mihari 5.7.0 → 5.7.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (164) hide show
  1. checksums.yaml +4 -4
  2. data/.rubocop.yml +1 -1
  3. data/lib/mihari/actor.rb +10 -4
  4. data/lib/mihari/commands/alert.rb +6 -4
  5. data/lib/mihari/commands/search.rb +10 -29
  6. data/lib/mihari/enrichers/ipinfo.rb +1 -1
  7. data/lib/mihari/entities/tag.rb +1 -0
  8. data/lib/mihari/rule.rb +14 -0
  9. data/lib/mihari/service.rb +12 -2
  10. data/lib/mihari/services/alert_builder.rb +81 -8
  11. data/lib/mihari/services/alert_runner.rb +3 -10
  12. data/lib/mihari/services/rule_builder.rb +8 -10
  13. data/lib/mihari/services/rule_runner.rb +2 -25
  14. data/lib/mihari/structs/binaryedge.rb +9 -0
  15. data/lib/mihari/structs/censys.rb +0 -14
  16. data/lib/mihari/structs/fofa.rb +3 -0
  17. data/lib/mihari/structs/google_public_dns.rb +0 -4
  18. data/lib/mihari/structs/greynoise.rb +0 -6
  19. data/lib/mihari/structs/hunterhow.rb +0 -6
  20. data/lib/mihari/structs/ipinfo.rb +0 -2
  21. data/lib/mihari/structs/onyphe.rb +0 -4
  22. data/lib/mihari/structs/shodan.rb +0 -2
  23. data/lib/mihari/structs/urlscan.rb +0 -6
  24. data/lib/mihari/structs/virustotal_intelligence.rb +0 -8
  25. data/lib/mihari/version.rb +1 -1
  26. data/lib/mihari/web/app.rb +20 -17
  27. data/lib/mihari/web/endpoints/alerts.rb +75 -38
  28. data/lib/mihari/web/endpoints/artifacts.rb +60 -53
  29. data/lib/mihari/web/endpoints/ip_addresses.rb +19 -4
  30. data/lib/mihari/web/endpoints/rules.rb +132 -88
  31. data/lib/mihari/web/endpoints/tags.rb +15 -13
  32. data/lib/mihari/web/public/assets/{index-821134e2.js → index-07fafab5.js} +4 -3
  33. data/lib/mihari/web/public/index.html +1 -1
  34. data/lib/mihari.rb +0 -1
  35. data/mihari.gemspec +1 -1
  36. data/mkdocs.yml +1 -0
  37. metadata +3 -130
  38. data/docs/alternatives.md +0 -5
  39. data/docs/analyzers/binaryedge.md +0 -26
  40. data/docs/analyzers/censys.md +0 -31
  41. data/docs/analyzers/circl.md +0 -37
  42. data/docs/analyzers/crtsh.md +0 -26
  43. data/docs/analyzers/dnstwister.md +0 -25
  44. data/docs/analyzers/feed.md +0 -73
  45. data/docs/analyzers/fofa.md +0 -31
  46. data/docs/analyzers/greynoise.md +0 -26
  47. data/docs/analyzers/hunterhow.md +0 -33
  48. data/docs/analyzers/index.md +0 -104
  49. data/docs/analyzers/onyphe.md +0 -26
  50. data/docs/analyzers/otx.md +0 -28
  51. data/docs/analyzers/passivetotal.md +0 -52
  52. data/docs/analyzers/pulsedive.md +0 -28
  53. data/docs/analyzers/securitytrails.md +0 -41
  54. data/docs/analyzers/shodan.md +0 -26
  55. data/docs/analyzers/urlscan.md +0 -28
  56. data/docs/analyzers/virustotal.md +0 -43
  57. data/docs/analyzers/virustotal_intelligence.md +0 -33
  58. data/docs/analyzers/zoomeye.md +0 -38
  59. data/docs/configuration.md +0 -35
  60. data/docs/emitters/database.md +0 -22
  61. data/docs/emitters/hive.md +0 -26
  62. data/docs/emitters/index.md +0 -36
  63. data/docs/emitters/misp.md +0 -21
  64. data/docs/emitters/slack.md +0 -21
  65. data/docs/emitters/webhook.md +0 -63
  66. data/docs/enrichers/google_public_dns.md +0 -19
  67. data/docs/enrichers/index.md +0 -35
  68. data/docs/enrichers/ipinfo.md +0 -26
  69. data/docs/enrichers/shodan.md +0 -22
  70. data/docs/enrichers/whois.md +0 -17
  71. data/docs/github_actions.md +0 -43
  72. data/docs/index.md +0 -11
  73. data/docs/installation.md +0 -31
