mihari 6.2.0 → 7.0.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.gitignore +4 -10
- data/.rubocop.yml +2 -0
- data/Dockerfile +13 -0
- data/config.ru +5 -3
- data/docker-compose.yml +62 -0
- data/exe/mihari +2 -1
- data/lefthook.yml +8 -0
- data/lib/mihari/actor.rb +4 -4
- data/lib/mihari/analyzers/base.rb +16 -0
- data/lib/mihari/analyzers/binaryedge.rb +4 -2
- data/lib/mihari/analyzers/censys.rb +7 -5
- data/lib/mihari/analyzers/circl.rb +5 -3
- data/lib/mihari/analyzers/crtsh.rb +4 -1
- data/lib/mihari/analyzers/dnstwister.rb +1 -1
- data/lib/mihari/analyzers/feed.rb +12 -20
- data/lib/mihari/analyzers/fofa.rb +6 -8
- data/lib/mihari/analyzers/greynoise.rb +4 -2
- data/lib/mihari/analyzers/hunterhow.rb +4 -2
- data/lib/mihari/analyzers/onyphe.rb +4 -2
- data/lib/mihari/analyzers/otx.rb +5 -3
- data/lib/mihari/analyzers/passivetotal.rb +29 -12
- data/lib/mihari/analyzers/pulsedive.rb +5 -3
- data/lib/mihari/analyzers/securitytrails.rb +32 -8
- data/lib/mihari/analyzers/shodan.rb +4 -2
- data/lib/mihari/analyzers/urlscan.rb +4 -2
- data/lib/mihari/analyzers/virustotal.rb +5 -5
- data/lib/mihari/analyzers/virustotal_intelligence.rb +4 -2
- data/lib/mihari/analyzers/zoomeye.rb +4 -2
- data/lib/mihari/cli/{main.rb → application.rb} +17 -5
- data/lib/mihari/cli/artifact.rb +14 -0
- data/lib/mihari/cli/config.rb +14 -0
- data/lib/mihari/cli/rule.rb +1 -0
- data/lib/mihari/cli/tag.rb +14 -0
- data/lib/mihari/clients/base.rb +2 -2
- data/lib/mihari/clients/binaryedge.rb +2 -2
- data/lib/mihari/clients/crtsh.rb +2 -9
- data/lib/mihari/clients/fofa.rb +1 -1
- data/lib/mihari/clients/hunterhow.rb +1 -1
- data/lib/mihari/clients/mmdb.rb +28 -0
- data/lib/mihari/clients/passivetotal.rb +7 -20
- data/lib/mihari/clients/securitytrails.rb +19 -43
- data/lib/mihari/clients/shodan_internet_db.rb +28 -0
- data/lib/mihari/clients/the_hive.rb +7 -5
- data/lib/mihari/commands/alert.rb +53 -11
- data/lib/mihari/commands/artifact.rb +66 -0
- data/lib/mihari/commands/config.rb +23 -0
- data/lib/mihari/commands/database.rb +1 -1
- data/lib/mihari/commands/rule.rb +40 -27
- data/lib/mihari/commands/search.rb +10 -11
- data/lib/mihari/commands/sidekiq.rb +31 -0
- data/lib/mihari/commands/tag.rb +46 -0
- data/lib/mihari/commands/web.rb +6 -7
- data/lib/mihari/{mixins/autonomous_system.rb → concerns/autonomous_system_normalizable.rb} +5 -3
- data/lib/mihari/concerns/configurable.rb +72 -0
- data/lib/mihari/concerns/database_connectable.rb +16 -0
- data/lib/mihari/{mixins/unwrap_error.rb → concerns/error_unwrappable.rb} +5 -3
- data/lib/mihari/{mixins/falsepositive.rb → concerns/falsepositive_validatable.rb} +5 -3
- data/lib/mihari/{mixins/refang.rb → concerns/refangable.rb} +5 -3
- data/lib/mihari/{mixins → concerns}/retriable.rb +4 -2
- data/lib/mihari/config.rb +13 -12
- data/lib/mihari/database.rb +30 -42
- data/lib/mihari/emitters/database.rb +5 -6
- data/lib/mihari/emitters/misp.rb +4 -11
- data/lib/mihari/emitters/slack.rb +7 -5
