mihari 5.6.2 → 5.7.1

data/lib/mihari/config.rb

@@ -1,178 +1,167 @@
-module Mihari
-  class Config
-    # @return [String, nil]
-    attr_reader :binaryedge_api_key
-
-    # @return [String, nil]
-    attr_reader :censys_id
-
-    # @return [String, nil]
-    attr_reader :censys_secret
-
-    # @return [String, nil]
-    attr_reader :circl_passive_password
-
-    # @return [String, nil]
-    attr_reader :circl_passive_username
-
-    # @return [URI]
-    attr_reader :database_url
-
-    # @return [String, nil]
-    attr_reader :greynoise_api_key
-
-    # @return [String, nil]
-    attr_reader :hunterhow_api_key
-
-    # @return [String, nil]
-    attr_reader :ipinfo_api_key
-
-    # @return [String, nil]
-    attr_reader :misp_url
-
-    # @return [String, nil]
-    attr_reader :misp_api_key
-
-    # @return [String, nil]
-    attr_reader :onyphe_api_key
-
-    # @return [String, nil]
-    attr_reader :otx_api_key
-
-    # @return [String, nil]
-    attr_reader :passivetotal_api_key
-
-    # @return [String, nil]
-    attr_reader :passivetotal_username
-
-    # @return [String, nil]
-    attr_reader :pulsedive_api_key
-
-    # @return [String, nil]
-    attr_reader :securitytrails_api_key
-
-    # @return [String, nil]
-    attr_reader :shodan_api_key
-
-    # @return [String, nil]
-    attr_reader :slack_channel
-
-    # @return [String, nil]
-    attr_reader :slack_webhook_url
-
-    # @return [String, nil]
-    attr_reader :thehive_url
+# frozen_string_literal: true
 
-    # @return [String, nil]
-    attr_reader :thehive_api_key
+require "anyway_config"
 
-    # @return [String, nil]
-    attr_reader :thehive_api_version
-
-    # @return [String, nil]
-    attr_reader :urlscan_api_key
-
-    # @return [String, nil]
-    attr_reader :virustotal_api_key
-
-    # @return [String, nil]
-    attr_reader :zoomeye_api_key
-
-    # @return [String, nil]
-    attr_reader :sentry_dsn
-
-    # @return [Boolean]
-    attr_accessor :hide_config_values
-
-    # @return [Integer]
-    attr_reader :retry_interval
-
-    # @return [Integer]
-    attr_reader :retry_times
-
-    # @return [Boolean]
-    attr_reader :retry_exponential_backoff
-
-    # @return [Integer]
-    attr_reader :pagination_interval
-
-    # @return [Integer]
-    attr_reader :pagination_limit
-
-    # @return [Boolean]
-    attr_reader :ignore_error
-
-    def initialize
-      load
-    end
-
-    def load
-      @binaryedge_api_key = ENV.fetch("BINARYEDGE_API_KEY", nil)
-
-      @censys_id = ENV.fetch("CENSYS_ID", nil)
-      @censys_secret = ENV.fetch("CENSYS_SECRET", nil)
-
-      @circl_passive_password = ENV.fetch("CIRCL_PASSIVE_PASSWORD", nil)
-      @circl_passive_username = ENV.fetch("CIRCL_PASSIVE_USERNAME", nil)
-
-      @database_url = URI(ENV.fetch("DATABASE_URL", "sqlite3:///mihari.db"))
-
-      @greynoise_api_key = ENV.fetch("GREYNOISE_API_KEY", nil)
-
-      @ipinfo_api_key = ENV.fetch("IPINFO_API_KEY", nil)
-
-      @hunterhow_api_key = ENV.fetch("HUNTERHOW_API_KEY", nil)
+module Mihari
+  class Config < Anyway::Config
+    config_name :mihari
+    env_prefix ""
+
+    attr_config(
+      # analyzers, emitters & enrichers
+      binaryedge_api_key: nil,
+      censys_id: nil,
+      censys_secret: nil,
+      circl_passive_password: nil,
+      circl_passive_username: nil,
+      database_url: URI("sqlite3:///mihari.db"),
+      fofa_api_key: nil,
+      fofa_email: nil,
+      greynoise_api_key: nil,
+      hunterhow_api_key: nil,
+      ipinfo_api_key: nil,
+      misp_api_key: nil,
+      misp_url: nil,
+      onyphe_api_key: nil,
+      otx_api_key: nil,
+      passivetotal_api_key: nil,
+      passivetotal_username: nil,
+      pulsedive_api_key: nil,
+      securitytrails_api_key: nil,
+      shodan_api_key: nil,
+      slack_channel: nil,
+      slack_webhook_url: nil,
+      thehive_api_key: nil,
+      thehive_api_version: nil,
+      thehive_url: nil,
+      urlscan_api_key: nil,
+      virustotal_api_key: nil,
+      zoomeye_api_key: nil,
+      # others
+      hide_config_values: true,
+      ignore_error: false,
+      pagination_interval: 0,
+      pagination_limit: 100,
+      retry_exponential_backoff: true,
+      retry_interval: 5,
+      retry_times: 3,
+      sentry_dsn: nil
+    )
+
+    # @!attribute [r] binaryedge_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] censys_id
+    #   @return [String, nil]
 
