mihari 5.6.2 → 5.7.0

data/lib/mihari/clients/onyphe.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # Onyphe API client
+    #
     class Onyphe < Base
       PAGE_SIZE = 10
 
@@ -33,7 +36,7 @@ module Mihari
       # @param [String] query
       # @param [Integer] page
       #
-      # @return [Structs::Onyphe::Response]
+      # @return [Mihari::Structs::Onyphe::Response]
       #
       def datascan(query, page: 1)
         params = { page: page, apikey: api_key }
@@ -45,7 +48,7 @@ module Mihari
       # @param [String] query
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::Onyphe::Response>]
+      # @return [Enumerable<Mihari::Structs::Onyphe::Response>]
       #
       def datascan_with_pagination(query, pagination_limit: Mihari.config.pagination_limit)
         Enumerator.new do |y|

data/lib/mihari/clients/otx.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # OTX API client
+    #
     class OTX < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/passivetotal.rb

@@ -4,6 +4,9 @@ require "base64"
 
 module Mihari
   module Clients
+    #
+    # PassiveTotal API client
+    #
     class PassiveTotal < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/publsedive.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # PulseDive API client
+    #
     class PulseDive < Base
       # @return [String]
       attr_reader :api_key
@@ -21,7 +24,7 @@ module Mihari
       end
 
       #
-      # @param [String] indicator_id
+      # @param [String] ip_or_domain
       #
       # @return [Hash]
       #

data/lib/mihari/clients/securitytrails.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # SecurityTrails API client
+    #
     class SecurityTrails < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/shodan.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # Shodan API client
+    #
     class Shodan < Base
       PAGE_SIZE = 100
 
@@ -34,7 +37,7 @@ module Mihari
       # @param [Integer] page
       # @param [Boolean] minify
       #
-      # @return [Structs::Shodan::Result]
+      # @return [Mihari::Structs::Shodan::Result]
       #
       def search(query, page: 1, minify: true)
         params = {
@@ -52,7 +55,7 @@ module Mihari
       # @param [Boolean] minify
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::Shodan::Response>]
+      # @return [Enumerable<Mihari::Structs::Shodan::Response>]
       #
       def search_with_pagination(query, minify: true, pagination_limit: Mihari.config.pagination_limit)
         Enumerator.new do |y|

data/lib/mihari/clients/the_hive.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # TheHive API client
+    #
     class TheHive < Base
       #
       # @param [String] base_url

data/lib/mihari/clients/urlscan.rb

@@ -2,12 +2,15 @@
 
 module Mihari
   module Clients
-    class UrlScan < Base
+    #
+    # urlscan.io API client
+    #
+    class Urlscan < Base
       #
       # @param [String] base_url
       # @param [String, nil] api_key
       # @param [Hash] headers
-      # @param [Integer, nil] interval
+      # @param [Integer, nil] pagination_interval
       # @param [Integer, nil] timeout
       #
       def initialize(
@@ -29,7 +32,7 @@ module Mihari
       # @param [Integer, nil] size
       # @param [String, nil] search_after
       #
-      # @return [Structs::Urlscan::Response]
+      # @return [Mihari::Structs::Urlscan::Response]
       #
       def search(q, size: nil, search_after: nil)
         params = { q: q, size: size, search_after: search_after }.compact
@@ -42,7 +45,7 @@ module Mihari
       # @param [Integer, nil] size
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::Urlscan::Response>]
+      # @return [Enumerable<Mihari::Structs::Urlscan::Response>]
       #
       def search_with_pagination(q, size: nil, pagination_limit: Mihari.config.pagination_limit)
         search_after = nil

data/lib/mihari/clients/virustotal.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # VirusTotal API client
+    #
     class VirusTotal < Base
       #
       # @param [String] base_url
@@ -46,7 +49,7 @@ module Mihari
       # @param [String] query
       # @param [String, nil] cursor
       #
-      # @return [Structs::VirusTotalIntelligence::Response]
+      # @return [Mihari::Structs::VirusTotalIntelligence::Response]
       #
       def intel_search(query, cursor: nil)
         params = { query: query, cursor: cursor }.compact
@@ -58,7 +61,7 @@ module Mihari
       # @param [String] query
       # @param [Integer] pagination_limit
       #
-      # @return [Enumerable<Structs::VirusTotalIntelligence::Response>]
+      # @return [Enumerable<Mihari::Structs::VirusTotalIntelligence::Response>]
       #
       def intel_search_with_pagination(query, pagination_limit: Mihari.config.pagination_limit)
         cursor = nil

data/lib/mihari/clients/zoomeye.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Clients
+    #
+    # ZoomEye API client
+    #
     class ZoomEye < Base
       PAGE_SIZE = 10
 

data/lib/mihari/commands/alert.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Commands
+    #
+    # Alert sub-commands
+    #
     module Alert
       class << self
         def included(thor)
@@ -16,26 +19,14 @@ module Mihari
               Mihari::Database.with_db_connection do
                 builder = Services::AlertBuilder.new(path)
 
