mihari 5.7.0 → 5.7.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.rubocop.yml +1 -1
- data/lib/mihari/actor.rb +10 -4
- data/lib/mihari/commands/alert.rb +6 -4
- data/lib/mihari/commands/search.rb +10 -29
- data/lib/mihari/enrichers/ipinfo.rb +1 -1
- data/lib/mihari/entities/tag.rb +1 -0
- data/lib/mihari/rule.rb +14 -0
- data/lib/mihari/service.rb +12 -2
- data/lib/mihari/services/alert_builder.rb +81 -8
- data/lib/mihari/services/alert_runner.rb +3 -10
- data/lib/mihari/services/rule_builder.rb +8 -10
- data/lib/mihari/services/rule_runner.rb +2 -25
- data/lib/mihari/structs/binaryedge.rb +9 -0
- data/lib/mihari/structs/censys.rb +0 -14
- data/lib/mihari/structs/fofa.rb +3 -0
- data/lib/mihari/structs/google_public_dns.rb +0 -4
- data/lib/mihari/structs/greynoise.rb +0 -6
- data/lib/mihari/structs/hunterhow.rb +0 -6
- data/lib/mihari/structs/ipinfo.rb +0 -2
- data/lib/mihari/structs/onyphe.rb +0 -4
- data/lib/mihari/structs/shodan.rb +0 -2
- data/lib/mihari/structs/urlscan.rb +0 -6
- data/lib/mihari/structs/virustotal_intelligence.rb +0 -8
- data/lib/mihari/version.rb +1 -1
- data/lib/mihari/web/app.rb +20 -17
- data/lib/mihari/web/endpoints/alerts.rb +75 -38
- data/lib/mihari/web/endpoints/artifacts.rb +60 -53
- data/lib/mihari/web/endpoints/ip_addresses.rb +19 -4
- data/lib/mihari/web/endpoints/rules.rb +132 -88
- data/lib/mihari/web/endpoints/tags.rb +15 -13
- data/lib/mihari/web/public/assets/{index-821134e2.js → index-07fafab5.js} +4 -3
- data/lib/mihari/web/public/index.html +1 -1
- data/lib/mihari.rb +0 -1
- data/mihari.gemspec +1 -1
- data/mkdocs.yml +1 -0
- metadata +3 -130
- data/docs/alternatives.md +0 -5
- data/docs/analyzers/binaryedge.md +0 -26
- data/docs/analyzers/censys.md +0 -31
- data/docs/analyzers/circl.md +0 -37
- data/docs/analyzers/crtsh.md +0 -26
- data/docs/analyzers/dnstwister.md +0 -25
- data/docs/analyzers/feed.md +0 -73
- data/docs/analyzers/fofa.md +0 -31
- data/docs/analyzers/greynoise.md +0 -26
- data/docs/analyzers/hunterhow.md +0 -33
- data/docs/analyzers/index.md +0 -104
- data/docs/analyzers/onyphe.md +0 -26
- data/docs/analyzers/otx.md +0 -28
- data/docs/analyzers/passivetotal.md +0 -52
- data/docs/analyzers/pulsedive.md +0 -28
- data/docs/analyzers/securitytrails.md +0 -41
- data/docs/analyzers/shodan.md +0 -26
- data/docs/analyzers/urlscan.md +0 -28
- data/docs/analyzers/virustotal.md +0 -43
- data/docs/analyzers/virustotal_intelligence.md +0 -33
- data/docs/analyzers/zoomeye.md +0 -38
- data/docs/configuration.md +0 -35
- data/docs/emitters/database.md +0 -22
- data/docs/emitters/hive.md +0 -26
- data/docs/emitters/index.md +0 -36
- data/docs/emitters/misp.md +0 -21
- data/docs/emitters/slack.md +0 -21
- data/docs/emitters/webhook.md +0 -63
- data/docs/enrichers/google_public_dns.md +0 -19
- data/docs/enrichers/index.md +0 -35
- data/docs/enrichers/ipinfo.md +0 -26
- data/docs/enrichers/shodan.md +0 -22
- data/docs/enrichers/whois.md +0 -17
- data/docs/github_actions.md +0 -43
- data/docs/index.md +0 -11
- data/docs/installation.md +0 -31
- data/docs/requirements.md +0 -13
- data/docs/rule.md +0 -168
- data/docs/tags.md +0 -3
- data/docs/usage.md +0 -103
- data/frontend/.eslintrc.cjs +0 -22
- data/frontend/.gitignore +0 -31