-      @misp_url = ENV.fetch("MISP_URL", nil)
-      @misp_api_key = ENV.fetch("MISP_API_KEY", nil)
+    # @!attribute [r] circl_passive_password
+    #   @return [String, nil]
+
+    # @!attribute [r] circl_passive_username
+    #   @return [String, nil]
+
+    # @!attribute [r] database_url
+    #   @return [String, nil]
+
+    # @!attribute [r] fofa_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] fofa_email
+    #   @return [String, nil]
+
+    # @!attribute [r] greynoise_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] hunterhow_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] ipinfo_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] misp_url
+    #   @return [String, nil]
+
+    # @!attribute [r] misp_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] onyphe_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] otx_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] passivetotal_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] passivetotal_username
+    #   @return [String, nil]
+
+    # @!attribute [r] pulsedive_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] securitytrails_api_key
+    #   @return [String, nil]
+
+    # @!attribute [r] shodan_api_key
+    #   @return [String, nil]
 
-      @onyphe_api_key = ENV.fetch("ONYPHE_API_KEY", nil)
+    # @!attribute [r] slack_channel
+    #   @return [String, nil]
+
+    # @!attribute [r] slack_webhook_url
+    #   @return [String, nil]
 
-      @otx_api_key = ENV.fetch("OTX_API_KEY", nil)
+    # @!attribute [r] thehive_url
+    #   @return [String, nil]
 
-      @passivetotal_api_key = ENV.fetch("PASSIVETOTAL_API_KEY", nil)
-      @passivetotal_username = ENV.fetch("PASSIVETOTAL_USERNAME", nil)
+    # @!attribute [r] thehive_api_key
+    #   @return [String, nil]
 
-      @pulsedive_api_key = ENV.fetch("PULSEDIVE_API_KEY", nil)
+    # @!attribute [r] thehive_api_version
+    #   @return [String, nil]
 
-      @securitytrails_api_key = ENV.fetch("SECURITYTRAILS_API_KEY", nil)
+    # @!attribute [r] urlscan_api_key
+    #   @return [String, nil]
 
-      @shodan_api_key = ENV.fetch("SHODAN_API_KEY", nil)
+    # @!attribute [r] virustotal_api_key
+    #   @return [String, nil]
 
-      @slack_channel = ENV.fetch("SLACK_CHANNEL", nil)
-      @slack_webhook_url = ENV.fetch("SLACK_WEBHOOK_URL", nil)
+    # @!attribute [r] zoomeye_api_key
+    #   @return [String, nil]
 
-      @thehive_url = ENV.fetch("THEHIVE_URL", nil)
-      @thehive_api_key = ENV.fetch("THEHIVE_API_KEY", nil)
-      @thehive_api_version = ENV.fetch("THEHIVE_API_VERSION", nil)
+    # @!attribute [r] sentry_dsn
+    #   @return [String, nil]
 
