mihari 5.7.0 → 5.7.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (164) hide show
  1. checksums.yaml +4 -4
  2. data/.rubocop.yml +1 -1
  3. data/lib/mihari/actor.rb +10 -4
  4. data/lib/mihari/commands/alert.rb +6 -4
  5. data/lib/mihari/commands/search.rb +10 -29
  6. data/lib/mihari/enrichers/ipinfo.rb +1 -1
  7. data/lib/mihari/entities/tag.rb +1 -0
  8. data/lib/mihari/rule.rb +14 -0
  9. data/lib/mihari/service.rb +12 -2
  10. data/lib/mihari/services/alert_builder.rb +81 -8
  11. data/lib/mihari/services/alert_runner.rb +3 -10
  12. data/lib/mihari/services/rule_builder.rb +8 -10
  13. data/lib/mihari/services/rule_runner.rb +2 -25
  14. data/lib/mihari/structs/binaryedge.rb +9 -0
  15. data/lib/mihari/structs/censys.rb +0 -14
  16. data/lib/mihari/structs/fofa.rb +3 -0
  17. data/lib/mihari/structs/google_public_dns.rb +0 -4
  18. data/lib/mihari/structs/greynoise.rb +0 -6
  19. data/lib/mihari/structs/hunterhow.rb +0 -6
  20. data/lib/mihari/structs/ipinfo.rb +0 -2
  21. data/lib/mihari/structs/onyphe.rb +0 -4
  22. data/lib/mihari/structs/shodan.rb +0 -2
  23. data/lib/mihari/structs/urlscan.rb +0 -6
  24. data/lib/mihari/structs/virustotal_intelligence.rb +0 -8
  25. data/lib/mihari/version.rb +1 -1
  26. data/lib/mihari/web/app.rb +20 -17
  27. data/lib/mihari/web/endpoints/alerts.rb +75 -38
  28. data/lib/mihari/web/endpoints/artifacts.rb +60 -53
  29. data/lib/mihari/web/endpoints/ip_addresses.rb +19 -4
  30. data/lib/mihari/web/endpoints/rules.rb +132 -88
  31. data/lib/mihari/web/endpoints/tags.rb +15 -13
  32. data/lib/mihari/web/public/assets/{index-821134e2.js → index-07fafab5.js} +4 -3
  33. data/lib/mihari/web/public/index.html +1 -1
  34. data/lib/mihari.rb +0 -1
  35. data/mihari.gemspec +1 -1
  36. data/mkdocs.yml +1 -0
  37. metadata +3 -130
  38. data/docs/alternatives.md +0 -5
  39. data/docs/analyzers/binaryedge.md +0 -26
  40. data/docs/analyzers/censys.md +0 -31
  41. data/docs/analyzers/circl.md +0 -37
  42. data/docs/analyzers/crtsh.md +0 -26
  43. data/docs/analyzers/dnstwister.md +0 -25
  44. data/docs/analyzers/feed.md +0 -73
  45. data/docs/analyzers/fofa.md +0 -31
  46. data/docs/analyzers/greynoise.md +0 -26
  47. data/docs/analyzers/hunterhow.md +0 -33
  48. data/docs/analyzers/index.md +0 -104
  49. data/docs/analyzers/onyphe.md +0 -26
  50. data/docs/analyzers/otx.md +0 -28
  51. data/docs/analyzers/passivetotal.md +0 -52
  52. data/docs/analyzers/pulsedive.md +0 -28
  53. data/docs/analyzers/securitytrails.md +0 -41
  54. data/docs/analyzers/shodan.md +0 -26
  55. data/docs/analyzers/urlscan.md +0 -28
  56. data/docs/analyzers/virustotal.md +0 -43
  57. data/docs/analyzers/virustotal_intelligence.md +0 -33
  58. data/docs/analyzers/zoomeye.md +0 -38
  59. data/docs/configuration.md +0 -35
  60. data/docs/emitters/database.md +0 -22
  61. data/docs/emitters/hive.md +0 -26
  62. data/docs/emitters/index.md +0 -36
  63. data/docs/emitters/misp.md +0 -21
  64. data/docs/emitters/slack.md +0 -21
  65. data/docs/emitters/webhook.md +0 -63
  66. data/docs/enrichers/google_public_dns.md +0 -19
  67. data/docs/enrichers/index.md +0 -35
  68. data/docs/enrichers/ipinfo.md +0 -26
  69. data/docs/enrichers/shodan.md +0 -22
  70. data/docs/enrichers/whois.md +0 -17