-                run_proxy_l = ->(proxy) { run_proxy proxy }
-                result = builder.result.bind(run_proxy_l)
+                runner_result_l = ->(proxy) { Services::AlertRunner.new(proxy).result }
+                result = builder.result.bind(runner_result_l)
 
                 alert = result.value!
                 data = Entities::Alert.represent(alert)
                 puts JSON.pretty_generate(data.as_json)
               end
             end
-
-            no_commands do
-              #
-              # @param [Mihari::Services::AlertProxy] proxy
-              #
-              def run_proxy(proxy)
-                Dry::Monads::Try[StandardError] do
-                  runner = Services::AlertRunner.new(proxy)
-                  runner.run
-                end.to_result
-              end
-            end
           end
         end
       end

data/lib/mihari/commands/database.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Commands
+    #
+    # Database sub-commands
+    #
     module Database
       class << self
         def included(thor)

data/lib/mihari/commands/rule.rb

@@ -4,6 +4,9 @@ require "pathname"
 
 module Mihari
   module Commands
+    #
+    # Rule sub-commands
+    #
     module Rule
       class << self
         def included(thor)
@@ -48,7 +51,13 @@ module Mihari
               # @return [nil]
               #
               def initialize_rule(path, files = Dry::Files.new)
-                rule = Mihari::Rule.from_yaml File.read(File.expand_path("../templates/rule.yml.erb", __dir__))
+                rule = Mihari::Rule.new(
+                  id: SecureRandom.uuid,
+                  title: "Title goes here",
+                  description: "Description goes here",
+                  created_on: Date.today,
+                  queries: []
+                )
                 files.write(path, rule.yaml)
               end
             end

data/lib/mihari/commands/search.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Commands
+    #
+    # Search sub-commands
+    #
     module Search
       class << self
         def included(thor)
@@ -20,9 +23,9 @@ module Mihari
                 builder = Services::RuleBuilder.new(path_or_id)
 
                 check_diff_l = ->(rule) { check_diff rule }
-                update_and_run_l = ->(runner) { update_and_run runner }
+                update_and_call_l = ->(runner) { update_and_call runner }
 
-                result = builder.result.bind(check_diff_l).bind(update_and_run_l)
+                result = builder.result.bind(check_diff_l).bind(update_and_call_l)
 
                 alert = result.value!
                 data = Entities::Alert.represent(alert)
@@ -32,7 +35,7 @@ module Mihari
 
             no_commands do
               #
-              # @param [Mihari::Services::RuleRunner] rule
+              # @param [Mihari::RuleRunner] rule
               #
               def check_diff(rule)
                 force_overwrite = options["force_overwrite"] || false
@@ -45,12 +48,12 @@ module Mihari
               end
 
               #
-              # @param [Mihari::Services::RuleRunner] runner
+              # @param [Mihari::RuleRunner] runner
               #
-              def update_and_run(runner)
+              def update_and_call(runner)
                 Dry::Monads::Try[StandardError] do
                   runner.update_or_create
-                  runner.run
+                  runner.call
                 end.to_result
               end
             end

data/lib/mihari/commands/version.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Commands
+    #
+    # Version sub-commands
+    #
     module Version
       class << self
         def included(thor)

data/lib/mihari/commands/web.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Commands
+    #
+    # Web sub-commands
+    #
     module Web
       class << self
         def included(thor)
@@ -20,7 +23,7 @@ module Mihari
               Mihari.config.hide_config_values = options["hide_config_values"]
               # set rack env as production
               ENV["RACK_ENV"] ||= options["rack_env"]
-              Mihari::App.run!(
+              Mihari::Web::App.run!(
                 port: options["port"],
                 host: options["host"],
                 threads: options["threads"],

data/lib/mihari/config.rb

@@ -1,178 +1,167 @@
-module Mihari
-  class Config
-    # @return [String, nil]
-    attr_reader :binaryedge_api_key
-
-    # @return [String, nil]
-    attr_reader :censys_id
-
-    # @return [String, nil]
-    attr_reader :censys_secret
-
-    # @return [String, nil]
-    attr_reader :circl_passive_password
-
-    # @return [String, nil]
-    attr_reader :circl_passive_username
-
-    # @return [URI]
-    attr_reader :database_url
-
-    # @return [String, nil]
-    attr_reader :greynoise_api_key
-
-    # @return [String, nil]
-    attr_reader :hunterhow_api_key
-
-    # @return [String, nil]
-    attr_reader :ipinfo_api_key
-
-    # @return [String, nil]
-    attr_reader :misp_url
-
-    # @return [String, nil]
-    attr_reader :misp_api_key
-
-    # @return [String, nil]
-    attr_reader :onyphe_api_key
-
-    # @return [String, nil]
-    attr_reader :otx_api_key
-
-    # @return [String, nil]
-    attr_reader :passivetotal_api_key
-
-    # @return [String, nil]
-    attr_reader :passivetotal_username
-
-    # @return [String, nil]
-    attr_reader :pulsedive_api_key
-
-    # @return [String, nil]
-    attr_reader :securitytrails_api_key
-
-    # @return [String, nil]
-    attr_reader :shodan_api_key
-
-    # @return [String, nil]
-    attr_reader :slack_channel
-
-    # @return [String, nil]
-    attr_reader :slack_webhook_url
-
-    # @return [String, nil]
-    attr_reader :thehive_url
+# frozen_string_literal: true
 