-      @urlscan_api_key = ENV.fetch("URLSCAN_API_KEY", nil)
+    # @!attribute [r] retry_interval
+    #   @return [Integer]
 
-      @virustotal_api_key = ENV.fetch("VIRUSTOTAL_API_KEY", nil)
+    # @!attribute [r] retry_times
+    #   @return [Integer]
 
-      @zoomeye_api_key = ENV.fetch("ZOOMEYE_API_KEY", nil)
+    # @!attribute [r] retry_exponential_backoff
+    #   @return [Boolean]
 
-      @sentry_dsn = ENV.fetch("SENTRY_DSN", nil)
+    # @!attribute [r] pagination_interval
+    #   @return [Integer]
 
-      @hide_config_values = ENV.fetch("HIDE_CONFIG_VALUES", true)
+    # @!attribute [r] pagination_limit
+    #   @return [Integer]
 
-      @retry_times = ENV.fetch("RETRY_TIMES", 3).to_i
-      @retry_interval = ENV.fetch("RETRY_INTERVAL", 5).to_i
-      @retry_exponential_backoff = ENV.fetch("RETRY_EXPONENTIAL_BACKOFF", true).to_s.downcase == "true"
+    # @!attribute [r] ignore_error
+    #   @return [Boolean]
 
-      @pagination_interval = ENV.fetch("PAGINATION_INTERVAL", 0).to_i
-      @pagination_limit = ENV.fetch("PAGINATION_LIMIT", 100).to_i
+    # @!attribute [rw] hide_config_values
+    #   @return [Boolean]
 
-      @ignore_error = ENV.fetch("IGNORE_ERROR", false)
+    def database_url=(val)
+      super URI(val.to_s)
     end
 
     #
     # @return [Array<String>]
     #
     def keys
-      instance_variables.map do |key|
-        key[1..].to_s.upcase
-      end
+      to_h.keys.map(&:to_s).map(&:upcase)
     end
   end
 end

data/lib/mihari/constants.rb

@@ -5,7 +5,7 @@ module Mihari
   DEFAULT_DATA_TYPES = Types::DataTypes.values.freeze
 
   # @return [Array<Hash>]
-  DEFAULT_EMITTERS = %w[database].map { |name| { emitter: name } }.freeze
+  DEFAULT_EMITTERS = Emitters::Database.class_keys.map { |name| { emitter: name } }.freeze
 
   # @return [Array<Hash>]
   DEFAULT_ENRICHERS = Mihari.enricher_to_class.keys.map { |name| { enricher: name.downcase } }.freeze

data/lib/mihari/database.rb

@@ -13,6 +13,9 @@ def development_env?
   env == "development"
 end
 
+#
+# Mihari v5 DB schema
+#
 class V5Schema < ActiveRecord::Migration[7.1]
   def change
     create_table :rules, id: :string, if_not_exists: true do |t|
@@ -125,6 +128,9 @@ def schemas
 end
 
 module Mihari
+  #
+  # Database
+  #
   class Database
     class << self
       #

data/lib/mihari/emitters/base.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Emitters
+    #
+    # Base class for emitters
+    #
     class Base < Actor
       # @return [Mihari::Rule]
       attr_reader :rule
@@ -9,9 +12,8 @@ module Mihari
       #
       # @param [Mihari::Rule] rule
       # @param [Hash, nil] options
-      # @param [Hash] **_params
       #
-      def initialize(rule:, options: nil, **_params)
+      def initialize(rule:, options: nil)
         super(options: options)
 
         @rule = rule
@@ -20,23 +22,23 @@ module Mihari
       #
       # @param [Array<Mihari::Models::Artifact>] artifacts
       #
-      def emit_result(artifacts)
+      def call(artifacts)
+        raise NotImplementedError, "You must implement #{self.class}##{__method__}"
+      end
+
+      #
+      # @return [Dry::Monads::Result::Success<Object>, Dry::Monads::Result::Failure]
+      #
+      def result(artifacts)
         Try[StandardError] do
           retry_on_error(
             times: retry_times,
             interval: retry_interval,
             exponential_backoff: retry_exponential_backoff
-          ) { emit artifacts }
+          ) { call(artifacts) }
         end.to_result
       end
 