  71. data/docs/github_actions.md +0 -43
  72. data/docs/index.md +0 -11
  73. data/docs/installation.md +0 -31
  74. data/docs/requirements.md +0 -13
  75. data/docs/rule.md +0 -168
  76. data/docs/tags.md +0 -3
  77. data/docs/usage.md +0 -103
  78. data/frontend/.eslintrc.cjs +0 -22
  79. data/frontend/.gitignore +0 -31
  80. data/frontend/.prettierrc.json +0 -8
  81. data/frontend/README.md +0 -3
  82. data/frontend/env.d.ts +0 -5
  83. data/frontend/index.html +0 -21
  84. data/frontend/package-lock.json +0 -7219
  85. data/frontend/package.json +0 -67
  86. data/frontend/public/favicon.ico +0 -0
  87. data/frontend/scripts/swagger_doc_to_yaml.rb +0 -23
  88. data/frontend/src/App.vue +0 -27
  89. data/frontend/src/ace-config.ts +0 -6
  90. data/frontend/src/api-helper.ts +0 -111
  91. data/frontend/src/api.ts +0 -105
  92. data/frontend/src/components/ErrorMessage.vue +0 -31
  93. data/frontend/src/components/Loading.vue +0 -15
  94. data/frontend/src/components/Navbar.vue +0 -42
  95. data/frontend/src/components/Pagination.vue +0 -119
  96. data/frontend/src/components/alert/Alert.vue +0 -87
  97. data/frontend/src/components/alert/Alerts.vue +0 -63
  98. data/frontend/src/components/alert/AlertsWithPagination.vue +0 -90
  99. data/frontend/src/components/alert/AlertsWrapper.vue +0 -128
  100. data/frontend/src/components/alert/Form.vue +0 -169
  101. data/frontend/src/components/artifact/AS.vue +0 -23
  102. data/frontend/src/components/artifact/Artifact.vue +0 -287
  103. data/frontend/src/components/artifact/ArtifactTag.vue +0 -64
  104. data/frontend/src/components/artifact/ArtifactTags.vue +0 -29
  105. data/frontend/src/components/artifact/ArtifactWrapper.vue +0 -57
  106. data/frontend/src/components/artifact/CPEs.vue +0 -23
  107. data/frontend/src/components/artifact/DnsRecords.vue +0 -32
  108. data/frontend/src/components/artifact/Ports.vue +0 -23
  109. data/frontend/src/components/artifact/ReverseDnsNames.vue +0 -23
  110. data/frontend/src/components/artifact/Tags.vue +0 -29
  111. data/frontend/src/components/artifact/WhoisRecord.vue +0 -44
  112. data/frontend/src/components/config/Configs.vue +0 -65
  113. data/frontend/src/components/config/ConfigsWrapper.vue +0 -32
  114. data/frontend/src/components/link/Link.vue +0 -32
  115. data/frontend/src/components/link/Links.vue +0 -42
  116. data/frontend/src/components/rule/EditRule.vue +0 -72
  117. data/frontend/src/components/rule/EditRuleWrapper.vue +0 -48
  118. data/frontend/src/components/rule/Form.vue +0 -158
  119. data/frontend/src/components/rule/InputForm.vue +0 -45
  120. data/frontend/src/components/rule/NewRule.vue +0 -57
  121. data/frontend/src/components/rule/Rule.vue +0 -100
  122. data/frontend/src/components/rule/RuleWrapper.vue +0 -53
  123. data/frontend/src/components/rule/Rules.vue +0 -84
  124. data/frontend/src/components/rule/RulesWrapper.vue +0 -121
  125. data/frontend/src/components/rule/YAML.vue +0 -37
  126. data/frontend/src/components/tag/Tag.vue +0 -65
  127. data/frontend/src/components/tag/Tags.vue +0 -37
  128. data/frontend/src/countries.ts +0 -350
  129. data/frontend/src/index.ts +0 -20
  130. data/frontend/src/links/anyrun.ts +0 -19
  131. data/frontend/src/links/base.ts +0 -14
  132. data/frontend/src/links/censys.ts +0 -20
