mihari 5.6.2 → 5.7.0

data/lib/mihari/database.rb

@@ -13,6 +13,9 @@ def development_env?
   env == "development"
 end
 
+#
+# Mihari v5 DB schema
+#
 class V5Schema < ActiveRecord::Migration[7.1]
   def change
     create_table :rules, id: :string, if_not_exists: true do |t|
@@ -125,6 +128,9 @@ def schemas
 end
 
 module Mihari
+  #
+  # Database
+  #
   class Database
     class << self
       #

data/lib/mihari/emitters/base.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Emitters
+    #
+    # Base class for emitters
+    #
     class Base < Actor
       # @return [Mihari::Rule]
       attr_reader :rule
@@ -9,9 +12,8 @@ module Mihari
       #
       # @param [Mihari::Rule] rule
       # @param [Hash, nil] options
-      # @param [Hash] **_params
       #
-      def initialize(rule:, options: nil, **_params)
+      def initialize(rule:, options: nil)
         super(options: options)
 
         @rule = rule
@@ -20,23 +22,23 @@ module Mihari
       #
       # @param [Array<Mihari::Models::Artifact>] artifacts
       #
-      def emit_result(artifacts)
+      def call(artifacts)
+        raise NotImplementedError, "You must implement #{self.class}##{__method__}"
+      end
+
+      #
+      # @return [Dry::Monads::Result::Success<Object>, Dry::Monads::Result::Failure]
+      #
+      def result(artifacts)
         Try[StandardError] do
           retry_on_error(
             times: retry_times,
             interval: retry_interval,
             exponential_backoff: retry_exponential_backoff
-          ) { emit artifacts }
+          ) { call(artifacts) }
         end.to_result
       end
 
-      #
-      # @param [Array<Mihari::Models::Artifact>] artifacts
-      #
-      def emit(artifacts)
-        raise NotImplementedError, "You must implement #{self.class}##{__method__}"
-      end
-
       class << self
         def inherited(child)
           super

data/lib/mihari/emitters/database.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Emitters
+    #
+    # Database emitter
+    #
     class Database < Base
       #
       # Create an alert
@@ -10,7 +13,7 @@ module Mihari
       #
       # @return [Mihari::Models::Alert, nil]
       #
-      def emit(artifacts)
+      def call(artifacts)
         return if artifacts.empty?
 
         tags = rule.tags.filter_map { |name| Models::Tag.find_or_create_by(name: name) }.uniq

data/lib/mihari/emitters/misp.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Emitters
+    #
+    # MISP emitter
+    #
     class MISP < Base
       # @return [String, nil]
       attr_reader :url
@@ -9,16 +12,16 @@ module Mihari
       # @return [String, nil]
       attr_reader :api_key
 
-      # @return [Mihari::Services::Rule]
+      # @return [Mihari::Rule]
       attr_reader :rule
 
       # @return [Array<Mihari::Models::Artifact>]
       attr_accessor :artifacts
 
       #
-      # @param [Mihari::Services::Rule] rule
+      # @param [Mihari::Rule] rule
       # @param [Hash, nil] options
-      # @param [Hash] **params
+      # @param [Hash, nil] params
       #
       def initialize(rule:, options: nil, **params)
         super(rule: rule, options: options)
@@ -41,7 +44,7 @@ module Mihari
       #
       # @param [Array<Mihari::Models::Artifact>] artifacts
       #
-      def emit(artifacts)
+      def call(artifacts)
         return if artifacts.empty?
 
         client.create_event({

data/lib/mihari/emitters/slack.rb

@@ -135,9 +135,9 @@ module Mihari
       attr_accessor :artifacts
 
       #
-      # @param [Mihari::Services::Rule] rule
+      # @param [Mihari::Rule] rule
       # @param [Hash, nil] options
-      # @param [Hash] **params
+      # @param [Hash, nil] params
       #
       def initialize(rule:, options: nil, **params)
         super(rule: rule, options: options)
@@ -216,7 +216,7 @@ module Mihari
       #
       # @param [Array<Mihari::Models::Artifact>] artifacts
       #
-      def emit(artifacts)
+      def call(artifacts)
         return if artifacts.empty?
 
