mihari 5.6.1 → 5.7.0

data/lib/mihari/models/cpe.rb

@@ -1,29 +1,34 @@
 # frozen_string_literal: true
 
 module Mihari
-  class CPE < ActiveRecord::Base
-    belongs_to :artifact
+  module Models
+    #
+    # CPE model
+    #
+    class CPE < ActiveRecord::Base
+      belongs_to :artifact
 
-    class << self
-      include Dry::Monads[:result]
+      class << self
+        include Dry::Monads[:result]
 
-      #
-      # Build CPEs
-      #
-      # @param [String] ip
-      # @param [Mihari::Enrichers::Shodan] enricher
-      #
-      # @return [Array<Mihari::CPE>]
-      #
-      def build_by_ip(ip, enricher: Enrichers::Shodan.new)
-        result = enricher.query_result(ip).bind do |res|
-          if res.nil?
-            Success []
-          else
-            Success(res.cpes.map { |cpe| new(cpe: cpe) })
+        #
+        # Build CPEs
+        #
+        # @param [String] ip
+        # @param [Mihari::Enrichers::Shodan] enricher
+        #
+        # @return [Array<Mihari::CPE>]
+        #
+        def build_by_ip(ip, enricher: Enrichers::Shodan.new)
+          result = enricher.result(ip).bind do |res|
+            if res.nil?
+              Success []
+            else
+              Success(res.cpes.map { |cpe| new(cpe: cpe) })
+            end
           end
+          result.value_or []
         end
-        result.value_or []
       end
     end
   end

data/lib/mihari/models/dns.rb

@@ -1,31 +1,36 @@
 # frozen_string_literal: true
 
 module Mihari
-  class DnsRecord < ActiveRecord::Base
-    belongs_to :artifact
+  module Models
+    #
+    # DNS record model
+    #
+    class DnsRecord < ActiveRecord::Base
+      belongs_to :artifact
 
-    class << self
-      include Dry::Monads[:result]
+      class << self
+        include Dry::Monads[:result]
 
-      #
-      # Build DNS records
-      #
-      # @param [String] domain
-      # @param [Mihari::Enrichers::Shodan] enricher
-      #
-      # @return [Array<Mihari::DnsRecord>]
-      #
-      def build_by_domain(domain, enricher: Enrichers::GooglePublicDNS.new)
-        result = enricher.query_result(domain).bind do |responses|
-          Success(
-            responses.map do |res|
-              res.answers.map do |answer|
-                new(resource: answer.resource_type, value: answer.data)
-              end
-            end.flatten
-          )
+        #
+        # Build DNS records
+        #
+        # @param [String] domain
+        # @param [Mihari::Enrichers::Shodan] enricher
+        #
+        # @return [Array<Mihari::Models::DnsRecord>]
+        #
+        def build_by_domain(domain, enricher: Enrichers::GooglePublicDNS.new)
+          result = enricher.result(domain).bind do |responses|
+            Success(
+              responses.map do |res|
+                res.answers.map do |answer|
+                  new(resource: answer.resource_type, value: answer.data)
+                end
+              end.flatten
+            )
+          end
+          result.value_or []
         end
-        result.value_or []
       end
     end
   end

data/lib/mihari/models/geolocation.rb

@@ -3,30 +3,35 @@
 require "normalize_country"
 
 module Mihari
-  class Geolocation < ActiveRecord::Base
-    belongs_to :artifact
+  module Models
+    #
+    # Geolocation model
+    #
+    class Geolocation < ActiveRecord::Base
+      belongs_to :artifact
 
-    class << self
-      include Dry::Monads[:result]
+      class << self
+        include Dry::Monads[:result]
 
-      #
-      # Build Geolocation
-      #
-      # @param [String] ip
-      # @param [Mihari::Enrichers::IPinfo] enricher
-      #
-      # @return [Mihari::Geolocation, nil]
-      #
-      def build_by_ip(ip, enricher: Enrichers::IPInfo.new)
-        result = enricher.query_result(ip).bind do |res|
-          value = res&.country_code
-          if value.nil?
-            Success nil
-          else
-            Success new(country: NormalizeCountry(value, to: :short), country_code: value)
+        #
+        # Build Geolocation
+        #
+        # @param [String] ip
+        # @param [Mihari::Enrichers::IPinfo] enricher
+        #
+        # @return [Mihari::Geolocation, nil]
+        #
+        def build_by_ip(ip, enricher: Enrichers::IPInfo.new)
+          result = enricher.result(ip).bind do |res|
+            value = res&.country_code
+            if value.nil?
+              Success nil
+            else
+              Success new(country: NormalizeCountry(value, to: :short), country_code: value)
+            end
           end
+          result.value_or nil
         end
-        result.value_or nil
       end
     end
   end

data/lib/mihari/models/port.rb

@@ -1,29 +1,34 @@
 # frozen_string_literal: true
 
 module Mihari
-  class Port < ActiveRecord::Base
-    belongs_to :artifact
+  module Models
+    #
+    # Port model
+    #
+    class Port < ActiveRecord::Base
+      belongs_to :artifact
 