- data/lib/mihari/emitters/the_hive.rb +8 -58
- data/lib/mihari/emitters/webhook.rb +6 -6
- data/lib/mihari/enrichers/google_public_dns.rb +1 -1
- data/lib/mihari/enrichers/mmdb.rb +28 -0
- data/lib/mihari/enrichers/shodan.rb +3 -5
- data/lib/mihari/enrichers/whois.rb +3 -3
- data/lib/mihari/entities/alert.rb +3 -10
- data/lib/mihari/entities/artifact.rb +9 -9
- data/lib/mihari/entities/config.rb +2 -2
- data/lib/mihari/entities/cpe.rb +1 -0
- data/lib/mihari/entities/dns.rb +1 -0
- data/lib/mihari/entities/geolocation.rb +1 -0
- data/lib/mihari/entities/ip_address.rb +1 -3
- data/lib/mihari/entities/messages.rb +17 -0
- data/lib/mihari/entities/pagination.rb +11 -0
- data/lib/mihari/entities/port.rb +1 -0
- data/lib/mihari/entities/reverse_dns.rb +1 -0
- data/lib/mihari/entities/rule.rb +2 -20
- data/lib/mihari/entities/tag.rb +2 -2
- data/lib/mihari/entities/whois.rb +1 -0
- data/lib/mihari/errors.rb +2 -4
- data/lib/mihari/http.rb +4 -0
- data/lib/mihari/models/alert.rb +21 -76
- data/lib/mihari/models/artifact.rb +51 -31
- data/lib/mihari/models/autonomous_system.rb +5 -13
- data/lib/mihari/models/concerns/searchable.rb +50 -0
- data/lib/mihari/models/cpe.rb +3 -10
- data/lib/mihari/models/dns.rb +2 -6
- data/lib/mihari/models/geolocation.rb +7 -12
- data/lib/mihari/models/port.rb +3 -10
- data/lib/mihari/models/reverse_dns.rb +3 -8
- data/lib/mihari/models/rule.rb +16 -60
- data/lib/mihari/models/tag.rb +17 -1
- data/lib/mihari/models/tagging.rb +1 -1
- data/lib/mihari/models/whois.rb +1 -4
- data/lib/mihari/rule.rb +35 -24
- data/lib/mihari/schemas/alert.rb +1 -0
- data/lib/mihari/schemas/analyzer.rb +2 -2
- data/lib/mihari/schemas/concerns/orrable.rb +24 -0
- data/lib/mihari/schemas/emitter.rb +1 -2
- data/lib/mihari/schemas/enricher.rb +3 -4
- data/lib/mihari/schemas/macros.rb +1 -1
- data/lib/mihari/schemas/options.rb +0 -2
- data/lib/mihari/schemas/rule.rb +1 -2
- data/lib/mihari/services/{rule_builder.rb → builders.rb} +1 -6
- data/lib/mihari/services/creators.rb +22 -0
- data/lib/mihari/services/destroyers.rb +41 -0
- data/lib/mihari/services/enrichers.rb +25 -0
- data/lib/mihari/services/feed.rb +107 -0
- data/lib/mihari/services/getters.rb +58 -0
- data/lib/mihari/services/initializers.rb +22 -0
- data/lib/mihari/services/{alert_builder.rb → proxies.rb} +10 -40
- data/lib/mihari/services/searchers.rb +91 -0
- data/lib/mihari/sidekiq/application.rb +13 -0
- data/lib/mihari/sidekiq/jobs.rb +36 -0
- data/lib/mihari/structs/censys.rb +1 -1
- data/lib/mihari/structs/config.rb +10 -10
- data/lib/mihari/structs/filters.rb +12 -86
- data/lib/mihari/structs/google_public_dns.rb +1 -1
- data/lib/mihari/structs/greynoise.rb +1 -1
- data/lib/mihari/structs/mmdb.rb +115 -0
- data/lib/mihari/structs/onyphe.rb +1 -1
- data/lib/mihari/structs/shodan.rb +2 -2
- data/lib/mihari/version.rb +1 -1
- data/lib/mihari/web/{app.rb → application.rb} +28 -15
- data/lib/mihari/web/endpoints/alerts.rb +34 -81
- data/lib/mihari/web/endpoints/artifacts.rb +43 -63