  133. data/frontend/src/links/crtsh.ts +0 -20
  134. data/frontend/src/links/dnslytics.ts +0 -38
  135. data/frontend/src/links/greynoise.ts +0 -20
  136. data/frontend/src/links/index.ts +0 -40
  137. data/frontend/src/links/intezer.ts +0 -20
  138. data/frontend/src/links/otx.ts +0 -33
  139. data/frontend/src/links/securitytrails.ts +0 -38
  140. data/frontend/src/links/shodan.ts +0 -20
  141. data/frontend/src/links/urlscan.ts +0 -50
  142. data/frontend/src/links/virustotal.ts +0 -72
  143. data/frontend/src/main.ts +0 -41
  144. data/frontend/src/router/index.ts +0 -57
  145. data/frontend/src/rule.ts +0 -14
  146. data/frontend/src/shims-vue.d.ts +0 -6
  147. data/frontend/src/swagger.yaml +0 -771
  148. data/frontend/src/types.ts +0 -188
  149. data/frontend/src/utils.ts +0 -54
  150. data/frontend/src/views/Alerts.vue +0 -20
  151. data/frontend/src/views/Artifact.vue +0 -39
  152. data/frontend/src/views/Configs.vue +0 -20
  153. data/frontend/src/views/EditRule.vue +0 -39
  154. data/frontend/src/views/NewRule.vue +0 -26
  155. data/frontend/src/views/Rule.vue +0 -39
  156. data/frontend/src/views/Rules.vue +0 -20
  157. data/frontend/tests/utils.spec.ts +0 -9
  158. data/frontend/tsconfig.app.json +0 -21
  159. data/frontend/tsconfig.json +0 -14
  160. data/frontend/tsconfig.node.json +0 -13
  161. data/frontend/tsconfig.vitest.json +0 -12
  162. data/frontend/vite.config.ts +0 -24
  163. data/frontend/vitest.config.ts +0 -21
  164. data/lib/mihari/services/alert_proxy.rb +0 -97
@@ -1,63 +0,0 @@
1
- <template>
2
- <Alert
3
- v-for="(alert, index) in alerts.alerts"
4
- :alert="alert"
5
- :key="index"
6
- @refresh-page="refreshPage"
7
- @update-tag="updateTag"
8
- ></Alert>
9
- <Pagination
10
- :total="alerts.total"
11
- :currentPage="alerts.currentPage"
12
- :pageSize="alerts.pageSize"
13
- @update-page="updatePage"
14
- ></Pagination>
15
- <p class="help">({{ alerts.total }} results in total, {{ alerts.alerts.length }} shown)</p>
16
- </template>
17
-
18
- <script lang="ts">
19
- import { defineComponent, type PropType } from "vue"
20
-
21
- import Alert from "@/components/alert/Alert.vue"
22
- import Pagination from "@/components/Pagination.vue"
23
- import type { Alerts } from "@/types"
24
-
25
- export default defineComponent({
26
- name: "AlertsItem",
27
- components: {
28
- Alert,
29
- Pagination
30
- },
31
- props: {
32
- alerts: {
33
- type: Object as PropType<Alerts>,
34
- required: true
35
- }
36
- },
37
- emits: ["update-page", "refresh-page", "update-tag"],
38
- setup(_, context) {
39
- const scrollToTop = () => {
40
- window.scrollTo({
41
- top: 0
42
- })
43
- }
44
-
45
- const updatePage = (page: number) => {
46
- scrollToTop()
47
- context.emit("update-page", page)
48
- }
49
-
50
- const refreshPage = () => {
51
- scrollToTop()
52
- context.emit("refresh-page")
53
- }
54
-
55
- const updateTag = (tag: string) => {
56
- scrollToTop()
57
- context.emit("update-tag", tag)
58
- }
59
-
60
- return { updatePage, updateTag, refreshPage }
61
- }
62
- })
63
- </script>
@@ -1,90 +0,0 @@
1
- <template>
2
- <Loading v-if="getAlertsTask.isRunning"></Loading>
3
- <Alerts
4
- :alerts="getAlertsTask.last.value"
5
- v-if="getAlertsTask.last?.value"
6
- @refresh-page="refreshPage"
7
- @update-page="updatePage"
8