- data/frontend/.prettierrc.json +0 -8
- data/frontend/README.md +0 -3
- data/frontend/env.d.ts +0 -5
- data/frontend/index.html +0 -21
- data/frontend/package-lock.json +0 -7219
- data/frontend/package.json +0 -67
- data/frontend/public/favicon.ico +0 -0
- data/frontend/scripts/swagger_doc_to_yaml.rb +0 -23
- data/frontend/src/App.vue +0 -27
- data/frontend/src/ace-config.ts +0 -6
- data/frontend/src/api-helper.ts +0 -111
- data/frontend/src/api.ts +0 -105
- data/frontend/src/components/ErrorMessage.vue +0 -31
- data/frontend/src/components/Loading.vue +0 -15
- data/frontend/src/components/Navbar.vue +0 -42
- data/frontend/src/components/Pagination.vue +0 -119
- data/frontend/src/components/alert/Alert.vue +0 -87
- data/frontend/src/components/alert/Alerts.vue +0 -63
- data/frontend/src/components/alert/AlertsWithPagination.vue +0 -90
- data/frontend/src/components/alert/AlertsWrapper.vue +0 -128
- data/frontend/src/components/alert/Form.vue +0 -169
- data/frontend/src/components/artifact/AS.vue +0 -23
- data/frontend/src/components/artifact/Artifact.vue +0 -287
- data/frontend/src/components/artifact/ArtifactTag.vue +0 -64
- data/frontend/src/components/artifact/ArtifactTags.vue +0 -29
- data/frontend/src/components/artifact/ArtifactWrapper.vue +0 -57
- data/frontend/src/components/artifact/CPEs.vue +0 -23
- data/frontend/src/components/artifact/DnsRecords.vue +0 -32
- data/frontend/src/components/artifact/Ports.vue +0 -23
- data/frontend/src/components/artifact/ReverseDnsNames.vue +0 -23
- data/frontend/src/components/artifact/Tags.vue +0 -29
- data/frontend/src/components/artifact/WhoisRecord.vue +0 -44
- data/frontend/src/components/config/Configs.vue +0 -65
- data/frontend/src/components/config/ConfigsWrapper.vue +0 -32
- data/frontend/src/components/link/Link.vue +0 -32
- data/frontend/src/components/link/Links.vue +0 -42
- data/frontend/src/components/rule/EditRule.vue +0 -72
- data/frontend/src/components/rule/EditRuleWrapper.vue +0 -48
- data/frontend/src/components/rule/Form.vue +0 -158
- data/frontend/src/components/rule/InputForm.vue +0 -45
- data/frontend/src/components/rule/NewRule.vue +0 -57
- data/frontend/src/components/rule/Rule.vue +0 -100
- data/frontend/src/components/rule/RuleWrapper.vue +0 -53
- data/frontend/src/components/rule/Rules.vue +0 -84
- data/frontend/src/components/rule/RulesWrapper.vue +0 -121
- data/frontend/src/components/rule/YAML.vue +0 -37
- data/frontend/src/components/tag/Tag.vue +0 -65
- data/frontend/src/components/tag/Tags.vue +0 -37
- data/frontend/src/countries.ts +0 -350
- data/frontend/src/index.ts +0 -20
- data/frontend/src/links/anyrun.ts +0 -19
- data/frontend/src/links/base.ts +0 -14
- data/frontend/src/links/censys.ts +0 -20
- data/frontend/src/links/crtsh.ts +0 -20
- data/frontend/src/links/dnslytics.ts +0 -38
- data/frontend/src/links/greynoise.ts +0 -20
- data/frontend/src/links/index.ts +0 -40
- data/frontend/src/links/intezer.ts +0 -20
- data/frontend/src/links/otx.ts +0 -33
- data/frontend/src/links/securitytrails.ts +0 -38
- data/frontend/src/links/shodan.ts +0 -20
- data/frontend/src/links/urlscan.ts +0 -50
- data/frontend/src/links/virustotal.ts +0 -72
- data/frontend/src/main.ts +0 -41