-      #
-      # @param [Array<Mihari::Models::Artifact>] artifacts
-      #
-      def emit(artifacts)
-        raise NotImplementedError, "You must implement #{self.class}##{__method__}"
-      end
-
       class << self
         def inherited(child)
           super

data/lib/mihari/emitters/database.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Emitters
+    #
+    # Database emitter
+    #
     class Database < Base
       #
       # Create an alert
@@ -10,7 +13,7 @@ module Mihari
       #
       # @return [Mihari::Models::Alert, nil]
       #
-      def emit(artifacts)
+      def call(artifacts)
         return if artifacts.empty?
 
         tags = rule.tags.filter_map { |name| Models::Tag.find_or_create_by(name: name) }.uniq

data/lib/mihari/emitters/misp.rb

@@ -2,6 +2,9 @@
 
 module Mihari
   module Emitters
+    #
+    # MISP emitter
+    #
     class MISP < Base
       # @return [String, nil]
       attr_reader :url
@@ -9,16 +12,16 @@ module Mihari
       # @return [String, nil]
       attr_reader :api_key
 
-      # @return [Mihari::Services::Rule]
+      # @return [Mihari::Rule]
       attr_reader :rule
 
       # @return [Array<Mihari::Models::Artifact>]
       attr_accessor :artifacts
 
       #
-      # @param [Mihari::Services::Rule] rule
+      # @param [Mihari::Rule] rule
       # @param [Hash, nil] options
-      # @param [Hash] **params
+      # @param [Hash, nil] params
       #
       def initialize(rule:, options: nil, **params)
         super(rule: rule, options: options)
@@ -41,7 +44,7 @@ module Mihari
       #
       # @param [Array<Mihari::Models::Artifact>] artifacts
       #
-      def emit(artifacts)
+      def call(artifacts)
         return if artifacts.empty?
 
         client.create_event({

data/lib/mihari/emitters/slack.rb

@@ -135,9 +135,9 @@ module Mihari
       attr_accessor :artifacts
 
       #
-      # @param [Mihari::Services::Rule] rule
+      # @param [Mihari::Rule] rule
       # @param [Hash, nil] options
-      # @param [Hash] **params
+      # @param [Hash, nil] params
       #
       def initialize(rule:, options: nil, **params)
         super(rule: rule, options: options)
@@ -216,7 +216,7 @@ module Mihari
       #
       # @param [Array<Mihari::Models::Artifact>] artifacts
       #
-      def emit(artifacts)
+      def call(artifacts)
         return if artifacts.empty?
 
         @artifacts = artifacts

data/lib/mihari/emitters/the_hive.rb

@@ -16,9 +16,9 @@ module Mihari
       attr_accessor :artifacts
 
       #
-      # @param [Mihari::Services::Rule] rule
+      # @param [Mihari::Rule] rule
       # @param [Hash, nil] options
-      # @param [Hash] **params
+      # @param [Hash] params
       #
       def initialize(rule:, options: nil, **params)
         super(rule: rule, options: options)
@@ -42,7 +42,7 @@ module Mihari
       #
       # @param [Array<Mihari::Models::Artifact>] artifacts
       #
-      def emit(artifacts)
+      def call(artifacts)
         return if artifacts.empty?
 
         @artifacts = artifacts

data/lib/mihari/emitters/webhook.rb

@@ -61,8 +61,9 @@ module Mihari
       attr_accessor :artifacts
 
       #
-      # @param [Mihari::Services::Rule] rule
-      # @param [Hash] **options
+      # @param [Mihari::Rule] rule
+      # @param [Hash, nil] options
+      # @param [Hash, nil] params
       #
       def initialize(rule:, options: nil, **params)
         super(rule: rule, options: options)
@@ -87,7 +88,7 @@ module Mihari
       #
       # @param [Array<Mihari::Models::Artifact>] artifacts
       #
-      def emit(artifacts)
+      def call(artifacts)
         return if artifacts.empty?
 