  74. data/docs/requirements.md +0 -13
  75. data/docs/rule.md +0 -168
  76. data/docs/tags.md +0 -3
  77. data/docs/usage.md +0 -103
  78. data/frontend/.eslintrc.cjs +0 -22
  79. data/frontend/.gitignore +0 -31
  80. data/frontend/.prettierrc.json +0 -8
  81. data/frontend/README.md +0 -3
  82. data/frontend/env.d.ts +0 -5
  83. data/frontend/index.html +0 -21
  84. data/frontend/package-lock.json +0 -7219
  85. data/frontend/package.json +0 -67
  86. data/frontend/public/favicon.ico +0 -0
  87. data/frontend/scripts/swagger_doc_to_yaml.rb +0 -23
  88. data/frontend/src/App.vue +0 -27
  89. data/frontend/src/ace-config.ts +0 -6
  90. data/frontend/src/api-helper.ts +0 -111
  91. data/frontend/src/api.ts +0 -105
  92. data/frontend/src/components/ErrorMessage.vue +0 -31
  93. data/frontend/src/components/Loading.vue +0 -15
  94. data/frontend/src/components/Navbar.vue +0 -42
  95. data/frontend/src/components/Pagination.vue +0 -119
  96. data/frontend/src/components/alert/Alert.vue +0 -87
  97. data/frontend/src/components/alert/Alerts.vue +0 -63
  98. data/frontend/src/components/alert/AlertsWithPagination.vue +0 -90
  99. data/frontend/src/components/alert/AlertsWrapper.vue +0 -128
  100. data/frontend/src/components/alert/Form.vue +0 -169
  101. data/frontend/src/components/artifact/AS.vue +0 -23
  102. data/frontend/src/components/artifact/Artifact.vue +0 -287
  103. data/frontend/src/components/artifact/ArtifactTag.vue +0 -64
  104. data/frontend/src/components/artifact/ArtifactTags.vue +0 -29
  105. data/frontend/src/components/artifact/ArtifactWrapper.vue +0 -57
  106. data/frontend/src/components/artifact/CPEs.vue +0 -23
  107. data/frontend/src/components/artifact/DnsRecords.vue +0 -32
  108. data/frontend/src/components/artifact/Ports.vue +0 -23
  109. data/frontend/src/components/artifact/ReverseDnsNames.vue +0 -23
  110. data/frontend/src/components/artifact/Tags.vue +0 -29
  111. data/frontend/src/components/artifact/WhoisRecord.vue +0 -44
  112. data/frontend/src/components/config/Configs.vue +0 -65
  113. data/frontend/src/components/config/ConfigsWrapper.vue +0 -32
  114. data/frontend/src/components/link/Link.vue +0 -32
  115. data/frontend/src/components/link/Links.vue +0 -42
  116. data/frontend/src/components/rule/EditRule.vue +0 -72
  117. data/frontend/src/components/rule/EditRuleWrapper.vue +0 -48
  118. data/frontend/src/components/rule/Form.vue +0 -158
  119. data/frontend/src/components/rule/InputForm.vue +0 -45
  120. data/frontend/src/components/rule/NewRule.vue +0 -57
  121. data/frontend/src/components/rule/Rule.vue +0 -100
  122. data/frontend/src/components/rule/RuleWrapper.vue +0 -53
  123. data/frontend/src/components/rule/Rules.vue +0 -84
  124. data/frontend/src/components/rule/RulesWrapper.vue +0 -121
  125. data/frontend/src/components/rule/YAML.vue +0 -37
  126. data/frontend/src/components/tag/Tag.vue +0 -65
  127. data/frontend/src/components/tag/Tags.vue +0 -37
  128. data/frontend/src/countries.ts +0 -350
  129. data/frontend/src/index.ts +0 -20
  130. data/frontend/src/links/anyrun.ts +0 -19
  131. data/frontend/src/links/base.ts +0 -14
  132. data/frontend/src/links/censys.ts +0 -20
  133. data/frontend/src/links/crtsh.ts +0 -20
  134. data/frontend/src/links/dnslytics.ts +0 -38
  135. data/frontend/src/links/greynoise.ts +0 -20
  136. data/frontend/src/links/index.ts +0 -40