- data/frontend/src/router/index.ts +0 -57
- data/frontend/src/rule.ts +0 -14
- data/frontend/src/shims-vue.d.ts +0 -6
- data/frontend/src/swagger.yaml +0 -771
- data/frontend/src/types.ts +0 -188
- data/frontend/src/utils.ts +0 -54
- data/frontend/src/views/Alerts.vue +0 -20
- data/frontend/src/views/Artifact.vue +0 -39
- data/frontend/src/views/Configs.vue +0 -20
- data/frontend/src/views/EditRule.vue +0 -39
- data/frontend/src/views/NewRule.vue +0 -26
- data/frontend/src/views/Rule.vue +0 -39
- data/frontend/src/views/Rules.vue +0 -20
- data/frontend/tests/utils.spec.ts +0 -9
- data/frontend/tsconfig.app.json +0 -21
- data/frontend/tsconfig.json +0 -14
- data/frontend/tsconfig.node.json +0 -13
- data/frontend/tsconfig.vitest.json +0 -12
- data/frontend/vite.config.ts +0 -24
- data/frontend/vitest.config.ts +0 -21
- data/lib/mihari/services/alert_proxy.rb +0 -97
@@ -7,6 +7,113 @@ module Mihari
|
|
7
7
|
# Rule API endpoint
|
8
8
|
#
|
9
9
|
class Rules < Grape::API
|
10
|
+
class RuleSearcher < Mihari::Service
|
11
|
+
class ResultValue
|
12
|
+
# @return [Array<Mihari::Models::Rule>]
|
13
|
+
attr_reader :rules
|
14
|
+
|
15
|
+
# @return [Integer]
|
16
|
+
attr_reader :total
|
17
|
+
|
18
|
+
# @return [Mihari::Structs::Filters::Rule::SearchFilterWithPagination]
|
19
|
+
attr_reader :filter
|
20
|
+
|
21
|
+
#
|
22
|
+
# @param [Array<Mihari::Models::Rule>] rules
|
23
|
+
# @param [Integer] total
|
24
|
+
# @param [Mihari::Structs::Filters::Rule::SearchFilterWithPagination] filter
|
25
|
+
#
|
26
|
+
def initialize(rules:, total:, filter:)
|
27
|
+
@rules = rules
|
28
|
+
@total = total
|
29
|
+
@filter = filter
|
30
|
+
end
|
31
|
+
end
|
32
|
+
|
33
|
+
#
|
34
|
+
# @params [Hash]
|
35
|
+
#
|
36
|
+
# @return [ResultValue]
|
37
|
+
#
|
38
|
+
def call(params)
|
39
|
+
filter = params.to_h.to_snake_keys
|
40
|
+
|
41
|
+
# normalize keys
|
42
|
+
filter["tag_name"] = filter["tag"]
|
43
|
+
# symbolize hash keys
|
44
|
+
filter = filter.to_h.symbolize_keys
|
45
|
+
|
46
|
+
search_filter_with_pagination = Mihari::Structs::Filters::Rule::SearchFilterWithPagination.new(**filter)
|
47
|
+
rules = Mihari::Models::Rule.search(search_filter_with_pagination)
|
48
|
+
total = Mihari::Models::Rule.count(search_filter_with_pagination.without_pagination)
|
49
|
+
|
50
|
+
ResultValue.new(rules: rules, total: total, filter: filter)
|
51
|
+
end
|
52
|
+
end
|
53
|
+
|
54
|
+
class RuleGetter < Service
|
55
|
+
#
|
56
|
+
# @params [String] id
|
57
|
+
#
|
58
|
+
# @return [Mihari::Models::Rule]
|
59
|
+
#
|
60
|
+
def call(id)
|
61
|
+
Mihari::Models::Rule.find id
|
62
|
+
end
|
63
|
+
end
|
64
|
+
|
65
|
+
class RuleRunner < Service
|
66
|
+
#
|
67
|
+
# @param [String] id
|
68
|
+
#
|
69
|
+
def call(id)
|
70
|
+
rule = Mihari::Rule.from_model(Mihari::Models::Rule.find(id))
|
71
|
+
rule.call
|
72
|
+
end
|
73
|
+
end
|
74
|
+
|
75
|
+
class RuleCreator < Service
|
76
|
+
#
|
77
|
+
# @params [String]
|
78
|
+
#
|
79
|
+
# @return [Mihari::Models::Rule]
|
80
|
+
#
|
81
|
+
def call(yaml)
|
82
|
+
rule = Rule.from_yaml(yaml)
|
83
|
+
|
84
|
+
found = Mihari::Models::Rule.find_by_id(rule.id)
|
85
|
+
error!({ message: "ID:#{rule.id} is already registered" }, 400) unless found.nil?