-    class << self
-      include Dry::Monads[:result]
+      class << self
+        include Dry::Monads[:result]
 
-      #
-      # Build ports
-      #
-      # @param [String] ip
-      # @param [Mihari::Enrichers::Shodan] enricher
-      #
-      # @return [Array<Mihari::Port>]
-      #
-      def build_by_ip(ip, enricher: Enrichers::Shodan.new)
-        result = enricher.query_result(ip).bind do |res|
-          if res.nil?
-            Success []
-          else
-            Success(res.ports.map { |port| new(port: port) })
+        #
+        # Build ports
+        #
+        # @param [String] ip
+        # @param [Mihari::Enrichers::Shodan] enricher
+        #
+        # @return [Array<Mihari::Port>]
+        #
+        def build_by_ip(ip, enricher: Enrichers::Shodan.new)
+          result = enricher.result(ip).bind do |res|
+            if res.nil?
+              Success []
+            else
+              Success(res.ports.map { |port| new(port: port) })
+            end
           end
+          result.value_or []
         end
-        result.value_or []
       end
     end
   end

data/lib/mihari/models/reverse_dns.rb

@@ -1,29 +1,34 @@
 # frozen_string_literal: true
 
 module Mihari
-  class ReverseDnsName < ActiveRecord::Base
-    belongs_to :artifact
+  module Models
+    #
+    # Reverse DNS name model
+    #
+    class ReverseDnsName < ActiveRecord::Base
+      belongs_to :artifact
 
-    class << self
-      include Dry::Monads[:result]
+      class << self
+        include Dry::Monads[:result]
 
-      #
-      # Build reverse DNS names
-      #
-      # @param [String] ip
-      # @param [Mihari::Enrichers::Shodan] enricher
-      #
-      # @return [Array<Mihari::ReverseDnsName>]
-      #
-      def build_by_ip(ip, enricher: Enrichers::Shodan.new)
-        result = enricher.query_result(ip).bind do |res|
-          if res.nil?
-            Success []
-          else
-            Success(res.hostnames.map { |name| new(name: name) })
+        #
+        # Build reverse DNS names
+        #
+        # @param [String] ip
+        # @param [Mihari::Enrichers::Shodan] enricher
+        #
+        # @return [Array<Mihari::Models::ReverseDnsName>]
+        #
+        def build_by_ip(ip, enricher: Enrichers::Shodan.new)
+          result = enricher.result(ip).bind do |res|
+            if res.nil?
+              Success []
+            else
+              Success(res.hostnames.map { |name| new(name: name) })
+            end
           end
+          result.value_or []
         end
-        result.value_or []
       end
     end
   end

data/lib/mihari/models/rule.rb

@@ -3,77 +3,82 @@
 require "yaml"
 
 module Mihari
-  class Rule < ActiveRecord::Base
-    has_many :alerts, dependent: :destroy
-
-    def symbolized_data
-      @symbolized_data ||= data.deep_symbolize_keys
-    end
-
-    def yaml
-      data.to_yaml
-    end
-
-    def tags
-      (data["tags"] || []).map { |tag| { name: tag } }
-    end
-
-    class << self
-      #
-      # Search rules
-      #
-      # @param [Structs::Filters::Rule::SearchFilterWithPagination] filter
-      #
-      # @return [Array<Rule>]
-      #
-      def search(filter)
-        limit = filter.limit.to_i
-        raise ArgumentError, "limit should be bigger than zero" unless limit.positive?
-
-        page = filter.page.to_i
-        raise ArgumentError, "page should be bigger than zero" unless page.positive?
-
-        offset = (page - 1) * limit
-
-        relation = build_relation(filter.without_pagination)
-
-        # TODO: improve queires
-        rule_ids = relation.limit(limit).offset(offset).order(created_at: :desc).pluck(:id).uniq
-        where(id: [rule_ids]).order(created_at: :desc)
+  module Models
+    #
+    # Rule model
+    #
+    class Rule < ActiveRecord::Base
+      has_many :alerts, dependent: :destroy
+
+      def symbolized_data
+        @symbolized_data ||= data.deep_symbolize_keys
       end
 
-      #
-      # Count alerts
-      #
-      # @param [Structs::Filters::Rule::SearchFilterWithPagination] filter
-      #
-      # @return [Integer]
-      #
-      def count(filter)
-        relation = build_relation(filter)
-        relation.distinct("rules.id").count
+      def yaml
+        data.to_yaml
       end
 