         @artifacts = artifacts

data/lib/mihari/emitters/the_hive.rb

@@ -16,9 +16,9 @@ module Mihari
       attr_accessor :artifacts
 
       #
-      # @param [Mihari::Services::Rule] rule
+      # @param [Mihari::Rule] rule
       # @param [Hash, nil] options
-      # @param [Hash] **params
+      # @param [Hash] params
       #
       def initialize(rule:, options: nil, **params)
         super(rule: rule, options: options)
@@ -42,7 +42,7 @@ module Mihari
       #
       # @param [Array<Mihari::Models::Artifact>] artifacts
       #
-      def emit(artifacts)
+      def call(artifacts)
         return if artifacts.empty?
 
         @artifacts = artifacts

data/lib/mihari/emitters/webhook.rb

@@ -61,8 +61,9 @@ module Mihari
       attr_accessor :artifacts
 
       #
-      # @param [Mihari::Services::Rule] rule
-      # @param [Hash] **options
+      # @param [Mihari::Rule] rule
+      # @param [Hash, nil] options
+      # @param [Hash, nil] params
       #
       def initialize(rule:, options: nil, **params)
         super(rule: rule, options: options)
@@ -87,7 +88,7 @@ module Mihari
       #
       # @param [Array<Mihari::Models::Artifact>] artifacts
       #
-      def emit(artifacts)
+      def call(artifacts)
         return if artifacts.empty?
 
         @artifacts = artifacts

data/lib/mihari/enrichers/base.rb

@@ -2,28 +2,34 @@
 
 module Mihari
   module Enrichers
+    #
+    # Base class for enrichers
+    #
     class Base < Actor
       def initialize(options: nil)
         super(options: options)
       end
 
-      def query_result(value)
+      #
+      # @param [String] value
+      #
+      def call(value)
+        raise NotImplementedError, "You must implement #{self.class}##{__method__}"
+      end
+
+      #
+      # @return [Dry::Monads::Result::Success<Object>, Dry::Monads::Result::Failure]
+      #
+      def result(value)
         Try[StandardError] do
           retry_on_error(
             times: retry_times,
             interval: retry_interval,
             exponential_backoff: retry_exponential_backoff
-          ) { query value }
+          ) { call value }
         end.to_result
       end
 
-      #
-      # @param [String] value
-      #
-      def query(value)
-        raise NotImplementedError, "You must implement #{self.class}##{__method__}"
-      end
-
       class << self
         def inherited(child)
           super

data/lib/mihari/enrichers/google_public_dns.rb

@@ -1,18 +1,19 @@
 # frozen_string_literal: true
 
-require "net/https"
-
 module Mihari
   module Enrichers
+    #
+    # Google Public DNS enricher
+    #
     class GooglePublicDNS < Base
       #
       # Query Google Public DNS
       #
       # @param [String] name
       #
-      # @return [Array<Mihari::Structs::Shodan::GooglePublicDNS::Response>]
+      # @return [Array<Mihari::Structs::GooglePublicDNS::Response>]
       #
-      def query(name)
+      def call(name)
         %w[A AAAA CNAME TXT NS].filter_map do |resource_type|
           query_by_type(name, resource_type)
         end
@@ -24,7 +25,7 @@ module Mihari
       # @param [String] name
       # @param [String] resource_type
       #
-      # @return [Mihari::Structs::Shodan::GooglePublicDNS::Response, nil]
+      # @return [Mihari::Structs::GooglePublicDNS::Response, nil]
       #
       def query_by_type(name, resource_type)
         url = "https://dns.google/resolve"

data/lib/mihari/enrichers/ipinfo.rb

@@ -1,23 +1,24 @@
 # frozen_string_literal: true
 
-require "net/https"
-
 module Mihari
   module Enrichers
+    #
+    # IPInfo enricher
+    #
     class IPInfo < Base
-      include Memist::Memoizable
-
       # @return [String, nil]
       attr_reader :api_key
 
+      #
+      # @param [Hash, nil] options
+      # @param [String, nil] api_key
+      #
       def initialize(options: nil, api_key: nil)
         @api_key = api_key || Mihari.config.ipinfo_api_key
 
         super(options: options)
       end
 
-      private
-
       def configuration_keys
         %w[ipinfo_api_key]
       end
@@ -29,14 +30,15 @@ module Mihari
       #
       # @return [Mihari::Structs::IPInfo::Response, nil]
       #
-      def query(ip)
+      def call(ip)
         url = "https://ipinfo.io/#{ip}/json"
         res = http.get(url)
         data = JSON.parse(res.body.to_s)
 