  137. data/frontend/src/links/intezer.ts +0 -20
  138. data/frontend/src/links/otx.ts +0 -33
  139. data/frontend/src/links/securitytrails.ts +0 -38
  140. data/frontend/src/links/shodan.ts +0 -20
  141. data/frontend/src/links/urlscan.ts +0 -50
  142. data/frontend/src/links/virustotal.ts +0 -72
  143. data/frontend/src/main.ts +0 -41
  144. data/frontend/src/router/index.ts +0 -57
  145. data/frontend/src/rule.ts +0 -14
  146. data/frontend/src/shims-vue.d.ts +0 -6
  147. data/frontend/src/swagger.yaml +0 -771
  148. data/frontend/src/types.ts +0 -188
  149. data/frontend/src/utils.ts +0 -54
  150. data/frontend/src/views/Alerts.vue +0 -20
  151. data/frontend/src/views/Artifact.vue +0 -39
  152. data/frontend/src/views/Configs.vue +0 -20
  153. data/frontend/src/views/EditRule.vue +0 -39
  154. data/frontend/src/views/NewRule.vue +0 -26
  155. data/frontend/src/views/Rule.vue +0 -39
  156. data/frontend/src/views/Rules.vue +0 -20
  157. data/frontend/tests/utils.spec.ts +0 -9
  158. data/frontend/tsconfig.app.json +0 -21
  159. data/frontend/tsconfig.json +0 -14
  160. data/frontend/tsconfig.node.json +0 -13
  161. data/frontend/tsconfig.vitest.json +0 -12
  162. data/frontend/vite.config.ts +0 -24
  163. data/frontend/vitest.config.ts +0 -21
  164. data/lib/mihari/services/alert_proxy.rb +0 -97
@@ -7,6 +7,113 @@ module Mihari
7
7
  # Rule API endpoint
8
8
  #
9
9
  class Rules < Grape::API
10
+ class RuleSearcher < Mihari::Service
11
+ class ResultValue
12
+ # @return [Array<Mihari::Models::Rule>]
13
+ attr_reader :rules
14
+
15
+ # @return [Integer]
16
+ attr_reader :total
17
+
18
+ # @return [Mihari::Structs::Filters::Rule::SearchFilterWithPagination]
19
+ attr_reader :filter
20
+
21
+ #
22
+ # @param [Array<Mihari::Models::Rule>] rules
23
+ # @param [Integer] total
24
+ # @param [Mihari::Structs::Filters::Rule::SearchFilterWithPagination] filter
25
+ #
26
+ def initialize(rules:, total:, filter:)
27
+ @rules = rules
28
+ @total = total
29
+ @filter = filter
30
+ end
31
+ end
32
+
33
+ #
34
+ # @params [Hash]
35
+ #
36
+ # @return [ResultValue]
37
+ #
38
+ def call(params)
39
+ filter = params.to_h.to_snake_keys
40
+
41
+ # normalize keys
42
+ filter["tag_name"] = filter["tag"]
43
+ # symbolize hash keys
44
+ filter = filter.to_h.symbolize_keys
45
+
46
+ search_filter_with_pagination = Mihari::Structs::Filters::Rule::SearchFilterWithPagination.new(**filter)
47
+ rules = Mihari::Models::Rule.search(search_filter_with_pagination)
48
+ total = Mihari::Models::Rule.count(search_filter_with_pagination.without_pagination)
49
+
50
+ ResultValue.new(rules: rules, total: total, filter: filter)
51
+ end
52
+ end
53
+
54
+ class RuleGetter < Service
55
+ #
56
+ # @params [String] id
57
+ #
58
+ # @return [Mihari::Models::Rule]
59
+ #
60
+ def call(id)
61
+ Mihari::Models::Rule.find id
62
+ end
63
+ end
64
+
65
+ class RuleRunner < Service
66
+ #
67
+ # @param [String] id
68
+ #
69
+ def call(id)
70
+ rule = Mihari::Rule.from_model(Mihari::Models::Rule.find(id))
71
+ rule.call
72
+ end
73
+ end
74
+
75
+ class RuleCreator < Service
76
+ #
77
+ # @params [String]
78
+ #
79
+ # @return [Mihari::Models::Rule]
80
+ #
81
+ def call(yaml)
82
+ rule = Rule.from_yaml(yaml)
83
+
84
+ found = Mihari::Models::Rule.find_by_id(rule.id)
85
+ error!({ message: "ID:#{rule.id} is already registered" }, 400) unless found.nil?