- data/lib/mihari/web/endpoints/configs.rb +3 -5
- data/lib/mihari/web/endpoints/ip_addresses.rb +14 -15
- data/lib/mihari/web/endpoints/rules.rb +58 -137
- data/lib/mihari/web/endpoints/tags.rb +21 -17
- data/lib/mihari/web/middleware/capture_exceptions.rb +25 -0
- data/lib/mihari/web/middleware/{connection_adapter.rb → connection.rb} +4 -2
- data/lib/mihari/web/public/assets/index-cQUcyII5.js +1766 -0
- data/lib/mihari/web/public/assets/index-dVaNxqTC.css +1 -0
- data/lib/mihari/web/public/index.html +2 -3
- data/lib/mihari/web/public/redoc-static.html +385 -381
- data/lib/mihari.rb +56 -28
- data/mihari.gemspec +16 -8
- data/mkdocs.yml +5 -2
- data/requirements.txt +1 -1
- metadata +173 -42
- data/lib/mihari/commands/mixins.rb +0 -11
- data/lib/mihari/enrichers/ipinfo.rb +0 -52
- data/lib/mihari/entities/message.rb +0 -9
- data/lib/mihari/feed/parser.rb +0 -38
- data/lib/mihari/feed/reader.rb +0 -111
- data/lib/mihari/mixins/configurable.rb +0 -68
- data/lib/mihari/schemas/mixins.rb +0 -20
- data/lib/mihari/services/alert_runner.rb +0 -20
- data/lib/mihari/structs/ipinfo.rb +0 -53
- data/lib/mihari/web/middleware/error_notification_adapter.rb +0 -35
- data/lib/mihari/web/public/assets/index-1d77cd61.js +0 -1756
- data/lib/mihari/web/public/assets/index-4c8509ee.css +0 -1
- /data/lib/mihari/web/public/assets/{mode-yaml-24faa242.js → mode-yaml-BC4MIiYj.js} +0 -0
@@ -1,68 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
module Mihari
|
4
|
-
module Mixins
|
5
|
-
#
|
6
|
-
# Configurable mixin
|
7
|
-
#
|
8
|
-
module Configurable
|
9
|
-
#
|
10
|
-
# Check whether there are configuration key-values or not
|
11
|
-
#
|
12
|
-
# @return [Boolean]
|
13
|
-
#
|
14
|
-
def configuration_keys?
|
15
|
-
return true if configuration_keys.empty?
|
16
|
-
|
17
|
-
configuration_keys.all? { |key| Mihari.config.send(key) }
|
18
|
-
end
|
19
|
-
|
20
|
-
#
|
21
|
-
# Check whether it is configured or not
|
22
|
-
#
|
23
|
-
# @return [Boolean]
|
24
|
-
#
|
25
|
-
def configured?
|
26
|
-
configuration_keys? || api_key?
|
27
|
-
end
|
28
|
-
|
29
|
-
#
|
30
|
-
# Configuration values
|
31
|
-
#
|
32
|
-
# @return [Array<Hash>, nil] Configuration values as a list of hash. Returns nil if there is any keys.
|
33
|
-
#
|
34
|
-
def configuration_values
|
35
|
-
return nil if configuration_keys.empty?
|
36
|
-
|
37
|
-
configuration_keys.map do |key|
|
38
|
-
value = Mihari.config.send(key)
|
39
|
-
value = "REDACTED" if value && Mihari.config.hide_config_values
|
40
|
-
{ key: key.upcase, value: value }
|
41
|
-
end
|
42
|
-
end
|
43
|
-
|
44
|
-
#
|
45
|
-
# Configuration keys
|
46
|
-
#
|
47
|
-
# @return [Array<String>] A list of configuration keys
|
48
|
-
#
|
49
|
-
def configuration_keys
|
50
|
-
[]
|
51
|
-
end
|
52
|
-
|
53
|
-
private
|
54
|
-
|
55
|
-
#
|
56
|
-
# Check whether API key is set or not
|
57
|
-
#
|
58
|
-
# @return [Boolean]
|
59
|
-
#
|
60
|
-
def api_key?
|
61
|
-
value = method(:api_key).call
|
62
|
-
!value.nil?
