mihari 5.7.0 → 5.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f226f30917400448aecfc83808609ff3eb180228c2d10d797d3409cc3ecdb9c0
-  data.tar.gz: 5ce20637fed160cdecb7d8c22726b44670834843f2e77f5ef235f943a6321701
+  metadata.gz: 2d27340b82929d2a9dba6cab93c9e429112eed2f254f18595b765bd65852cdfa
+  data.tar.gz: 137141dad2d1b3c4f5b33a2ed38824a9e19c965c7d13e99d20358c2d546dd24c
 SHA512:
-  metadata.gz: 3900c2cc6a8ac2010b4579f574be0ce4d620a180dcfadf00c97b7597a7bccd79de9efdfdce402b40f06d7afeaaec0062210796391123e3a145f54d3be4270261
-  data.tar.gz: 7655638dd621bf03f0d9178eb2e0ca6bf4d161b6563c266380d3cc8bf37bef692bc06765ef3050aaf7683a0f1be2ca51d8a9d7e7c3f34a9e184389fcd31b2885
+  metadata.gz: 84825a14e57d1e740d7ee1e312ac23454017665b92dbdbe9fd2fe0cb55eb900addda0d9563049cf493094b67e9f1e5888d09fe37e7a102db5732f09837558fec
+  data.tar.gz: 393031f2550d7943271dd4b662c65b1da2df322661cdf1228808848e93f7bb7f65acaf8d1861599036bd951b464b5248f615e2abd738b171699eaf396b64f7c4

data/.rubocop.yml

@@ -3,7 +3,7 @@ Style/HashSyntax:
 Style/StringLiterals:
   EnforcedStyle: double_quotes
 Metrics/BlockLength:
-  Max: 100
+  Max: 150
   Exclude:
     - "spec/**/*"
     - "*.gemspec"

data/lib/mihari/actor.rb

@@ -2,9 +2,11 @@
 
 module Mihari
   #
-  # Base class for Analyzer, Emitter and Enricher
+  # Yet another base service class for Analyzer, Emitter and Enricher
   #
-  class Actor < Service
+  class Actor
+    include Dry::Monads[:result, :try]
+
     include Mixins::Configurable
     include Mixins::Retriable
 
@@ -57,13 +59,17 @@ module Mihari
       raise ConfigurationError, message
     end
 
-    def result
+    def call(*args, **kwargs)
+      raise NotImplementedError, "You must implement #{self.class}##{__method__}"
+    end
+
+    def result(...)
       Try[StandardError] do
         retry_on_error(
           times: retry_times,
           interval: retry_interval,
           exponential_backoff: retry_exponential_backoff
-        ) { call }
+        ) { call(...) }
       end.to_result
     end
 

data/lib/mihari/commands/alert.rb

@@ -17,11 +17,13 @@ module Mihari
             #
             def add(path)
               Mihari::Database.with_db_connection do
-                builder = Services::AlertBuilder.new(path)
-
-                runner_result_l = ->(proxy) { Services::AlertRunner.new(proxy).result }
-                result = builder.result.bind(runner_result_l)
+                result = Dry::Monads::Try[StandardError] do
+                  # @type [Mihari::Services::AlertProxy]
+                  proxy = Mihari::Services::AlertBuilder.call(path)
+                  Mihari::Services::AlertRunner.call(proxy)
+                end.to_result
 
+                # @type [Mihari::Models::Alert]
                 alert = result.value!
                 data = Entities::Alert.represent(alert)
                 puts JSON.pretty_generate(data.as_json)

data/lib/mihari/commands/search.rb

@@ -20,43 +20,24 @@ module Mihari
             #
             def search(path_or_id)
               Mihari::Database.with_db_connection do
-                builder = Services::RuleBuilder.new(path_or_id)
+                result = Dry::Monads::Try[StandardError] do
+                  # @type [Mihari::Rule]
+                  rule = Services::RuleBuilder.call(path_or_id)
 
-                check_diff_l = ->(rule) { check_diff rule }
-                update_and_call_l = ->(runner) { update_and_call runner }
+                  force_overwrite = options["force_overwrite"] || false
+                  message = "There is a diff in the rule. Are you sure you want to overwrite the rule? (y/n)"
+                  exit 0 if rule.diff? && !force_overwrite && !yes?(message)
 
-                result = builder.result.bind(check_diff_l).bind(update_and_call_l)
+                  rule.update_or_create
+                  rule.call
+                end.to_result
 