86
+
87
+ rule.model.save
88
+ rule
89
+ end
90
+ end
91
+
92
+ class RuleUpdater < Service
93
+ #
94
+ # @params [String] id
95
+ # @params [String] yaml
96
+ #
97
+ # @return [Mihari::Models::Rule]
98
+ #
99
+ def call(id:, yaml:)
100
+ Mihari::Models::Rule.find(id)
101
+
102
+ rule = Rule.from_yaml(yaml)
103
+ rule.model.save
104
+ rule
105
+ end
106
+ end
107
+
108
+ class RuleDestroyer < Service
109
+ #
110
+ # @param [String] id
111
+ #
112
+ def call(id)
113
+ Mihari::Models::Rule.find(id).destroy
114
+ end
115
+ end
116
+
10
117
  namespace :rules do
11
118
  desc "Get Rule IDs", {
12
119
  is_array: true,
@@ -27,33 +134,21 @@ module Mihari
27
134
  params do
28
135
  optional :page, type: Integer, default: 1
29
136
  optional :limit, type: Integer, default: 10
30
-
31
137
  optional :title, type: String
32
138
  optional :description, type: String
33
139
  optional :tag, type: String
34
-
35
140
  optional :fromAt, type: DateTime
36
141
  optional :toAt, type: DateTime
37
142
  end
38
143
  get "/" do
39
- filter = params.to_h.to_snake_keys
40
-
41
- # normalize keys
42
- filter["tag_name"] = filter["tag"]
43
- # symbolize hash keys
44
- filter = filter.to_h.symbolize_keys
45
-
46
- search_filter_with_pagenation = Structs::Filters::Rule::SearchFilterWithPagination.new(**filter)
47
- rules = Mihari::Models::Rule.search(search_filter_with_pagenation)
48
- total = Mihari::Models::Rule.count(search_filter_with_pagenation.without_pagination)
49
-
50
- present(
51
- { rules: rules,
52
- total: total,
53
- current_page: filter[:page].to_i,
54
- page_size: filter[:limit].to_i },
55
- with: Entities::RulesWithPagination
56
- )
144
+ value = RuleSearcher.call(params.to_h)
145
+ present({
146
+ rules: value.rules,
147
+ total: value.total,
148
+ current_page: value.filter[:page].to_i,
149
+ page_size: value.filter[:limit].to_i
150
+ },
151
+ with: Entities::RulesWithPagination)
57
152
  end
58
153
 
59
154
  desc "Get a rule", {
@@ -65,23 +160,16 @@ module Mihari
65
160
  requires :id, type: String
66
161
  end
67
162
  get "/:id" do
68
- extend Dry::Monads[:result, :try]
69
-
70
- id = params["id"].to_s
71
-
72
- result = Try do
73
- Mihari::Models::Rule.find(id)
74
- end.to_result
75
-
163
+ id = params[:id].to_s
164
+ result = RuleGetter.result(params[:id].to_s)
76
165
  return present(result.value!, with: Entities::Rule) if result.success?
77
166
 
78
167
  failure = result.failure
79
168
  case failure
80
169
  when ActiveRecord::RecordNotFound
81
170
  error!({ message: "ID:#{id} is not found" }, 404)
82
- else
83
- raise failure
84
171
  end
172
+ raise failure
85
173
  end
86
174
 
87
175
  desc "Run a rule", {
@@ -92,24 +180,19 @@ module Mihari
92
180
  requires :id, type: String
93
181
  end
94
182
  get "/:id/run" do
95
- extend Dry::Monads[:result, :try]
96
-
97
- id = params["id"].to_s
98
-
99
- result = Try { Rule.from_model(Mihari::Models::Rule.find(id)) }.to_result
183
+ id = params[:id].to_s
184
+ result = RuleRunner.result(id)
100
185
  if result.success?
101
- result.value!.analyzer.run
102
186
  status 201
103
- return present({ message: "ID:#{id} is ran successfully" }, with: Entities::Message)
187
+ return present({ message: "ID:#{id}} ran successfully" }, with: Entities::Message)
104
188
  end
105
189
 
106
190
  failure = result.failure
107
191
  case failure
108
192
  when ActiveRecord::RecordNotFound
109
193
  error!({ message: "ID:#{id} is not found" }, 404)
110
- else
111
- raise failure
112
194
  end
195
+ raise failure
113
196
  end
114
197
 
115
198
  desc "Create a rule", {
@@ -120,22 +203,7 @@ module Mihari
120
203
  requires :yaml, type: String, documentation: { param_type: "body" }
121
204
  end
122
205
  post "/" do
123
- extend Dry::Monads[:result, :try]
124
-
125
- yaml = params[:yaml]
126
- result = Try { Rule.from_yaml(yaml) }.to_result.bind do |rule|
127
- Try do
128
- found = Mihari::Models::Rule.find_by_id(rule.id)
129
- error!({ message: "ID:#{rule.id} is already registered" }, 400) unless found.nil?
130
- rule
131
- end.to_result
132
- end.bind do |rule|
133
- Try do
134
- rule.model.save
135
- rule
136
- end.to_result
137
- end
138
-
206
+ result = RuleCreator.result(params[:yaml])
139
207
  if result.success?