- @update-tag="updateTag"
9
- >
10
- </Alerts>
11
- </template>
12
-
13
- <script lang="ts">
14
- import { defineComponent, nextTick, onMounted, ref, watch } from "vue"
15
-
16
- import { generateGetAlertsTask } from "@/api-helper"
17
- import Alerts from "@/components/alert/Alerts.vue"
18
- import Loading from "@/components/Loading.vue"
19
- import type { AlertSearchParams } from "@/types"
20
-
21
- export default defineComponent({
22
- name: "AlertsWithPagination",
23
- props: {
24
- ruleId: {
25
- type: String
26
- },
27
- artifact: {
28
- type: String
29
- }
30
- },
31
- components: {
32
- Alerts,
33
- Loading
34
- },
35
- setup(props) {
36
- const page = ref(1)
37
- const tag = ref<string | undefined>(undefined)
38
-
39
- const getAlertsTask = generateGetAlertsTask()
40
-
41
- const getAlerts = async () => {
42
- const params: AlertSearchParams = {
43
- artifact: props.artifact,
44
- page: page.value,
45
- ruleId: props.ruleId,
46
- tag: tag.value,
47
- toAt: undefined,
48
- fromAt: undefined
49
- }
50
- return await getAlertsTask.perform(params)
51
- }
52
-
53
- const updatePage = (newPage: number) => {
54
- page.value = newPage
55
- }
56
-
57
- const resetPage = () => {
58
- page.value = 1
59
- }
60
-
61
- const refreshPage = async () => {
62
- resetPage()
63
- await getAlerts()
64
- }
65
-
66
- const updateTag = (newTag: string | undefined) => {
67
- if (tag.value === newTag) {
68
- tag.value = undefined
69
- } else {
70
- tag.value = newTag
71
- }
72
- }
73
-
74
- onMounted(async () => {
75
- await getAlerts()
76
- })
77
-
78
- watch([props, page, tag], async () => {
79
- nextTick(async () => await getAlerts())
80
- })
81
-
82
- return {
83
- getAlertsTask,
84
- refreshPage,
85
- updatePage,
86
- updateTag
87
- }
88
- }
89
- })
90
- </script>
@@ -1,128 +0,0 @@
1
- <template>
2
- <div class="box mb-6">
3
- <FormComponent
4
- ref="form"
5
- :ruleSet="getRuleSetTask.last?.value || []"
6
- :tags="getTagsTask.last?.value || []"
7
- :page="page"
8
- :tag="tag"
9
- ></FormComponent>
10
- <hr />
11
- <div class="columns">
12
- <div class="column">
13
- <div class="field is-grouped is-grouped-centered">
14
- <p class="control">
15
- <a class="button is-primary" @click="search">
16
- <span class="icon is-small">
17
- <font-awesome-icon icon="search"></font-awesome-icon>
18
- </span>
19
- <span>Search</span>
20
- </a>
21
- </p>
22
- </div>
23
- </div>
24
- </div>
25
- </div>
26
- <div v-if="getAlertsTask.performCount > 0">
27
- <hr />
28
- <Loading v-if="getAlertsTask.isRunning"></Loading>
29
- <ErrorMessage v-if="getAlertsTask.isError" :error="getAlertsTask.last?.error"></ErrorMessage>
30
- <AlertsComponent
31
- :alerts="getAlertsTask.last.value"
32
- v-if="getAlertsTask.last?.value"
33
- @refresh-page="refreshPage"
34
- @update-page="updatePage"
35
- @update-tag="updateTag"
36
- ></AlertsComponent>
37
- </div>
38
- </template>
39
-
40
- <script lang="ts">
41
- import { defineComponent, nextTick, onMounted, ref, watch } from "vue"
42
-
43
- import { generateGetAlertsTask, generateGetRuleSetTask, generateGetTagsTask } from "@/api-helper"
44
- import AlertsComponent from "@/components/alert/Alerts.vue"
45
- import FormComponent from "@/components/alert/Form.vue"
46
- import ErrorMessage from "@/components/ErrorMessage.vue"
47