+                # @type [Mihari::Models::Alert]
                 alert = result.value!
                 data = Entities::Alert.represent(alert)
                 puts JSON.pretty_generate(data.as_json)
               end
             end
-
-            no_commands do
-              #
-              # @param [Mihari::RuleRunner] rule
-              #
-              def check_diff(rule)
-                force_overwrite = options["force_overwrite"] || false
-                message = "There is a diff in the rule. Are you sure you want to overwrite the rule? (y/n)"
-                runner = Services::RuleRunner.new(rule)
-
-                exit 0 if runner.diff? && !force_overwrite && !yes?(message)
-
-                Success runner
-              end
-
-              #
-              # @param [Mihari::RuleRunner] runner
-              #
-              def update_and_call(runner)
-                Dry::Monads::Try[StandardError] do
-                  runner.update_or_create
-                  runner.call
-                end.to_result
-              end
-            end
           end
         end
       end

data/lib/mihari/enrichers/ipinfo.rb

@@ -28,7 +28,7 @@ module Mihari
       #
       # @param [String] ip
       #
-      # @return [Mihari::Structs::IPInfo::Response, nil]
+      # @return [Mihari::Structs::IPInfo::Response]
       #
       def call(ip)
         url = "https://ipinfo.io/#{ip}/json"

data/lib/mihari/entities/tag.rb

@@ -3,6 +3,7 @@
 module Mihari
   module Entities
     class Tag < Grape::Entity
+      expose :id, documentation: { type: Integer, required: true }
       expose :name, documentation: { type: String, required: true }
     end
 

data/lib/mihari/rule.rb

@@ -218,6 +218,20 @@ module Mihari
       )
     end
 
+    #
+    # @return [Boolean]
+    #
+    def diff?
+      model = Mihari::Models::Rule.find(id)
+      model.data != data.deep_stringify_keys
+    rescue ActiveRecord::RecordNotFound
+      false
+    end
+
+    def update_or_create
+      model.save
+    end
+
     class << self
       #
       # Load rule from YAML string

data/lib/mihari/service.rb

@@ -9,8 +9,18 @@ module Mihari
       raise NotImplementedError, "You must implement #{self.class}##{__method__}"
     end
 
-    def result
-      Try[StandardError] { call }.to_result
+    def result(...)
+      Try[StandardError] { call(...) }.to_result
+    end
+
+    class << self
+      def call(...)
+        new.call(...)
+      end
+
+      def result(...)
+        new.result(...)
+      end
     end
   end
 end

data/lib/mihari/services/alert_builder.rb

@@ -9,23 +9,90 @@ require "yaml"
 module Mihari
   module Services
     #
-    # Alert builder
+    # Alert proxy
     #
-    class AlertBuilder < Service
-      # @return [String]
-      attr_reader :path
+    class AlertProxy
+      # @return [Hash]
+      attr_reader :data
+
+      # @return [Array, nil]
+      attr_reader :errors
 
       #
       # Initialize
       #
-      # @param [String] path
+      # @param [Hash] data
       #
-      def initialize(path)
+      def initialize(**data)
         super()
 
-        @path = path
+        @data = data.deep_symbolize_keys
+        @errors = nil
+
+        validate!
+      end
+
+      #
+      # @return [Boolean]
+      #
+      def errors?
+        return false if @errors.nil?
+
+        !@errors.empty?
+      end
+
+      def validate!
+        contract = Schemas::AlertContract.new
+        result = contract.call(data)
+
+        @data = result.to_h
+        @errors = result.errors
+
+        raise ValidationError.new("Validation failed", errors) if errors?
+      end
+
+      def [](key)
+        data key.to_sym
+      end
+
+      #
+      # @return [String]
+      #
+      def rule_id
+        @rule_id ||= data[:rule_id]
+      end
+
+      #
+      # @return [Array<Mihari::Models::Artifact>]
+      #
+      def artifacts
+        @artifacts ||= data[:artifacts].map do |data|
+          artifact = Models::Artifact.new(data: data)
+          artifact.rule_id = rule_id
+          artifact
+        end.uniq(&:data).select(&:valid?)
+      end
+
+      #
+      # @return [Mihari::Rule]
+      #
+      def rule
+        @rule ||= [].tap do |out|
+          data = Mihari::Models::Rule.find(rule_id).data
+          out << Rule.new(**data)
+        end.first
       end
+    end
+
+    #
+    # Alert builder
+    #
+    class AlertBuilder < Service
+      # @return [String]
+      attr_reader :path
 
+      #
+      # @param [String] path
       #
       # @return [Hash]
       #
@@ -38,7 +105,13 @@ module Mihari
         )
       end
 