         Structs::IPInfo::Response.from_dynamic! data
       end
-      memoize :query
+
+      private
 
       def headers
         authorization = api_key.nil? ? nil : "Bearer #{api_key}"

data/lib/mihari/enrichers/shodan.rb

@@ -1,12 +1,11 @@
 # frozen_string_literal: true
 
-require "net/https"
-
 module Mihari
   module Enrichers
+    #
+    # Shodan enricher
+    #
     class Shodan < Base
-      include Memist::Memoizable
-
       #
       # Query Shodan Internet DB
       #
@@ -14,14 +13,13 @@ module Mihari
       #
       # @return [Mihari::Structs::Shodan::InternetDBResponse, nil]
       #
-      def query(ip)
+      def call(ip)
         url = "https://internetdb.shodan.io/#{ip}"
         res = http.get(url)
         data = JSON.parse(res.body.to_s)
 
         Structs::Shodan::InternetDBResponse.from_dynamic! data
       end
-      memoize :query
 
       private
 

data/lib/mihari/enrichers/whois.rb

@@ -4,6 +4,9 @@ require "whois-parser"
 
 module Mihari
   module Enrichers
+    #
+    # Whois enricher
+    #
     class Whois < Base
       # @return [Hash]
       attr_accessor :memo
@@ -20,11 +23,11 @@ module Mihari
       #
       # Query IAIA Whois API
       #
-      # @param [String] name
+      # @param [String] domain
       #
-      # @return [Mihari::WhoisRecord, nil]
+      # @return [Mihari::Models::WhoisRecord, nil]
       #
-      def query(domain)
+      def call(domain)
         domain = PublicSuffix.domain(domain)
 
         # check memo
@@ -71,7 +74,7 @@ module Mihari
       #
       # Get created_on
       #
-      # @param [::Whois::Parser:] parser
+      # @param [::Whois::Parser] parser
       #
       # @return [Date, nil]
       #
@@ -84,7 +87,7 @@ module Mihari
       #
       # Get updated_on
       #
-      # @param [::Whois::Parser:] parser
+      # @param [::Whois::Parser] parser
       #
       # @return [Date, nil]
       #
@@ -97,7 +100,7 @@ module Mihari
       #
       # Get expires_on
       #
-      # @param [::Whois::Parser:] parser
+      # @param [::Whois::Parser] parser
       #
       # @return [Date, nil]
       #
@@ -110,7 +113,7 @@ module Mihari
       #
       # Get registrar
       #
-      # @param [::Whois::Parser:] parser
+      # @param [::Whois::Parser] parser
       #
       # @return [Hash, nil]
       #
@@ -123,9 +126,9 @@ module Mihari
       #
       # Get contacts
       #
-      # @param [::Whois::Parser:] parser
+      # @param [::Whois::Parser] parser
       #
-      # @return [Array[Hash], nil]
+      # @return [Array<Hash>, nil]
       #
       def get_contacts(parser)
         parser.contacts.map(&:to_h)

data/lib/mihari/errors.rb

@@ -20,6 +20,9 @@ module Mihari
 
   class TimeoutError < HTTPError; end
 
+  #
+  # HTTP status code error
+  #
   class StatusCodeError < HTTPError
     # @return [Integer]
     attr_reader :status_code
@@ -40,6 +43,9 @@ module Mihari
     end
   end
 
+  #
+  # (dry-schema) Schema validation error
+  #
   class ValidationError < Error
     attr_reader :errors
 

data/lib/mihari/feed/parser.rb

@@ -4,6 +4,9 @@ require "jr/cli/core_ext"
 
 module Mihari
   module Feed
+    #
+    # Feed parser
+    #
     class Parser
       # @return [Array<Hash>, Array<Array<String>>]
       attr_reader :data

data/lib/mihari/feed/reader.rb

@@ -4,6 +4,9 @@ require "csv"
 
 module Mihari
   module Feed
+    #
+    # Feed reader
+    #
     class Reader
       # @return [String]
       attr_reader :url

data/lib/mihari/http.rb

@@ -4,6 +4,9 @@ require "http"
 
 module Mihari
   module HTTP
+    #
+    # Better error handling feature
+    #
     class BetterError < ::HTTP::Feature
       def wrap_response(response)
         unless response.status.success?
@@ -24,6 +27,9 @@ module Mihari
       ::HTTP::Options.register_feature(:better_error, self)
     end
 