|
63
|
-
rescue NameError
|
64
|
-
true
|
65
|
-
end
|
66
|
-
end
|
67
|
-
end
|
68
|
-
end
|
@@ -1,20 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
module Mihari
|
4
|
-
module Schemas
|
5
|
-
#
|
6
|
-
# Mixins for schemas
|
7
|
-
#
|
8
|
-
module Mixins
|
9
|
-
def get_or_composition
|
10
|
-
schemas = constants.map { |sym| const_get sym }
|
11
|
-
return schemas.first if schemas.length <= 1
|
12
|
-
|
13
|
-
base, *others = schemas
|
14
|
-
others.each { |other| base = base.or(other) }
|
15
|
-
|
16
|
-
base
|
17
|
-
end
|
18
|
-
end
|
19
|
-
end
|
20
|
-
end
|
@@ -1,20 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
module Mihari
|
4
|
-
module Services
|
5
|
-
#
|
6
|
-
# Alert runner
|
7
|
-
#
|
8
|
-
class AlertRunner < Service
|
9
|
-
#
|
10
|
-
# @param [Mihari::Services::AlertProxy] alert
|
11
|
-
#
|
12
|
-
# @return [Mihari::Models::Alert]
|
13
|
-
#
|
14
|
-
def call(alert)
|
15
|
-
emitter = Emitters::Database.new(rule: alert.rule)
|
16
|
-
emitter.call alert.artifacts
|
17
|
-
end
|
18
|
-
end
|
19
|
-
end
|
20
|
-
end
|
@@ -1,53 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
module Mihari
|
4
|
-
module Structs
|
5
|
-
module IPInfo
|
6
|
-
class Response < Dry::Struct
|
7
|
-
# @!attribute [r] ip
|
8
|
-
# @return [String]
|
9
|
-
attribute :ip, Types::String
|
10
|
-
|
11
|
-
# @!attribute [r] hostname
|
12
|
-
# @return [String, nil]
|
13
|
-
attribute :hostname, Types::String.optional
|
14
|
-
|
15
|
-
# @!attribute [r] loc
|
16
|
-
# @return [String, nil]
|
17
|
-
attribute :loc, Types::String.optional
|
18
|
-
|
19
|
-
# @!attribute [r] country_code
|
20
|
-
# @return [String, nil]
|
21
|
-
attribute :country_code, Types::String.optional
|
22
|
-
|
23
|
-
# @!attribute [r] asn
|
24
|
-
# @return [Integer, nil]
|
25
|
-
attribute :asn, Types::Int.optional
|
26
|
-
|
27
|
-
class << self
|
28
|
-
include Mixins::AutonomousSystem
|
29
|
-
|
30
|
-
#
|
31
|
-
# @param [Hash] d
|
32
|
-
#
|
33
|
-
def from_dynamic!(d)
|
34
|
-
d = d.deep_stringify_keys
|
35
|
-
d = Types::Hash[d]
|
36
|
-
|
37
|
-
asn = nil
|
38
|
-
asn_ = d.dig("asn", "asn")
|
39
|
-
asn = normalize_asn(asn_) unless asn_.nil?
|
40
|
-
|
41
|
-
new(
|
42
|
-
ip: d.fetch("ip"),
|
43
|
-
loc: d["loc"],
|
44
|
-
hostname: d["hostname"],
|
45
|
-
country_code: d["country"],
|
46
|
-
asn: asn
|
47
|
-
)
|
48
|
-
end
|
49
|
-
end
|
50
|
-
end
|
51
|
-
end
|
52
|
-
end
|
53
|
-
end
|
@@ -1,35 +0,0 @@
|
|
1
|
-
# frozen_string_literal: true
|
2
|
-
|
3
|
-
module Mihari
|
4
|
-
module Web
|
5
|
-
module Middleware
|
6
|
-
#
|
7
|
-
# Error notification adapter for Rack app
|
8
|
-
#
|
9
|
-
class ErrorNotificationAdapter
|
10
|
-
include Mihari::Mixins::UnwrapError
|
11
|
-
|
12
|
-
attr_reader :app
|
13
|
-
|
14
|
-
def initialize(app)
|
15
|
-
@app = app
|
16
|
-
end
|
17
|
-
|
18
|
-
def with_error_notification
|
19
|
-
yield
|
20
|
-
rescue StandardError => e
|
21
|
-
unwrapped = unwrap_error(e)
|
22
|
-
|
23
|
-
Mihari.logger.error unwrapped
|
24
|
-
Sentry.capture_exception(unwrapped) if Sentry.initialized?
|
25
|
-
|
26
|
-
raise unwrapped
|
27
|
-
end
|
28
|
-
|
29
|
-
def call(env)
|
30
|
-
with_error_notification { app.call(env) }
|
31
|
-
end
|
32
|
-
end
|
33
|
-
end
|
34
|
-
end
|
35
|
-
end
|