-      private
-
-      #
-      # @param [Structs::Filters::Rule::SearchFilter] filter
-      #
-      # @return [Mihari::Rule]
-      #
-      def build_relation(filter)
-        relation = self
-        relation = relation.includes(alerts: :tags)
-
-        relation = relation.where(alerts: { tags: { name: filter.tag_name } }) if filter.tag_name
-
-        relation = relation.where("rules.title LIKE ?", "%#{filter.title}%") if filter.title
-        relation = relation.where("rules.description LIKE ?", "%#{filter.description}%") if filter.description
-
-        relation = relation.where("rules.created_at >= ?", filter.from_at) if filter.from_at
-        relation = relation.where("rules.created_at <= ?", filter.to_at) if filter.to_at
+      def tags
+        (data["tags"] || []).map { |tag| { name: tag } }
+      end
 
-        relation
+      class << self
+        #
+        # Search rules
+        #
+        # @param [Mihari::Structs::Filters::Rule::SearchFilterWithPagination] filter
+        #
+        # @return [Array<Rule>]
+        #
+        def search(filter)
+          limit = filter.limit.to_i
+          raise ArgumentError, "limit should be bigger than zero" unless limit.positive?
+
+          page = filter.page.to_i
+          raise ArgumentError, "page should be bigger than zero" unless page.positive?
+
+          offset = (page - 1) * limit
+
+          relation = build_relation(filter.without_pagination)
+
+          # TODO: improve queires
+          rule_ids = relation.limit(limit).offset(offset).order(created_at: :desc).pluck(:id).uniq
+          where(id: [rule_ids]).order(created_at: :desc)
+        end
+
+        #
+        # Count alerts
+        #
+        # @param [Mihari::Structs::Filters::Rule::SearchFilterWithPagination] filter
+        #
+        # @return [Integer]
+        #
+        def count(filter)
+          relation = build_relation(filter)
+          relation.distinct("rules.id").count
+        end
+
+        private
+
+        #
+        # @param [Mihari::Structs::Filters::Rule::SearchFilter] filter
+        #
+        # @return [Mihari::Models::Rule]
+        #
+        def build_relation(filter)
+          relation = self
+          relation = relation.includes(alerts: :tags)
+
+          relation = relation.where(alerts: { tags: { name: filter.tag_name } }) if filter.tag_name
+
+          relation = relation.where("rules.title LIKE ?", "%#{filter.title}%") if filter.title
+          relation = relation.where("rules.description LIKE ?", "%#{filter.description}%") if filter.description
+
+          relation = relation.where("rules.created_at >= ?", filter.from_at) if filter.from_at
+          relation = relation.where("rules.created_at <= ?", filter.to_at) if filter.to_at
+
+          relation
+        end
       end
     end
   end

data/lib/mihari/models/tag.rb

@@ -1,8 +1,13 @@
 # frozen_string_literal: true
 
 module Mihari
-  class Tag < ActiveRecord::Base
-    has_many :taggings, dependent: :destroy
-    has_many :tags, through: :taggings
+  module Models
+    #
+    # Tag model
+    #
+    class Tag < ActiveRecord::Base
+      has_many :taggings, dependent: :destroy
+      has_many :tags, through: :taggings
+    end
   end
 end

data/lib/mihari/models/tagging.rb

@@ -1,8 +1,13 @@
 # frozen_string_literal: true
 
 module Mihari
-  class Tagging < ActiveRecord::Base
-    belongs_to :alert
-    belongs_to :tag
+  module Models
+    #
+    # Tagging model
+    #
+    class Tagging < ActiveRecord::Base
+      belongs_to :alert
+      belongs_to :tag
+    end
   end
 end

data/lib/mihari/models/whois.rb

@@ -1,25 +1,28 @@
 # frozen_string_literal: true
 
 module Mihari
-  class WhoisRecord < ActiveRecord::Base
-    belongs_to :artifact
+  module Models
+    #
+    # Whois record model
+    #
+    class WhoisRecord < ActiveRecord::Base
+      belongs_to :artifact
 
-    @memo = {}
+      @memo = {}
 
-    class << self
-      include Dry::Monads[:result]
-
-      #
-      # Build whois record
-      #
-      # @param [String] domain
-      # @param [Mihari::Enrichers::Whois] enricher
-      #
-      # @return [WhoisRecord, nil]
-      #
-      def build_by_domain(domain, enricher: Enrichers::Whois.new)
-        result = enricher.query_result(domain)
-        result.value_or nil
+      class << self
+        #
+        # Build whois record
+        #
+        # @param [String] domain
+        # @param [Mihari::Enrichers::Whois] enricher
+        #
+        # @return [WhoisRecord, nil]
+        #
+        def build_by_domain(domain, enricher: Enrichers::Whois.new)
+          result = enricher.result(domain)
+          result.value_or nil
+        end
       end
     end
   end