|
86
|
+
|
87
|
+
rule.model.save
|
88
|
+
rule
|
89
|
+
end
|
90
|
+
end
|
91
|
+
|
92
|
+
class RuleUpdater < Service
|
93
|
+
#
|
94
|
+
# @params [String] id
|
95
|
+
# @params [String] yaml
|
96
|
+
#
|
97
|
+
# @return [Mihari::Models::Rule]
|
98
|
+
#
|
99
|
+
def call(id:, yaml:)
|
100
|
+
Mihari::Models::Rule.find(id)
|
101
|
+
|
102
|
+
rule = Rule.from_yaml(yaml)
|
103
|
+
rule.model.save
|
104
|
+
rule
|
105
|
+
end
|
106
|
+
end
|
107
|
+
|
108
|
+
class RuleDestroyer < Service
|
109
|
+
#
|
110
|
+
# @param [String] id
|
111
|
+
#
|
112
|
+
def call(id)
|
113
|
+
Mihari::Models::Rule.find(id).destroy
|
114
|
+
end
|
115
|
+
end
|
116
|
+
|
10
117
|
namespace :rules do
|
11
118
|
desc "Get Rule IDs", {
|
12
119
|
is_array: true,
|
@@ -27,33 +134,21 @@ module Mihari
|
|
27
134
|
params do
|
28
135
|
optional :page, type: Integer, default: 1
|
29
136
|
optional :limit, type: Integer, default: 10
|
30
|
-
|
31
137
|
optional :title, type: String
|
32
138
|
optional :description, type: String
|
33
139
|
optional :tag, type: String
|
34
|
-
|
35
140
|
optional :fromAt, type: DateTime
|
36
141
|
optional :toAt, type: DateTime
|
37
142
|
end
|
38
143
|
get "/" do
|
39
|
-
|
40
|
-
|
41
|
-
|
42
|
-
|
43
|
-
|
44
|
-
|
45
|
-
|
46
|
-
|
47
|
-
rules = Mihari::Models::Rule.search(search_filter_with_pagenation)
|
48
|
-
total = Mihari::Models::Rule.count(search_filter_with_pagenation.without_pagination)
|
49
|
-
|
50
|
-
present(
|
51
|
-
{ rules: rules,
|
52
|
-
total: total,
|
53
|
-
current_page: filter[:page].to_i,
|
54
|
-
page_size: filter[:limit].to_i },
|
55
|
-
with: Entities::RulesWithPagination
|
56
|
-
)
|
144
|
+
value = RuleSearcher.call(params.to_h)
|
145
|
+
present({
|
146
|
+
rules: value.rules,
|
147
|
+
total: value.total,
|
148
|
+
current_page: value.filter[:page].to_i,
|
149
|
+
page_size: value.filter[:limit].to_i
|
150
|
+
},
|
151
|
+
with: Entities::RulesWithPagination)
|
57
152
|
end
|
58
153
|
|
59
154
|
desc "Get a rule", {
|
@@ -65,23 +160,16 @@ module Mihari
|
|
65
160
|
requires :id, type: String
|
66
161
|
end
|
67
162
|
get "/:id" do
|
68
|
-
|
69
|
-
|
70
|
-
id = params["id"].to_s
|
71
|
-
|
72
|
-
result = Try do
|
73
|
-
Mihari::Models::Rule.find(id)
|
74
|
-
end.to_result
|
75
|
-
|
163
|
+
id = params[:id].to_s
|
164
|
+
result = RuleGetter.result(params[:id].to_s)
|
76
165
|
return present(result.value!, with: Entities::Rule) if result.success?