         @artifacts = artifacts

data/lib/mihari/enrichers/base.rb

@@ -2,28 +2,34 @@
 
 module Mihari
   module Enrichers
+    #
+    # Base class for enrichers
+    #
     class Base < Actor
       def initialize(options: nil)
         super(options: options)
       end
 
-      def query_result(value)
+      #
+      # @param [String] value
+      #
+      def call(value)
+        raise NotImplementedError, "You must implement #{self.class}##{__method__}"
+      end
+
+      #
+      # @return [Dry::Monads::Result::Success<Object>, Dry::Monads::Result::Failure]
+      #
+      def result(value)
         Try[StandardError] do
           retry_on_error(
             times: retry_times,
             interval: retry_interval,
             exponential_backoff: retry_exponential_backoff
-          ) { query value }
+          ) { call value }
         end.to_result
       end
 
-      #
-      # @param [String] value
-      #
-      def query(value)
-        raise NotImplementedError, "You must implement #{self.class}##{__method__}"
-      end
-
       class << self
         def inherited(child)
           super

data/lib/mihari/enrichers/google_public_dns.rb

@@ -1,18 +1,19 @@
 # frozen_string_literal: true
 
-require "net/https"
-
 module Mihari
   module Enrichers
+    #
+    # Google Public DNS enricher
+    #
     class GooglePublicDNS < Base
       #
       # Query Google Public DNS
       #
       # @param [String] name
       #
-      # @return [Array<Mihari::Structs::Shodan::GooglePublicDNS::Response>]
+      # @return [Array<Mihari::Structs::GooglePublicDNS::Response>]
       #
-      def query(name)
+      def call(name)
         %w[A AAAA CNAME TXT NS].filter_map do |resource_type|
           query_by_type(name, resource_type)
         end
@@ -24,7 +25,7 @@ module Mihari
       # @param [String] name
       # @param [String] resource_type
       #
-      # @return [Mihari::Structs::Shodan::GooglePublicDNS::Response, nil]
+      # @return [Mihari::Structs::GooglePublicDNS::Response, nil]
       #
       def query_by_type(name, resource_type)
         url = "https://dns.google/resolve"

data/lib/mihari/enrichers/ipinfo.rb

@@ -1,23 +1,24 @@
 # frozen_string_literal: true
 
-require "net/https"
-
 module Mihari
   module Enrichers
+    #
+    # IPInfo enricher
+    #
     class IPInfo < Base
-      include Memist::Memoizable
-
       # @return [String, nil]
       attr_reader :api_key
 
+      #
+      # @param [Hash, nil] options
+      # @param [String, nil] api_key
+      #
       def initialize(options: nil, api_key: nil)
         @api_key = api_key || Mihari.config.ipinfo_api_key
 
         super(options: options)
       end
 
-      private
-
       def configuration_keys
         %w[ipinfo_api_key]
       end
@@ -27,16 +28,17 @@ module Mihari
       #
       # @param [String] ip
       #
-      # @return [Mihari::Structs::IPInfo::Response, nil]
+      # @return [Mihari::Structs::IPInfo::Response]
       #
-      def query(ip)
+      def call(ip)
         url = "https://ipinfo.io/#{ip}/json"
         res = http.get(url)
         data = JSON.parse(res.body.to_s)
 
         Structs::IPInfo::Response.from_dynamic! data
       end
-      memoize :query
+
+      private
 
       def headers
         authorization = api_key.nil? ? nil : "Bearer #{api_key}"

data/lib/mihari/enrichers/shodan.rb

@@ -1,12 +1,11 @@
 # frozen_string_literal: true
 
-require "net/https"
-
 module Mihari
   module Enrichers
+    #
+    # Shodan enricher
+    #
     class Shodan < Base
-      include Memist::Memoizable
-
       #
       # Query Shodan Internet DB
       #
@@ -14,14 +13,13 @@ module Mihari
       #
       # @return [Mihari::Structs::Shodan::InternetDBResponse, nil]
       #
-      def query(ip)
+      def call(ip)
         url = "https://internetdb.shodan.io/#{ip}"
         res = http.get(url)
         data = JSON.parse(res.body.to_s)
 
         Structs::Shodan::InternetDBResponse.from_dynamic! data
       end
-      memoize :query
 
       private