-      def call
+      #
+      # @param [String] path
+      #
+      # @return [Mihari::AlertProxy]
+      #
+      def call(path)
+        @path = path
         AlertProxy.new(**data)
       end
     end

data/lib/mihari/services/alert_runner.rb

@@ -6,19 +6,12 @@ module Mihari
     # Alert runner
     #
     class AlertRunner < Service
-      # @return [Mihari::Services::AlertProxy]
-      attr_reader :alert
-
-      def initialize(alert)
-        super()
-
-        @alert = alert
-      end
-
+      #
+      # @param [Mihari::Services::AlertProxy] alert
       #
       # @return [Mihari::Models::Alert]
       #
-      def call
+      def call(alert)
         emitter = Emitters::Database.new(rule: alert.rule)
         emitter.call alert.artifacts
       end

data/lib/mihari/services/rule_builder.rb

@@ -14,17 +14,8 @@ module Mihari
       # @return [String]
       attr_reader :path_or_id
 
-      #
-      # Initialize
       #
       # @param [String] path_or_id
-      #
-      def initialize(path_or_id)
-        super()
-
-        @path_or_id = path_or_id
-      end
-
       #
       # @return [Hash]
       #
@@ -42,7 +33,14 @@ module Mihari
         )
       end
 
-      def call
+      #
+      # @param [String] path_or_id
+      #
+      # @return [Mihari::Rule]
+      #
+      def call(path_or_id)
+        @path_or_id = path_or_id
+
         Rule.new(**data)
       end
     end

data/lib/mihari/services/rule_runner.rb

@@ -6,35 +6,12 @@ module Mihari
     # Rule runner
     #
     class RuleRunner < Service
-      include Dry::Monads[:result, :try]
-
-      # @return [Mihari::Rule]
-      attr_reader :rule
-
-      def initialize(rule)
-        super()
-
-        @rule = rule
-      end
-
       #
-      # @return [Boolean]
-      #
-      def diff?
-        model = Mihari::Models::Rule.find(rule.id)
-        model.data != rule.data.deep_stringify_keys
-      rescue ActiveRecord::RecordNotFound
-        false
-      end
-
-      def update_or_create
-        rule.model.save
-      end
-
+      # @params [Mihari::Rule]
       #
       # @return [Mihari::Models::Alert, nil]
       #
-      def call
+      def call(rule)
         rule.call
       end
     end

data/lib/mihari/structs/binaryedge.rb

@@ -9,6 +9,9 @@ module Mihari
         attribute :ip, Types::String
 
         class << self
+          #
+          # @param [Hash] d
+          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -24,6 +27,9 @@ module Mihari
         attribute :target, Target
 
         class << self
+          #
+          # @param [Hash] d
+          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -58,6 +64,9 @@ module Mihari
         end
 
         class << self
+          #
+          # @param [Hash] d
+          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/censys.rb

@@ -21,8 +21,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [AutonomousSystem]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -59,8 +57,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Location]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -87,8 +83,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Service]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -143,8 +137,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Hit]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -171,8 +163,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Links]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -211,8 +201,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Result]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -242,8 +230,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/fofa.rb

@@ -27,6 +27,9 @@ module Mihari
         attribute? :results, Types.Array(Types.Array(Types::String)).optional
 
         class << self
+          #
+          # @param [Hash] d
+          #
           def from_dynamic!(d)
             new(
               error: d.fetch("error"),

data/lib/mihari/structs/google_public_dns.rb

@@ -28,8 +28,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Answer]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             resource_type = INT_TYPE_TO_TYPE[d.fetch("type")]
@@ -51,8 +49,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/greynoise.rb

@@ -39,8 +39,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Metadata]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -81,8 +79,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Datum]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -130,8 +126,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/hunterhow.rb

@@ -27,8 +27,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [ListItem]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -60,8 +58,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [DataClass]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -89,8 +85,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/ipinfo.rb

@@ -30,8 +30,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = d.deep_stringify_keys
             d = Types::Hash[d]

data/lib/mihari/structs/onyphe.rb

@@ -58,8 +58,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Result]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -113,8 +111,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/shodan.rb

@@ -221,8 +221,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [InternetDBResponse]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/urlscan.rb

@@ -20,8 +20,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Page]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -62,8 +60,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Result]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -96,8 +92,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/virustotal_intelligence.rb

@@ -12,8 +12,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [ContextAttributes]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(url: d["url"])
@@ -65,8 +63,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Datum]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
 
@@ -94,8 +90,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Meta]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -125,8 +119,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "5.7.0"
+  VERSION = "5.7.1"
 end