|
77
166
|
|
78
167
|
failure = result.failure
|
79
168
|
case failure
|
80
169
|
when ActiveRecord::RecordNotFound
|
81
170
|
error!({ message: "ID:#{id} is not found" }, 404)
|
82
|
-
else
|
83
|
-
raise failure
|
84
171
|
end
|
172
|
+
raise failure
|
85
173
|
end
|
86
174
|
|
87
175
|
desc "Run a rule", {
|
@@ -92,24 +180,19 @@ module Mihari
|
|
92
180
|
requires :id, type: String
|
93
181
|
end
|
94
182
|
get "/:id/run" do
|
95
|
-
|
96
|
-
|
97
|
-
id = params["id"].to_s
|
98
|
-
|
99
|
-
result = Try { Rule.from_model(Mihari::Models::Rule.find(id)) }.to_result
|
183
|
+
id = params[:id].to_s
|
184
|
+
result = RuleRunner.result(id)
|
100
185
|
if result.success?
|
101
|
-
result.value!.analyzer.run
|
102
186
|
status 201
|
103
|
-
return present({ message: "ID:#{id}
|
187
|
+
return present({ message: "ID:#{id}} ran successfully" }, with: Entities::Message)
|
104
188
|
end
|
105
189
|
|
106
190
|
failure = result.failure
|
107
191
|
case failure
|
108
192
|
when ActiveRecord::RecordNotFound
|
109
193
|
error!({ message: "ID:#{id} is not found" }, 404)
|
110
|
-
else
|
111
|
-
raise failure
|
112
194
|
end
|
195
|
+
raise failure
|
113
196
|
end
|
114
197
|
|
115
198
|
desc "Create a rule", {
|
@@ -120,22 +203,7 @@ module Mihari
|
|
120
203
|
requires :yaml, type: String, documentation: { param_type: "body" }
|
121
204
|
end
|
122
205
|
post "/" do
|
123
|
-
|
124
|
-
|
125
|
-
yaml = params[:yaml]
|
126
|
-
result = Try { Rule.from_yaml(yaml) }.to_result.bind do |rule|
|
127
|
-
Try do
|
128
|
-
found = Mihari::Models::Rule.find_by_id(rule.id)
|
129
|
-
error!({ message: "ID:#{rule.id} is already registered" }, 400) unless found.nil?
|
130
|
-
rule
|
131
|
-
end.to_result
|
132
|
-
end.bind do |rule|
|
133
|
-
Try do
|
134
|
-
rule.model.save
|
135
|
-
rule
|
136
|
-
end.to_result
|
137
|
-
end
|
138
|
-
|
206
|
+
result = RuleCreator.result(params[:yaml])
|
139
207
|
if result.success?
|
140
208
|
status 201
|
141
209
|
return present(result.value!.model, with: Entities::Rule)
|
@@ -146,10 +214,9 @@ module Mihari
|
|
146
214
|
when Psych::SyntaxError
|
147
215
|
error!({ message: failure.message }, 400)
|
148
216
|
when ValidationError
|
149
|
-
error!({ message: "
|
150
|
-
else
|
151
|
-
raise failure
|
217
|
+
error!({ message: "Rule format is invalid", details: failure.errors.to_h }, 400)
|
152
218
|
end
|
219
|
+
raise failure
|
153
220
|
end
|
154
221
|
|
155
222
|
desc "Update a rule", {
|
@@ -161,22 +228,8 @@ module Mihari
|
|
161
228
|
requires :yaml, type: String, documentation: { param_type: "body" }
|
162
229
|
end
|
163
230
|
put "/" do
|
164
|
-
|
165
|
-
|
166
|
-
id = params[:id]
|
167
|
-
yaml = params[:yaml]
|
168
|
-
|
169
|
-
result = Try do
|
170
|
-
Mihari::Models::Rule.find(id)
|
171
|
-
end.to_result.bind do |_|
|
172
|
-
Try { Rule.from_yaml(yaml) }.to_result
|
173
|
-
end.bind do |rule|
|
174
|
-
Try do
|
175
|
-
rule.model.save
|
176
|
-
rule
|
177
|
-
end.to_result
|
178
|
-
end
|
179
|
-
|
231
|
+
id = params[:id].to_s
|
232
|
+
result = RuleUpdater.result(id: id, yaml: params[:yaml].to_s)
|
180
233
|
if result.success?
