/mihari/enrichers/whois.rb

@@ -4,6 +4,9 @@ require "whois-parser"
 
 module Mihari
   module Enrichers
+    #
+    # Whois enricher
+    #
     class Whois < Base
       # @return [Hash]
       attr_accessor :memo
@@ -20,11 +23,11 @@ module Mihari
       #
       # Query IAIA Whois API
       #
-      # @param [String] name
+      # @param [String] domain
       #
-      # @return [Mihari::WhoisRecord, nil]
+      # @return [Mihari::Models::WhoisRecord, nil]
       #
-      def query(domain)
+      def call(domain)
         domain = PublicSuffix.domain(domain)
 
         # check memo
@@ -34,7 +37,7 @@ module Mihari
         parser = record.parser
         return nil if parser.available?
 
-        whois_record = WhoisRecord.new(
+        whois_record = Models::WhoisRecord.new(
           domain: domain,
           created_on: get_created_on(parser),
           updated_on: get_updated_on(parser),
@@ -71,7 +74,7 @@ module Mihari
       #
       # Get created_on
       #
-      # @param [::Whois::Parser:] parser
+      # @param [::Whois::Parser] parser
       #
       # @return [Date, nil]
       #
@@ -84,7 +87,7 @@ module Mihari
       #
       # Get updated_on
       #
-      # @param [::Whois::Parser:] parser
+      # @param [::Whois::Parser] parser
       #
       # @return [Date, nil]
       #
@@ -97,7 +100,7 @@ module Mihari
       #
       # Get expires_on
       #
-      # @param [::Whois::Parser:] parser
+      # @param [::Whois::Parser] parser
       #
       # @return [Date, nil]
       #
@@ -110,7 +113,7 @@ module Mihari
       #
       # Get registrar
       #
-      # @param [::Whois::Parser:] parser
+      # @param [::Whois::Parser] parser
       #
       # @return [Hash, nil]
       #
@@ -123,9 +126,9 @@ module Mihari
       #
       # Get contacts
       #
-      # @param [::Whois::Parser:] parser
+      # @param [::Whois::Parser] parser
       #
-      # @return [Array[Hash], nil]
+      # @return [Array<Hash>, nil]
       #
       def get_contacts(parser)
         parser.contacts.map(&:to_h)

data/lib/mihari/errors.rb

@@ -20,6 +20,9 @@ module Mihari
 
   class TimeoutError < HTTPError; end
 
+  #
+  # HTTP status code error
+  #
   class StatusCodeError < HTTPError
     # @return [Integer]
     attr_reader :status_code
@@ -40,6 +43,9 @@ module Mihari
     end
   end
 
+  #
+  # (dry-schema) Schema validation error
+  #
   class ValidationError < Error
     attr_reader :errors
 

data/lib/mihari/feed/parser.rb

@@ -4,6 +4,9 @@ require "jr/cli/core_ext"
 
 module Mihari
   module Feed
+    #
+    # Feed parser
+    #
     class Parser
       # @return [Array<Hash>, Array<Array<String>>]
       attr_reader :data

data/lib/mihari/feed/reader.rb

@@ -4,6 +4,9 @@ require "csv"
 
 module Mihari
   module Feed
+    #
+    # Feed reader
+    #
     class Reader
       # @return [String]
       attr_reader :url

data/lib/mihari/http.rb

@@ -4,6 +4,9 @@ require "http"
 
 module Mihari
   module HTTP
+    #
+    # Better error handling feature
+    #
     class BetterError < ::HTTP::Feature
       def wrap_response(response)
         unless response.status.success?
@@ -24,6 +27,9 @@ module Mihari
       ::HTTP::Options.register_feature(:better_error, self)
     end
 
+    #
+    # HTTP client factory
+    #
     class Factory
       class << self
         #

data/lib/mihari/mixins/autonomous_system.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Mixins
+    #
+    # Autonomous System mixin
+    #
     module AutonomousSystem
       #
       # Normalize ASN value

data/lib/mihari/mixins/configurable.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Mixins
+    #
+    # Configurable mixin
+    #
     module Configurable
       #
       # Check whether there are configuration key-values or not

data/lib/mihari/mixins/error_notification.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Mixins
+    #
+    # Error notification mixin
+    #
     module ErrorNotification
       #
       # Send an exception notification if there is any error in a block