+    #
+    # HTTP client factory
+    #
     class Factory
       class << self
         #

data/lib/mihari/mixins/autonomous_system.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Mixins
+    #
+    # Autonomous System mixin
+    #
     module AutonomousSystem
       #
       # Normalize ASN value

data/lib/mihari/mixins/configurable.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Mixins
+    #
+    # Configurable mixin
+    #
     module Configurable
       #
       # Check whether there are configuration key-values or not

data/lib/mihari/mixins/error_notification.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Mixins
+    #
+    # Error notification mixin
+    #
     module ErrorNotification
       #
       # Send an exception notification if there is any error in a block

data/lib/mihari/mixins/falsepositive.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Mixins
+    #
+    # False positive mixins
+    #
     module FalsePositive
       include Memist::Memoizable
 

data/lib/mihari/mixins/refang.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Mixins
+    #
+    # Refang mixin
+    #
     module Refang
       #
       # Refang defanged indicator

data/lib/mihari/mixins/retriable.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Mixins
+    #
+    # Retriable mixin
+    #
     module Retriable
       DEFAULT_ON = [
         Errno::ECONNRESET,
@@ -11,8 +14,9 @@ module Mihari
         Timeout::Error,
         RetryableError,
         NetworkError,
-        TimeoutError
-      ]
+        TimeoutError,
+        StatusCodeError
+      ].freeze
 
       #
       # Retry on error

data/lib/mihari/models/alert.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Models
+    #
+    # Alert model
+    #
     class Alert < ActiveRecord::Base
       has_many :taggings, dependent: :destroy
       has_many :artifacts, dependent: :destroy
@@ -13,7 +16,7 @@ module Mihari
         #
         # Search alerts
         #
-        # @param [Structs::Filters::Alert::SearchFilterWithPagination] filter
+        # @param [Mihari::Structs::Filters::Alert::SearchFilterWithPagination] filter
         #
         # @return [Array<Alert>]
         #
@@ -35,7 +38,7 @@ module Mihari
         #
         # Count alerts
         #
-        # @param [String, nil] artifact_data
+        # @param [Mihari::Structs::Filters::Alert::SearchFilter] filter
         #
         # @return [Integer]
         #
@@ -47,7 +50,7 @@ module Mihari
         private
 
         #
-        # @param [Structs::Filters::Alert::SearchFilter] filter
+        # @param [Mihari::Structs::Filters::Alert::SearchFilter] filter
         #
         # @return [Array<Integer>]
         #
@@ -65,7 +68,7 @@ module Mihari
         end
 
         #
-        # @param [Structs::Filters::Alert::SearchFilter] filter
+        # @param [Mihari::Structs::Filters::Alert::SearchFilter] filter
         #
         # @return [Mihari::Models::Alert]
         #

data/lib/mihari/models/artifact.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Models
+    #
+    # Artifact validator
+    #
     class ArtifactValidator < ActiveModel::Validator
       def validate(record)
         return if record.data_type
@@ -10,6 +13,9 @@ module Mihari
       end
     end
 
+    #
+    # Artifact model
+    #
     class Artifact < ActiveRecord::Base
       belongs_to :alert
 

data/lib/mihari/models/autonomous_system.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Models
+    #
+    # AS model
+    #
     class AutonomousSystem < ActiveRecord::Base
       belongs_to :artifact
 
@@ -17,7 +20,7 @@ module Mihari
         # @return [Mihari::AutonomousSystem, nil]
         #
         def build_by_ip(ip, enricher: Enrichers::IPInfo.new)
-          result = enricher.query_result(ip).bind do |res|
+          result = enricher.result(ip).bind do |res|
             value = res&.asn
             if value.nil?
               Success nil

data/lib/mihari/models/cpe.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Models
+    #
+    # CPE model
+    #
     class CPE < ActiveRecord::Base
       belongs_to :artifact
 
@@ -17,7 +20,7 @@ module Mihari
         # @return [Array<Mihari::CPE>]
         #
         def build_by_ip(ip, enricher: Enrichers::Shodan.new)
-          result = enricher.query_result(ip).bind do |res|
+          result = enricher.result(ip).bind do |res|
             if res.nil?
               Success []
             else

data/lib/mihari/models/dns.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Models
+    #
+    # DNS record model
+    #
     class DnsRecord < ActiveRecord::Base
       belongs_to :artifact
 
@@ -17,7 +20,7 @@ module Mihari
         # @return [Array<Mihari::Models::DnsRecord>]
         #
         def build_by_domain(domain, enricher: Enrichers::GooglePublicDNS.new)
-          result = enricher.query_result(domain).bind do |responses|
+          result = enricher.result(domain).bind do |responses|
             Success(
               responses.map do |res|
                 res.answers.map do |answer|