|
181
234
|
status 201
|
182
235
|
return present(result.value!.model, with: Entities::Rule)
|
@@ -189,10 +242,9 @@ module Mihari
|
|
189
242
|
when Psych::SyntaxError
|
190
243
|
error!({ message: failure.message }, 400)
|
191
244
|
when ValidationError
|
192
|
-
error!({ message: "
|
193
|
-
else
|
194
|
-
raise failure
|
245
|
+
error!({ message: "Rule format is invalid", details: failure.errors.to_h }, 400)
|
195
246
|
end
|
247
|
+
raise failure
|
196
248
|
end
|
197
249
|
|
198
250
|
desc "Delete a rule", {
|
@@ -204,15 +256,8 @@ module Mihari
|
|
204
256
|
requires :id, type: String
|
205
257
|
end
|
206
258
|
delete "/:id" do
|
207
|
-
|
208
|
-
|
209
|
-
id = params["id"].to_s
|
210
|
-
|
211
|
-
result = Try do
|
212
|
-
rule = Mihari::Models::Rule.find(id)
|
213
|
-
rule.destroy
|
214
|
-
end.to_result
|
215
|
-
|
259
|
+
id = params[:id].to_s
|
260
|
+
result = RuleDestroyer.result(id)
|
216
261
|
if result.success?
|
217
262
|
status 204
|
218
263
|
return present({ message: "ID:#{id} is deleted" }, with: Entities::Message)
|
@@ -222,9 +267,8 @@ module Mihari
|
|
222
267
|
case failure
|
223
268
|
when ActiveRecord::RecordNotFound
|
224
269
|
error!({ message: "ID:#{id} is not found" }, 404)
|
225
|
-
else
|
226
|
-
raise failure
|
227
270
|
end
|
271
|
+
raise failure
|
228
272
|
end
|
229
273
|
end
|
230
274
|
end
|
@@ -7,6 +7,15 @@ module Mihari
|
|
7
7
|
# Tag API endpoint
|
8
8
|
#
|
9
9
|
class Tags < Grape::API
|
10
|
+
class TagDestroyer < Service
|
11
|
+
#
|
12
|
+
# @param [Integer] id
|
13
|
+
#
|
14
|
+
def call(id)
|
15
|
+
Mihari::Models::Tag.find(id).destroy
|
16
|
+
end
|
17
|
+
end
|
18
|
+
|
10
19
|
namespace :tags do
|
11
20
|
desc "Get tags", {
|
12
21
|
is_array: true,
|
@@ -24,17 +33,11 @@ module Mihari
|
|
24
33
|
summary: "Delete a tag"
|
25
34
|
}
|
26
35
|
params do
|
27
|
-
requires :
|
36
|
+
requires :id, type: Integer
|
28
37
|
end
|
29
|
-
delete "/:
|
30
|
-
|
31
|
-
|
32
|
-
name = params[:name].to_s
|
33
|
-
|
34
|
-
result = Try do
|
35
|
-
Mihari::Models::Tag.where(name: name).destroy_all
|
36
|
-
end.to_result
|
37
|
-
|
38
|
+
delete "/:id" do
|
39
|
+
id = params[:id].to_i
|
40
|
+
result = TagDestroyer.result(id)
|
38
41
|
if result.success?
|
39
42
|
status 204
|
40
43
|
return present({ message: "" }, with: Entities::Message)
|
@@ -43,10 +46,9 @@ module Mihari
|
|
43
46
|
failure = result.failure
|
44
47
|
case failure
|
45
48
|
when ActiveRecord::RecordNotFound
|
46
|
-
error!({ message: "
|
47
|
-
else
|
48
|
-
raise failure
|
49
|
+
error!({ message: "ID:#{id} is not found" }, 404)
|
49
50
|
end
|
51
|
+
raise failure
|
50
52
|
end
|
51
53
|
end
|
52
54
|
end
|