-    # @return [String, nil]
-    attr_reader :thehive_api_key
+require "anyway_config"
 
-    # @return [String, nil]
-    attr_reader :thehive_api_version
-
-    # @return [String, nil]
-    attr_reader :urlscan_api_key
-
-    # @return [String, nil]
-    attr_reader :virustotal_api_key
-
-    # @return [String, nil]
-    attr_reader :zoomeye_api_key
-
-    # @return [String, nil]
-    attr_reader :sentry_dsn
-
-    # @return [Boolean]
-    attr_accessor :hide_config_values
-
-    # @return [Integer]
-    attr_reader :retry_interval
-
-    # @return [Integer]
-    attr_reader :retry_times
-
-    # @return [Boolean]
-    attr_reader :retry_exponential_backoff
-
-    # @return [Integer]
-    attr_reader :pagination_interval
-
-    # @return [Integer]
-    attr_reader :pagination_limit
-
-    # @return [Boolean]
-    attr_reader :ignore_error
-
-    def initialize
-      load
-    end
-
-    def load
-      @binaryedge_api_key = ENV.fetch("BINARYEDGE_API_KEY", nil)
-
-      @censys_id = ENV.fetch("CENSYS_ID", nil)
-      @censys_secret = ENV.fetch("CENSYS_SECRET", nil)
-
-      @circl_passive_password = ENV.fetch("CIRCL_PASSIVE_PASSWORD", nil)
-      @circl_passive_username = ENV.fetch("CIRCL_PASSIVE_USERNAME", nil)
-
-      @database_url = URI(ENV.fetch("DATABASE_URL", "sqlite3:///mihari.db"))
-
-      @greynoise_api_key = ENV.fetch("GREYNOISE_API_KEY", nil)
-
-      @ipinfo_api_key = ENV.fetch("IPINFO_API_KEY", nil)
-
-      @hunterhow_api_key = ENV.fetch("HUNTERHOW_API_KEY", nil)
+module Mihari
+  class Config < Anyway::Config
+    config_name :mihari
+    env_prefix ""
+
+    attr_config(
+      # analyzers, emitters & enrichers
+      binaryedge_api_key: nil,
+      censys_id: nil,
+      censys_secret: nil,
+      circl_passive_password: nil,
+      circl_passive_username: nil,
+      database_url: URI("sqlite3:///mihari.db"),
+      fofa_api_key: nil,
+      fofa_email: nil,
+      greynoise_api_key: nil,
+      hunterhow_api_key: nil,
+      ipinfo_api_key: nil,
+      misp_api_key: nil,
+      misp_url: nil,
+      onyphe_api_key: nil,
+      otx_api_key: nil,
+      passivetotal_api_key: nil,
+      passivetotal_username: nil,
+      pulsedive_api_key: nil,
+      securitytrails_api_key: nil,
+      shodan_api_key: nil,
+      slack_channel: nil,
+      slack_webhook_url: nil,
+      thehive_api_key: nil,
+      thehive_api_version: nil,
+      thehive_url: nil,
+      urlscan_api_key: nil,
+      virustotal_api_key: nil,
+      zoomeye_api_key: nil,
+      # others
+      hide_config_values: true,
+      ignore_error: false,
+      pagination_interval: 0,
+      pagination_limit: 100,
+      retry_exponential_backoff: true,
+      retry_interval: 5,
+      retry_times: 3,
+      sentry_dsn: nil
+    )
+
+    # @!attribute [r] binaryedge_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] censys_id
+    #   @return [String, nil]
 
-      @misp_url = ENV.fetch("MISP_URL", nil)
-      @misp_api_key = ENV.fetch("MISP_API_KEY", nil)
+    # @!attribute [r] circl_passive_password
+    #   @return [String, nil]
+
+    # @!attribute [r] circl_passive_username
+    #   @return [String, nil]
+
+    # @!attribute [r] database_url
+    #   @return [String, nil]
+
+    # @!attribute [r] fofa_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] fofa_email
+    #   @return [String, nil]
+
+    # @!attribute [r] greynoise_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] hunterhow_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] ipinfo_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] misp_url
+    #   @return [String, nil]
+
+    # @!attribute [r] misp_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] onyphe_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] otx_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] passivetotal_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] passivetotal_username
+    #   @return [String, nil]
+
+    # @!attribute [r] pulsedive_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] securitytrails_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] shodan_api_key
+    #   @return [String, nil]
 