140
208
  status 201
141
209
  return present(result.value!.model, with: Entities::Rule)
@@ -146,10 +214,9 @@ module Mihari
146
214
  when Psych::SyntaxError
147
215
  error!({ message: failure.message }, 400)
148
216
  when ValidationError
149
- error!({ message: "Data format is invalid", details: failure.errors.to_h }, 400)
150
- else
151
- raise failure
217
+ error!({ message: "Rule format is invalid", details: failure.errors.to_h }, 400)
152
218
  end
219
+ raise failure
153
220
  end
154
221
 
155
222
  desc "Update a rule", {
@@ -161,22 +228,8 @@ module Mihari
161
228
  requires :yaml, type: String, documentation: { param_type: "body" }
162
229
  end
163
230
  put "/" do
164
- extend Dry::Monads[:result, :try]
165
-
166
- id = params[:id]
167
- yaml = params[:yaml]
168
-
169
- result = Try do
170
- Mihari::Models::Rule.find(id)
171
- end.to_result.bind do |_|
172
- Try { Rule.from_yaml(yaml) }.to_result
173
- end.bind do |rule|
174
- Try do
175
- rule.model.save
176
- rule
177
- end.to_result
178
- end
179
-
231
+ id = params[:id].to_s
232
+ result = RuleUpdater.result(id: id, yaml: params[:yaml].to_s)
180
233
  if result.success?
181
234
  status 201
182
235
  return present(result.value!.model, with: Entities::Rule)
@@ -189,10 +242,9 @@ module Mihari
189
242
  when Psych::SyntaxError
190
243
  error!({ message: failure.message }, 400)
191
244
  when ValidationError
192
- error!({ message: "Data format is invalid", details: failure.errors.to_h }, 400)
193
- else
194
- raise failure
245
+ error!({ message: "Rule format is invalid", details: failure.errors.to_h }, 400)
195
246
  end
247
+ raise failure
196
248
  end
197
249
 
198
250
  desc "Delete a rule", {
@@ -204,15 +256,8 @@ module Mihari
204
256
  requires :id, type: String
205
257
  end
206
258
  delete "/:id" do
207
- extend Dry::Monads[:result, :try]
208
-
209
- id = params["id"].to_s
210
-
211
- result = Try do
212
- rule = Mihari::Models::Rule.find(id)
213
- rule.destroy
214
- end.to_result
215
-
259
+ id = params[:id].to_s
260
+ result = RuleDestroyer.result(id)
216
261
  if result.success?
217
262
  status 204
218
263
  return present({ message: "ID:#{id} is deleted" }, with: Entities::Message)
@@ -222,9 +267,8 @@ module Mihari
222
267
  case failure
223
268
  when ActiveRecord::RecordNotFound
224
269
  error!({ message: "ID:#{id} is not found" }, 404)
225
- else
226
- raise failure
227
270
  end
271
+ raise failure
228
272
  end
229
273
  end
230
274
  end
@@ -7,6 +7,15 @@ module Mihari
7
7
  # Tag API endpoint
8
8
  #
9
9
  class Tags < Grape::API
10
+ class TagDestroyer < Service
11
+ #
12
+ # @param [Integer] id
13
+ #
14
+ def call(id)
15
+ Mihari::Models::Tag.find(id).destroy
16
+ end
17
+ end
18
+
10
19
  namespace :tags do
11
20
  desc "Get tags", {
12
21
  is_array: true,
@@ -24,17 +33,11 @@ module Mihari
24
33
  summary: "Delete a tag"
25
34
  }
26
35
  params do
27
- requires :name, type: String
36
+ requires :id, type: Integer
28
37
  end
29
- delete "/:name" do
30
- extend Dry::Monads[:result, :try]
31
-
32
- name = params[:name].to_s
33
-
34
- result = Try do
35
- Mihari::Models::Tag.where(name: name).destroy_all
36
- end.to_result
37
-
38
+ delete "/:id" do
39
+ id = params[:id].to_i
40
+ result = TagDestroyer.result(id)
38
41
  if result.success?
39
42
  status 204
40
43
  return present({ message: "" }, with: Entities::Message)
@@ -43,10 +46,9 @@ module Mihari
43
46
  failure = result.failure
44
47
  case failure
45
48
  when ActiveRecord::RecordNotFound
46
- error!({ message: "Name:#{name} is not found" }, 404)
47
- else
48
- raise failure
49
+ error!({ message: "ID:#{id} is not found" }, 404)
49
50
  end
51
+ raise failure
50
52
  end
51
53
  end
52
54
  end