- import Loading from "@/components/Loading.vue"
48
- import type { AlertSearchParams } from "@/types"
49
-
50
- export default defineComponent({
51
- name: "AlertsWrapper",
52
- components: {
53
- AlertsComponent,
54
- FormComponent,
55
- Loading,
56
- ErrorMessage
57
- },
58
- setup() {
59
- const page = ref(1)
60
- const tag = ref<string | undefined>(undefined)
61
- const form = ref<InstanceType<typeof FormComponent>>()
62
-
63
- const getAlertsTask = generateGetAlertsTask()
64
- const getTagsTask = generateGetTagsTask()
65
- const getRuleSetTask = generateGetRuleSetTask()
66
-
67
- const getAlerts = async () => {
68
- const params = form.value?.getSearchParams() as AlertSearchParams
69
- return await getAlertsTask.perform(params)
70
- }
71
-
72
- const updatePage = (newPage: number) => {
73
- page.value = newPage
74
- }
75
-
76
- const resetPage = () => {
77
- page.value = 1
78
- }
79
-
80
- const search = async () => {
81
- // reset page
82
- resetPage()
83
-
84
- await getAlerts()
85
- }
86
-
87
- const updateTag = (newTag: string | undefined) => {
88
- if (tag.value === newTag) {
89
- tag.value = undefined
90
- } else {
91
- tag.value = newTag
92
- }
93
-
94
- nextTick(async () => await search())
95
- }
96
-
97
- const refreshPage = async () => {
98
- // it is just an alias of search
99
- // this function will be invoked when an alert is deleted
100
- await search()
101
- }
102
-
103
- onMounted(async () => {
104
- getTagsTask.perform()
105
- getRuleSetTask.perform()
106
-
107
- await getAlerts()
108
- })
109
-
110
- watch([page, tag], async () => {
111
- nextTick(async () => await getAlerts())
112
- })
113
-
114
- return {
115
- getAlertsTask,
116
- getRuleSetTask,
117
- getTagsTask,
118
- refreshPage,
119
- search,
120
- tag,
121
- updatePage,
122
- updateTag,
123
- form,
124
- page
125
- }
126
- }
127
- })
128
- </script>
@@ -1,169 +0,0 @@
1
- <template>
2
- <div class="columns">
3
- <div class="column">
4
- <div class="field is-horizontal">
5
- <div class="field-label is-normal">
6
- <label class="label">Rule</label>
7
- </div>
8
- <div class="field-body">
9
- <div class="field">
10
- <div class="control">
11
- <div class="select">
12
- <select v-model="ruleId">
13
- <option></option>
14
- <option v-for="ruleId_ in ruleSet" :key="ruleId_">
15
- {{ ruleId_ }}
16
- </option>
17
- </select>
18
- </div>
19
- </div>
20
- </div>
21
- </div>
22
- </div>
23
- </div>
24
- <div class="column">
25
- <div class="field is-horizontal">
26
- <div class="field-label is-normal">
27
- <label class="label">Artifact</label>
28
- </div>
29
- <div class="field-body">
30
- <div class="field">
31
- <p class="control">
32
- <input class="input" type="text" v-model="artifact" />
33
- </p>
34
- </div>
35
- </div>
36
- </div>
37
- </div>
38
- </div>
39
- <div class="columns">
40
- <div class="column">
41
- <div class="field is-horizontal">
42
- <div class="field-label is-normal">
43
- <label class="label">Tag</label>
44
- </div>
45
- <div class="field-body">
46
- <div class="field">
47
- <div class="control">
48
- <div class="select">
49
- <select v-model="tagInput">
50
- <option></option>
51
- <option v-for="tag_ in tags" :key="tag_">
52
- {{ tag_ }}
53
- </option>
54
- </select>
55
- </div>
56
- </div>
57
- </div>
58
- </div>
59
- </div>