-      @onyphe_api_key = ENV.fetch("ONYPHE_API_KEY", nil)
+    # @!attribute [r] slack_channel
+    #   @return [String, nil]
+
+    # @!attribute [r] slack_webhook_url
+    #   @return [String, nil]
 
-      @otx_api_key = ENV.fetch("OTX_API_KEY", nil)
+    # @!attribute [r] thehive_url
+    #   @return [String, nil]
 
-      @passivetotal_api_key = ENV.fetch("PASSIVETOTAL_API_KEY", nil)
-      @passivetotal_username = ENV.fetch("PASSIVETOTAL_USERNAME", nil)
+    # @!attribute [r] thehive_api_key
+    #   @return [String, nil]
 
-      @pulsedive_api_key = ENV.fetch("PULSEDIVE_API_KEY", nil)
+    # @!attribute [r] thehive_api_version
+    #   @return [String, nil]
 
-      @securitytrails_api_key = ENV.fetch("SECURITYTRAILS_API_KEY", nil)
+    # @!attribute [r] urlscan_api_key
+    #   @return [String, nil]
 
-      @shodan_api_key = ENV.fetch("SHODAN_API_KEY", nil)
+    # @!attribute [r] virustotal_api_key
+    #   @return [String, nil]
 
-      @slack_channel = ENV.fetch("SLACK_CHANNEL", nil)
-      @slack_webhook_url = ENV.fetch("SLACK_WEBHOOK_URL", nil)
+    # @!attribute [r] zoomeye_api_key
+    #   @return [String, nil]
 
-      @thehive_url = ENV.fetch("THEHIVE_URL", nil)
-      @thehive_api_key = ENV.fetch("THEHIVE_API_KEY", nil)
-      @thehive_api_version = ENV.fetch("THEHIVE_API_VERSION", nil)
+    # @!attribute [r] sentry_dsn
+    #   @return [String, nil]
 
-      @urlscan_api_key = ENV.fetch("URLSCAN_API_KEY", nil)
+    # @!attribute [r] retry_interval
+    #   @return [Integer]
 
-      @virustotal_api_key = ENV.fetch("VIRUSTOTAL_API_KEY", nil)
+    # @!attribute [r] retry_times
+    #   @return [Integer]
 
-      @zoomeye_api_key = ENV.fetch("ZOOMEYE_API_KEY", nil)
+    # @!attribute [r] retry_exponential_backoff
+    #   @return [Boolean]
 
-      @sentry_dsn = ENV.fetch("SENTRY_DSN", nil)
+    # @!attribute [r] pagination_interval
+    #   @return [Integer]
 
-      @hide_config_values = ENV.fetch("HIDE_CONFIG_VALUES", true)
+    # @!attribute [r] pagination_limit
+    #   @return [Integer]
 
-      @retry_times = ENV.fetch("RETRY_TIMES", 3).to_i
-      @retry_interval = ENV.fetch("RETRY_INTERVAL", 5).to_i
-      @retry_exponential_backoff = ENV.fetch("RETRY_EXPONENTIAL_BACKOFF", true).to_s.downcase == "true"
+    # @!attribute [r] ignore_error
+    #   @return [Boolean]
 
-      @pagination_interval = ENV.fetch("PAGINATION_INTERVAL", 0).to_i
-      @pagination_limit = ENV.fetch("PAGINATION_LIMIT", 100).to_i
+    # @!attribute [rw] hide_config_values
+    #   @return [Boolean]
 
-      @ignore_error = ENV.fetch("IGNORE_ERROR", false)
+    def database_url=(val)
+      super URI(val.to_s)
     end
 
     #
     # @return [Array<String>]
     #
     def keys
-      instance_variables.map do |key|
-        key[1..].to_s.upcase
-      end
+      to_h.keys.map(&:to_s).map(&:upcase)
     end
   end
 end

data/lib/mihari/constants.rb

@@ -5,7 +5,7 @@ module Mihari
   DEFAULT_DATA_TYPES = Types::DataTypes.values.freeze
 
   # @return [Array<Hash>]
-  DEFAULT_EMITTERS = %w[database].map { |name| { emitter: name } }.freeze
+  DEFAULT_EMITTERS = Emitters::Database.class_keys.map { |name| { emitter: name } }.freeze
 
   # @return [Array<Hash>]
   DEFAULT_ENRICHERS = Mihari.enricher_to_class.keys.map { |name| { enricher: name.downcase } }.freeze