60
- </div>
61
- <div class="column"></div>
62
- </div>
63
- <div class="columns">
64
- <div class="column">
65
- <div class="field is-horizontal">
66
- <div class="field-label is-normal">
67
- <label class="label">From</label>
68
- </div>
69
- <div class="field-body">
70
- <div class="field">
71
- <p class="control">
72
- <input class="input" type="date" v-model="fromAt" />
73
- </p>
74
- </div>
75
- </div>
76
- </div>
77
- </div>
78
- <div class="column">
79
- <div class="field is-horizontal">
80
- <div class="field-label is-normal">
81
- <label class="label">To</label>
82
- </div>
83
- <div class="field-body">
84
- <div class="field">
85
- <p class="control">
86
- <input class="input" type="date" v-model="toAt" />
87
- </p>
88
- </div>
89
- </div>
90
- </div>
91
- </div>
92
- </div>
93
- </template>
94
-
95
- <script lang="ts">
96
- import { defineComponent, type PropType, ref, toRef, watch } from "vue"
97
- import { useRoute } from "vue-router"
98
-
99
- import type { AlertSearchParams } from "@/types"
100
- import { normalizeQueryParam } from "@/utils"
101
-
102
- export default defineComponent({
103
- name: "AlertsForm",
104
- props: {
105
- tags: {
106
- type: Array as PropType<string[]>,
107
- required: true
108
- },
109
- ruleSet: {
110
- type: Array as PropType<string[]>,
111
- required: true
112
- },
113
- page: {
114
- type: Number,
115
- required: true
116
- },
117
- tag: {
118
- type: String,
119
- required: false
120
- }
121
- },
122
- setup(props) {
123
- const route = useRoute()
124
-
125
- const artifact = ref<string | undefined>(undefined)
126
- const fromAt = ref<string | undefined>(undefined)
127
- const tagInput = ref<string | undefined>(props.tag)
128
- const ruleId = ref<string | undefined>(undefined)
129
- const toAt = ref<string | undefined>(undefined)
130
-
131
- const updateByQueryParams = () => {
132
- const tag_ = route.query["tag"]
133
- if (tagInput.value === undefined) {
134
- tagInput.value = normalizeQueryParam(tag_)
135
- }
136
- }
137
-
138
- const getSearchParams = (): AlertSearchParams => {
139
- updateByQueryParams()
140
-
141
- const params: AlertSearchParams = {
142
- artifact: artifact.value === "" ? undefined : artifact.value,
143
- page: props.page,
144
- ruleId: ruleId.value === "" ? undefined : ruleId.value,
145
- tag: tagInput.value === "" ? undefined : tagInput.value,
146
- toAt: toAt.value === "" ? undefined : toAt.value,
147
- fromAt: fromAt.value === "" ? undefined : fromAt.value
148
- }
149
- return params
150
- }
151
-
152
- watch(
153
- () => props.tag,
154
- () => {
155
- tagInput.value = props.tag
156
- }
157
- )
158
-
159
- return {
160
- artifact,
161
- fromAt,
162
- getSearchParams,
163
- ruleId,
164
- toAt,
165
- tagInput
166
- }
167
- }
168
- })
169
- </script>
@@ -1,23 +0,0 @@
1
- <template>
2
- <div class="tags are-medium">
3
- <span class="tag">
4
- {{ autonomousSystem.asn }}
5
- </span>
6
- </div>
7
- </template>
8
-
9
- <script lang="ts">
10
- import { defineComponent, type PropType } from "vue"
11
-
12
- import type { AutonomousSystem } from "@/types"
13
-
14
- export default defineComponent({
15
- name: "AS",
16
- props: {
17
- autonomousSystem: {
18
- type: Object as PropType<AutonomousSystem>,
19
- required: true
20
- }
21
- }
22
- })
23
- </script>